Ambassador container pattern in Docker - Mini Project: Build & Apply

Using the Ambassador Container Pattern with Docker

📖 Scenario: You are working on a small web application that needs to connect to a database. To keep things simple and organized, you will use the Ambassador container pattern. This means you will create a separate container that acts as a helper to connect your app to the database.This pattern helps you manage connections easily and keeps your app container clean.

🎯 Goal: Build a Docker setup with two containers: one for a simple web app and one as an ambassador container that forwards requests to a database container.You will create the necessary Dockerfiles and a docker-compose.yml file to run all containers together.

📋 What You'll Learn

Create a Dockerfile for the web app container

Create a Dockerfile for the ambassador container

Create a docker-compose.yml file to define the web app, ambassador, and database containers

Configure the ambassador container to forward traffic to the database container

Run the containers and verify the web app can connect to the database through the ambassador

💡 Why This Matters

🌍 Real World

The ambassador container pattern is used in microservices and containerized applications to manage connections to external services like databases or APIs. It helps isolate connection logic and makes scaling and maintenance easier.

💼 Career

Understanding this pattern is useful for DevOps engineers and developers working with Docker and Kubernetes, as it improves application architecture and network management.

1

Create the web app Dockerfile

Create a file named Dockerfile.app with these exact contents:

FROM python:3.12-slim
WORKDIR /app
COPY app.py .
CMD ["python", "app.py"]

Docker

# Create Dockerfile.app with the specified content
# Your code here

Hint

This Dockerfile sets up a Python 3.12 environment, copies the app code, and runs it.

2

Create the ambassador Dockerfile

Create a file named Dockerfile.ambassador with these exact contents:

FROM alpine/socat
CMD ["socat", "TCP-LISTEN:5432,fork,reuseaddr", "TCP:db:5432"]

Docker

FROM python:3.12-slim
WORKDIR /app
COPY app.py .
CMD ["python", "app.py"]

# Create Dockerfile.ambassador with socat forwarding
# Your code here

Hint

This Dockerfile uses socat to forward TCP traffic from port 5432 to the database container named db.

3

Create the docker-compose.yml file

Create a file named docker-compose.yml with these exact services:
- app using Dockerfile.app, depends on ambassador
- ambassador using Dockerfile.ambassador, depends on db
- db using the official postgres:15 image with environment variables POSTGRES_USER=user and POSTGRES_PASSWORD=pass
Make sure ports and networks are configured so app connects to ambassador on port 5432.

Docker

FROM python:3.12-slim
WORKDIR /app
COPY app.py .
CMD ["python", "app.py"]

FROM alpine/socat
CMD ["socat", "TCP-LISTEN:5432,fork,reuseaddr", "TCP:db:5432"]

# Create docker-compose.yml with app, ambassador, and db services
# Your code here

Hint

This file defines the three containers and their relationships. The app connects to the ambassador, which forwards to the db.

4

Run and verify the setup

Run docker-compose up --build in your terminal. Then, inside the app container, run python app.py to check if it connects to the database through the ambassador. The output should be:

Connected to database successfully

Docker

FROM python:3.12-slim
WORKDIR /app
COPY app.py .
CMD ["python", "app.py"]

FROM alpine/socat
CMD ["socat", "TCP-LISTEN:5432,fork,reuseaddr", "TCP:db:5432"]

version: '3.8'
services:
  db:
    image: postgres:15
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
  ambassador:
    build:
      context: .
      dockerfile: Dockerfile.ambassador
    depends_on:
      - db
  app:
    build:
      context: .
      dockerfile: Dockerfile.app
    depends_on:
      - ambassador
    environment:
      DB_HOST: ambassador
      DB_PORT: 5432

# Run docker-compose up --build and then run python app.py inside the app container
# Your code here

Hint

Make sure you build and run the containers with docker-compose up --build. Then enter the app container and run python app.py.

Practice

1. What is the main role of an ambassador container in the ambassador container pattern?

easy

A. It acts as a helper proxy inside the same pod as your application.

B. It stores application data persistently.

C. It builds Docker images automatically.

D. It manages user authentication directly.

Solution

1. Step 1: Understand the ambassador container role

   The ambassador container acts as a proxy that helps your app communicate with external services.

2. Step 2: Differentiate from other container roles

   Unlike storage or build containers, the ambassador focuses on networking inside the pod.

3. Final Answer:

   It acts as a helper proxy inside the same pod as your application. -> Option A

4. Quick Check:

   Ambassador container = helper proxy [OK]

Hint: Ambassador = proxy helper inside pod [OK]

Common Mistakes:

• Confusing ambassador with storage or build containers
• Thinking ambassador manages authentication directly
• Assuming ambassador runs outside the pod

2. Which of the following is the correct way to link an application container to an ambassador container in a Kubernetes pod YAML?

easy

A. Use separate pods for app and ambassador with no shared network.

B. Use a Docker volume to share files between app and ambassador containers.

C. Define both containers under the same pod spec with shared localhost communication.

D. Expose the ambassador container on a public IP address.

Solution

1. Step 1: Understand pod container communication

   Containers in the same pod share the network namespace and can communicate over localhost.

2. Step 2: Identify correct linking method

   Defining both containers in the same pod spec allows the app to talk to ambassador via localhost.

3. Final Answer:

   Define both containers under the same pod spec with shared localhost communication. -> Option C

4. Quick Check:

   Same pod = localhost communication [OK]

Hint: Same pod containers communicate via localhost [OK]

Common Mistakes:

• Thinking ambassador must be in a separate pod
• Using volumes for network communication
• Exposing ambassador publicly instead of internal proxy

3. Given this pod spec snippet, what will be the hostname your app container uses to reach the ambassador container?

{
  "containers": [
    {"name": "app", "image": "myapp"},
    {"name": "ambassador", "image": "ambassador-image"}
  ]
}

medium

A. "external-service"

B. "ambassador"

C. "127.0.0.1"

D. "localhost"

Solution

1. Step 1: Understand pod networking

   Containers in the same pod share the network namespace, so they communicate over localhost or 127.0.0.1.

2. Step 2: Identify hostname for ambassador

   The ambassador container listens on localhost inside the pod, so the app uses "localhost" or "127.0.0.1" to reach it.

3. Final Answer:

   "localhost" -> Option D

4. Quick Check:

   Same pod communication = localhost [OK]

Hint: Same pod containers use localhost to communicate [OK]

Common Mistakes:

• Using container name as hostname inside pod
• Using external service name instead of localhost
• Confusing IP addresses inside pod

4. You have an ambassador container configured, but your app cannot reach the external service through it. What is a likely cause?

medium

A. The ambassador container is not running in the same pod as the app container.

B. The app container is using localhost to reach the ambassador.

C. The ambassador container is exposing port 8080 internally.

D. The external service is reachable directly by the app.

Solution

1. Step 1: Check pod configuration

   If ambassador is not in the same pod, app cannot reach it via localhost.

2. Step 2: Understand communication failure

   Without shared network namespace, localhost won't connect to ambassador, causing failure.

3. Final Answer:

   The ambassador container is not running in the same pod as the app container. -> Option A

4. Quick Check:

   Ambassador outside pod = no localhost access [OK]

Hint: Ambassador must be in same pod for localhost access [OK]

Common Mistakes:

• Assuming localhost works across pods
• Ignoring ambassador container status
• Confusing internal port exposure with connectivity

5. You want to improve security by restricting your app's access to an external database using the ambassador container pattern. Which approach best achieves this?

hard

A. Allow the app container to connect directly to the database and use ambassador only for logging.

B. Configure the ambassador container to handle all database connections and apply network policies to block direct app access.

C. Run the ambassador container in a separate pod with public IP to filter traffic.

D. Disable the ambassador container and let the app connect directly for simplicity.

Solution

1. Step 1: Use ambassador as controlled proxy

   Configure ambassador to manage all database connections, acting as a gatekeeper.

2. Step 2: Apply network policies

   Block direct app access to the database, forcing traffic through ambassador for security.

3. Final Answer:

   Configure the ambassador container to handle all database connections and apply network policies to block direct app access. -> Option B

4. Quick Check:

   Ambassador proxy + network policies = secure access [OK]

Hint: Use ambassador as proxy and block direct app access [OK]

Common Mistakes:

• Allowing direct app access to database
• Running ambassador outside pod with public IP
• Disabling ambassador for simplicity