Inception

Inception is a late core (milestone M5; placement Reported by students) system administration project with Docker, done solo. Inside a virtual machine you build a small infrastructure with Docker Compose: an NGINX container that is the only entry point (TLS 1.2 or 1.3 on port 443), a WordPress container with php-fpm, and a MariaDB container, each built from your own Dockerfile on Alpine or Debian (penultimate stable version). Data lives in two named volumes and the containers talk over a dedicated Docker network. The bonus adds services such as Redis cache, an FTP server, Adminer, a static site and one service of your choice.

What you will learn

• Writing Dockerfiles from a bare base image: no ready-made wordpress or mariadb images
• Docker Compose: services, networks, named volumes, build contexts, restart policies, environment files
• Process management in containers: PID 1, running a daemon in the foreground, why tail -f is not a solution
• NGINX as a TLS reverse proxy and FastCGI gateway to php-fpm
• MariaDB initialisation, users and privileges, and WordPress setup with wp-cli
• Secrets handling with a .env file and Docker secrets, keeping passwords out of Dockerfiles and git

Before you start

• Previous nodes: Born2beroot (Linux administration in a VM) and NetPractice (ports and networks). Being comfortable in a shell is essential.
• Tools: a Linux VM with Docker Engine and the Compose plugin, make, and openssl for the self-signed certificate.
• The repository layout is fixed by the subject: a Makefile at the root and everything else in srcs/ (with docker-compose.yml, .env and requirements/ holding one folder per service).
• Your domain must be login.42.fr pointing to the VM's local IP (edit /etc/hosts).

Plan of attack

1. Day 1: install Docker in the VM, read the Compose file reference, and write the Makefile (up, down, clean, fclean, re) that creates the host data folders under /home/login/data.
2. Day 1: MariaDB first. A Dockerfile that installs it, a script that creates the database and the two users on first start only, and runs mysqld in the foreground.
3. Day 2: WordPress with php-fpm listening on port 9000. Use wp-cli to download, configure and install WordPress, creating an administrator (whose name must not contain "admin") and a second user.
4. Day 3: NGINX with a self-signed certificate, only TLSv1.2 and TLSv1.3, forwarding PHP to the WordPress container.
5. Day 3: wire everything in docker-compose.yml: one network, two named volumes bound to the host data folders, restart on failure, and dependency order.
6. Day 4: destroy everything with make fclean, rebuild from zero, and check the site still comes up with the same content after a reboot of the VM.
7. Day 5 (bonus): add the extra services one container each, then rehearse the defence questions.

docker compose -f srcs/docker-compose.yml up -d --build
docker compose -f srcs/docker-compose.yml ps
curl -kI https://login.42.fr

Common pitfalls

• Using latest tags, prebuilt service images, network: host, links or --link: forbidden.
• Infinite loops or sleep infinity as the container command instead of the real daemon in the foreground.
• Passwords committed in Dockerfiles or in git history.
• NGINX also listening on port 80, or accepting TLS 1.0 and 1.1.
• Init scripts that recreate the database at every start and wipe the data.
• Containers that do not restart after a crash, or a stack that only works after a manual step.

How it is evaluated

• Peer evaluation in the VM. The evaluator clones the repository, checks the layout, reads every Dockerfile and the Compose file, and searches for forbidden patterns.
• make must build and start everything with no manual step. The site must answer only on https://login.42.fr on port 443.
• The evaluator logs in to WordPress, edits a page, restarts the VM and checks the change survived. Then checks the volumes, the network and the MariaDB users from inside the container.
• You must explain the difference between a VM and a container, Docker versus Docker Compose, and how the services talk to each other.
• The bonus is graded only if the mandatory part is perfect.

Resources

• Dockerfile reference
• Compose file reference
• NGINX: configuring HTTPS servers
• WP-CLI handbook
• MariaDB documentation
• Docker best practices for Dockerfiles