CONTAINERIZE C, C++ AND VC++ APPLICATIONS TO AZURE

Solution Description

Containerization of C, C++ and VC++ applications on Docker VM on Azure can be done using Docker for Linux software. Here on Windows based Azure VM, install Docker for Windows software from https://docs.docker.com/docker-for-windows/ and switch it to Docker for Linux.  

Solution Approach

Methods of Containerizing existing C, C++ and VC++ applications with Linux Containers on Windows VM or on Linux VM.

	C	C++	VC++
Compiler	Using gcc complier that compiles *.c files of C applications	Using g++ compiler and compiles *.cpp files of C++ applications	Using g++ compiler and compiles *.cpp files of VC++ applications
Prequisites	·         *.c file ·         Dockerfile	·         *.cpp file ·         Dockerfile	·         *.cpp file ·         Dockerfile
Dockerfile	FROM gcc:4.9 COPY . /AppsName WORKDIR /AppsName RUN gcc --o AppsName AppsName.c CMD ["./AppsName"]	FROM gcc:4.9 COPY . /AppsName WORKDIR /AppsName RUN g++ --o AppsName AppsName.cpp --lstdc++ CMD ["./AppsName"]	FROM gcc:4.9 COPY . /AppsName WORKDIR /AppsName RUN g++ --o AppsName AppsName.cpp --lstdc++ CMD ["./AppsName"]

Create a Dockerfile (in a vi editor or in Notepad and save it with no extension while selecting file type as “All files”) in the same directory as the AppsName.cpp or AppsName.c file. A Dockerfile contains instructions to build a Docker image that could be used to run a Docker container. Meaning of instructions of Dockerfile is:

Dockerfile Instruction	Description
FROM gcc:4.9	The Docker image to use as the base image is gcc with tag 4.9.
COPY . /AppsName	Copy the files in the current directory to the / AppsName directory.
WORKDIR /AppsName	Set the /AppsName directory as the working directory.
RUN g++ --o outputname AppName.cpp	Run the g++ command g++ with output as " outputname" and input as "AppName.cpp". The command generates a runnable application called " AppName "
CMD ["./AppsName "]	Run the compiled, runnable application ./ AppsName

Within directory named AppsName, place both *.cpp or *.c file and Dockerfile file for respective application and sets its permission to global for active user. Right click the directory, add user and give user admin rights. Set the environment variable for docker.exe so that docker commands can be ran from anywhere in system from command prompt. In Command prompt, run cd command to move to the location of directory where *cpp or *.c file and Dockerfile is kept. Then run the docker build command to create a Docker image called AppsName:v1 from the Dockerfile.

docker build -t  AppsName:v1 .

Subsequently, list the Docker images.

docker images

Having created the Docker image, run a Docker container with the docker run command. The Docker container may optionally be named, "ContainerName" for example, with the --name option. If the --name option is not used, a random name is used for the Docker container. The --rm option is called the "Clean up" option and removes the Docker container and the filesystem & volumes associated with the container after it has run. Run the following docker run command for the Docker image AppsName:v1.

docker run -it --rm --name ContainerName AppsName:v1

The Docker containers get removed when using the --rm option. To List the running containers:

docker ps

List of exited Docker containers:

docker ps -a

Docker applications are compiled into a Docker image with docker build and docker run commands. C, C++ and VC++ applications are run each time therefore to avoid over load of containers in Docker, container is moved to exited state after running an application. 

Value Added

·         Docker Engine makes better use of the operating system kernel in comparison to a virtualization platform such as Virtual Box or VMWare. A single Docker container does not make use of a whole OS kernel, whereas a single virtual machine does.

·         Each Docker container includes its own filesystem and networking, which makes it an isolated process on the Docker Engine. A single Docker Engine with multiple Docker containers running in isolation makes it feasible to run different applications. Even some containers make use of other containers.

·         One of the main benefits of Docker Engine is the ease of installation and configuration for software.

Accelerators used and its purpose

Tools Used	Purpose
Docker for Linux	It enables Docker support and enables debugging and running of application on Docker
Command Prompt	Enables us to execute docker build and docker run commands

Activity breakup and efforts required

Activities	Efforts
Installation of Docker of Windows Software	Go to https://docs.docker.com/docker-for-windows/ URL and download stable version and install in client system. Within 5 minutes’ system is compliant for Docker support.
Creation of VM in Azure	Go to Azure Portal and create windows VM. It takes approx. 10 minutes
Build Image	Passing Docker Build commands creates image within 2 minutes
Run Image	Passing Docker Run commands run application on docker container with in 1 minute

Limitation

C, C++ and VC++ applications can be deployed to Linux VM or Windows VM with Docker for Linux support but cannot be deployed to Azure Container Services due to UI interface incompatibility.

Summary

Container-based deployments have quickly become the preferred approach for managing the build and release of complex applications. Container-based development is both productive and compelling, and it reduces the number of moving parts, which historically was the cause of many mistakes and system challenges. Containers delivers highly reliable and secure systems.

Best Practice for Hybrid Applications

Introduction

Hybrid environment consists of on-premises and cloud-based services. Good reasons for enterprises to move to the cloud is greater business agility, keeping track with the speed of innovation, and cost savings. Despite the benefits of cloud computing, companies face numerous challenges including the integration of cloud services into the enterprise architecture, security and compliance of corporate data. Therefore, IT are looking to put in place policies and processes so that employees and business departments can take advantage of cloud services that drive business growth without compromising the security, compliance, and governance of corporate data. There are multiple potential destinations for any application like Private cloud, IAAS, PAAS, SAAS or can be mixture of them (hybrid cloud).

Private Cloud Microsoft Azure Stack is a product that enables organizations to deliver Azure services from their own datacentre. It helps you build and deploy your applications the same way regardless of whether it runs on Azure or Azure Stack.

Infrastructure as a Service (IaaS) IaaS services allow you to build and run server-based IT workloads in the cloud, rather than in your on-premises datacentre. IaaS services typically consist of an IT workload that runs on virtual machines that is transparently connected to your on-premises network.

Platform as a Service (PaaS) Platform as a Service delivers application execution services, such as application runtime, storage, and integration for application. In a PaaS deployment model, enterprises are focusing on deploying their application code into PaaS services.

Software as a Service (SaaS) Software as a Service delivers business processes and applications, such as CRM, collaboration, and email, as standardized capabilities for a usage-based cost at an agreed, business-relevant service level.

Hybrid Cloud A hybrid is created when these two independent systems like private and on premises are joined through encrypted connections using technology specifically designed to facilitate the portability of data and applications.

Scope

Many enterprise organizations take a three-step approach to cloud adoption. The first approach is to take advantage of SaaS productive workloads such as Office 365. The second approach is to base new modern cloud applications on PaaS (Azure SQL databases, Azure Web Apps, Logic Apps, Mobile Apps, etc.). The third approach is moving existing applications to IaaS virtual machines by using one of the two approaches:

·         Lift and Shift: Existing virtual machines are shifted to the cloud.

·         Build in the cloud: applications are prebuilt in Azure, and traditional methods are used to back up and restore data.

Pros and Cons of the Hybrid Cloud

Pros

Capacity expansion When the incremental cost of adding capacity on-premises is high – think upgrading power and cooling in a data center to accommodate additional racks or building a whole new data center – a hybrid approach is a viable alternative.

Dev/test Dev/test workloads are highly elastic; they are regularly stood up and torn down, and the number of instances at any one time varies widely based on the development phase. Placing these workloads on the hosted cloud allows you to scale capacity to match demand and pay only for what is used.

Planned temporary need Most needs are known in advance, such as new product launches, holidays, peak season and so forth. When given time to plan and execute, most applications can be scaled

Network optimization Hosted cloud provides the opportunity to shift the heavy lifting of the network off-premises and, in the process, improves the availability, scalability and reliability of the connection by leveraging the provider’s network investment.

Cons

Cost While the public cloud can offer an attractive option for its flexibility and relatively low cost to operate, building a private enterprise cloud requires significant expenditure and can become expensive very quickly with all the physical hardware necessary.

Security The proper precautions must be taken to ensure data is properly protected and that control is maintained by the right people.

Data and application integration if an application lives in a private cloud and its data lives in an on-premise data center, is the application built to access the data remotely? Technologies like copy data virtualization can decouple data from infrastructure

Compatibility With dual levels of infrastructure, a private cloud the company controls and a public one that it doesn’t, the chances are that they will be running different stacks

Networking Will very active applications be living in the cloud? It’s necessary to consider the bandwidth usage they could take up on the network and whether it could cause problems in bottlenecking other applications.

Best Practices for moving to the cloud

Catalog existing applications

To understand what applications should be moved, when and how, it’s important to create a well-attributed catalog of applications managed by IT. Then, the relative importance of each attribute (say, business criticality or amount of system integration) can be weighted and the prioritized list can be built.

Define criteria for moving to or starting applications in the cloud

You should set priorities within your migration plan based on a combination of business factors, hardware/software factors, and other technical factors. For sequencing the migration of your workloads, you should begin with less-complex projects and gradually increase the complexity after the less-complex projects have been migrated.

Architect core infrastructure components for cloud integration

You must account for the following elements when planning and implementing hybrid cloud scenarios.

·         Networking for hybrid cloud scenarios includes the connectivity to Microsoft cloud platforms and services and enough bandwidth to be performant under peak loads.

·         Identity for SaaS and Azure PaaS hybrid scenarios can include Azure AD as a common identity provider, which can be synchronized with your on-premises Windows Server AD, or federated with Windows Server AD or other identity providers. You can also extend your on-premises Identity infrastructure to Azure IaaS.

·         Security for hybrid cloud scenarios includes protection and management for your identities, data protection, administrative privilege management, threat awareness, and the implementation of governance and security policies.

Acquire cloud development skills

You must develop competencies with cloud technologies and services even as those services evolve and change. Practically, this means that staff must have time to explore new technologies and that you may need to increase your investment in IT staff training.

Retool for adoption and change management

Rethink your IT service management and disaster recovery practices, as well as how a given cloud service integrates with your existing in-house technology infrastructure. Consider the usage of cloud-based IT service management solutions.

Take a systematic and disciplined approach to Security, Governance, Compliance

Invest in core capabilities within your organization that lead to secure environments:

·         Governance & Security Policy

·         Administrative Privilege Management

·         Identity Systems and Identity Management

·         Threat Awareness

·         Data Protection

Best Practices for cloud connectivity

·         Examine the set of systems at your edge network to ensure that they are current, provide high availability, and have sufficient capacity to meet peak loads.

·         For a high SLA use ExpressRoute

·         Analyze your client computers and optimize for network hardware, software drivers, protocol settings, and Internet browsers.

·         Analyze you’re on-premises network for traffic latency and optimal routing to the Internet edge device.

·         Analyze the capacity and performance of your Internet edge device and optimize for higher levels of traffic.

·         Analyze the latency between your Internet edge device (such as your external firewall) and the regional locations of the Microsoft cloud service to which you are connecting.

·         Analyze the capacity and utilization of your current Internet connection and add capacity if needed. Alternately, add an ExpressRoute connection.

·         Prepare your intranet for Microsoft cloud services.

·         Optimize your Internet bandwidth.

·         Determine the type of VNet (cloud-only or cross-premises).

·         Determine the address space of the VNet.

·         Determine the subnets within the VNet and the address spaces assigned to each.

·         Determine the DNS server configuration and the addresses of the DNS servers to assign to VMs in the VNet.

·         Determine the load balancing configuration (Internet-facing or internal).

·         Determine the use of virtual appliances and user-defined routes.

·         Determine how computers from the Internet will connect to virtual machines.

·         For multiple VNets, determine the VNet-to-VNet connection topology.

·         Determine the on-premises connection to the VNet (S2S VPN or ExpressRoute).

·         Determine the on-premises VPN device or router.

·         Add routes to make the address space of the VNet reachable.

·         For ExpressRoute, plan for the new connection with your provider.

·         Determine the Local Network address space for the Azure gateway.

·         Configure on-premises DNS servers for DNS replication with DNS servers hosted in Azure.

·         Determine the use of forced tunneling and user-defined routes.

Best Practices for using Azure Active Directory

·         Create a unique Active Directory site object for each Azure region where virtual machines reside, and associate all the virtual networks in that region with the Active Directory site.

·         Place two domain controllers within an availability set in all Azure regions where virtual machines reside.

·         Make all domain controllers in Azure Global Catalog servers.

·         Make sure that domain controllers are pointing to a DNS server in Windows that hosts the Active Directory zones, rather than the default DNS servers in Azure.

·         Do not set a static IP address on the network adapter in the operating system for virtual domain controllers in Azure. Doing so will isolate the virtual machines and prevent them from communicating on the virtual network.

·         To give a domain controller the IP address that you want and prevent it from changing if the virtual machine is de-provisioned, provide the virtual machine with a static virtual network IP address.

·         Make sure that you place the Active Directory database and SYSVOL on a data disk. If you use the operating system disk or a temporary disk, the database may get corrupted or purged during an outage.

Managing security, compliance and data privacy

Infrastructure protection

·         Monitoring and logging Centralized monitoring, correlation, and analysis systems manage the large amount of information generated by devices within the Azure environment, providing continuous visibility and timely alerts to the teams that manage the service.

·         Update management Security update management helps protect systems from known vulnerabilities. Azure uses integrated deployment systems to manage the distribution and installation of security updates for Microsoft software.

·         Antivirus and antimalware Azure software components must go through a virus scan prior to deployment. Code is not moved to production without a clean and successful virus scan.

·         DDoS protection Azure has a defense system against Distributed Denial-of-Service (DDoS) attacks on Azure platform services. It uses standard detection and mitigation techniques.

 Network protection

·         Network isolation Azure is a multitenant service, meaning that multiple customers’ deployments and VMs are stored on the same physical hardware. Azure uses logical isolation to segregate each customer’s data from that of others.

·         Virtual networks A customer can assign multiple deployments within a subscription to a virtual network and allow those deployments to communicate with each other through private IP addresses. Each virtual network is isolated from other virtual networks.

·         VPN and ExpressRoute For even better performance, customers can use an optional ExpressRoute, a private fiber link into Azure datacenters that keeps their traffic off the Internet.

·         Encrypting communications Built-in cryptographic technology enables customers to encrypt communications within and between deployments, between Azure regions, and from Azure to on-premises datacenters.

Data protection

·         Data isolation Azure is a multitenant service, meaning that multiple customers’ deployments and virtual machines are stored on the same physical hardware.

·         Protecting data at rest Azure Disk Encryption is a capability that lets you encrypt your Windows and Linux IaaS virtual machine disks. Azure Disk Encryption leverages the industry-standard BitLocker feature of Windows and the DM-Crypt feature of Linux to provide volume encryption for the OS and the data disks. The solution is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets in your key vault subscription, while ensuring that all data in the virtual machine disks are encrypted at rest in your Azure storage.

SQL Database TDE is based on SQL Server’s TDE technology, which encrypts the storage of an entire database by using an industry-standard AES-256 symmetric key called the database encryption key.

·         Protecting data in transit For data in transit, Azure uses industry-standard transport protocols such as TLS between devices and Microsoft datacenters, and within datacenters themselves.

·         Data redundancy Data may be replicated within a selected geographic area for redundancy.

Identity and access

·         Enterprise cloud directory. It combines core directory services, advanced identity governance, security, and application access management. Azure Active Directory makes it easy for developers to build policy-based identity management into their applications. Azure Active Directory enables a single identity management capability across on-premises, cloud, and mobile solutions.

·         Multi-Factor Authentication Microsoft Azure provides Multi-Factor Authentication (MFA). It delivers strong authentication via a range of easy verification options—phone call, text message, or mobile app notification—allowing users to choose the method they prefer.

·         Access monitoring and logging Security reports are used to monitor access patterns and to proactively identify and mitigate potential threats. Microsoft administrative operations, including system access, are logged to provide an audit trail if unauthorized or accidental changes are made.

·         Least privilege admin model

o    Limit the number of administrators or members of privileged groups.

o    Delegate fewer privileges to accounts.

o    Provide privileges on demand.

o    Have existing administrators perform tasks instead of adding additional administrators.

o    Provide processes for emergency access and rare use scenarios.