Difference between revisions of "Docker"

Revision as of 21:43, 11 January 2017

Docker is an open-source project that automates the deployment of applications inside software containers. Quote of features from docker web page:

Docker containers wrap up a piece of software in a complete filesystem that contains everything it needs to run: code, runtime, system tools, system libraries – anything you can install on a server. This guarantees that it will always run the same, regardless of the environment it is running in.^[1]

Install docker

Debian-based distros

Note: For this install, I will be using Ubuntu 16.04 LTS (Xenial Xerus). Docker requires a 64-bit version of Ubuntu as well as a kernel version equal to or greater than 3.10. My system satisfies both requirements.

• Setup the docker repo to install from:

$ sudo apt-get update -y
$ sudo apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 58118E89F3A912897C070ADBF76221572C52609D
$ echo "deb https://apt.dockerproject.org/repo ubuntu-xenial main" | sudo tee /etc/apt/sources.list.d/docker.list
$ sudo apt-get update -y

Make sure you are about to install from the Docker repo instead of the default Ubuntu 16.04 repo:

$ apt-cache policy docker-engine

The output of the above command show look something like the following:

docker-engine:
  Installed: (none)
  Candidate: 1.11.2-0~xenial
  Version table:
     1.11.2-0~xenial 500
        500 https://apt.dockerproject.org/repo ubuntu-xenial/main amd64 Packages
     1.11.1-0~xenial 500
        500 https://apt.dockerproject.org/repo ubuntu-xenial/main amd64 Packages
     1.11.0-0~xenial 500
        500 https://apt.dockerproject.org/repo ubuntu-xenial/main amd64 Packages

• Install docker:

$ sudo apt-get install -y docker-engine

Red Hat-based distros

Note: For this install, I will be using CentOS 7 (release 7.2.1511). Docker requires a 64-bit version of CentOS as well as a kernel version equal to or greater than 3.10. My system satisfies both requirements.

• Install Docker (the fast way):

$ sudo yum update -y
$ curl -fsSL https://get.docker.com/ | sh

• Install Docker (via a yum repo):

$ sudo yum update -y
$ sudo pip install docker-py
$ cat << EOF > /etc/yum.repos.d/docker.repo
[dockerrepo]
name=Docker Repository
baseurl=https://yum.dockerproject.org/repo/main/centos/7/
enabled=1
gpgcheck=1
gpgkey=https://yum.dockerproject.org/gpg
EOF
$ sudo rpm -vv --import https://yum.dockerproject.org/gpg
$ sudo yum install docker-engine -y

Post-installation steps

• Check on the status of docker:

$ sudo systemctl status docker

● docker.service - Docker Application Container Engine
   Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2016-07-12 12:31:08 PDT; 6s ago
     Docs: https://docs.docker.com
 Main PID: 3392 (docker)
   CGroup: /system.slice/docker.service
           ├─3392 /usr/bin/docker daemon -H fd://
           └─3411 docker-containerd -l /var/run/docker/libcontainerd/docker-containerd.sock --runtime docker-runc --start-timeout 2m

• Make sure the docker service automatically starts after a machine reboot:

$ sudo systemctl enable docker

• Execute docker without `sudo`:

$ sudo usermod -aG docker $(whoami)

Log out and log back in to use docker without `sudo`.

• Check that docker has been successfully installed and configured:

$ docker run hello-world

...
This message shows that your installation appears to be working correctly.
...

Install your own Docker private registry

Note: I will use CentOS 7 for this install and assume you already have docker and docker-compose installed (see above).

For this install, I will assume you have a domain name registered somewhere. I will use docker.example.com as my example domain. Replace anywhere you see that below with your actual domain name.

• Install dependencies:

$ yum install -y nginx  # used for the registry endpoint
$ yum install -y httpd-tools  # for the htpasswd utility

• Setup docker registry directory structure:

$ mkdir -p /opt/docker-registry/{data,nginx{/conf.d,/certs},log}
$ cd /opt/docker-registry

• Create a docker-compose file:

$ vim docker-compose.yml  # and add the following:

nginx:
  image: "nginx:1.9"
  ports:
    - 5043:443
  links:
    - registry:registry
  volumes:
    - ./log/nginx/:/var/log/nginx:rw
    - ./nginx/conf.d:/etc/nginx/conf.d:ro
    - ./nginx/certs:/etc/nginx/certs:ro
registry:
  image: registry:2
  ports:
    - 127.0.0.1:5000:5000
  environment:
    REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
  volumes:
    - ./data:/data

• Create an Nginx configuration file:

$ vim /opt/docker-registry/nginx/conf.d/registry.conf  # and add the following:

upstream docker-registry {
  server registry:5000;
}

server {
  listen 443;
  server_name docker.example.com;

  # SSL
  ssl on;
  ssl_certificate /etc/nginx/certs/docker.example.com.crt;
  ssl_certificate_key /etc/nginx/certs/docker.example.com.key;

  # disable any limits to avoid HTTP 413 for large image uploads
  client_max_body_size 0;

  # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
  chunked_transfer_encoding on;

  location /v2/ {
    # Do not allow connections from docker 1.5 and earlier
    # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
    if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
      return 404;
    }

    proxy_pass                          http://docker-registry;
    proxy_set_header  Host              $http_host;   # required for docker client's sake
    proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
    proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto $scheme;
    proxy_read_timeout                  900;

    add_header 'Docker-Distribution-Api-Version:' 'registry/2.0' always;

    # To add basic authentication to v2 use auth_basic setting plus add_header
    auth_basic "Restricted access to Docker Registry";
    auth_basic_user_file /etc/nginx/conf.d/registry.htpasswd;
  }
}

$ cd /opt/docker-registry/nginx/conf.d
$ htpasswd -c registry.htpasswd <username>  # replace <username> with your actual username
$ htpasswd registry.htpasswd <username2>  # [optional] add a 2nd user

• Setup your own certificate signing authority (for use with SSL):

$ cd /opt/docker-registry/nginx/certs

• Generate a new root key:

$ openssl genrsa -out docker-registry-CA.key 2048

• Generate a root certificate (enter anything you like at the prompts):

$ openssl req -x509 -new -nodes -key docker-registry-CA.key -days 3650 -out docker-registry-CA.crt

Then generate a key for your server (this is the file referenced by ssl_certificate_key in the Nginx configuration above):

$ openssl genrsa -out docker.example.com.key 2048

Now we have to make a certificate signing request (CSR). After you type the following command, OpenSSL will prompt you to answer a few questions. Enter anything you like for the first few, however, when OpenSSL prompts you to enter the "Common Name", make sure to enter the domain or IP of your server.

$ openssl req -new -key docker.example.com.key -out docker.example.com.csr

• Sign the certificate request:

$ openssl x509 -req -in docker.example.com.csr -CA docker-registry-CA.crt -CAkey docker-registry-CA.key -CAcreateserial -out docker.example.com.crt -days 3650

• Force any clients that will use the certificate authority we created above to accept that it is a "legitimate" certificate. Run the following commands on the Docker registry server and on any hosts that will be communicating with the Docker registry server:

$ sudo cp /opt/docker-registry/nginx/certs/docker-registry-CA.crt /usr/local/share/ca-certificates/
$ sudo update-ca-trust

• Restart the Docker daemon in order for it to pick up the changes to the certificate store:

$ sudo systemctl restart docker.service

• Bring up the associated Docker containers:

$ docker-compose up -d

• Your Docker registry directory structure should look like the following:

$ cd /opt/docker-registry && tree .
.
├── data
├── docker-compose.yml
├── log
│   └── nginx
│       ├── access.log
│       └── error.log
└── nginx
    ├── certs
    │   ├── docker-registry-CA.crt
    │   ├── docker-registry-CA.key
    │   ├── docker-registry-CA.srl
    │   ├── docker.example.com.crt
    │   ├── docker.example.com.csr
    │   └── docker.example.com.key
    └── conf.d
        ├── registry.conf
        └── registry.htpasswd

• To access the private Docker registry from a client machine (any machine, really), first add the SSL certificate you created earlier to the client machine:

$ cat /opt/docker-registry/nginx/certs/docker-registry-CA.crt  # copy contents
# On client machine:
$ sudo vim /usr/local/share/ca-certificates/docker-registry-CA.crt  # paste contents
$ sudo update-ca-certificates  # You should see "1 added" in the output

• Restart Docker on the client machine to make sure it reloads the system's CA certificates:

$ sudo service docker restart

• Test that you can reach your private Docker registry:

$ curl -k https://USERNAME:PASSWORD@docker.example.com:5043/v2/
{}  # <- proper output

• Now, test that you can login with Docker:

$ docker login https://docker.example.com:5043

If that returns with "Login Succeeded", your private Docker registry is up and running!

This section is incomplete. It will be updated presently.

Docker environment variables

Note: See here for the most up-to-date list of environment variables.

The following list of environment variables are supported by the docker command line:

DOCKER_API_VERSION 

The API version to use (e.g., 1.19)

DOCKER_CONFIG 

The location of your client configuration files.

DOCKER_CERT_PATH 

The location of your authentication keys.

DOCKER_DRIVER 

The graph driver to use.

DOCKER_HOST 

Daemon socket to connect to.

DOCKER_NOWARN_KERNEL_VERSION 

Prevent warnings that your Linux kernel is unsuitable for Docker.

DOCKER_RAMDISK 

If set this will disable "pivot_root".

DOCKER_TLS_VERIFY 

When set Docker uses TLS and verifies the remote.

DOCKER_CONTENT_TRUST 

When set Docker uses notary to sign and verify images. Equates to --disable-content-trust=false for build, create, pull, push, run.

DOCKER_CONTENT_TRUST_SERVER 

The URL of the Notary server to use. This defaults to the same URL as the registry.

DOCKER_TMPDIR 

Location for temporary Docker files.

Because Docker is developed using "Go", one can also use any environment variables used by the "Go" runtime. In particular, the following might be useful:

HTTP_PROXY

HTTPS_PROXY

NO_PROXY

• Example usage:

$ export DOCKER_API_VERSION=1.19

References

1. ↑ https://www.docker.com/what-docker

External links

• Official website