Docker can now run within Docker(blog.docker.io)

150 pointsby jpetazzovor 13 Jahren45 comments

blog.docker.io

http://blog.docker.io/2013/09/docker-can-now-run-within-docker/

49 comments

I remember running VMs in VMs when I was younger and wondered how far I could go before my computer would implode. Infinite recursion is amazing. Let me rephrase that; infinity is amazing.

null_ptrvor 13 Jahren

How far did you get? :-)

pearjuicevor 13 Jahren

After three to four iterations (cannot remember precisely) I couldn't split up my computer its capacities any further to qualify for any decent OS its specifications which could run another VM. Please note that this was years ago, I suggest you should try it!

Unless you want to waste a lot of time installing the nested OS's, like I did, I suggest using pre-installed images you can throw right in.

kozhevnikovvor 13 Jahren

To infinity and beyond.

jpetazzovor 13 Jahren

This is one of the many potential applications of the new "-privileged" flag of Docker. This is very exciting, because it means that we will soon run Docker CI within Docker itself (instead of ad-hoc VMs), among other things!

andrewmunsellvor 13 Jahren

The big thing for me about the privileged flag is the ability to run VPN software on the containers-- this way, they can talk to each other cross-physical-machine as well as between containers on the same host.

jpetazzovor 13 Jahren

We're on the same page. That's my next hack — an OpenVPN server within Docker. The blog post, Dockerfile, and helper scripts should be out next week :-)

andrewmunsellvor 13 Jahren

Great, looking forward to seeing it.

My system uses peer to peer software to synchronize each container's public keys and IP address/port information, as well as a mesh network VPN. This allows me to easily join a new node to the VPN cluster (using ENV variables to specify the port and public address to listen on, which is then used in the Docker container creation) and still have minimal latency between any two nodes.

I'll probably have to write up a post myself describing the system and how Docker is used to create new containers and add it to the cluster.

gcrvor 13 Jahren

Whoa. That's really cool. What do you use that for?

Also: does openVPN drive your "mesh network VPN"? i thought it was only client<-->server!

andrewmunsellvor 13 Jahren

OpenVPN is only client-server, so I'm currently using tinc[1]. BitTorrent Sync is the software used to synchronize the actual public keys and container IP addresses.

[1]: http://www.tinc-vpn.org/

contingenciesvor 13 Jahren

To be fair this is a standard feature of Linux Control Groups that's existed for years now. For more info on how that works, see https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt

jpetazzovor 13 Jahren

Cgroups and namespaces. Even though some namespaces are nested (typically, the PID namespace) why others don't need to be.

There is nothing special with nesting cgroups and namespaces from the kernel point of view. The interesting part is to work around the little details (as anybody who ran nested LXC containers will know) :-)

[deleted]vor 13 Jahren

(1)

tlrobinsonvor 13 Jahren

Mostly-unrelated question: could one build a desktop Linux distribution around Docker? Or rather, how difficult would it be? I assume OS X's application sandboxing uses a technology similar to LXC.

wmfvor 13 Jahren

Some people are working in that direction, see https://people.gnome.org/~alexl/glick2/ and http://lwn.net/Articles/562138/ Because this stuff is older than Docker it tends to be Dockerish but not actually Docker.

joffreyfvor 13 Jahren

You might be looking for something akin to http://coreos.com/ !

tlrobinsonvor 13 Jahren

CoreOS could be a good starting point, but it's intended for servers so it's very bare bones (and the service discovery stuff might not make much sense)

jpetazzovor 13 Jahren

Depends what you have in mind, I guess.

You could run most essential system components (syslog, ssh, cron...) inside containers, and bind-mount /home when it makes sense. Since those components need elevated privileges, I don't know if containers would be that useful... And then systemd already puts services in cgroups; it's a nice approach (IMHO).

Or you could use containers a bit like virtualenvs. If you're a Python developer familiar with virtualenvwrapper, you probably use mkvirtualenv when you start working on a new project (or on a different setup for an existing project). Containers could be used in a similar manner with some clever wrappers.

[deleted]vor 13 Jahren

songgaovor 13 Jahren

Another feature liberated by `-privilege ` that I like a lot is ability to run `mknod`, which is necessary for using TUN/TAP interface.

tachionvor 13 Jahren

It is nice to see, especially because fast moving project is always an enjoyable thing to observer. As a sidenote, to increase overall awareness, FreeBSD has capability for hierarchical Jails (Jails inside of Jails) for a while.

outside1234vor 13 Jahren

Does anyone know if there are plans for when docker will be able to run in 32-bit?

dsissitkavor 13 Jahren

It'll work now if you remove this if block...

https://github.com/dotcloud/docker/blob/master/server.go#L12...

...and create your own images.

It's unsupported, but it'll work.

segeekvor 13 Jahren

Very nice!

One thing that I am looking forward to is Docker support for Windows. Would really like to see that feature.

yebyenvor 13 Jahren

There is Docker within Vagrant, I have a Windows 7 desktop in front of me and all I need to do to enter my CoreOS system is "vagrant up; vagrant ssh" from the git shell.

I don't think there will be direct Docker support for Windows (erm... hrm)

http://coreos.com/blog/coreos-vagrant-images/

yebyenvor 13 Jahren

Actually I do remember hearing that docker/lxc was only the beginning, can you be more specific? What virtualization tech in Windows do you want to see Docker containers running in?

There's no reason you can't run CoreOS in qemu or CoreOS in VirtualBox, but all of those things are still coming back to Linux Containers. Did you have an idea of another way?

gcrvor 13 Jahren

Would each container run on something like coLinux?

(coLinux is a port of the Linux kernel to run as an ordinary Windows program, so you can run the Linux kernel as a Windows userland program by double-clicking on "linux.exe"; then you can SSH in and mess around, etc)

csearsvor 13 Jahren

I wouldn't expect Windows support anytime soon, especially Windows containers running in a Linux host using LXC as the "hypervisor".

Windows containers running in a Windows host is much more likely. Commercial solutions like Virtuozzo Containers offer Windows on Windows support today [1]. Someone could implement a Virtuozzo-for-Windows provider for Docker, but that seems like a long shot.

[1]: http://www.parallels.com/products/pvc/what-s-new-for-windows...

jpetazzovor 13 Jahren

Are you looking forward to run the Docker CLI in Windows (i.e., being able to use Docker commands from a Windows machine, while the containers run on a remote box), or run the containers themselves on a Windows box?

[deleted]vor 13 Jahren

likeclockworkvor 13 Jahren

When will Docker support distros other than Ubuntu?

jpetazzovor 13 Jahren

There is already some support for Gentoo and Archlinux, and if you are willing to use a "foreign" kernel, Red Hat / Fedora / CentOS work as well.

There is some significant work in progress to add compatibility for non-AUFS systems. I don't have an accurate timeline at this point, but expect something (or at least an announcement) at the end of the month!

gcrvor 13 Jahren

Last I checked, using Docker on Arch required a custom kernel with the AUFS patch. Is that still true?

Edit: yes, docker on arch still requires a custom kernel. See http://docs.docker.io/en/latest/installation/archlinux/

jpetazzovor 13 Jahren

Yeah, still true, but we are actively working on an alternate implementation to be compatible with anything post 3.2 and RHEL 6.4 as well.

shykesvor 13 Jahren

Just to confirm that we're planning to remove the dependency on aufs for the 0.7 release (late September). As a result docker will run on vanilla linux kernels.

aufs will probably come back as a plugin in a future version.

aufs is great and I wish we could keep it as the default. But the kernel politics are what they are.

gcrvor 13 Jahren

Oh interesting. What are you moving to? Are you hooking into 'libc' to be able to intercept file accesse for layers or something?

shykesvor 13 Jahren

We're moving to device-mapper, which is the underlying block-level facility used by LVM.

willvarfarvor 13 Jahren

post 6.4 means > or >=? Will it run on my ec2 rhel 6.4 out-of-the-box?

jlgrecovor 13 Jahren

Good to hear. I've played around with Docker a bit but I don't have a compelling enough use for it yet to keep on building AUFS kernels.

likeclockworkvor 13 Jahren

Thanks for the information!

bachbackvor 13 Jahren

Amazing. What do the docker guys think of coreOS?

[deleted]vor 13 Jahren

arnleyvor 13 Jahren

so meta

nnnnnivor 13 Jahren

Also "yo dawg...".

Now that the obligatory comments have been covered, we can move on. Yay!

jpetazzovor 13 Jahren

Yeah... Note for future self: make all the mandatory lame jokes in the blog post itself, so people don't feel obligated to do them on HN instead. ;-)

reginaldjcoopervor 13 Jahren

Please no :) just rely on us to downvote these people on HN, then you can spare at least some of the readers the pain.

I don't even understand, it's not like it's conversation or even funny, but X in X immediately results in someone announcing their awareness of canonical jokes. "yo dawg i heard you like plays so I put a play in your play to inception the king."

mrmondovor 13 Jahren

I take it you break out of docker-docker when you here the theme from inception starting to play.