Architecting Containerized Environments with Docker on Rocky Linux 9

The integration of Docker into the Rocky Linux 9 ecosystem represents a strategic convergence of enterprise-grade stability and modern application agility. Docker, an open-source platform, facilitates the creation, packaging, distribution, and deployment of applications through the use of lightweight, portable containers. Unlike traditional virtualization, which requires a full guest operating system, Docker containers bundle only the necessary runtime dependencies, libraries, application code, and configuration parameters. This ensures that software runs reliably across disparate environments and host systems, effectively eliminating the "it works on my machine" dilemma. On Rocky Linux 9, Docker provides a consistent framework for managing containerized applications, which significantly streamlines the development, testing, and deployment phases of the software development lifecycle by isolating environments from the underlying host hardware and OS configuration.

Conceptual Framework of Docker and Rocky Linux

To understand the implementation of Docker on Rocky Linux, one must first understand the relationship between the two. Rocky Linux is a community-supported distribution derived from sources provided by Red Hat for Red Hat Enterprise Linux (RHEL). Because it is designed to be functionally compatible with RHEL, it inherits the rigorous stability and security standards required for enterprise environments. The Rocky Linux Project focuses on removing upstream vendor branding and artwork, ensuring the OS remains a no-cost, free-to-redistribute platform.

The synergy between Rocky Linux and Docker is rooted in the need for a secure, low-maintenance, and predictable environment. Rocky Linux versions are maintained for up to 10 years via security updates, with new versions released approximately every two years and periodic updates every six months to support newer hardware. When Docker is deployed on this foundation, it allows developers to wrap their applications in a thin layer of abstraction. These containers are more resource-friendly than virtual machines because they share the host operating system's kernel while remaining isolated in user space, making them highly portable across any system running a compatible Docker Engine.

Comprehensive Installation Guide for Docker Engine

Installing Docker on Rocky Linux 9 requires a methodical approach to ensure the latest stable versions of the engine and its plugins are utilized, rather than relying on potentially outdated versions found in default repositories.

Prerequisites and Initial Environment Setup

Before initiating the installation, several environmental requirements must be met to ensure system stability and security.

• Deployment of a Rocky Linux 9 instance (e.g., via Vultr).
• Establishment of a Container Registry (such as Vultr Container Registry) to store and manage Docker images.
• SSH access to the server using a non-root user account.
• Configuration of sudo privileges for the non-root user to perform administrative tasks.
• A fully updated system package database to prevent dependency conflicts.

The requirement for a non-root user with sudo privileges is a critical security measure. Running the entire installation and subsequent management as the root user increases the risk of accidental system-wide configuration errors and poses a security vulnerability.

Repository Configuration and Package Installation

The official Rocky Linux 9 repositories may contain Docker packages, but they often lack the most recent updates. To obtain the "latest and greatest" version, users must tap into the official Docker repositories. Although Docker does not provide a Rocky Linux-specific repository, Rocky Linux's compatibility with CentOS allows it to use the CentOS repository.

The installation process follows these technical steps:

1. Update the package database to ensure all current software is synchronized.
   sudo dnf check-update

2. Add the official Docker repository using the dnf config-manager. Depending on the specific documentation path chosen, users may use the CentOS or RHEL repository links.
   sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
   or
   sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo

3. Install the essential Docker suite, which includes the engine, the command-line interface, the container runtime, and the compose plugin.
   sudo dnf -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

The inclusion of containerd.io is vital as it serves as the industry-standard container runtime that manages the complete container lifecycle of transferring images, executing containers, and supervising network and storage options. docker-compose-plugin allows for the definition and running of multi-container Docker applications using YAML files.

Activating and Persisting the Docker Service

Once the binaries are installed, the Docker daemon (dockerd) must be started and configured to persist across system reboots. This is handled via the systemd manager.

sudo systemctl --now enable docker

The --now flag is a critical addition here; it tells systemd to both enable the service (meaning it will start automatically on boot) and start the service immediately in the current session. Without this, the user would need to run a separate sudo systemctl start docker command.

Post-Installation Configuration and User Management

By default, the Docker daemon binds to a Unix socket, which is owned by the root user. This means that any user attempting to run docker commands must use sudo, which can be cumbersome and presents security risks in shared environments.

Managing Docker without Sudo

To allow a non-root user to manage Docker containers without requiring root privileges for every command, that user must be added to the docker group.

• To add the current active user to the group:
  sudo usermod -a -G docker $(whoami)
• To add a specific, different user to the group:
  sudo usermod -a -G docker custom-user
• Alternative syntax for adding the current user:
  sudo usermod -aG docker $USER

This administrative change alters the group membership of the user. For these permissions to take effect, the user must log out of the current SSH or terminal session and log back in. This forces the system to refresh the user's group tokens. This step is highly recommended for those who are the main system users or in scenarios where multiple users need to manage containers but should not be granted full sudo (administrative) access to the host operating system.

Deploying Rocky Linux as a Docker Container

One of the most powerful use cases for Docker is running a Rocky Linux environment inside a container on a different host. This allows for a reproducible development environment that mirrors the production server.

Image Acquisition and Verification

To begin, the Rocky Linux image must be pulled from the official registry. Because the Docker team's Official Images program has technical constraints preventing certain updates, the Rocky Enterprise Software Foundation maintains the official Rocky Linux Docker Hub repository.

• Pull the image:
  docker pull rockylinux/rockylinux

• Verify the image is present on the local host:
  docker images

A typical output of the verification command would look like this:
rockylinux/rockylinux latest 523ffac7fb2e 15 months ago 196MB

Container Deployment and Interaction

Deploying the container requires a combination of flags to ensure the container remains active and accessible.

• Deploy and run the container in detached mode:
  docker run -it --name rocky -d rockylinux/rockylinux

In this command:
- -it allows for interactive terminal access.
- --name rocky assigns a human-readable name to the container.
- -d runs the container in the background (detached mode).

To enter the running container and interact with the shell, use the exec command:
docker exec -it --user root rocky /bin/bash

The --user root flag ensures that the user enters the container with administrative privileges, which is evidenced by the prompt starting with root@.

Application Development within Rocky Linux Containers

Once inside a Rocky Linux container, the environment behaves like a minimal installation of the OS. This is an ideal place to test software installations, such as a web server, before committing them to a permanent image.

Installing a Web Server (Apache)

Using the dnf package manager inside the container, a user can install the Apache HTTP Server:

• Install the package:
  dnf install httpd -y

• Start the Apache daemon:
  httpd

• Verify the server is running by requesting the local page:
  curl localhost

The output of the curl command will display the text version of the Apache welcome page, confirming that the web server is correctly configured and serving traffic within the container's internal network. To leave the container, the user simply types:
exit

This workflow allows developers to create a "gold image." By installing the necessary software and then committing the container to a new image, the developer creates a custom version of Rocky Linux that includes the Apache web server by default, which can then be distributed and deployed across multiple servers.

Analysis of Rocky Linux Docker Hub Image Variants

The Rocky Linux project provides a variety of image tags to cater to different needs, ranging from minimal footprints for microservices to full-featured images for initialization.

Detailed Comparison of Available Image Tags

The following table outlines the different image variants available on the Rocky Linux Docker Hub repository.

Strategic Tag Selection

The rockylinux:latest tag is intentionally missing from the repository. This is a critical architectural decision by the Rocky Enterprise Software Foundation to prevent "tag drift," where an update to the latest tag might unexpectedly break a production pipeline. Users are encouraged to use specific version tags (e.g., 9-ubi or 10-ubi-micro) to ensure build reproducibility.

• UBI (Universal Base Image) variants are designed for maximum compatibility and security.
• Micro images are optimized for speed of deployment and reduced attack surface, as they contain only the absolute minimum required binaries.
• Init images are necessary when the application requires a systemd-like environment to manage services.

Advanced Infrastructure Implications

The deployment of Docker on Rocky Linux is not merely about installing a tool, but about establishing a robust infrastructure pattern.

Resource Efficiency and Portability

Because Docker containers share the host kernel, they avoid the hypervisor overhead associated with Virtual Machines. In a Rocky Linux 9 environment, this means higher density; a single physical server can host significantly more containers than it could virtual machines. This portability is extended by the Docker Hub, where the Rocky Enterprise Software Foundation provides official images and toolbox images (linked to GitHub containers/toolbox).

Security Architecture

The use of a non-root user for Docker management, combined with the inherent isolation of containers, creates a layered security model. When a user pulls a Rocky Linux image and runs it, the application is isolated from the host's filesystems and processes. By utilizing the UBI-micro images, the attack surface is further reduced, as there are fewer binaries available for an attacker to exploit if a container is compromised.

Conclusion

The implementation of Docker on Rocky Linux 9 provides a comprehensive solution for modernizing application delivery. By leveraging the functional compatibility with RHEL, Rocky Linux offers a stable, long-term supported foundation that is ideal for the Docker Engine. The installation process—transitioning from the official CentOS/RHEL repositories to the deployment of the docker-ce suite—ensures that users have access to the most current features and security patches.

The strategic use of specific image tags, such as ubi-micro or ubi-init, allows architects to balance the trade-off between image size and functionality. Furthermore, the ability to transition from a base Rocky Linux container to a customized image (e.g., by adding an Apache web server) demonstrates the agility of the platform. Ultimately, the combination of Rocky Linux's 10-year support cycle and Docker's containerization capabilities results in a professional, reproducible, and highly scalable environment suitable for any enterprise-grade workload.

Sources

1. How to Install Docker on Rocky Linux 9 - Vultr
2. How to Install and Use Docker on Rocky Linux 9 - DigitalOcean
3. Rocky Linux Official Images - Docker Hub
4. Docker on Rocky Linux - Rocky Linux Documentation
5. Start Developing with Rocky Linux as a Docker Container - The New Stack
6. Rocky Linux Image Tags - Docker Hub
7. The Rocky Enterprise Software Foundation - Docker Hub