Building Python Application in Docker

Docker container is a very popular way to build Python applications.

Installing Docker

1. Of course, we will need to install Docker to start using it. We will follow DigitalOcean’s excellent installation guide for Ubuntu 22.04 (https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-ubuntu-22-04). If you are using other versions of the Linux distribution, you can simply use the drop-down menu from the documentation to pick a different version. For installation on Mac or Windows, my recommendation would be to install Docker Desktop (https://docs.docker.com/desktop/). It will include the Docker Engine, CLI client, and GUI application.

$ sudo apt-get update
$ sudo apt-get -y upgrade
$ sudo apt install apt-transport-https ca-certificates curl software-properties-common
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
$ echo "deb [arch...

Container Networking

1. Container networking is not an easy topic to cover because of its scope and the number of technologies it touches. The space spans from Linux networking, how the particular type of Linux (Ubuntu, Red Hat, etc.) implements networking, to Docker’s implementation of networking. Adding to the complexity is the fact that Docker is a fast-moving project, and many third-party plugins are available.
2. In this section, we will stick to the basics of the networking options offered by Docker by default. We will then briefly explain the options of overlay, Macvlan, and network plugins.
3. When we launch a container, it can reach the internet by default. Let’s do a quick test by launching a Ubuntu container and attach to it:

$ docker run -it ubuntu:22.04
<container launches and attached>
root@dcaa61a548be:/# apt update && apt install -y net-tools iputils-ping
root@dcaa61a548be:/# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500...

Containers in the Network Engineering Field

1. Container technologies are transforming how infrastructure is built in modern days. We now have an additional layer of abstraction we can use to overcome limitations on physical space, power, cooling, and other factors. This is especially true of the need to move toward more environmentally friendly data centers.
2. There are many new challenges and opportunities associated with the new container-based world:
3. Networking in the container world. As we saw in the last section, there are lots of options that exist when it comes to networking in containers.
4. DevOps. One of the challenges when trying to implement DevOps practices in network engineering is the lack of options for flexible, virtualized network devices. Containers can potentially solve that problem if we can virtualize our network along with the hosts.
5. Lab and Testing. If we can virtualize our network via container images, this makes lab and testing much easier.
6. We will discuss DevOps in...

Docker and Kubernetes

1. As we have seen, Docker images and orchestration can be done with the tools provided by the Docker community. However, it is almost impossible to think about Docker containers without Kubernetes. This is because when it comes to container orchestration, Kubernetes is becoming the de facto standard in doing so. There is not enough space to cover Kubernetes in this chapter, but because of its strong ties to container orchestration, we should at least know the basics about Kubernetes.
2. Kubernetes (https://kubernetes.io/) was originally developed by Google, but the project is now managed by the Cloud Native Computing Foundation. It is an open-source container orchestration system that automatically deploys, scale, and manage containers. The project was well-received by the community right from the beginning since it had a proven track record of scale with Google’s internal usage.
3. Kubernetes uses a master as the controlling unit that manages worker nodes to deploy...

Summary

In this chapter, we learned about container virtualization. Containers are similar to virtual machines in their ability to isolate computing resources but different in the sense that it is lightweight and fast to deploy.

We saw how to use Docker containers to build Python applications and docker-compose to build multi-container applications on a single host.

Later in the chapter, we learned how networks are constructed with Docker containers using the default bridge, custom bridges, and host options. Containers can also help with network operating system testing using the Container Lab project.

In the next chapter, we will look at how we can use Python in network security.

Other tools

There are other network security tools that we can use and automate with Python. Let’s take a look at two of the most commonly used ones.

Private VLANs

Virtual local area networks (VLANs) have been around for a long time. They are essentially broadcast domains where all hosts can be connected to a single switch but are partitioned out to different domains, so we can separate the hosts according to which hosts can see others via broadcasts. Let’s consider a map based on IP subnets. For example, in an enterprise building, I would likely see one IP subnet per physical floor: 192.168.1.0/24 for the first floor, 192.168.2.0/24 for the second floor, and so on. In this pattern, we use a /24 block for each floor. This gives a clear delineation of my physical network as well as my logical network. A host wanting to communicate beyond its subnet will need to traverse through its layer 3 gateway, where I can use an access list to enforce security.

What happens...

Further reading

Python is a very common language used in many security-related fields. A few of the books I would recommend are listed as follows:

• Violent Python: A cookbook for hackers, forensic analysts, penetration testers, and security engineers, by T.J. O’Connor (ISBN-10: 1597499579)
• Black Hat Python: Python programming for hackers and pen-testers, by Justin Seitz (ISBN-10: 1593275900)

I have personally used Python extensively in my research work on Distributed Denial of Service (DDoS) at A10 Networks. If you are interested in learning more, the guide can be downloaded for free at https://www.a10networks.com/resources/ebooks/distributed-denial-service-ddos/.

Summary

In this chapter, we looked at network security with Python. We used the Cisco CML tool to set up our lab with hosts and network devices, consisting of NX-OSv and IOSv types. We took a tour around Scapy, which allows us to construct packets from the ground up.

Scapy can be used in interactive mode for quick testing. Once testing is completed in interactive mode, we can put the steps into a file for more scalable testing. It can be used to perform various network penetration testing for known vulnerabilities.

We also looked at how we can use both an IP access list and a MAC access list to protect our network. They are usually the first line of defense in our network protection. Using Ansible, we can deploy access lists consistently and quickly to multiple devices.

Syslog and other log files contain useful information that we should regularly comb through to detect any early signs of a breach. Using Python regular expressions, we can systematically search for known...