issue #7580 volumes-from comma separated list mentioned this case.
Options like --volumes-from=[] indicate they can be specified multiple times:
docker run -it --rm --volumes-from TEST_DATA --volumes-from TEST_DATA2 ubuntu bash
Signed-off-by: Deshi Xiao <dxiao@redhat.com>
Out of box, the 'sudo' command on openSUSE does not work similarly to other distros. In this case, the path to usermod should be explicitly given, since /usr/sbin, where usermod is located, is not on the sudoing user's PATH. The other sudo commands here should be fine.
The cli interface works similar to other registry related commands:
docker search foo
... searches for foo on the official hub
docker search localhost:5000/foo
... does the same for the private reg at localhost:5000
Signed-off-by: Daniel Menet <membership@sontags.ch>
Reset the time increment if the container's execution time is greater
than 10s or else as a container runs and is restarted the time will grow
overtime.
Signed-off-by: Michael Crosby <michael@docker.com>
We need to do this so that when a user asks docker to stop the container
and it is currently in the restart loop we don't want to have to wait
for the duration of the restart time increment before ack. the stop.
Signed-off-by: Michael Crosby <michael@docker.com>
- Use a common struct for Volumes
- Split out some functionality in intializeVolume into separate functions
- Removes some duplicate code
- In general much easier to grok the code now
Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
This PR moves the userland proxies for TCP and UDP traffic out of the
main docker daemon's process ( from goroutines per proxy ) to be a
separate reexec of the docker binary. This reduces the cpu and memory
needed by the daemon and if the proxy processes crash for some reason
the daemon is unaffected. This also displays in the standard process
tree so that a user can clearly see if there is a userland proxy that is
bound to a certain ip and port.
```bash
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
5d349506feb6 busybox:buildroot-2014.02 "sh" 13 minutes ago Up 1 seconds 0.0.0.0:49153->81/tcp, 0.0.0.0:49154->90/tcp hungry_pike
root@1cbfdcedc5a7:/go/src/github.com/docker/docker# ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.1 18168 3100 ? Ss 21:09 0:00 bash
root 8328 0.7 0.6 329072 13420 ? Sl 22:03 0:00 docker -d -s vfs
root 8373 1.0 0.5 196500 10548 ? Sl 22:03 0:00 userland-proxy -proto tcp -host-ip 0.0.0.0 -host-port 49153 -container-ip 10.0.0.2 -container-port 81
root 8382 1.0 0.5 270232 10576 ? Sl 22:03 0:00 userland-proxy -proto tcp -host-ip 0.0.0.0 -host-port 49154 -container-ip 10.0.0.2 -container-port 90
root 8385 1.2 0.0 3168 184 pts/0 Ss+ 22:03 0:00 sh
root 8408 0.0 0.1 15568 2112 ? R+ 22:03 0:00 ps aux
```
This also helps us to cleanly cleanup the proxy processes by stopping
these commands instead of trying to terminate a goroutine.
Signed-off-by: Michael Crosby <michael@docker.com>
renaming this struct to more clearly be session, as that is what it
handles.
Splitting out files for easier readability.
Signed-off-by: Vincent Batts <vbatts@redhat.com>
* starting with filtering for exit codes. `docker ps -a --filter 'exited=1'`
* API doc for filter parameter
* formatting filters for help usage
* tweaks for review
This requires https://github.com/dotcloud/docker/pull/4430
Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
Later versions of `apt` are smart enough to just create this directory if it's missing, but Lucid balks (just like `gnupg` and `gpgv` aren't in the Required set so don't come in a minbase -- good ol' Lucid).
Signed-off-by: Andrew Page <admwiggin@gmail.com>
This is an extremely tentative PR. However, I feel that the suggestions are generally good.
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: timthelion)
This commit contains a re-structured re-write of the original
certificated.md file, containing the amendments proposed with
PR #7120 (commit ID bd28595e310ccfa98) by @timthelion.
Related to: https://github.com/dotcloud/docker/pull/7120
2014-07-30: Update/rebase/squash based on the comments from @jamtur01 and @fredlf.
2014-08-12: Update/rebase/squash based on the comments from @fredlf (of 2014-08-12).
Docker-DCO-1.1-Signed-off-by: O.S. Tezer <ostezer@gmail.com> (github: ostezer)
This changes the way the exec drivers work by not specifing a -driver
flag on reexec. For each of the exec drivers they register their own
functions that will be matched aginst the argv 0 on exec and called if
they match.
This also allows any functionality to be added to docker so that the
binary can be reexec'd and any type of function can be called. I moved
the flag parsing on docker exec to the specific initializers so that the
implementations do not bleed into one another. This also allows for
more flexability within reexec initializers to specify their own flags
and options.
Signed-off-by: Michael Crosby <michael@docker.com>
This PR proposes to fix some already existing (i.e., older)
line-length & line-alignment issues and the ones recently
included/merged with the PR #7406
(https://github.com/docker/docker/pull/7406).
It also proposes to fix a couple minor typography mistakes
(i.e., spelling of GitHub and Service Hooks (headers))
This PR does *not* propose any content changes.
Docker-DCO-1.1-Signed-off-by: O.S. Tezer <ostezer@gmail.com> (github: ostezer)
The cli interface works similar to other registry related commands:
docker search foo
... searches for foo on the official hub
docker search localhost:5000/foo
... does the same for the private reg at localhost:5000
Signed-off-by: Daniel Menet <membership@sontags.ch>
Cover network configuration and reference the official openSUSE image
inside of the examples.
Docker-DCO-1.1-Signed-off-by: Flavio Castelli <fcastelli@suse.com> (github: flavio)
This is part of the ongoing effort to remove the deprecated server/
package, and generally cleanup and simplify the codebase.
Signed-off-by: Solomon Hykes <solomon@docker.com>
- add `set -e` to make failing commands bail the script
- remove trailing `exit 0` which is just extraneous anyhow
- adjust `status_of_proc` options to pass in `$DOCKER_DESC` so we get consistently styled messages like `Docker is running` or `Docker is not running` or `could not access PID file for Docker`
Signed-off-by: Andrew Page <admwiggin@gmail.com>
`rm -f` was originally deprecated in favor of `rm --stop/--kill` since `rm
-f` was sending SIGTERM and potentially very slow.
Instead this will bring back `rm -f` but use SIGKILL isntead
Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
The graphtest package is only imported in the test files of other
packages therefore we do not leak testing flags.
Signed-off-by: Michael Crosby <michael@docker.com>
This prevents the testing package flags from leaking into the flagsets
of binaries that import docker. I left integration-cli alone.
Docker-DCO-1.1-Signed-off-by: Peter Bourgon <peter@bourgon.org> (github: peterbourgon)
Update hack/vendor.sh to use libcontainer's update-vendor.sh script as the source of truth for libcontainer deps and not include them in Docker's repo twice
This removes a shim `daemon.Server` interface which was used to start
separating Daemon from Server *gradually*, without getting cyclic
dependency errors.
Now that the last Daemon->Server dependency has been removed, we can
finally remove the shim. Yay!
Signed-off-by: Solomon Hykes <solomon@docker.com>
That job was a hacky solution to a real race condition. This removes the
hack without re-introducing the race.
Signed-off-by: Solomon Hykes <solomon@docker.com>
This disentangles the following functions, which were previously all mixed together:
* 1) Waiting for jobs to terminate when shutting down
* 2) Handling signals in the Docker daemon
* 3) Per-subsystem cleanup handlers
* 4) pidfile management
Responsibilities are dispatched as follows:
* Signal traps are set in `main`, and trigger `engine.Shutdown`
* `engine.Shutdown` coordinates cleanup by waiting for jobs to complete, and calling shutdown handlers
* To perform cleanup at shutdown, each subsystem registers handlers with `engine.OnShutdown`
* `daemon` is one subsystem, so it registers cleanup via `engine.OnShutdown`.
* `daemon` owns the pidfile, which is used to lock access to `/var/lib/docker`. Part of its cleanup is to remove the pidfile.
Signed-off-by: Solomon Hykes <solomon@docker.com>
* Events subsystem merged from `server/events.go` and
`utils/jsonmessagepublisher.go` and moved to `events/events.go`
* Only public interface for this subsystem is engine jobs
* There is two new engine jobs - `log_event` and `subscribers_count`
* There is auxiliary function `container.LogEvent` for logging events for
containers
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
[solomon@docker.com: resolve merge conflicts]
Signed-off-by: Solomon Hykes <solomon@docker.com>
Note: this cannot yet be moved to graph/ because of a lingering
dependency on daemon. This has been noted in a FIXME.
Signed-off-by: Solomon Hykes <solomon@docker.com>
/tmp is often a tmpfs file system and large temporary files could cause
docker commands to fail. Also using /tmp potentially allows users on the
system to get access to content, or even attack the content. Moving the tmpdir to
/var/lib/container/tmp will protect the data.
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Conflicts:
docker/docker.go
DOCKER_CONFIG was introduced in #6984.
We may use "config" for other purposes (e.g. #7232). Until we
have made a design decision around how configuration files will
work, DOCKER_CERT_PATH is a much safer name to rely on for future
compatibility.
Docker-DCO-1.1-Signed-off-by: Ben Firshman <ben@firshman.co.uk> (github: bfirsh)
This works mostly by refactoring our "main" package to be careful about what it imports based on the daemon build tag. :)
Also, I've updated Travis to test "client-only" compilation after it tests the daemon version.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
This allows signing off commits with `git commit -s`
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Cleaned up DCO regex
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
Issues addressed:
- Remote API doco refers to "registry" parameter which is not supported
- Neglects to mention "tag" parameter which is supported
- Offers no guidance on pushing to private registries
Changes made:
- As directed in review comments, `registry` removed from all api versions (1.0-1.14)
- Have added documentation for `tag` parameter and guidance on private registries for versions 1.10-1.14 (I have only validated this on .10)
Docker-DCO-1.1-Signed-off-by: Lachlan Coote <lachlan.t.coote@gmail.com> (github: lcoote)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Fix issues with renaming changes to container_changes
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Fix issues with renaming container_delete to delete
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Btrfs graph driver is not experimental now according to #4838 and CHANGELOG.md is saying "btrfs is no longer considered experimental.".
Docker-DCO-1.1-Signed-off-by: Ken ICHIKAWA <ichikawa.ken@jp.fujitsu.com> (github: ichik1)
Tag can be a number, like centos:6.4, and so must be handled like a
string otherwise will lose quotation marks when converting to json
and the client (API < 1.7) will try to convert to int, failing
because the type is string. Additionally using ParseRepositoryTag to
parse repository names to split the tag because an URL can have : and
so more than one occurrence of : can be found on repository names.
Docker-DCO-1.1-Signed-off-by: Fabio Falci <fabiofalci@gmail.com> (github: fabiofalci)
Addresses issue #7141
Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
a little git by
Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: SvenDowideit)
The initial `ValidateContextDirectory` implementation fails loudly when a file
lacks read permissions in the current context. However that situation is valid
if the file is included in the `.dockerignore` patterns.
Docker-DCO-1.1-Signed-off-by: Bruno Renié <brutasse@gmail.com> (github: brutasse)
This came up in #docker-dev today. We're not sure exactly why the original restriction was put it place. It is not well obeyed. Please comment if you know the origin of the restriction.
Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: timthelion)
- Directories should have u+x (0600 -> 0700)
- Don't chown files to root because we don't have to
Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
This commit proposes some minor amendments and updates
for the articles/https.md document to fix certain errors, inc.:
- Marking commands / flags as code (e.g. `tlsverify`) [done before rebase]
- Capitalising the word Docker
- Normalizing headers to match the rest of the docs;
- Expanding the page description to match the page title and the content;
- Capitalizing HTTPS etc.;
- Some spelling error fixes;
- Line-length adjustments to make it easier to read the raw file.
It does not propose any fundemental changes to the structure of the document.
Certain changes were based before another update on this doc.
Docker-DCO-1.1-Signed-off-by: O.S. Tezer <ostezer@gmail.com> (github: ostezer)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the deprecated server/ package
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
This is part of an effort to break apart the legacy server package. Help wanted!
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
functions to pkg/parsers/kernel, and parsing filters to
pkg/parsers/filter. Adjust imports and package references.
Docker-DCO-1.1-Signed-off-by: Erik Hollensbe <github@hollensbe.org> (github: erikh)
The image centos:centos6.4 doesn't exist. Instead you have to choose between the official centos6 or centos7. Both images does not work together with de yum npm install. When choosing an centos6.5 from another distributor (tutum) it works.
This should not be done by default but used by adminsys with a drop-in.d file,
for buggy daemons which crash without known fixes.
Docker-DCO-1.1-Signed-off-by: Sébastien Luttringer <seblu@seblu.net> (github: seblu)
- put all the precompiled test binaries in $DEST so they show up in bundles and can be re-run individually afterwards
- support cases where parallel is not installed (when using dyntest-unit, for example, this is much more common, since it's designed to be run outside the Dockerfile)
- use "mktemp -d" instead of "/tmp" directly for our temporary parallel HOME
- update the default PARALLEL_JOBS to be the value of "nproc" instead of 0, since "0 means as many as possible" (see https://www.gnu.org/software/parallel/man.html#jobs_n)
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
removing the insert documentation for > 1.10 since it has been removed
in 1.11. This commit fixes#7183
Docker-DCO-1.1-Signed-off-by: Julien Bordellier <me@julienbordellier.com> (github: jstoja)
Defining err as named return parameter will make sure the variable gets
assigned before returning and thus avoid masking
Docker-DCO-1.1-Signed-off-by: Johannes 'fish' Ziemke <github@freigeist.org> (github: discordianfish)
The ENTRYPOINT example uses "/usr/bin/ls" as path, but `ls` is located at `/bin/ls`.
Docker-DCO-1.1-Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (github: thaJeztah)
Both functions perform the same logic and they just vary on the base
multiplication units. We can refactor the common code into a single
place.
Docker-DCO-1.1-Signed-off-by: Francisco Carriedo <fcarriedo@gmail.com> (github: fcarriedo)
No need to initialize every time the function executes since it works as
a catalog.
Docker-DCO-1.1-Signed-off-by: Francisco Carriedo <fcarriedo@gmail.com> (github: fcarriedo)
No need to have two lines. The type is even explicit when type casting
to `float64(size)`
Docker-DCO-1.1-Signed-off-by: Francisco Carriedo <fcarriedo@gmail.com> (github: fcarriedo)
No need to recompile a fixed regular expression each time the function
executes. Abstracting it to the `init()` method.
Docker-DCO-1.1-Signed-off-by: Francisco Carriedo <fcarriedo@gmail.com> (github: fcarriedo)
May make sense that both `FromHumanSize()` and `RAMInBytes()` support
the same units. Added 'PB' to the RAMInBytes regex.
Also updated tests.
Note: int64 is overflowed on quantities >= EB
Docker-DCO-1.1-Signed-off-by: Francisco Carriedo <fcarriedo@gmail.com> (github: fcarriedo)
namespaces are not well documented, and I had to jump around to other docs. replacing `foo/bar` hopefully makes what's going on here a bit more obvious.
Docker-DCO-1.1-Signed-off-by: Tim Ruffles <timruffles@gmail.com> (github: timruffles)
Better to not use `error` as var name (might eclipse the error type) for
clarity and to prevent subtle bugs.
Docker-DCO-1.1-Signed-off-by: Francisco Carriedo <fcarriedo@gmail.com> (github: fcarriedo)
Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
Final revisions to B2D doc.
Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
Remove named returns since not used in function body. Might prevent
potential subtle bugs.
Docker-DCO-1.1-Signed-off-by: Francisco Carriedo <fcarriedo@gmail.com> (github: fcarriedo)
Increased coverage:
* Added test cases to size_test.go
* Added coverage for duration.go
Docker-DCO-1.1-Signed-off-by: Francisco Carriedo <fcarriedo@gmail.com> (github: fcarriedo)
If AppArmor is enabled on the current system, but "apparmor_parser" isn't installed, it causes all kinds of issues.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Make it possible to inspect an initial response and pass it to
ResumableRequestReader. This makes it possible to inspect an initial
response and passing it to ResumableRequestReader to avoid making an
extra request.
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
"docker logout [SERVER]" will remove the registry server' credentials from
.dockercfg file. If a server is not specified, it will log user out of the
default docker registry server
Docker-DCO-1.1-Signed-off-by: Daniel, Dao Quang Minh <dqminh89@gmail.com> (github: dqminh)
As requested after #7021 add me as a maintainer alongside the sword
toting @lsm5.
Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
zsh completion is updated with the content of
felixr/docker-zsh-completion.
Docker-DCO-1.1-Signed-off-by: Vincent Bernat <vincent@bernat.im> (github: vincentbernat)
lxc is special in that we cannot create the master outside of the
container without opening the slave because we have nothing to provide to the
cmd. We have to open both then do the crazy setup on command right now instead of
passing the console path to lxc and telling it to open up that console. we save a couple of
openfiles in the native driver because we can do this.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
This results in a dramatic improvement in the size of individual "apt-get update" layers (on a clean wheezy base, from "29.88 MB" down to "8.273 MB").
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
This uses "," instead of spaces so that the flags are parsed correctly
and also does not do a strings.Split on an empty string because
strings.Split will return a slice with one element, and empty string
causing parsing to fail when it validates that the cap exists.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Can now dynamically set the docker config directory through an
environment variable.
export DOCKER_CONFIG=/path/to/docker_config/
Default behavior remains the same, e.g. ~/.docker
Documentation for change added to the https.md docs.
Docker-DCO-1.1-Signed-off-by: James A. Kyle <james@jameskyle.org> (github: jameskyle)
Here was possible race with inspect where we changing HostConfig.Links
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
Made a "Secure by default" section, create 2048-bit keys, various cleanups.
Docker-DCO-1.1-Signed-off-by: Aaron Huslage <huslage@gmail.com> (github: huslage)
We add a --device flag which can be used like:
docker run --device /dev/sda:/dev/xvda:rwm ubuntu /bin/bash
To allow the container to have read write permissions to access the host's /dev/sda via a node named /dev/xvda in the container.
Note: Much of this code was written by Dinesh Subhraveti dineshs@altiscale.com (github: dineshs-altiscale) and so he deserves a ton of credit.
Docker-DCO-1.1-Signed-off-by: Timothy <timothyhobbs@seznam.cz> (github: timthelion)
Commit 09ee269d ("devmapper: Add option for specifying the thin pool
blocksize") also switched the default dm-thin-pool blocksize from 64K to
512K. That change unfortunately breaks the activation of dm-thin-pool
devices that were previously created using a 64K blocksize. Here is an
example of the dm-thin-pool activation failure users may experience:
device-mapper: thin: 253:4: pool target (204800 blocks) too small: expected 1638400
device-mapper: table: 253:4: thin-pool: preresume failed, error = -22
The reason for this is docker is passing 512K as the blocksize for a
dm-thin-pool that was previously created using a 64K blocksize. Docker
doesn't record the blocksize the is used when it creates a dm-thin-pool.
Until now it never had a need to do so because the blocksize was always
hardcoded. The dm-thin-pool blocksize must be the same every time a
dm-thin-pool is activated.
As a stop-gap fix, revert to using 64K for the default blocksize.
But we do need a proper fix for this now that 'dm.blocksize' is exposed
as a proper storage option. One possible fix would be to record the
blocksize for each dm-thin-pool that docker creates and to pass that
recorded blocksize down in the dmsetup table load each time the
dm-thin-pool is activated (this would be comparable to what lvm2 does).
Docker-DCO-1.1-Signed-off-by: Mike Snitzer <snitzer@redhat.com> (github: snitm)
Currently the docker logs timestamp flag generates log entries like:
$ sudo docker logs -ft daemon_dave
[May 10 13:06:17.934] hello world
It uses Go's StampMilli timestamp to generate the timestamp. The entry
is also wrapped in [ ].
This is non-standard operational timestamp and one that will require
custom parsing.
The new timestamp is RFC3999Nano and generates entries like:
2014-05-10T17:42:14.999999999Z07:00 hello world
These are readily parsed by tools like ELK.
Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
Revised to match new UI, fixed links, copy edits and improvements.
Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
More revisions to builds.md
Corrections to automated build process, copy edits.
Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
Edits based on Sonat's feedback
Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
Term 'service' was used together with 'daemon'. It would be better to use the term 'daemon' solely because most part of documentation are using the term.
Note that the archive does _not_ have a symlink from oldstable-lts to squeeze-lts, hence the change from using "${suite}" to not using it in here and just using the string "squeeze-lts" directly regardless of whether we're building a "squeeze" image or an "oldstable" image.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
If "DOCKER_HOST" is set, we can usually assume the user is connecting to a remote Docker and thus not bind mount anything by default (meaning the Makefile will more often DWIM for our users).
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
These start up much faster and the only caveat is that we can't use "sudo" (which we don't currently use anyhow).
Also, I've updated the Go version here to match what's in the Dockerfile.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Turns out, "alphanumeric" actually means both "alpha" AND "numeric". Dur.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Also removed skipped tests on "viz" and "tree" because they
blocked integration/buildfile_test.go removing.
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
In the Docker Linking Docs, the parent child relationship
was backwards. The Web container should be able to access
the DB, not other way around. Furthermore, the output of
'docker ps' was wrong (it showed that the DB could access
the Web). This fixes both typos.
Docker-DCO-1.1-Signed-off-by: Ian Bull <irbull@gmail.com> (github: irbull)
For various use cases, the 'repositories' file does not match expected
behavior.
Like,
docker save busybox:latest | tar t
Before:
[...]
busybox:latest/
busybox:latest/VERSION
busybox:latest/json
busybox:latest/layer.tar
# note, the layer name, and lack of 'repositories' file
Now:
[...]
a9eb172552348a9a49180694790b33a1097f546456d041b6e82e4d7716ddb721/
a9eb172552348a9a49180694790b33a1097f546456d041b6e82e4d7716ddb721/VERSION
a9eb172552348a9a49180694790b33a1097f546456d041b6e82e4d7716ddb721/json
a9eb172552348a9a49180694790b33a1097f546456d041b6e82e4d7716ddb721/layer.tar
repositories
# and the repositories file is correct for the single tagged
# image.
#> {"busybox":{"latest":"a9eb172552348a9a49180694790b33a1097f546456d041b6e82e4d7716ddb721"}}
and
docker save a9eb17255234 | tar t
Before:
[...]
a9eb17255234/
a9eb17255234/VERSION
a9eb17255234/json
a9eb17255234/layer.tar
# Note the truncated layer name
Now:
[...]
a9eb172552348a9a49180694790b33a1097f546456d041b6e82e4d7716ddb721/
a9eb172552348a9a49180694790b33a1097f546456d041b6e82e4d7716ddb721/VERSION
a9eb172552348a9a49180694790b33a1097f546456d041b6e82e4d7716ddb721/json
a9eb172552348a9a49180694790b33a1097f546456d041b6e82e4d7716ddb721/layer.tar
# There is no 'repositories' file, because there is no named repo
Docker-DCO-1.1-Signed-off-by: Vincent Batts <vbatts@redhat.com> (github: vbatts)
And also move it in to the `ADD` section, rather than being hidden in the `RUN` section.
Docker-DCO-1.1-Signed-off-by: Daniel Watkins <daniel@daniel-watkins.co.uk> (github: OddBloke)
An unbalanced single quote caused Fish to fail to load the completion file with `source: Error while reading file “/etc/fish/completions/docker.fish”`.
Docker-DCO-1.1-Signed-off-by: Andrew France <andrew@avito.co.uk> (github: Odaeus)
In that case /etc/resolv.conf will be generated with no search
option. Usage: --dns-search=.
Docker-DCO-1.1-Signed-off-by: Fabio Falci <fabiofalci@gmail.com> (github: fabiofalci)
The Docker btrfs graph driver does not interact well with SELinux at present.
If btrfs mounts the same file in several locations, the same SELinux label will
be applied to all mountpoints. In the context of the graph driver, things such
as shared libraries become inaccessible to containers due to SELInux, causing
all dynamically linked applications to fail when run in a container.
Consequently, error when we detect the daemon is being run with SELinux enabled
and the btrfs driver. Documentation has been added for this behavior.
Docker-DCO-1.1-Signed-off-by: Matthew Heon <mheon@redhat.com> (github: mheon)
It became slightly faster and lighter
possibly fixes#5923 problems
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
- Hover colours of doc nav wrong
- Primary Docs Nav not active when user is Logged in.
Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@docker.com> (github: SvenDowideit)
* Fixed some uses of docker v. Docker
* Formatting and line wrapping.
* Spelling errors and grammar fixes.
Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
* Replaced docker with Docker.
* Consistently used STDIN, STDOUT, STDERR.
* Consistently used TTY.
* Fixed some grammar and spelling issues.
* Fixed references to the index.
Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: jamtur01)
Docker-DCO-1.1-Signed-off-by: James Turnbull <james@lovedthanlost.net> (github: SvenDowideit)
Release notes for v.1.1 have been added to the docs index.md page. Made some revisions to
other content to make it shorter.
Docker-DCO-1.1-Signed-off-by: Fred Lifton <fred.lifton@docker.com> (github: fredlf)
This speeds up the tag cli integration tests by about 20 seconds.
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Initiates a pause before committing a container,
adds a pause option to the commit command, defaulting to 'true'.
Fixes bug: #6267
Fixes bug: #3675
Docker-DCO-1.1-Signed-off-by: Eric Windisch <ewindisch@docker.com> (github: ewindisch)
This lowers the test execution time by about 5 seconds.
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Also, add completion for "docker run -a" ("stdin", "stdout", and "stderr"), "docker run --env-file" (local filesystem), and some other minor code style tweaks.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
Port allocation status is stored in a global map: a port detected in use will remain as such for the lifetime of the daemon. Change the behavior to only mark as allocated ports which are claimed by Docker itself (which we can trust to properly remove from the allocation map once released). Ports allocated by other applications will always be retried to account for the eventually of the port having been released.
Docker-DCO-1.1-Signed-off-by: Arnaud Porterie <icecrime@gmail.com> (github: icecrime)
The -m flag permits the setting of a memory limit when running a Docker
container. The actual limit set must be a multiple of page size on Linux, so
whatever number the uses passes in will be rounded up if needed. Document this
behavior to prevent confusion. Also fixed several small formatting and grammar
issues in the docker run manpage.
Docker-DCO-1.1-Signed-off-by: Matthew Heon <mheon@redhat.com> (github: mheon)
It avoids hidden error when ports are redirected from
container to host using -p host_port:guest_port.
Docker-DCO-1.1-Signed-off-by: Jiří Župka <jzupka@redhat.com> (github: jzupka)
Additionally, this can be overridden by setting the TMPDIR variable,
like this was already the case for the generic `mkimage.sh` script.
As explained in #6456, the rationale to use `/var/tmp` instead of `/tmp`
is that `/tmp` is often a small tmpfs filesystem with more restricted
rights.
Docker-DCO-1.1-Signed-off-by: Vincent Bernat <vincent@bernat.im> (github: vincentbernat)
Update md2man script to generate manpages inside docs/man/ directory. Update
usage documentation in the readme to point to the new docs/man path. Update
Ubuntu makefile to use new path to manpages
Docker-DCO-1.1-Signed-off-by: Matthew Heon <mheon@redhat.com> (github: mheon)
We discussed this at the docker plumbers meetup and for tools and
working on the system for things like boot2docker and coreos this is
needed. You can already bypass this check so we felt it is ok to start
allowing this feature.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Without this line of code, if a volume is present in /proc/mounts,
it cannot be remounted with new mount options.
Docker-DCO-1.1-Signed-off-by: Peter Waller <p@pwaller.net> (github: pwaller)
Like in the other installation guides I added a simple test
to verify that importing images and starting containers is
working.
Docker-DCO-1.1-Signed-off-by: Christian Berendt <berendt@b1-systems.de> (github: berendt)
Docker's --sig-proxy option sends all signals but one to a container. The
exception s SIGCHLD, which is deliberately ignored as it doesn't make sense to
send such a signal to a process in a container. Documentation updates will make
this less confusing if anyone does attempt to do this.
Docker-DCO-1.1-Signed-off-by: Matt Heon <mheon@redhat.com> (github: mheon)
Add dm.blocksize option that you can use with --storage-opt to set a
specific blocksize for the thin provisioning pool.
Also change the default dm-thin-pool blocksize from 64K to 512K. This
strikes a balance between the desire to have smaller blocksize given
docker's use of snapshots versus the desire to have more performance
that comes with using a larger blocksize. But if very small files will
be used on average the user is encouraged to override this default.
Docker-DCO-1.1-Signed-off-by: Mike Snitzer <snitzer@redhat.com> (github: snitm)
Device Mapper needs device sizes in binary (1024) multiples. Otherwise
kernel checks can find that the specified thin-pool device sizes aren't
a multiple of the specified thin-pool blocksize.
The name for "RAMInBytes" is likely too narrow given the new consumers
but... Also add "tebibyte" support to RAMInBytes.
Docker-DCO-1.1-Signed-off-by: Mike Snitzer <snitzer@redhat.com> (github: snitm)
createPool() and reloadPool() should be consistent with the thin-pool
table params they use.
Since createPool() specifies '1 skip_block_zeroing' reloadPool() should
too. Otherwise, if the pool is reloaded (as is done when resizing
loopback devices) block zeroing will be enabled after the reload
completes.
Docker-DCO-1.1-Signed-off-by: Mike Snitzer <snitzer@redhat.com> (github: snitm)
This will allow us to _know_ what the user's -H settings are, which may
be useful for debugging later.
Docker-DCO-1.1-Signed-off-by: Sven Dowideit <SvenDowideit@fosiki.com> (github: SvenDowideit)
TestServerListOrderedImagesByCreationDateAndTag was redundant and broken
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
not everything that is indented is a commandline example
Closes#6591
Docker-DCO-1.1-Signed-off-by: SvenDowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
The docker ps command displays the user-entered command running in a container.
If that command contained \n, \t, or other control characters, they were
interpreted literally, and newlines and tabs would be printed in the output.
Escape the command string to make things more readable.
Docker-DCO-1.1-Signed-off-by: Matt Heon <mheon@redhat.com> (github: mheon)
This fixes a code block typo so it renders as a code block. Additionally synchronizes the variable prefix examples from 'DB' and 'DB1_' to 'DB_' and 'DB1_'
It's not necessary to use the netgo implementation for non-static builds. :)
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
This patch adds CLI integration tests to ensure that NOCACHE instructions
in Dockerfiles only apply to direct children of the original image.
Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)
This patch fixes the bug where ONBUILD triggers are committed each build
step created during the ONBUILD trigger execution, since the triggers are
only wiped *after* all ONBUILD trigger steps have been committed. This was
fixed by simply copying the ONBUILD triggers and wiping the config
*before* committing anything.
Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)
ZSH completion scripts aren't supposed to be executable - they're sourced by ZSH and aren't run directly.
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
This patch updates container.getResourcePath and container.getRootResourcePath
to return the error from symlink.FollowSymlinkInScope (rather than using utils).
Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)
Remove Inject to help rebase
Docker-DCO-1.1-Signed-off-by: Tibor Vass <teabee89@gmail.com> (github: tiborvass)
Docker-DCO-1.1-Signed-off-by: cyphar <cyphar@cyphar.com> (github: tiborvass)
Fixes#6506
There is the bug, that very hard to fix: When we return job.Errorf in
"logs" job it writes to job.Stderr, to which connected ResponseWriter and on
this write w.WriteHeader(http.StatusOK) is called. So, we get 200 on error
from "logs" job.
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
The chan struct used to forward signals to containers was one element only,
which caused some signals to be dropped when many were being received.
Increasing the size of the chan buffer makes this much less likely to happen.
Docker-DCO-1.1-Signed-off-by: Matt Heon <mheon@redhat.com> (github: mheon)
At the moment maintainers responsibility are spelled out with a hybrid
list. I.e. an unordered list with an associated number.
In this commit I the number list proper is used.
Docker-DCO-1.1-Signed-off-by: Daan van Berkel <daan.v.berkel.1980@email.com> (github: dvberkel)
The JSONMessage.Display methods erases the entire line by outputting the <ESC>[2K\r sequence before displaying the message content. This is not necessary for messages other than progress indicators, and introduces unwanted characters in the /events output.
Fixes#6203.
Docker-DCO-1.1-Signed-off-by: Arnaud Porterie <icecrime@gmail.com> (github: icecrime)
Events subscription (/events API endpoint) attributes pseudo-unique identifiers to incoming subscribers: originally its host, then its subscription time. This is unecessary and leads to code complexity.
Introduce a JSONMessagePublisher to provide simple pub/sub mechanism for JSONMessage, and rely on this new type to publish events to all subscribed listeners. The original logic is kept for the 'since' and 'until' parameters, and for client disconnection handling.
Docker-DCO-1.1-Signed-off-by: Arnaud Porterie <icecrime@gmail.com> (github: icecrime)
Added section to show how to get IP address and view running python app if the user is using boot2docker on OSX
Docker-DCO-1.1-Signed-off-by: Richard Harvey <richard@squarecows.com> (github: richarvey)
Docker-DCO-1.1-Signed-off-by: Richard Harvey <richard@squarecows.com> (github: SvenDowideit)
Closes issue #5036
This commit redirects the reader to top level doc upon clicking
on a main nav. menu item (eg. Installation [click] -> Mac OS X)
Docker-DCO-1.1-Signed-off-by: O.S. Tezer <ostezer@gmail.com> (github: ostezer)
as a maintainer.
Best of luck on your e-commerce business Guillaume, and thanks for all
the great contributions!
Docker-DCO-1.1-Signed-off-by: Solomon Hykes <solomon@docker.com> (github: shykes)
Sometimes third attacher attaching to already stopped container.
Also I've changed prefix to attach and fixed cleanup on Fatal.
Docker-DCO-1.1-Signed-off-by: Alexandr Morozov <lk4d4math@gmail.com> (github: LK4D4)
This lets you specify custom client TLS certificates and CA root for a
specific registry hostname. Docker will then verify the registry
against the CA and present the client cert when talking to that
registry. This allows the registry to verify that the client has a
proper key, indicating that the client is allowed to access the
images.
A custom cert is configured by creating a directory in
/etc/docker/certs.d with the same name as the registry hostname. Inside
this directory all *.crt files are added as CA Roots (if none exists,
the system default is used) and pair of files <filename>.key and
<filename>.cert indicate a custom certificate to present to the registry.
If there are multiple certificates each one will be tried in
alphabetical order, proceeding to the next if we get a 403 of 5xx
response.
So, an example setup would be:
/etc/docker/certs.d/
└── localhost
├── client.cert
├── client.key
└── localhost.crt
A simple way to test this setup is to use an apache server to host a
registry. Just copy a registry tree into the apache root, here is an
example one containing the busybox image:
http://people.gnome.org/~alexl/v1.tar.gz
Then add this conf file as /etc/httpd/conf.d/registry.conf:
# This must be in the root context, otherwise it causes a re-negotiation
# which is not supported by the tls implementation in go
SSLVerifyClient optional_no_ca
<Location /v1>
Action cert-protected /cgi-bin/cert.cgi
SetHandler cert-protected
Header set x-docker-registry-version "0.6.2"
SetEnvIf Host (.*) custom_host=$1
Header set X-Docker-Endpoints "%{custom_host}e"
</Location>
And this as /var/www/cgi-bin/cert.cgi
#!/bin/bash
if [ "$HTTPS" != "on" ]; then
echo "Status: 403 Not using SSL"
echo "x-docker-registry-version: 0.6.2"
echo
exit 0
fi
if [ "$SSL_CLIENT_VERIFY" == "NONE" ]; then
echo "Status: 403 Client certificate invalid"
echo "x-docker-registry-version: 0.6.2"
echo
exit 0
fi
echo "Content-length: $(stat --printf='%s' $PATH_TRANSLATED)"
echo "x-docker-registry-version: 0.6.2"
echo "X-Docker-Endpoints: $SERVER_NAME"
echo "X-Docker-Size: 0"
echo
cat $PATH_TRANSLATED
This will return 403 for all accessed to /v1 unless *any* client cert
is presented. Obviously a real implementation would verify more details
about the certificate.
Example client certs can be generated with:
openssl genrsa -out client.key 1024
openssl req -new -x509 -text -key client.key -out client.cert
Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Currently the docs just say "let's go into the container and look at the
env vars", but doesn't show how to do it. It is also not currently
possible to enter the container as it is written in the doc
( container started with app.py and then somehow later on we have a
shell in the same container )
Docker-DCO-1.1-Signed-off-by: Brian Goff <cpuguy83@gmail.com> (github: cpuguy83)
would occasionally be returned in the incorrect order if sequential
layers had the same created time.
Docker-DCO-1.1-Signed-off-by: Bryan Murphy <bmurphy1976@gmail.com> (github: bmurphy1976)
The mention of NAT is confusing for those coming from pre-host-only networking b2d
Docker-DCO-1.1-Signed-off-by: SvenDowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
Its tricked a number of readers, as its not a TOC, its just local to the
current topic. Now that the docs are not mobile responsive its not an
active UI element either.
Docker-DCO-1.1-Signed-off-by: SvenDowideit <SvenDowideit@home.org.au> (github: SvenDowideit)
These constants don't need to use time.Duration(). Fixup this file since
it seems to be the only one using this style.
Docker-DCO-1.1-Signed-off-by: Brandon Philips <brandon.philips@coreos.com> (github: philips)
We use the start-stop-daemon pid creation mechanism in addition the intrinsic built into docker. This means the pid file is guaranteed to be written out by the time the script exits.
See #6184.
Docker-DCO-1.1-Signed-off-by: Joe Beda <joe.github@bedafamily.com> (github: jbeda)
FreeBSD doesn't have "bind" mount, but nullfs might be a similar feature.
However nullfs can mount only directories.
Docker-DCO-1.1-Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> (github: kzys)
# This should match the version in the Dockerfile.
- 1.3.1
# Test against older versions too, just for a little extra retrocompat.
- 1.2
# Let us have pretty experimental Docker-based Travis workers.
# (These spin up much faster than the VM-based ones.)
sudo:false
# Disable the normal go build.
install:true
install:
- export DOCKER_BUILDTAGS='exclude_graphdriver_btrfs exclude_graphdriver_devicemapper'# btrfs and devicemapper fail to compile thanks to a couple missing headers (which we can't install thanks to "sudo: false")
+ Make /etc/hosts /etc/resolv.conf and /etc/hostname editable at runtime
+ Auto-restart containers using policies
+ Use /var/lib/docker/tmp for large temporary files
+ `--cap-add` and `--cap-drop` to tweak what linux capability you want
+ `--device` to use devices in containers
#### Client
+ `docker search` on private registries
+ Add `exited` filter to `docker ps --filter`
*`docker rm -f` now kills instead of stop
+ Support for IPv6 addresses in `--dns` flag
#### Proxy
+ Proxy instances in separate processes
* Small bug fix on UDP proxy
## 1.1.2 (2014-07-23)
#### Runtime
+ Fix port allocation for existing containers
+ Fix containers restart on daemon restart
#### Packaging
+ Fix /etc/init.d/docker issue on Debian
## 1.1.1 (2014-07-09)
#### Builder
* Fix issue with ADD
## 1.1.0 (2014-07-03)
#### Notable features since 1.0.1
+ Add `.dockerignore` support
+ Pause containers during `docker commit`
+ Add `--tail` to `docker logs`
#### Builder
+ Allow a tar file as context for `docker build`
* Fix issue with white-spaces and multi-lines in `Dockerfiles`
#### Runtime
* Overall performance improvements
* Allow `/` as source of `docker run -v`
* Fix port allocation
* Fix bug in `docker save`
* Add links information to `docker inspect`
#### Client
* Improve command line parsing for `docker commit`
#### Remote API
* Improve status code for the `start` and `stop` endpoints
## 1.0.1 (2014-06-19)
#### Notable features since 1.0.0
* Enhance security for the LXC driver
#### Builder
* Fix `ONBUILD` instruction passed to grandchildren
#### Runtime
* Fix events subscription
* Fix /etc/hostname file with host networking
* Allow `-h` and `--net=none`
* Fix issue with hotplug devices in `--privileged`
#### Client
* Fix artifacts with events
* Fix a panic with empty flags
* Fix `docker cp` on Mac OS X
#### Miscellaneous
* Fix compilation on Mac OS X
* Fix several races
## 1.0.0 (2014-06-09)
#### Notable features since 0.12.0
* Production support
## 0.12.0 (2014-06-05)
#### Notable features since 0.11.0
* 40+ various improvements to stability, performance and usability
* New `COPY` Dockerfile instruction to allow copying a local file from the context into the container without ever extracting if the file is a tar file
* Inherit file permissions from the host on `ADD`
* New `pause` and `unpause` commands to allow pausing and unpausing of containers using cgroup freezer
@@ -246,7 +332,7 @@
- Add newlines to the JSON stream functions.
#### Runtime
* Do not ping the registry from the CLI. All requests to registres flow through the daemon.
* Do not ping the registry from the CLI. All requests to registries flow through the daemon.
- Check for nil information return in the lxc driver. This fixes panics with older lxc versions.
- Devicemapper: cleanups and fix for unmount. Fixes two problems which were causing unmount to fail intermittently.
- Devicemapper: remove directory when removing device. Directories don't get left behind when removing the device.
@@ -838,7 +924,7 @@ With the ongoing changes to the networking and execution subsystems of docker te
+ Add domainname support
+ Implement image filtering with path.Match
* Remove unnecesasry warnings
* Remove unnecessary warnings
* Remove os/user dependency
* Only mount the hostname file when the config exists
* Handle signals within the `docker login` command
@@ -861,7 +947,7 @@ With the ongoing changes to the networking and execution subsystems of docker te
+ Hack: Vendor all dependencies
* Remote API: Bump to v1.5
* Packaging: Break down hack/make.sh into small scripts, one per 'bundle': test, binary, ubuntu etc.
* Documentation: General improvments
* Documentation: General improvements
## 0.6.1 (2013-08-23)
@@ -1131,7 +1217,7 @@ With the ongoing changes to the networking and execution subsystems of docker te
* Prevent rm of running containers
* Use go1.1 cookiejar
- Fix issue detaching from running TTY container
- Forbid parralel push/pull for a single image/repo. Fixes #311
- Forbid parallel push/pull for a single image/repo. Fixes #311
- Fix race condition within Run command when attaching.
#### Client
@@ -1247,7 +1333,7 @@ With the ongoing changes to the networking and execution subsystems of docker te
+ Add caching to docker builder
+ Add support for docker builder with native API as top level command
+ Implement ENV within docker builder
- Check the command existance prior create and add Unit tests for the case
- Check the command existence prior create and add Unit tests for the case
* use any whitespaces instead of tabs
#### Runtime
@@ -1286,13 +1372,13 @@ With the ongoing changes to the networking and execution subsystems of docker te
#### Runtime
- Fix the command existance check
- Fix the command existence check
- strings.Split may return an empty string on no match
- Fix an index out of range crash if cgroup memory is not
#### Documentation
* Various improvments
* Various improvements
+ New example: sharing data between 2 couchdb databases
#### Other
@@ -1322,7 +1408,7 @@ With the ongoing changes to the networking and execution subsystems of docker te
## 0.2.0 (2013-04-23)
- Runtime: ghost containers can be killed and waited for
* Documentation: update install intructions
* Documentation: update install instructions
- Packaging: fix Vagrantfile
- Development: automate releasing binaries and ubuntu packages
// 'docker login': login / register a user to registry service.
func(cli*DockerCli)CmdLogin(args...string)error{
cmd:=cli.Subcmd("login","[OPTIONS] [SERVER]","Register or Login to a docker registry server, if no server is specified \""+registry.IndexServerAddress()+"\" is the default.")
cmd:=cli.Subcmd("login","[OPTIONS] [SERVER]","Register or login to a Docker registry server, if no server is specified \""+registry.IndexServerAddress()+"\" is the default.")
cmd:=cli.Subcmd("restart","[OPTIONS] CONTAINER [CONTAINER...]","Restart a running container")
nSeconds:=cmd.Int([]string{"t","-time"},10,"Number of seconds to try to stop for before killing the container. Once killed it will then be restarted. Default=10")
nSeconds:=cmd.Int([]string{"t","-time"},10,"Number of seconds to try to stop for before killing the container. Once killed it will then be restarted. Default is 10 seconds.")
flAuthor:=cmd.String([]string{"a","#author","-author"},"","Author (eg. \"John Hannibal Smith <hannibal@a-team.com>\"")
flAuthor:=cmd.String([]string{"a","#author","-author"},"","Author (e.g., \"John Hannibal Smith <hannibal@a-team.com>\")")
// FIXME: --run is deprecated, it will be replaced with inline Dockerfile commands.
flConfig:=cmd.String([]string{"#run","#-run"},"","this option is deprecated and will be removed in a future version in favor of inline Dockerfile-compatible commands")
flConfig:=cmd.String([]string{"#run","#-run"},"","This option is deprecated and will be removed in a future version in favor of inline Dockerfile-compatible commands")
cmd=cli.Subcmd("attach","[OPTIONS] CONTAINER","Attach to a running container")
noStdin=cmd.Bool([]string{"#nostdin","-no-stdin"},false,"Do not attach stdin")
proxy=cmd.Bool([]string{"#sig-proxy","-sig-proxy"},true,"Proxify all received signal to the process (even in non-tty mode)")
noStdin=cmd.Bool([]string{"#nostdin","-no-stdin"},false,"Do not attach STDIN")
proxy=cmd.Bool([]string{"#sig-proxy","-sig-proxy"},true,"Proxy all received signals to the process (even in non-TTY mode). SIGCHLD, SIGKILL, and SIGSTOP are not proxied.")
config,hostConfig,cmd,err:=runconfig.ParseSubcommand(cli.Subcmd("run","[OPTIONS] IMAGE [COMMAND] [ARG...]","Run a command in a new container"),args,nil)
@@ -105,7 +106,7 @@ func (cli *DockerCli) call(method, path string, data interface{}, passAuthInfo b
iflen(body)==0{
returnnil,resp.StatusCode,fmt.Errorf("Error: request returned %s for API route and version %s, check if the server supports the requested API version",http.StatusText(resp.StatusCode),req.URL)
@@ -79,13 +79,13 @@ complete -c docker -A -f -n '__fish_seen_subcommand_from build' -s t -l tag -d '
# commit
complete-c docker -f-n'__fish_docker_no_subcommand'-a commit -d"Create a new image from a container's changes"
complete-c docker -A-f-n'__fish_seen_subcommand_from commit'-s a -l author -d'Author (eg. "John Hannibal Smith <hannibal@a-team.com>"'
complete-c docker -A-f-n'__fish_seen_subcommand_from commit'-s a -l author -d'Author (e.g., "John Hannibal Smith <hannibal@a-team.com>"'
complete-c docker -A-f-n'__fish_seen_subcommand_from commit'-s m -l message -d'Commit message'
complete-c docker -A-f-n'__fish_seen_subcommand_from commit'-l run -d'Config automatically applied when the image is run. (ex: -run=\'{"Cmd": ["cat", "/world"], "PortSpecs": ["22"]}\')'
complete -c docker -A -f -n '__fish_seen_subcommand_from commit' -a '(__fish_print_docker_containers all)' -d "Container"
# cp
complete -c docker -f -n '__fish_docker_no_subcommand' -a cp -d 'Copy files/folders from the containers filesystem to the host path'
complete -c docker -f -n '__fish_docker_no_subcommand' -a cp -d "Copy files/folders from a container's filesystem to the host path"
# diff
complete -c docker -f -n '__fish_docker_no_subcommand' -a diff -d "Inspect changes on a container's filesystem"
@@ -120,10 +120,6 @@ complete -c docker -f -n '__fish_docker_no_subcommand' -a import -d 'Create a ne
# info
complete -c docker -f -n '__fish_docker_no_subcommand' -a info -d 'Display system-wide information'
# insert
complete -c docker -f -n '__fish_docker_no_subcommand' -a insert -d 'Insert a file in an image'
complete -c docker -A -f -n '__fish_seen_subcommand_from insert' -a '(__fish_print_docker_images)' -d "Image"
# inspect
complete -c docker -f -n '__fish_docker_no_subcommand' -a inspect -d 'Return low-level information on a container'
complete -c docker -A -f -n '__fish_seen_subcommand_from inspect' -s f -l format -d 'Format the output using the given go template.'
If you \fBdocker run\fR a container in detached mode (\fB-d\fR), you can reattach to the detached container with \fBdocker attach\fR using the container's ID or name.
.sp
You can detach from the container again (and leave it running) with CTRL-c (for a quiet exit) or CTRL-\ to get a stacktrace of the Docker client when it quits. When you detach from the container the exit code will be returned to the client.
.SH"OPTIONS"
.TP
.B--no-stdin=\fItrue\fR|\fIfalse\fR:
When set to true, do not attach to stdin. The default is \fIfalse\fR.
.TP
.B--sig-proxy=\fItrue\fR|\fIfalse\fR:
When set to true, proxify all received signal to the process (even in non-tty mode). The default is \fItrue\fR.
.sp
.SHEXAMPLES
.sp
.PP
.BAttachingtoacontainer
.TP
In this example the top command is run inside a container, from an image called fedora, in detached mode. The ID from the container is passed into the \fBdocker attach\fR command:
.sp
.nf
.RS
# ID=$(sudo docker run -d fedora /usr/bin/top -b)
# sudo docker attach $ID
top - 02:05:52 up 3:05, 0 users, load average: 0.01, 0.02, 0.05
docker-build \- Build an image from a Dockerfile source at PATH
.SHSYNOPSIS
.Bdockerbuild
[\fB--no-cache\fR[=\fIfalse\fR]
[\fB-q\fR|\fB--quiet\fR[=\fIfalse\fR]
[\fB--rm\fR[=\fitrue\fR]]
[\fB-t\fR|\fB--tag\fR=\fItag\fR]
PATH | URL | -
.SHDESCRIPTION
This will read the Dockerfile from the directory specified in \fBPATH\fR. It also sends any other files and directories found in the current directory to the Docker daemon. The contents of this directory would be used by ADD command found within the Dockerfile.
Warning, this will send a lot of data to the Docker daemon if the current directory contains a lot of data.
If the absolute path is provided instead of ‘.’, only the files and directories required by the ADD commands from the Dockerfile will be added to the context and transferred to the Docker daemon.
.sp
When a single Dockerfile is given as URL, then no context is set. When a Git repository is set as URL, the repository is used as context.
.SH"OPTIONS"
.TP
.B-q,--quiet=\fItrue\fR|\fIfalse\fR:
When set to true, suppress verbose build output. Default is \fIfalse\fR.
.TP
.B--rm=\fItrue\fr|\fIfalse\fR:
When true, remove intermediate containers that are created during the build process. The default is true.
.TP
.B-t,--tag=\fItag\fR:
Tag to be applied to the resulting image on successful completion of the build.
.TP
.B--no-cache=\fItrue\fR|\fIfalse\fR
When set to true, do not use a cache when building the image. The default is \fIfalse\fR.
.sp
.SHEXAMPLES
.sp
.sp
.BBuildinganimagefromcurrentdirectory
.TP
USing a Dockerfile, Docker images are built using the build command:
.sp
.RS
docker build .
.RE
.sp
If, for some reasone, you do not what to remove the intermediate containers created during the build you must set--rm=false.
.sp
.RS
docker build --rm=false .
.sp
.RE
.sp
A good practice is to make a subdirectory with a related name and create the Dockerfile in that directory. E.g. a directory called mongo may contain a Dockerfile for a MongoDB image, or a directory called httpd may contain an Dockerfile for an Apache web server.
.sp
It is also good practice to add the files required for the image to the subdirectory. These files will be then specified with the `ADD` instruction in the Dockerfile. Note: if you include a tar file, which is good practice, then Docker will automatically extract the contents of the tar file specified in the `ADD` instruction into the specified target.
.sp
.BBuildinganimagecontainerusingaURL
.TP
This will clone the Github repository and use it as context. The Dockerfile at the root of the repository is used as Dockerfile. This only works if the Github repository is a dedicated repository. Note that you can specify an arbitrary Git repository by using the ‘git://’ schema.
docker-images \- List the images in the local repository
.SHSYNOPSIS
.Bdockerimages
[\fB-a\fR|\fB--all\fR=\fIfalse\fR]
[\fB--no-trunc\fR[=\fIfalse\fR]
[\fB-q\fR|\fB--quiet\fR[=\fIfalse\fR]
[\fB-t\fR|\fB--tree\fR=\fIfalse\fR]
[\fB-v\fR|\fB--viz\fR=\fIfalse\fR]
[NAME]
.SHDESCRIPTION
This command lists the images stored in the local Docker repository.
.sp
By default, intermediate images, used during builds, are not listed. Some of the output, e.g. image ID, is truncated, for space reasons. However the truncated image ID, and often the first few characters, are enough to be used in other Docker commands that use the image ID. The output includes repository, tag, image ID, date created and the virtual size.
.sp
The title REPOSITORY for the first title may seem confusing. It is essentially the image name. However, because you can tag a specific image, and multiple tags (image instances) can be associated with a single name, the name is really a repository for all tagged images of the same name.
.SH"OPTIONS"
.TP
.B-a,--all=\fItrue\fR|\fIfalse\fR:
When set to true, also include all intermediate images in the list. The default is false.
.TP
.B--no-trunc=\fItrue\fR|\fIfalse\fR:
When set to true, list the full image ID and not the truncated ID. The default is false.
.TP
.B-q,--quiet=\fItrue\fR|\fIfalse\fR:
When set to true, list the complete image ID as part of the output. The default is false.
.TP
.B-t,--tree=\fItrue\fR|\fIfalse\fR:
When set to true, list the images in a tree dependency tree (hierarchy) format. The default is false.
.TP
.B-v,--viz=\fItrue\fR|\fIfalse\fR
When set to true, list the graph in graphviz format. The default is \fIfalse\fR.
.sp
.SHEXAMPLES
.sp
.BListingtheimages
.TP
To list the images in a local repository (not the registry) run:
.sp
.RS
docker images
.RE
.sp
The list will contain the image repository name, a tag for the image, and an image ID, when it was created and its virtual size. Columns: REPOSITORY, TAG, IMAGE ID, CREATED, and VIRTUAL SIZE.
.sp
To get a verbose list of images which contains all the intermediate images used in builds use \fB-a\fR:
.sp
.RS
docker images -a
.RE
.sp
.BListimagesdependencytreehierarchy
.TP
To list the images in the local repository (not the registry) in a dependency tree format then use the \fB-t\fR|\fB--tree=true\fR option.
.sp
.RS
docker images -t
.RE
.sp
This displays a staggered hierarchy tree where the less indented image is the oldest with dependent image layers branching inward (to the right) on subsequent lines. The newest or top level image layer is listed last in any tree branch.
.sp
.BListimagesinGraphVizformat
.TP
To display the list in a format consumable by a GraphViz tools run with \fB-v\fR|\fB--viz=true\fR. For example to produce a .png graph file of the hierarchy use:
.sp
.RS
docker images --viz | dot -Tpng -o docker.png
.sp
.RE
.sp
.BListingonlytheshortenedimageIDs
.TP
Listing just the shortened image IDs. This can be useful for some automated tools.
.sp
.RS
docker images -q
.RE
.sp
.SHHISTORY
April 2014, Originally compiled by William Henry (whenry at redhat dot com) based on dockier.io source material and internal work.
This command displays system wide information regarding the Docker installation. Information displayed includes the number of containers and images, pool name, data file, metadata file, data space used, total data space, metadata space used, total metadata space, execution driver, and the kernel version.
.sp
The data file is where the images are stored and the metadata file is where the meta data regarding those images are stored. When run for the first time Docker allocates a certain amount of data space and meta data space from the space available on the volume where /var/lib/docker is mounted.
.SH"OPTIONS"
There are no available options.
.sp
.SHEXAMPLES
.sp
.BDisplayDockersysteminformation
.TP
Here is a sample output:
.sp
.RS
# docker info
Containers: 18
Images: 95
Storage Driver: devicemapper
Pool Name: docker-8:1-170408448-pool
Data file: /var/lib/docker/devicemapper/devicemapper/data
docker-inspect \- Return low-level information on a container/image
.SHSYNOPSIS
.Bdockerinspect
[\fB-f\fR|\fB--format\fR=""
CONTAINER|IMAGE [CONTAINER|IMAGE...]
.SHDESCRIPTION
This displays all the information available in Docker for a given container or image. By default, this will render all results in a JSON array. If a format is specified, the given template will be executed for each result.
.SH"OPTIONS"
.TP
.B-f,--format="":
The text/template package of Go describes all the details of the format. See examples section
.SHEXAMPLES
.sp
.PP
.BGettinginformationonacontainer
.TP
To get information on a container use it's ID or instance name
This will remove one or more containers from the host node. The container name or ID can be used. This does not remove images. You cannot remove a running container unless you use the \fB-f\fR option. To see all containers on a host use the \fBdocker ps -a\fR command.
.SH"OPTIONS"
.TP
.B-f,--force=\fItrue\fR|\fIfalse\fR:
When set to true, force the removal of the container. The default is \fIfalse\fR.
.TP
.B-l,--link=\fItrue\fR|\fIfalse\fR:
When set to true, remove the specified link and not the underlying container. The default is \fIfalse\fR.
.TP
.B-v,--volumes=\fItrue\fR|\fIfalse\fR:
When set to true, remove the volumes associated to the container. The default is \fIfalse\fR.
.SHEXAMPLES
.sp
.PP
.BRemovingacontainerusingitsID
.TP
To remove a container using its ID, find either from a \fBdocker ps -a\fR command, or use the ID returned from the \fBdocker run\fR command, or retrieve it from a file used to store it using the \fBdocker run --cidfile\fR:
.sp
.RS
docker rm abebf7571666
.RE
.sp
.BRemovingacontainerusingthecontainername:
.TP
The name of the container can be found using the \fBdocker ps -a\fR command. The use that name as follows:
.sp
.RS
docker rm hopeful_morse
.RE
.sp
.SHHISTORY
March 2014, Originally compiled by William Henry (whenry at redhat dot com) based on dockier.io source material and internal work.
`docker rm` will remove one or more containers from the host node. The container name or ID can be used. This does not remove images. You cannot remove a running container unless you use the \fB-f\fR option. To see all containers on a host use the `docker ps -a` command.
OPTIONS
-------
`-f`, `--force`=*true*|*false*:
When set to true, force the removal of the container. The default is *false*.
`-l`, `--link`=*true*|*false*:
When set to true, remove the specified link and not the underlying container. The default is *false*.
`-v`, `--volumes`=*true*|*false*:
When set to true, remove the volumes associated to the container. The default is *false*.
EXAMPLES
--------
##Removing a container using its ID##
To remove a container using its ID, find either from a `docker ps -a` command, or use the ID returned from the `docker run` command, or retrieve it from a file used to store it using the `docker run --cidfile`:
docker rm abebf7571666
##Removing a container using the container name##
The name of the container can be found using the \fBdocker ps -a\fR command. The use that name as follows:
docker rm hopeful_morse
HISTORY
-------
April 2014, Originally compiled by William Henry (whenry at redhat dot com) based on dockier.io source material and internal work.
This will remove one or more images from the host node. This does not remove images from a registry. You cannot remove an image of a running container unless you use the \fB-f\fR option. To see all images on a host use the \fBdocker images\fR command.
.SH"OPTIONS"
.TP
.B-f,--force=\fItrue\fR|\fIfalse\fR:
When set to true, force the removal of the image. The default is \fIfalse\fR.
.SHEXAMPLES
.sp
.PP
.BRemovinganimage
.TP
Here is an example of removing and image:
.sp
.RS
docker rmi fedora/httpd
.RE
.sp
.SHHISTORY
March 2014, Originally compiled by William Henry (whenry at redhat dot com) based on dockier.io source material and internal work.
Run a process in a new container. \fBdocker run\fR starts a process with its own file system, its own networking, and its own isolated process tree. The \fIIMAGE\fR which starts the process may define defaults related to the process that will be run in the container, the networking to expose, and more, but \fBdocker run\fR gives final control to the operator or administrator who starts the container from the image. For that reason \fBdocker run\fR has more options than any other docker command.
If the \fIIMAGE\fR is not already loaded then \fBdocker run\fR will pull the \fIIMAGE\fR, and all image dependencies, from the repository in the same way running \fBdocker pull\fR\fIIMAGE\fR, before it starts the container from that image.
Attach to stdin, stdout or stderr. In foreground mode (the default when -d is not specified), \fBdocker run\fR can start the process in the container and attach the console to the process’s standard input, output, and standard error. It can even pretend to be a TTY (this is what most commandline executables expect) and pass along signals. The \fB-a\fR option can be set for each of stdin, stdout, and stderr.
.TP
.B-c,--cpu-shares=0:
CPU shares in relative weight. You can increase the priority of a container with the -c option. By default, all containers run at the same priority and get the same proportion of CPU cycles, but you can tell the kernel to give more shares of CPU time to one or more containers when you start them via \fBdocker run\fR.
.TP
.B-m,--memory=\fImemory-limit\fR:
Allows you to constrain the memory available to a container. If the host supports swap memory, then the -m memory setting can be larger than physical RAM. If a limit of 0 is specified, the container's memory is not limited. The memory limit format: <number><optional unit>, where unit = b, k, m or g.
.TP
.B--cidfile=\fIfile\fR:
Write the container ID to the file specified.
.TP
.B-d,--detach=\fItrue\fR|\fIfalse\fR:
Detached mode. This runs the container in the background. It outputs the new container's id and and error messages. At any time you can run \fBdocker ps\fR in the other shell to view a list of the running containers. You can reattach to a detached container with \fBdocker attach\fR. If you choose to run a container in the detached mode, then you cannot use the -rm option.
.TP
.B--dns=\fIIP-address\fR:
Set custom DNS servers. This option can be used to override the DNS configuration passed to the container. Typically this is necessary when the host DNS configuration is invalid for the container (eg. 127.0.0.1). When this is the case the \fB-dns\fR flags is necessary for every run.
.TP
.B-e,--env=\fIenvironment\fR:
Set environment variables. This option allows you to specify arbitrary environment variables that are available for the process that will be launched inside of the container.
.TP
.B--entrypoint=\ficommand\fR:
This option allows you to overwrite the default entrypoint of the image that is set in the Dockerfile. The ENTRYPOINT of an image is similar to a COMMAND because it specifies what executable to run when the container starts, but it is (purposely) more difficult to override. The ENTRYPOINT gives a container its default nature or behavior, so that when you set an ENTRYPOINT you can run the container as if it were that binary, complete with default options, and you can pass in more options via the COMMAND. But, sometimes an operator may want to run something else inside the container, so you can override the default ENTRYPOINT at runtime by using a \fB--entrypoint\fR and a string to specify the new ENTRYPOINT.
.TP
.B--expose=\fIport\fR:
Expose a port from the container without publishing it to your host. A containers port can be exposed to other containers in three ways: 1) The developer can expose the port using the EXPOSE parameter of the Dockerfile, 2) the operator can use the \fB--expose\fR option with \fBdocker run\fR, or 3) the container can be started with the \fB--link\fR.
.TP
.B-P,--publish-all=\fItrue\fR|\fIfalse\fR:
When set to true publish all exposed ports to the host interfaces. The default is false. If the operator uses -P (or -p) then Docker will make the exposed port accessible on the host and the ports will be available to any client that can reach the host. To find the map between the host ports and the exposed ports, use \fBdocker port\fR.
.TP
.B-p,--publish=[]:
Publish a container's port to the host (format: ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort) (use 'docker port' to see the actual mapping)
.TP
.B-h,--hostname=\fIhostname\fR:
Sets the container host name that is available inside the container.
.TP
.B-i,--interactive=\fItrue\fR|\fIfalse\fR:
When set to true, keep stdin open even if not attached. The default is false.
.TP
.B--link=\fIname\fR:\fIalias\fR:
Add link to another container. The format is name:alias. If the operator uses \fB--link\fR when starting the new client container, then the client container can access the exposed port via a private networking interface. Docker will set some environment variables in the client container to help indicate which interface and port to use.
.TP
.B-n,--networking=\fItrue\fR|\fIfalse\fR:
By default, all containers have networking enabled (true) and can make outgoing connections. The operator can disable networking with \fB--networking\fR to false. This disables all incoming and outgoing networking. In cases like this, I/O can only be performed through files or by using STDIN/STDOUT.
Also by default, the container will use the same DNS servers as the host. but you canThe operator may override this with \fB-dns\fR.
.TP
.B--name=\fIname\fR:
Assign a name to the container. The operator can identify a container in three ways:
.sp
.nf
UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”)
UUID short identifier (“f78375b1c487”)
Name (“jonah”)
.fi
.sp
The UUID identifiers come from the Docker daemon, and if a name is not assigned to the container with \fB--name\fR then the daemon will also generate a random string name. The name is useful when defining links (see \fB--link\fR) (or any other place you need to identify a container). This works for both background and foreground Docker containers.
.TP
.B--privileged=\fItrue\fR|\fIfalse\fR:
Give extended privileges to this container. By default, Docker containers are “unprivileged” (=false) and cannot, for example, run a Docker daemon inside the Docker container. This is because by default a container is not allowed to access any devices. A “privileged” container is given access to all devices.
When the operator executes \fBdocker run -privileged\fR, Docker will enable access to all devices on the host as well as set some configuration in AppArmor (\fB???\fR) to allow the container nearly all the same access to the host as processes running outside of a container on the host.
.TP
.B--rm=\fItrue\fR|\fIfalse\fR:
If set to \fItrue\fR the container is automatically removed when it exits. The default is \fIfalse\fR. This option is incompatible with \fB-d\fR.
.TP
.B--sig-proxy=\fItrue\fR|\fIfalse\fR:
When set to true, proxify all received signals to the process (even in non-tty mode). The default is true.
.TP
.B-t,--tty=\fItrue\fR|\fIfalse\fR:
When set to true Docker can allocate a pseudo-tty and attach to the standard input of any container. This can be used, for example, to run a throwaway interactive shell. The default is value is false.
.TP
.B-u,--user=\fIusername\fR,\fRuid\fR:
Set a username or UID for the container.
.TP
.B-v,--volume=\fIvolume\fR:
Bind mount a volume to the container. The \fB-v\fR option can be used one or more times to add one or more mounts to a container. These mounts can then be used in other containers using the \fB--volumes-from\fR option. See examples.
.TP
.B--volumes-from=\fIcontainer-id\fR:
Will mount volumes from the specified container identified by container-id. Once a volume is mounted in a one container it can be shared with other containers using the \fB--volumes-from\fR option when running those other containers. The volumes can be shared even if the original container with the mount is not running.
.TP
.B-w,--workdir=\fIdirectory\fR:
Working directory inside the container. The default working directory for running binaries within a container is the root directory (/). The developer can set a different default with the Dockerfile WORKDIR instruction. The operator can override the working directory by using the \fB-w\fR option.
.TP
.BIMAGE:
The image name or ID.
.TP
.BCOMMAND:
The command or program to run inside the image.
.TP
.BARG:
The arguments for the command to be run in the container.
If you want messages that are logged in your container to show up in the host's syslog/journal then you should bind mount the /var/log directory as follows.
.sp
.RS
docker run -v /dev/log:/dev/log -i -t fedora /bin/bash
.RE
.sp
From inside the container you can test this by sending a message to the log.
.sp
.RS
logger "Hello from my container"
.sp
.RE
Then exit and check the journal.
.RS
.sp
exit
.sp
journalctl -b | grep hello
.RE
.sp
This should list the message sent to logger.
.sp
.BAttachingtooneormorefromSTDIN,STDOUT,STDERR
.TP
If you do not specify -a then Docker will attach everything (stdin,stdout,stderr). You can specify to which of the three standard streams (stdin, stdout, stderr) you’d like to connect instead, as in:
.sp
.RS
docker run -a stdin -a stdout -i -t fedora /bin/bash
.RE
.sp
.BLinkingContainers
.TP
The link feature allows multiple containers to communicate with each other. For example, a container whose Dockerfile has exposed port 80 can be run and named as follows:
.sp
.RS
docker run --name=link-test -d -i -t fedora/httpd
.RE
.sp
.TP
A second container, in this case called linker, can communicate with the httpd container, named link-test, by running with the \fB--link=<name>:<alias>\fR
.sp
.RS
docker run -t -i --link=link-test:lt --name=linker fedora /bin/bash
.RE
.sp
.TP
Now the container linker is linked to container link-test with the alias lt. Running the \fBenv\fR command in the linker container shows environment variables with the LT (alias) context (\fBLT_\fR)
When linking two containers Docker will use the exposed ports of the container to create a secure tunnel for the parent to access.
.TP
.sp
.BMappingPortsforExternalUsage
.TP
The exposed port of an application can be mapped to a host port using the \fB-p\fR flag. For example a httpd port 80 can be mapped to the host port 8080 using the following:
.sp
.RS
docker run -p 8080:80 -d -i -t fedora/httpd
.RE
.sp
.TP
.BCreatingandMountingaDataVolumeContainer
.TP
Many applications require the sharing of persistent data across several containers. Docker allows you to create a Data Volume Container that other containers can mount from. For example, create a named container that contains directories /var/volume1 and /tmp/volume2. The image will need to contain these directories so a couple of RUN mkdir instructions might be required for you fedora-data image:
docker run --volumes-from=data --name=fedora-container1 -i -t fedora bash
.RE
.sp
.TP
Multiple --volumes-from parameters will bring together multiple data volumes from multiple containers. And it's possible to mount the volumes that came from the DATA container in yet another container via the fedora-container1 intermidiery container, allowing to abstract the actual data source from users of that data:
.sp
.RS
docker run --volumes-from=fedora-container1 --name=fedora-container2 -i -t fedora bash
.RE
.TP
.sp
.BMountingExternalVolumes
.TP
To mount a host directory as a container volume, specify the absolute path to the directory and the absolute path for the container directory separated by a colon:
.sp
.RS
docker run -v /var/db:/data1 -i -t fedora bash
.RE
.sp
.TP
When using SELinux, be aware that the host has no knowledge of container SELinux policy. Therefore, in the above example, if SELinux policy is enforced, the /var/db directory is not writable to the container. A "Permission Denied" message will occur and an avc: message in the host's syslog.
.sp
.TP
To work around this, at time of writing this man page, the following command needs to be run in order for the proper SELinux policy type label to be attached to the host directory:
.sp
.RS
chcon -Rt svirt_sandbox_file_t /var/db
.RE
.sp
.TP
Now, writing to the /data1 volume in the container will be allowed and the changes will also be reflected on the host in /var/db.
.sp
.SHHISTORY
March 2014, Originally compiled by William Henry (whenry at redhat dot com) based on dockier.io source material and internal work.
docker \- Docker image and container command line interface
.SHSYNOPSIS
.Bdocker[OPTIONS][COMMAND][arg...]
.SHDESCRIPTION
\fBdocker\fR has two distinct functions. It is used for starting the Docker daemon and to run the CLI (i.e., to command the daemon to manage images, containers etc.) So \fBdocker\fR is both a server as deamon and a client to the daemon through the CLI.
.sp
To run the Docker deamon you do not specify any of the commands listed below but must specify the \fB-d\fR option. The other options listed below are for the daemon only.
.sp
The Docker CLI has over 30 commands. The commands are listed below and each has its own man page which explain usage and arguements.
.sp
To see the man page for a command run \fBman docker <command>\fR.
// Config define the configuration of a docker daemon
// These are the configuration settings that you pass
// to the docker daemon when you launch it with say: `docker -d -e lxc`
// FIXME: separate runtime configuration from http api configuration
typeConfigstruct{
Pidfilestring
Rootstring
AutoRestartbool
Dns[]string
DnsSearch[]string
EnableIptablesbool
EnableIpForwardbool
DefaultIpnet.IP
BridgeIfacestring
BridgeIPstring
InterContainerCommunicationbool
GraphDriverstring
GraphOptions[]string
ExecDriverstring
Mtuint
DisableNetworkbool
EnableSelinuxSupportbool
Contextmap[string][]string
}
// InstallFlags adds command-line options to the top-level flag parser for
// the current process.
// Subsequent calls to `flag.Parse` will populate config with values parsed
// from the command-line.
func(config*Config)InstallFlags(){
flag.StringVar(&config.Pidfile,[]string{"p","-pidfile"},"/var/run/docker.pid","Path to use for daemon PID file")
flag.StringVar(&config.Root,[]string{"g","-graph"},"/var/lib/docker","Path to use as the root of the Docker runtime")
flag.BoolVar(&config.AutoRestart,[]string{"#r","#-restart"},true,"--restart on the daemon has been deprecated infavor of --restart policies on docker run")
flag.BoolVar(&config.EnableIptables,[]string{"#iptables","-iptables"},true,"Enable Docker's addition of iptables rules")
flag.StringVar(&config.BridgeIP,[]string{"#bip","-bip"},"","Use this CIDR notation address for the network bridge's IP, not compatible with -b")
flag.StringVar(&config.BridgeIface,[]string{"b","-bridge"},"","Attach containers to a pre-existing network bridge\nuse 'none' to disable container networking")
flag.StringVar(&config.GraphDriver,[]string{"s","-storage-driver"},"","Force the Docker runtime to use a specific storage driver")
flag.StringVar(&config.ExecDriver,[]string{"e","-exec-driver"},"native","Force the Docker runtime to use a specific exec driver")
flag.BoolVar(&config.EnableSelinuxSupport,[]string{"-selinux-enabled"},false,"Enable selinux support. SELinux does not presently support the BTRFS storage driver")
flag.IntVar(&config.Mtu,[]string{"#mtu","-mtu"},0,"Set the containers network MTU\nif no value is provided: default to the default route MTU or 1500 if no default route is available")
opts.IPVar(&config.DefaultIp,[]string{"#ip","-ip"},"0.0.0.0","Default IP address to use when binding container ports")
returnnil,fmt.Errorf("Could not locate dockerinit: This usually means docker was built incorrectly. See http://docs.docker.io/en/latest/contributing/devenvironment for official build instructions.")
returnnil,fmt.Errorf("Could not locate dockerinit: This usually means docker was built incorrectly. See http://docs.docker.com/contributing/devenvironment for official build instructions.")
}
ifsysInitPath!=localCopy{
@@ -867,7 +841,7 @@ func NewDaemonFromDirectory(config *daemonconfig.Config, eng *engine.Engine) (*D
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Victor Vieux