docker.md

Concepts

Containers isolation comes from the following kernel features

1. Linux namespaces to control resources access

   • Mount namespace (mnt) for file systems
   • Process ID namespace (pid)
   • Network namespace
   • Inter-process communication namespace
   • Unix Time-sharing System (UTS) namespace for hostname and Network Information Service (NIS) domain name
   • User ID namespace
   • Time namespace for system clock
   • Cgroup namespace

2. Linux Control Groups to limit resources consumption

   • CPU
   • Memory
   • Disk
   • Network bandwidth

3. Capabilities to limit privileges. Examples :

   • CAP_NET_ADMIN
   • CAP_NET_BIND_SERVICE
   • CAP_SYS_TIME

Along 3. to harden security, docker supports the --privileged option at container creation. For finer control, providing a seccomp profile is possible too. Containers can also be secured with two additional mandatory access control (MAC) mechanisms :

• SELinux (Security-Enhanced Linux)
• AppArmor (Application Armor).

Commands

See env var DOCKER_HOST if Docker daemon is remote.

docker CMD --help

docker build -t kiada:latest .   # -t to set name and tag
docker history kiada:latest      # display layers of an image
docker tag IMAGE ID/NAME:TAG     # create a tag referencing an existing image

docker login -u ID docker.io
docker push ID/NAME:TAG

docker run CONTAINER -p HOST_PORT:CONTAINER_PORT -d IMAGE    # -p port, -d detached
docker run --cpuset-cpus="1,2" ...                           # define CPU cores, other CPU time options : --cpus, --cpu-period, --cpu-quota and --cpu-shares 
docker run --memory="100m" ...                               # other memory options : --memory-reservation, --kernel-memory, --memory-swap, and --memory-swappiness

docker ps
docker inspect CONTAINER         # container info (JSON)
docker logs CONTAINER            # show stdout and stderr outputs
docker exec -it CONTAINER bash   # run a shell in the container, -i interactive and -t tty options are both required

docker stop CONTAINER

docker rm CONTAINER
docker rmi IMAGE
docker image prune               # remove all unused images 

Installation

Permission denied while trying to connect to the Docker daemon socket

When running docker CLI, the error like this appears :

permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

Solution 1 : run with docker CLI with sudo.

Solution 2 : add yourself to the docker group

sudo groupadd docker            # if group does not exist yet
sudo usermod -aG docker $USER
newgrp docker

Reference : https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user

Containers

Export a container's FS to a tarball

Exports a container's FS to a tarball.

-> Opposite of docker import.

NB : To transfer images, use docker save instead.
Recommanded reading : Docker save vs export.

# CONTAINER is the container's name or hash
docker export CONTAINER > /path/to/file.tar
# or
docker export -o /path/to/file.tar CONTAINER

Official docker export man.

Logs

https://stackoverflow.com/questions/42510002/docker-how-to-clear-the-logs-properly-for-a-docker-container

# identify
sudo sh -c "du -ch /var/lib/docker/containers/*/*-json.log | sort -hr"

# empty the faulty log file with
echo "" > $(docker inspect --format='{{.LogPath}}' <container_name_or_id>)
# or (: is a no op command)
: > $(docker inspect --format='{{.LogPath}}' <container_name_or_id>)
# or
truncate -s 0 $(docker inspect --format='{{.LogPath}}' <container_name_or_id>)

A better the way is to handle log size :

• through the containerized app
• through dockerd
• thourgh docker-compose

dockerd

dockerd ... --log-opt max-size=10m --log-opt max-file=3

or through its daemon.json file

{
  "log-driver": "json-file",
  "log-opts": {"max-size": "10m", "max-file": "3"}
}

docker run

docker run --log-driver json-file --log-opt max-size=10m --log-opt max-file=3 ...

docker-compose

version: '3.7'
services:
  app:
    image: ...
    logging:
      options:
        max-size: "10m"
        max-file: "3"

Removal

Remove all stopped containers

docker ps --filter “status=exited” -q | xargs -r docker rm --force

Remove all the containers

$ docker ps -a -q | xargs -r docker rm -- force

Disk usage

$ docker system df
TYPE                SIZE                RECLAIMABLE
Images              10.17GB             7.155GB (70%)
Containers          354B                354B (100%)
Local Volumes       1.105GB             151.1MB (13%)
Build Cache         3.409GB             3.409GB

Images

Create an image from a FS tarball

Creates one image from one tarball which is not an image "stricto sensu" (just a filesystem to import as an image).

-> Opposite of docker export.

NB : To import one or many "real" images, use docker load instead.
Recommanded reading : Docker load vs import.

docker import [OPTIONS] file|URL|- [REPOSITORY[:TAG]]

Official docker import man.

Create an image from an image tarball

Creates one or more images from a tarball containing one or more images.

-> Opposite of docker save.

NB : To create an image from a FS, use docker import instead.
Recommanded reading : Docker load vs import.

docker load < busybox.tar.gz
# or
docker load --input fedora.tar

Official docker load man.

Removal

Remove dangling images

# méthode 1
$ docker images -f “dangling=true” -q | xargs -r docker rmi -f
# ou méthode 2 
$ docker image prune

Save one or multiples images to a tarball

Useful to transfer one or multiples images between hosts.

NB : To export a container FS to a tarball for image creation, use docker export instead.
Recommanded reading : Docker save vs export.

# IMAGE can be FQN (eg. ghcr.io/xyz/my-application:1.2.3) or hash
docker save IMAGE [IMAGE...] > /path/to/file.tar
# or
docker save -o /path/to/file.tar IMAGE [IMAGE...]

Official docker save man.

System "cleaning"

# Clean the Docker builder cache
$ DOCKER_BUILDKIT=1 docker builder prune --all --force
# Remove networks
$ docker network prune --force
# Remove all stopped containers, unused networks, dangling images and/or unused images, dangling volumes, builder cache.
$ docker system prune

Volumes

Removal

Remove dangling images

# méthode 1
$ docker volume ls -qf dangling=true | xargs -r docker volume rm
# ou méthode 2 
$ docker volume prune --force