81–90 of 131 posts
Hmm, not sure I'm understanding #1 correct. Can I install it on, let's say, Debian without Vagrant/Virtualbox now? I can't find the info in the docs.
Nice to see Docker 0.7 hit with some very useful changes. I see lots of people are getting some generic Docker questions answered in here, and want to ask one I have been wondering about. What is the easiest way to use dockers like I would virtual machines? I want to boot an instance, make some changes e.g. apt-get install or edit config files, shutdown the instance, and have the changes available next time I boot th…
Your question is very near to me, I published a teeny-tiny script called 'urbinit'[1] for doing exactly what you are asking. It's meant to use with urbit, where you start by creating a 'pier' and use it to begin 'ships'. The ships must not be discarded (unless you don't mind having no real identity, and many parts of urbit require you to maintain a persistent identity). If you re-do the key exchange dance again from a fresh pier to identify yourself as the same 'destroyer' (having discarded the previous incarnation), you wind up as a perfectly viable ship with packet sequence numbers that are out of order and can't really receive any messages or acknowledge any packets that are waiting to be delivered in the correct order from your neighbor ships.
Anyway, urbinit is a manifestation of the fact that Docker doesn't really have anything to help you deal with this (very common and not at all unique to Urbit) problem. Docker offers that you can use a volume... make the state you need to be persistent part of a volume. Unfortunately this means it won't be present in your images; or you can do roughly what urbinit does, which is a very simple and classic problem all Computer Scientists past year 1 should already know.
Launch the container in detached mode (-d) and save the ID. Create a lock file. Urbinit won't do step 1 if there is already a lock file created that was never cleared. This is to prevent you from launching the same ship twice at one time with two addresses, which is very confusing to the network.
Attach if you need to interact through terminal, or however you want, affect the container by sending packets to it (eg. login via ssh and do stuff). Terminate your process or let it end when it's ready to end naturally, or the power goes out. If you're using urbinit (and the power did not go out), this is the point where the commit process comes along and commits your container ID back to the named image that it was created from, simultaneously clearing the lock created in step 2.
If you're doing this with several different images on one host that are meant to run simultaneously, a nice trick is to name your lock file after the actual docker image that's used in the commit step.
EL6 users (RHEL, CentOS, SL), I've just learned Docker is now in EPEL (testing for now, but will hit release soon): yum --enablerepo=epel-testing install docker-io PS: make sure you have "cgconfig" service running
Any info on how it sets up networking? I see -b none in the startup... Is there some other tool that does it on EL6?
Do you know where devel talks for this rpm are happening? I did not see any mention of it in the EPEL list archives.
Earlier quoted context omitted.
There's no need to manually take snapshots, docker does this automatically every time you run a process inside a container. In your example of running /bin/bash, after you exit bash and return to the host machine docker will give you the id for the container which has your changes. You can restart the container or run a new command inside it and your changes will still be there. If you want to access it more easily l…
Yes, my goal here is ease of playing around with something new. I would setup a dockerfile after I knew exactly what setup I wanted. You're right, I misunderstood what docker was doing when shutting down the container. Seems like I can start and reattach just fine. Here is an example workflow for anyone curious: root@chris-VM:~# docker run -i -t ubuntu /bin/bash root@0a8f96822140:/# cd /root root@0a8f96822140:/root#…
I prefer to never keep anything important in a stopped container (for very long) without committing it back to an image, and I don't like dealing with numeric ids.
Recently (it looks like you don't have this change yet) docker added the automatic naming scheme giving every container a random name of some "color_animal" pair which I think reinforces the point, stopped containers are not a place to store meaningful/persistent state information for very long.
This mishmash gets run almost every day on my docker hosts to clean up after terminated experiments:
docker ps -a|egrep -v 'ID|Up'|awk '{print $1}'|xargs docker rm
Beware, it will delete all of the stray containers you've ever created before that are now stopped!
Earlier quoted context omitted.
Doesn't 'flatten' mean that there's going to be a tradeoff between IO performance and storage size? If that's the case I'd like to have some control over what happens, at least with one of the implementations. Say, during development of a Dockerfile just use the layers as before, potentially without any depth limits, but when an image is ready being able to call 'flatten' manually. Some background: Using 0.65 it took…
"flatten" is a simplification, what I mean is that the devicemapper thin provisioning module uses a data structure on disk that has a complexity that is independent of the snapshot depth. I did not mean that the Docker image itself is somehow flattened. I don't think there will be any performance problems with deep layering of images, either on dm or ads.
Earlier quoted context omitted.
It's both. Everyone using docker benefits from the "software distribution" feature. Some people using docker also benefit from the security and isolation features - it depends on your needs and the security profile of your application. Because the underlying namespacing features of the kernel are still young, it's recommended to avoid running untrusted code as root inside a container on a shared machine. If you drop…
Which namespacing features are still young? Is it still possible to evade LXC as described in this post? http://blog.bofh.it/debian/id_413
Earlier quoted context omitted.
Yes, my goal here is ease of playing around with something new. I would setup a dockerfile after I knew exactly what setup I wanted. You're right, I misunderstood what docker was doing when shutting down the container. Seems like I can start and reattach just fine. Here is an example workflow for anyone curious: root@chris-VM:~# docker run -i -t ubuntu /bin/bash root@0a8f96822140:/# cd /root root@0a8f96822140:/root#…
Yes, I wrote a long wordy response and neglected to mention "docker start" which is a perfectly good way to come back to a stopped container after the first "docker run". I prefer to never keep anything important in a stopped container (for very long) without committing it back to an image, and I don't like dealing with numeric ids. Recently (it looks like you don't have this change yet) docker added the automatic na…
The changes you mention sound nice. It's no surprise I don't have them:
root@chris-VM:~# docker version
Client version: 0.5.3
Server version: 0.5.3
Go version: go1.1
I have used docker ps -a | awk '{print $1}' | xargs docker rm a couple times to clean up after playing around. I was slightly annoyed that it tried to docker rm a (nonexistent) container with the id ID. Thanks for reminding me to throw a egrep -v 'ID|Up' in front of awk.
Earlier quoted context omitted.
Which namespacing features are still young? Is it still possible to evade LXC as described in this post? http://blog.bofh.it/debian/id_413
Yes, it is trivial for a root user in an LXC container to break out. One can load a kernel module from within a container, for example. LXC containers do not provide security partitioning at all.
See my other comment in this thread for a more accurate answer.
EL6 users (RHEL, CentOS, SL), I've just learned Docker is now in EPEL (testing for now, but will hit release soon): yum --enablerepo=epel-testing install docker-io PS: make sure you have "cgconfig" service running
Very nice, I can stop updating my fork of the other rpm spec that's on github. Any info on how it sets up networking? I see -b none in the startup... Is there some other tool that does it on EL6? Do you know where devel talks for this rpm are happening? I did not see any mention of it in the EPEL list archives.
Earlier quoted context omitted.
Yes, I wrote a long wordy response and neglected to mention "docker start" which is a perfectly good way to come back to a stopped container after the first "docker run". I prefer to never keep anything important in a stopped container (for very long) without committing it back to an image, and I don't like dealing with numeric ids. Recently (it looks like you don't have this change yet) docker added the automatic na…
Indeed, if I had done anything important I would certainly commit the changes to the container. It's great to have some version control for my playful discovery. The changes you mention sound nice. It's no surprise I don't have them: root@chris-VM:~# docker version Client version: 0.5.3 Server version: 0.5.3 Go version: go1.1 It was the easiest VM I had access to at the moment of posting. I should update the docker i…