Setting up Docker CE

Installation

see host install

Setup

see xfs quotas for an advanced setup

Ready to go

enable at boot-time

vi /etc/rc.d/rc.inet1

brctl addbr br0
brctl addif br0 eth1
ifconfig br0 10.0.0.254/16 up

vi /etc/rc.d/rc.local
PATH=$PATH:/usr/local/bin:/usr/local/sbin

sysctl -w net.ipv4.ip_forward=1
echo starting dockerd
dockerd >> /var/log/dockerd.log 2>&1 &
pgrep -a dockerd
vi /etc/rc.d/rc.local_shutdown
echo -n killing dockerd...
pkill dockerd && echo done || echo FAIL

status

pgrep -a docker
ls -lF /var/run/docker.sock
brctl show br0

reload

pgrep -a dockerd
kill -HUP PID-HERE

Acceptance

live restore

we could not validate that running instances come back after a reboot. the best we’ve got is a come back after killing and starting the docker daemon again.

Operations

you can now operate your Docker host

systemd

systemctl list-unit-files | grep containerd
systemctl list-unit-files | grep docker

systemctl status containerd.service
systemctl status docker.socket
systemctl status docker.service

manually

ls -lF /run/containerd/containerd.sock
ls -lF /run/docker.sock
dockerd -H fd:// --containerd=/run/containerd/containerd.sock

Usage

as user

docker images -a
docker ps -a
docker pull pbraun9/devuan
docker pull pbraun9/devuan-svr4

see ops-image and ops

Troubleshooting

failed to start containerd: exec: "containerd": executable file not found in $PATH

==> add PATH into rc.local

seen on debian bookworm with docker-ce which starting dockerd manually

failed to load listeners: no sockets found via socket activation: make sure the service was started by systemd

==> look closer in the journalctl logs: Error initializing network controller

failed to start daemon: Error initializing network controller: error creating default "brige" network: Failed to Setup IP tables: Unable to enable NAT rule:  (iptables failed: iptables --wait -t nat -I POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE: Warning: Extension MASQUERADE revision 0 not supported, missing kernel module?

iptables v1.8.9 (nf_tables):  RULE_INSERT failed (No such file or directory): rule in chain POSTROUTING

==> fix your kernel config see https://blog.hypriot.com/post/verify-kernel-container-compatibility/

Resources

install

Install Docker Engine from binaries https://docs.docker.com/engine/install/binaries/

Post-installation steps for Linux https://docs.docker.com/engine/install/linux-postinstall/

daemon options

dockerd https://docs.docker.com/engine/reference/commandline/dockerd/

Configure and troubleshoot the Docker daemon https://docs.docker.com/config/daemon/

Daemon user namespace options https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-user-namespace-options

Set ulimits in container (–ulimit) https://docs.docker.com/engine/reference/commandline/run/#set-ulimits-in-container---ulimit

Enable IPv6 support https://docs.docker.com/config/daemon/ipv6/

How to run dockerd in the background without logs https://stackoverflow.com/questions/54852529/how-to-run-dockerd-in-the-background-without-logs

Local File logging driver https://docs.docker.com/config/containers/logging/local/

storage xfs

How to Enable Disk Quotas on an XFS File System https://www.thegeekdiary.com/how-to-enable-disk-quotas-on-an-xfs-file-system/

Docker Per-Container Disk Quota on Bind Mounted Volumes https://stackoverflow.com/questions/57248180/docker-per-container-disk-quota-on-bind-mounted-volumes

Storage quota per container - overlay2 backed by xfs https://forums.docker.com/t/storage-quota-per-container-overlay2-backed-by-xfs/37653

Docker Container Size Quota https://reece.tech/posts/docker-container-size-quota/

storage misc

About storage drivers https://docs.docker.com/storage/storagedriver/

Docker storage drivers https://docs.docker.com/storage/storagedriver/select-storage-driver/

Use the OverlayFS storage driver https://docs.docker.com/storage/storagedriver/overlayfs-driver/

Storage Drivers in Docker: A Deep Dive https://integratedcode.us/2016/08/30/storage-drivers-in-docker-a-deep-dive/

Docker Issues and Tips (aufs/overlay/btrfs..) https://github.com/AkihiroSuda/issues-docker

BTRFS vs OverlayFS https://www.reddit.com/r/docker/comments/5m4yhi/btrfs_vs_overlayfs/

storage advanced

how to clean up docker overlay directory? https://stackoverflow.com/questions/31712266/how-to-clean-up-docker-overlay-directory

security

Isolate containers with a user namespace https://docs.docker.com/engine/security/userns-remap/

Run the Docker daemon as a non-root user (Rootless mode) https://docs.docker.com/engine/security/rootless/

User privileges in Docker containers https://medium.com/jobteaser-dev-team/docker-user-best-practices-a8d2ca5205f4

Understanding root inside and outside a container https://www.redhat.com/en/blog/understanding-root-inside-and-outside-container

Running Docker Containers as ROOT: https://dockerlabs.collabnix.com/security/Running-Containers-as-ROOT.html

live restore

Keep containers alive during daemon downtime https://docs.docker.com/config/containers/live-restore/


HOME | GUIDES | LECTURES | LAB | SMTP HEALTH | HTML5 | CONTACT
Copyright © 2024 Pierre-Philipp Braun