diff --git a/DOCKER-CHEATSHEET.md b/DOCKER-CHEATSHEET.md new file mode 100644 index 0000000..941f1dd --- /dev/null +++ b/DOCKER-CHEATSHEET.md @@ -0,0 +1,321 @@ +# Docker Cheat Sheet + +### Lifecycle + +* [`docker run`](http://docs.docker.io/reference/commandline/cli/#run) creates a container. +* [`docker stop`](http://docs.docker.io/reference/commandline/cli/#stop) stops it. +* [`docker start`](http://docs.docker.io/reference/commandline/cli/#start) will start it again. +* [`docker restart`](http://docs.docker.io/reference/commandline/cli/#restart) restarts a container. +* [`docker rm`](http://docs.docker.io/reference/commandline/cli/#rm) deletes a container. +* [`docker kill`](http://docs.docker.io/reference/commandline/cli/#kill) sends a SIGKILL to a container. [Has issues](https://github.com/dotcloud/docker/issues/197). +* [`docker attach`](http://docs.docker.io/reference/commandline/cli/#attach) will connect to a running container. +* [`docker wait`](http://docs.docker.io/reference/commandline/cli/#wait) blocks until container stops. + +If you want to run and then interact with a container, `docker start` then `docker attach` or, as of 0.9, `nsenter`. + +You can find a copy of [nsenter here](https://github.com/jpetazzo/nsenter) + +# Using nsenter + +This is a small Docker recipe to build `nsenter` easily and install it in your +system. + +### Entering a Docker Container + +The "official" way to enter a docker container while it's running is to use `nsenter`, which uses [libcontainer under the hood](http://jpetazzo.github.io/2014/03/23/lxc-attach-nsinit-nsenter-docker-0-9/). Using an `sshd` daemon is [considered evil](http://jpetazzo.github.io/2014/06/23/docker-ssh-considered-evil/). + +Unfortunately, nsenter requires some configuration and installation. If your operating system does not include nsenter (usually in a package named util-linux or similar, although it has to be quite a recent version), the easiest way is probably to install it through docker, as described in the first of the following links: + +* [Installing nsenter using docker](https://github.com/jpetazzo/nsenter) +* [How to enter a Docker container](https://blog.codecentric.de/en/2014/07/enter-docker-container/) +* [Docker debug with nsenter on boot2docker](http://blog.sequenceiq.com/blog/2014/07/05/docker-debug-with-nsenter-on-boot2docker/) + +`nsenter` allows you to run any command (e.g. a shell) inside a container that's already running another command (e.g. your database or webserver). This allows you to see all mounted volumes, check on processes, log files etc. inside a running container. + +The first installation method described above also installs a small wrapper script wrapping `nsenter` named `docker-enter` that makes executing a shell inside a running container as easy as `docker-enter CONTAINER` and any other command via `docker-enter CONTAINER COMMAND`. + + +### What is `nsenter`? + +It is a small tool allowing to `enter` into `n`ame`s`paces. Technically, +it can enter existing namespaces, or spawn a process into a new set of +namespaces. "What are those namespaces you're blabbering about?" +We are talking about [container namespaces]. + +`nsenter` can do many useful things, but the main reason why I'm so +excited about it is because it lets you [enter into a Docker container]. + + +### Why build `nsenter` in a container? + +This is because my preferred distros (Debian and Ubuntu) ship with an +outdated version of `util-linux` (the package that should contain `nsenter`). +Therefore, if you need `nsenter` on those distros, you have to juggle with +APT repository, or compile from source, or… Ain't nobody got time for that. + +I'm going to make a very bold assumption: if you landed here, it's because +you want to enter a Docker container. Therefore, you won't mind if my +method to build `nsenter` uses Docker itself. + + +### How do I install `nsenter` with this? + +If you want to install `nsenter` into `/usr/local/bin`, just do this: + + docker run --rm -v /usr/local/bin:/target jpetazzo/nsenter + +The `jpetazzo/nsenter` container will detect that `/target` is a +mountpoint, and it will copy the `nsenter` binary into it. + +If you don't trust me, and prefer to extract the `nsenter` binary, +rather than allowing my container to potentially wreak havoc into +your system's `$PATH`, you can also do this: + + docker run --rm jpetazzo/nsenter cat /nsenter > /tmp/nsenter && chmod +x /tmp/nsenter + +Then do whatever you want with the binary in `/tmp/nsenter`. + + +### `nsenter` inner workings. + +First, figure out the PID of the container you want to enter: + + PID=$(docker inspect --format {{.State.Pid}} ) + +Then enter the container: + + nsenter --target $PID --mount --uts --ipc --net --pid + + +### What's that docker-enter thing? + +It's just a small shell script that wraps up the steps described above into +a tiny helper. It takes the name or ID of a container and optionally the name +of a program to execute inside the namespace. If no command is specified a +shell will be invoked instead. + `NOTE:` you have to be root to use it this way. + + # list the root filesystem + docker-enter my_awesome_container ls -la + + +If you want to expose container ports through the host, see the [exposing ports](https://github.com/wsargent/docker-cheat-sheet#exposing-ports) section. + +### Info + +* [`docker ps`](http://docs.docker.io/reference/commandline/cli/#ps) shows running containers. +* [`docker inspect`](http://docs.docker.io/reference/commandline/cli/#inspect) looks at all the info on a container (including IP address). +* [`docker logs`](http://docs.docker.io/reference/commandline/cli/#logs) gets logs from container. +* [`docker events`](http://docs.docker.io/reference/commandline/cli/#events) gets events from container. +* [`docker port`](http://docs.docker.io/reference/commandline/cli/#port) shows public facing port of container. +* [`docker top`](http://docs.docker.io/reference/commandline/cli/#top) shows running processes in container. +* [`docker diff`](http://docs.docker.io/reference/commandline/cli/#diff) shows changed files in the container's FS. + +`docker ps -a` shows running and stopped containers. + +### Import / Export + +There doesn't seem to be a way to use docker directly to import files into a container's filesystem. The closest thing is to mount a host file or directory as a data volume and copy it from inside the container. + +* [`docker cp`](http://docs.docker.io/reference/commandline/cli/#cp) copies files or folders out of a container's filesystem. +* [`docker export`](http://docs.docker.io/reference/commandline/cli/#export) turns container filesystem into tarball. + + +### Images + +Images are just [templates for docker containers](http://docker.readthedocs.org/reference/terms/image/). + + + +Docker.io hosts its own [index](https://index.docker.io/) to a central registry which contains a large number of repositories. + +* [`docker login`](http://docs.docker.io/reference/commandline/cli/#login) to login to a registry. +* [`docker search`](http://docs.docker.io/reference/commandline/cli/#search) searches registry for image. +* [`docker pull`](http://docs.docker.io/reference/commandline/cli/#pull) pulls an image from registry to local machine. +* [`docker push`](http://docs.docker.io/reference/commandline/cli/#push) pushes an image to the registry from local machine. + +### Dockerfile + +[The configuration file](http://docs.docker.io/introduction/working-with-docker/#working-with-the-dockerfile). Sets up a Docker container when you run `docker build` on it. Vastly preferable to `docker commit`. + +### Instructions + +* [FROM](http://docs.docker.io/reference/builder/#from) +* [MAINTAINER](http://docs.docker.io/reference/builder/#maintainer) +* [RUN](http://docs.docker.io/reference/builder/#run) +* [CMD](http://docs.docker.io/reference/builder/#cmd) +* [EXPOSE](http://docs.docker.io/reference/builder/#expose) +* [ENV](http://docs.docker.io/reference/builder/#env) +* [ADD](http://docs.docker.io/reference/builder/#add) +* [ENTRYPOINT](http://docs.docker.io/reference/builder/#entrypoint) +* [VOLUME](http://docs.docker.io/reference/builder/#volume) +* [USER](http://docs.docker.io/reference/builder/#user) +* [WORKDIR](http://docs.docker.io/reference/builder/#workdir) +* [ONBUILD](http://docs.docker.io/reference/builder/#onbuild) + +### Tutorial + +* [Flux7's Dockerfile Tutorial](http://flux7.com/blogs/docker/docker-tutorial-series-part-3-automation-is-the-word-using-dockerfile/) + +### Examples + +* [Examples](http://docs.docker.io/reference/builder/#dockerfile-examples) + +### Best Practices + +Best to look at [http://github.com/wsargent/docker-devenv](http://github.com/wsargent/docker-devenv) and the [best practices](http://crosbymichael.com/dockerfile-best-practices.html) / [take 2](http://crosbymichael.com/dockerfile-best-practices-take-2.html) for more details. + +If you use [jEdit](http://jedit.org), I've put up a syntax highlighting module for [Dockerfile](https://github.com/wsargent/jedit-docker-mode) you can use. + +## Layers + +The [versioned filesystem](http://en.wikipedia.org/wiki/Aufs) in Docker is based on layers. They're like [git commits or changesets for filesystems](http://docker.readthedocs.org/reference/terms/layer/). + +## Links + +Links are how Docker containers talk to each other [through TCP/IP ports](http://docs.docker.io/use/working_with_links_names/). [Linking into Redis](http://docs.docker.io/use/working_with_links_names/#links-service-discovery-for-docker) and [Atlassian](http://blogs.atlassian.com/2013/11/docker-all-the-things-at-atlassian-automation-and-wiring/) show worked examples. You can also (in 0.11) resolve [links by hostname](http://docs.docker.io/use/working_with_links_names/#resolving-links-by-name). + +NOTE: If you want containers to ONLY communicate with each other through links, start the docker daemon with `-icc=false` to disable inter process communication. + +If you have a container with the name CONTAINER (specified by `docker run --name CONTAINER`) and in the Dockerfile, it has an exposed port: + +``` +EXPOSE 1337 +``` + +Then if we create another container called LINKED like so: + +``` +docker run -d --link CONTAINER:ALIAS --name LINKED user/wordpress +``` + +Then the exposed ports and aliases of CONTAINER will show up in LINKED with the following environment variables: + +``` +$ALIAS_PORT_1337_TCP_PORT +$ALIAS_PORT_1337_TCP_ADDR +``` + +And you can connect to it that way. + +To delete links, use `docker rm --link `. + +## Volumes + +Docker volumes are [free-floating filesystems](http://docs.docker.com/userguide/dockervolumes/). They don't have to be connected to a particular container. + +Volumes are useful in situations where you can't use links (which are TCP/IP only). For instance, if you need to have two docker instances communicate by leaving stuff on the filesystem. + +You can mount them in several docker containers at once, using `docker run -volume-from` + +Because volumes are isolated filesystems, they are often used to store state from computations between transient containers. That is, you can have a stateless and transient container run from a recipe, blow it away, and then have a second instance of the transient container pick up from where the last one left off. + +See [advanced volumes](http://crosbymichael.com/advanced-docker-volumes.html) for more details. + +## Exposing ports + +Exposing ports through the host container is [fiddly but doable](http://docs.docker.io/use/port_redirection/#binding-a-port-to-an-host-interface). + +First expose the port in your Dockerfile: + +``` +EXPOSE +``` + +Then map the container port to the host port (only using localhost interface): + +``` +docker run -p 127.0.0.1:$HOSTPORT:$CONTAINERPORT --name CONTAINER -t someimage +``` + +If you're running Docker in Virtualbox, you then need to forward the port there as well. It can be useful to define something in Vagrantfile to expose a range of ports so that you can dynamically map them: + +``` +Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| + ... + + (49000..49900).each do |port| + config.vm.network :forwarded_port, :host => port, :guest => port + end + + ... +end +``` + +If you forget what you mapped the port to on the host container, use `docker port` to show it: + +``` +docker port CONTAINER $CONTAINERPORT +``` + +## Tips + +Sources: + +* [15 Docker Tips in 5 minutes](http://sssslide.com/speakerdeck.com/bmorearty/15-docker-tips-in-5-minutes) + +### Last Ids + +``` +alias dl='docker ps -l -q' +docker run ubuntu echo hello world +docker commit `dl` helloworld +``` + +### Commit with command (needs Dockerfile) + +``` +docker commit -run='{"Cmd":["postgres", "-too -many -opts"]}' `dl` postgres +``` + +### Get IP address + +``` +docker inspect `dl` | grep IPAddress | cut -d '"' -f 4 +``` + +or + +``` +wget http://stedolan.github.io/jq/download/source/jq-1.3.tar.gz +tar xzvf jq-1.3.tar.gz +cd jq-1.3 +./configure && make && sudo make install +docker inspect `dl` | jq -r '.[0].NetworkSettings.IPAddress' +``` + +or (this is unverified) + +``` +docker inspect -f '{{ .NetworkSettings.IPAddress }}' +``` + +### Get port mapping + +``` +docker inspect -f '{{range $p, $conf := .NetworkSettings.Ports}} {{$p}} -> {{(index $conf 0).HostPort}} {{end}}' +``` + +### Get Environment Settings + +``` +docker run --rm ubuntu env +``` + +### Delete old containers + +``` +docker ps -a | grep 'weeks ago' | awk '{print $1}' | xargs docker rm +``` + +### Delete stopped containers + +``` +docker rm `docker ps -a -q` +``` + +### Show image dependencies + +``` +docker images -viz | dot -Tpng -o docker.png +``` diff --git a/README.md b/README.md index dbd4d17..e4b83bc 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,30 @@ Refer : https://github.com/Eugeny/ajenti-v * Allow Web w SSL/Domain aliasing/DNS/Emailing/Database in a single setup * Very easy to move around/scale/create dev environments -##How to use? +##Docker Installation +* Install Docker on CentOS or Fedora +* To install Docker on CentOS, first enable EPEL repository, and then use yum command: +``` +$ sudo yum install docker-io +$ sudo service docker start +$ sudo chkconfig docker on +``` +* To install Docker on Fedora, use the following commands: +``` +$ sudo yum install docker-io +$ sudo systemctl start docker.service +$ sudo systemctl enable docker.service +``` +* After installing Docker on CentOS or Fedora, you need to add yourself to docker group to be able to run Docker as a non-root * user. Use this command for that: +``` +$ sudo usermod -a -G docker $USER +``` +###Log out, and log back in to activate the group change. + +#At this point, you should be able to run docker command as a unprivileged user + + +###How to use? Follow this tutorial if you like step by step instructions #### http://greenycloud.com/hosting-on-whatpanel/ @@ -60,6 +83,9 @@ on the docker-run command you can use different external ports than defaults for ex -p 7090:8000 , -p 2345:22 so it wont be obvious target for the attacker/viruses to try and hit your server. +### See DOCKER-CHEATSHEET.md for nsenter information + + ##Why Centos Image ? I would have loved to use the Ubuntu image / phusion baseimage however the ubuntu repositories are not suited for web hosting/ecommerce environments.