README ¶
Docker: the Linux container runtime
Docker complements LXC with a high-level API which operates at the process level. It runs unix processes with strong guarantees of isolation and repeatability across servers.
Docker is a great building block for automating distributed systems: large-scale web deployments, database clusters, continuous deployment systems, private PaaS, service-oriented architectures, etc.
-
Heterogeneous payloads: any combination of binaries, libraries, configuration files, scripts, virtualenvs, jars, gems, tarballs, you name it. No more juggling between domain-specific tools. Docker can deploy and run them all.
-
Any server: docker can run on any x64 machine with a modern linux kernel - whether it's a laptop, a bare metal server or a VM. This makes it perfect for multi-cloud deployments.
-
Isolation: docker isolates processes from each other and from the underlying host, using lightweight containers.
-
Repeatability: because containers are isolated in their own filesystem, they behave the same regardless of where, when, and alongside what they run.
Notable features
-
Filesystem isolation: each process container runs in a completely separate root filesystem.
-
Resource isolation: system resources like cpu and memory can be allocated differently to each process container, using cgroups.
-
Network isolation: each process container runs in its own network namespace, with a virtual interface and IP address of its own.
-
Copy-on-write: root filesystems are created using copy-on-write, which makes deployment extremeley fast, memory-cheap and disk-cheap.
-
Logging: the standard streams (stdout/stderr/stdin) of each process container are collected and logged for real-time or batch retrieval.
-
Change management: changes to a container's filesystem can be committed into a new image and re-used to create more containers. No templating or manual configuration required.
-
Interactive shell: docker can allocate a pseudo-tty and attach to the standard input of any container, for example to run a throwaway interactive shell.
Under the hood
Under the hood, Docker is built on the following components:
-
The cgroup and namespacing capabilities of the Linux kernel;
-
AUFS, a powerful union filesystem with copy-on-write capabilities;
-
The Go programming language;
-
lxc, a set of convenience scripts to simplify the creation of linux containers.
Install instructions
Installing on Ubuntu 12.04 and 12.10
-
Install dependencies:
sudo apt-get install lxc wget bsdtar curl sudo apt-get install linux-image-extra-`uname -r`
The
linux-image-extra
package is needed on standard Ubuntu EC2 AMIs in order to install the aufs kernel module. -
Install the latest docker binary:
wget http://get.docker.io/builds/$(uname -s)/$(uname -m)/docker-master.tgz tar -xf docker-master.tgz
-
Run your first container!
cd docker-master sudo ./docker run -i -t base /bin/bash
Consider adding docker to your
PATH
for simplicity.
Installing on other Linux distributions
Right now, the officially supported distributions are:
- Ubuntu 12.04 (precise LTS)
- Ubuntu 12.10 (quantal)
Docker probably works on other distributions featuring a recent kernel, the AUFS patch, and up-to-date lxc. However this has not been tested.
Installing with Vagrant
Currently, Docker can be installed with Vagrant both on your localhost with VirtualBox as well as on Amazon EC2. Vagrant 1.1 is required for EC2, but deploying is as simple as:
$ export AWS_ACCESS_KEY_ID=xxx \
AWS_SECRET_ACCESS_KEY=xxx \
AWS_KEYPAIR_NAME=xxx \
AWS_SSH_PRIVKEY=xxx
$ vagrant plugin install vagrant-aws
$ vagrant up --provider=aws
The environment variables are:
AWS_ACCESS_KEY_ID
- The API key used to make requests to AWSAWS_SECRET_ACCESS_KEY
- The secret key to make AWS API requestsAWS_KEYPAIR_NAME
- The name of the keypair used for this EC2 instanceAWS_SSH_PRIVKEY
- The path to the private key for the named keypair
For VirtualBox, you can simply ignore setting any of the environment
variables and omit the provider
flag. VirtualBox is still supported with
Vagrant <= 1.1:
$ vagrant up
Usage examples
Running an interactive shell
# Download a base image
docker import base
# Run an interactive shell in the base image,
# allocate a tty, attach stdin and stdout
docker run -i -t base /bin/bash
Starting a long-running worker process
# Run docker in daemon mode
(docker -d || echo "Docker daemon already running") &
# Start a very useful long-running process
JOB=$(docker run -d base /bin/sh -c "while true; do echo Hello world; sleep 1; done")
# Collect the output of the job so far
docker logs $JOB
# Kill the job
docker kill $JOB
Listing all running containers
docker ps
Expose a service on a TCP port
# Expose port 4444 of this container, and tell netcat to listen on it
JOB=$(docker run -d -p 4444 base /bin/nc -l -p 4444)
# Which public port is NATed to my container?
PORT=$(docker port $JOB 4444)
# Connect to the public port via the host's public address
echo hello world | nc $(hostname) $PORT
# Verify that the network connection worked
echo "Daemon received: $(docker logs $JOB)"
Contributing to Docker
Want to hack on Docker? Awesome! Here are instructions to get you started. They are probably not perfect, please let us know if anything feels wrong or incomplete.
Contribution guidelines
Pull requests are always welcome
We are always thrilled to receive pull requests, and do our best to process them as fast as possible. Not sure if that typo is worth a pull request? Do it! We will appreciate it.
If your pull request is not accepted on the first try, don't be discouraged! If there's a problem with the implementation, hopefully you received feedback on what to improve.
We're trying very hard to keep Docker lean and focused. We don't want it to do everything for everybody. This means that we might decide against incorporating a new feature. However, there might be a way to implement that feature on top of docker.
Discuss your design on the mailing list
We recommend discussing your plans on the mailing list before starting to code - especially for more ambitious contributions. This gives other contributors a chance to point you in the right direction, give feedback on your design, and maybe point out if someone else is working on the same thing.
Create issues...
Any significant improvement should be documented as a github issue before anybody starts working on it.
...but check for existing issues first!
Please take a moment to check that an issue doesn't already exist documenting your bug report or improvement proposal. If it does, it never hurts to add a quick "+1" or "I have this problem too". This will help prioritize the most common problems and requests.
Write tests
Golang has a great testing suite built in: use it! Take a look at existing tests for inspiration.
Setting up a dev environment
Instructions that have been verified to work on Ubuntu 12.10,
sudo apt-get -y install lxc wget bsdtar curl golang git
export GOPATH=~/go/
export PATH=$GOPATH/bin:$PATH
mkdir -p $GOPATH/src/github.com/dotcloud
cd $GOPATH/src/github.com/dotcloud
git clone git@github.com:dotcloud/docker.git
cd docker
go get -v github.com/dotcloud/docker/...
go install -v github.com/dotcloud/docker/...
Then run the docker daemon,
sudo $GOPATH/bin/docker -d
Run the go install
command (above) to recompile docker.
What is a Standard Container?
Docker defines a unit of software delivery called a Standard Container. The goal of a Standard Container is to encapsulate a software component and all its dependencies in a format that is self-describing and portable, so that any compliant runtime can run it without extra dependencies, regardless of the underlying machine and the contents of the container.
The spec for Standard Containers is currently a work in progress, but it is very straightforward. It mostly defines 1) an image format, 2) a set of standard operations, and 3) an execution environment.
A great analogy for this is the shipping container. Just like Standard Containers are a fundamental unit of software delivery, shipping containers (http://bricks.argz.com/ins/7823-1/12) are a fundamental unit of physical delivery.
1. STANDARD OPERATIONS
Just like shipping containers, Standard Containers define a set of STANDARD OPERATIONS. Shipping containers can be lifted, stacked, locked, loaded, unloaded and labelled. Similarly, standard containers can be started, stopped, copied, snapshotted, downloaded, uploaded and tagged.
2. CONTENT-AGNOSTIC
Just like shipping containers, Standard Containers are CONTENT-AGNOSTIC: all standard operations have the same effect regardless of the contents. A shipping container will be stacked in exactly the same way whether it contains Vietnamese powder coffee or spare Maserati parts. Similarly, Standard Containers are started or uploaded in the same way whether they contain a postgres database, a php application with its dependencies and application server, or Java build artifacts.
3. INFRASTRUCTURE-AGNOSTIC
Both types of containers are INFRASTRUCTURE-AGNOSTIC: they can be transported to thousands of facilities around the world, and manipulated by a wide variety of equipment. A shipping container can be packed in a factory in Ukraine, transported by truck to the nearest routing center, stacked onto a train, loaded into a German boat by an Australian-built crane, stored in a warehouse at a US facility, etc. Similarly, a standard container can be bundled on my laptop, uploaded to S3, downloaded, run and snapshotted by a build server at Equinix in Virginia, uploaded to 10 staging servers in a home-made Openstack cluster, then sent to 30 production instances across 3 EC2 regions.
4. DESIGNED FOR AUTOMATION
Because they offer the same standard operations regardless of content and infrastructure, Standard Containers, just like their physical counterpart, are extremely well-suited for automation. In fact, you could say automation is their secret weapon.
Many things that once required time-consuming and error-prone human effort can now be programmed. Before shipping containers, a bag of powder coffee was hauled, dragged, dropped, rolled and stacked by 10 different people in 10 different locations by the time it reached its destination. 1 out of 50 disappeared. 1 out of 20 was damaged. The process was slow, inefficient and cost a fortune - and was entirely different depending on the facility and the type of goods.
Similarly, before Standard Containers, by the time a software component ran in production, it had been individually built, configured, bundled, documented, patched, vendored, templated, tweaked and instrumented by 10 different people on 10 different computers. Builds failed, libraries conflicted, mirrors crashed, post-it notes were lost, logs were misplaced, cluster updates were half-broken. The process was slow, inefficient and cost a fortune - and was entirely different depending on the language and infrastructure provider.
5. INDUSTRIAL-GRADE DELIVERY
There are 17 million shipping containers in existence, packed with every physical good imaginable. Every single one of them can be loaded on the same boats, by the same cranes, in the same facilities, and sent anywhere in the World with incredible efficiency. It is embarrassing to think that a 30 ton shipment of coffee can safely travel half-way across the World in less time than it takes a software team to deliver its code from one datacenter to another sitting 10 miles away.
With Standard Containers we can put an end to that embarrassment, by making INDUSTRIAL-GRADE DELIVERY of software a reality.
Standard Container Specification
(TODO)
Image format
Standard operations
- Copy
- Run
- Stop
- Wait
- Commit
- Attach standard streams
- List filesystem changes
- ...
Execution environment
Root filesystem
Environment variables
Process arguments
Networking
Process namespacing
Resource limits
Process monitoring
Logging
Signals
Pseudo-terminal allocation
Security
Documentation ¶
Index ¶
- Constants
- Variables
- func CmdStream(cmd *exec.Cmd) (io.Reader, error)
- func ComputeId(content io.Reader) (string, error)
- func Debugf(format string, a ...interface{})
- func Download(url string, stderr io.Writer) (*http.Response, error)
- func GenerateId() string
- func Go(f func() error) chan error
- func HumanDuration(d time.Duration) string
- func MountAUFS(ro []string, rw string, target string) error
- func Mounted(mountpoint string) (bool, error)
- func NopWriteCloser(w io.Writer) io.WriteCloser
- func ProgressReader(r io.ReadCloser, size int, output io.Writer) *progressReader
- func SelfPath() string
- func StoreImage(img *Image, layerData Archive, root string) error
- func SysInit()
- func Tar(path string, compression Compression) (io.Reader, error)
- func Trunc(s string, maxlen int) string
- func Unmount(target string) error
- func Untar(archive io.Reader, path string) error
- func ValidateId(id string) error
- type Archive
- type Change
- type ChangeType
- type Compression
- type Config
- type Container
- func (container *Container) Changes() ([]Change, error)
- func (container *Container) Cmd() *exec.Cmd
- func (container *Container) EnsureMounted() error
- func (container *Container) Export() (Archive, error)
- func (container *Container) ExportRw() (Archive, error)
- func (container *Container) FromDisk() error
- func (container *Container) GetImage() (*Image, error)
- func (container *Container) Kill() error
- func (container *Container) Mount() error
- func (container *Container) Mounted() (bool, error)
- func (container *Container) Output() (output []byte, err error)
- func (container *Container) ReadLog(name string) (io.Reader, error)
- func (container *Container) Restart() error
- func (container *Container) RootfsPath() string
- func (container *Container) Run() error
- func (container *Container) Start() error
- func (container *Container) StderrPipe() (io.ReadCloser, error)
- func (container *Container) StdinPipe() (io.WriteCloser, error)
- func (container *Container) StdoutPipe() (io.ReadCloser, error)
- func (container *Container) Stop() error
- func (container *Container) ToDisk() (err error)
- func (container *Container) Unmount() error
- func (container *Container) Wait() int
- func (container *Container) WaitTimeout(timeout time.Duration) error
- func (container *Container) When() time.Time
- type Graph
- func (graph *Graph) All() ([]*Image, error)
- func (graph *Graph) ByParent() (map[string][]*Image, error)
- func (graph *Graph) Create(layerData Archive, container *Container, comment string) (*Image, error)
- func (graph *Graph) Delete(id string) error
- func (graph *Graph) Exists(id string) bool
- func (graph *Graph) Garbage() (*Graph, error)
- func (graph *Graph) GarbageCollect() error
- func (graph *Graph) Get(id string) (*Image, error)
- func (graph *Graph) Heads() (map[string]*Image, error)
- func (graph *Graph) LookupRemoteImage(imgId string, authConfig *auth.AuthConfig) bool
- func (graph *Graph) LookupRemoteRepository(remote string, authConfig *auth.AuthConfig) bool
- func (graph *Graph) Map() (map[string]*Image, error)
- func (graph *Graph) Mktemp(id string) (string, error)
- func (graph *Graph) PullImage(imgId string, authConfig *auth.AuthConfig) error
- func (graph *Graph) PullRepository(stdout io.Writer, remote, askedTag string, repositories *TagStore, ...) error
- func (graph *Graph) PushImage(stdout io.Writer, imgOrig *Image, authConfig *auth.AuthConfig) error
- func (graph *Graph) PushRepository(stdout io.Writer, remote string, localRepo Repository, ...) error
- func (graph *Graph) Register(layerData Archive, img *Image) error
- func (graph *Graph) Undelete(id string) error
- func (graph *Graph) WalkAll(handler func(*Image)) error
- type History
- type IPAllocator
- type Image
- type ListOpts
- type NetworkInterface
- type NetworkManager
- type NetworkSettings
- type PortAllocator
- type PortMapper
- type Repository
- type Runtime
- func (runtime *Runtime) Commit(id, repository, tag string) (*Image, error)
- func (runtime *Runtime) Create(config *Config) (*Container, error)
- func (runtime *Runtime) Destroy(container *Container) error
- func (runtime *Runtime) Exists(id string) bool
- func (runtime *Runtime) Get(id string) *Container
- func (runtime *Runtime) List() []*Container
- func (runtime *Runtime) Load(id string) (*Container, error)
- func (runtime *Runtime) LogToDisk(src *writeBroadcaster, dst string) error
- func (runtime *Runtime) Register(container *Container) error
- type Server
- func (srv *Server) CmdAttach(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdCommit(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdDiff(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdExport(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdHistory(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdImages(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdImport(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdInfo(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdInspect(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdKill(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdLogin(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdLogs(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdPort(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdPs(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdPull(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdPush(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdRestart(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdRm(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdRmi(stdin io.ReadCloser, stdout io.Writer, args ...string) (err error)
- func (srv *Server) CmdRun(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdStart(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdStop(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdTag(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdVersion(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) CmdWait(stdin io.ReadCloser, stdout io.Writer, args ...string) error
- func (srv *Server) Help() string
- func (srv *Server) Name() string
- type State
- type TagStore
- func (store *TagStore) ById() map[string][]string
- func (store *TagStore) Get(repoName string) (Repository, error)
- func (store *TagStore) GetImage(repoName, tag string) (*Image, error)
- func (store *TagStore) ImageName(id string) string
- func (store *TagStore) LookupImage(name string) (*Image, error)
- func (store *TagStore) Reload() error
- func (store *TagStore) Save() error
- func (store *TagStore) Set(repoName, tag, imageName string, force bool) error
Constants ¶
const ( ChangeModify = iota ChangeAdd ChangeDelete )
const DEFAULT_TAG = "latest"
const LxcTemplate = `` /* 2658-byte string literal not displayed */
const REGISTRY_ENDPOINT = auth.REGISTRY_SERVER + "/v1"
FIXME: Set the endpoint in a conf file or via commandline const REGISTRY_ENDPOINT = "http://registry-creack.dotcloud.com/v1"
const VERSION = "0.1.0"
Variables ¶
var LxcTemplateCompiled *template.Template
Functions ¶
func ComputeId ¶
ComputeId reads from `content` until EOF, then returns a SHA of what it read, as a string.
func Debugf ¶
func Debugf(format string, a ...interface{})
Debug function, if the debug flag is set, then display. Do nothing otherwise If Docker is in damon mode, also send the debug info on the socket
func GenerateId ¶
func GenerateId() string
func Go ¶
Go is a basic promise implementation: it wraps calls a function in a goroutine, and returns a channel which will later return the function's return value.
func HumanDuration ¶
HumanDuration returns a human-readable approximation of a duration (eg. "About a minute", "4 hours ago", etc.)
func NopWriteCloser ¶
func NopWriteCloser(w io.Writer) io.WriteCloser
func ProgressReader ¶
func ProgressReader(r io.ReadCloser, size int, output io.Writer) *progressReader
func SysInit ¶
func SysInit()
Sys Init code This code is run INSIDE the container and is responsible for setting up the environment before running the actual process
func ValidateId ¶
Types ¶
type Change ¶
type Change struct { Path string Kind ChangeType }
type ChangeType ¶
type ChangeType int
type Compression ¶
type Compression uint32
const ( Uncompressed Compression = iota Bzip2 Gzip )
func (*Compression) Flag ¶
func (compression *Compression) Flag() string
type Config ¶
type Config struct { Hostname string User string Memory int64 // Memory limit (in bytes) MemorySwap int64 // Total memory usage (memory + swap); set `-1' to disable swap Detach bool Ports []int Tty bool // Attach standard streams to a tty, including stdin if it is not closed. OpenStdin bool // Open stdin Env []string Cmd []string Image string // Name of the image as it was passed by the operator (eg. could be symbolic) }
type Container ¶
type Container struct { Id string Created time.Time Path string Args []string Config *Config State State Image string NetworkSettings *NetworkSettings SysInitPath string // contains filtered or unexported fields }
func (*Container) EnsureMounted ¶
func (*Container) RootfsPath ¶
This method must be exported to be used from the lxc template
func (*Container) StderrPipe ¶
func (container *Container) StderrPipe() (io.ReadCloser, error)
func (*Container) StdinPipe ¶
func (container *Container) StdinPipe() (io.WriteCloser, error)
StdinPipe() returns a pipe connected to the standard input of the container's active process.
func (*Container) StdoutPipe ¶
func (container *Container) StdoutPipe() (io.ReadCloser, error)
func (*Container) WaitTimeout ¶
type Graph ¶
type Graph struct {
Root string
}
func (*Graph) GarbageCollect ¶
func (*Graph) LookupRemoteImage ¶
func (graph *Graph) LookupRemoteImage(imgId string, authConfig *auth.AuthConfig) bool
Check if an image exists in the Registry
func (*Graph) LookupRemoteRepository ¶
func (graph *Graph) LookupRemoteRepository(remote string, authConfig *auth.AuthConfig) bool
func (*Graph) PullImage ¶
func (graph *Graph) PullImage(imgId string, authConfig *auth.AuthConfig) error
func (*Graph) PullRepository ¶
func (graph *Graph) PullRepository(stdout io.Writer, remote, askedTag string, repositories *TagStore, authConfig *auth.AuthConfig) error
FIXME: Handle the askedTag parameter
func (*Graph) PushRepository ¶
func (graph *Graph) PushRepository(stdout io.Writer, remote string, localRepo Repository, authConfig *auth.AuthConfig) error
Push a repository to the registry. Remote has the format '<user>/<repo>
type IPAllocator ¶
type IPAllocator struct {
// contains filtered or unexported fields
}
IP allocator: Atomatically allocate and release networking ports
type Image ¶
type Image struct { Id string `json:"id"` Parent string `json:"parent,omitempty"` Comment string `json:"comment,omitempty"` Created time.Time `json:"created"` Container string `json:"container,omitempty"` ContainerConfig Config `json:"container_config,omitempty"` // contains filtered or unexported fields }
func NewImgJson ¶
Build an Image object from raw json data
func NewMultipleImgJson ¶
Build an Image object list from a raw json data FIXME: Do this in "stream" mode
type NetworkInterface ¶
type NetworkInterface struct { IPNet net.IPNet Gateway net.IP // contains filtered or unexported fields }
Network interface represents the networking stack of a container
func (*NetworkInterface) AllocatePort ¶
func (iface *NetworkInterface) AllocatePort(port int) (int, error)
Allocate an external TCP port and map it to the interface
func (*NetworkInterface) Release ¶
func (iface *NetworkInterface) Release() error
Release: Network cleanup - release all resources
type NetworkManager ¶
type NetworkManager struct {
// contains filtered or unexported fields
}
Network Manager manages a set of network interfaces Only *one* manager per host machine should be used
func (*NetworkManager) Allocate ¶
func (manager *NetworkManager) Allocate() (*NetworkInterface, error)
Allocate a network interface
type NetworkSettings ¶
type PortAllocator ¶
type PortAllocator struct {
// contains filtered or unexported fields
}
Port allocator: Atomatically allocate and release networking ports
func (*PortAllocator) Acquire ¶
func (alloc *PortAllocator) Acquire() (int, error)
func (*PortAllocator) Release ¶
func (alloc *PortAllocator) Release(port int) error
type PortMapper ¶
type PortMapper struct {
// contains filtered or unexported fields
}
Port mapper takes care of mapping external ports to containers by setting up iptables rules. It keeps track of all mappings and is able to unmap at will
func (*PortMapper) Unmap ¶
func (mapper *PortMapper) Unmap(port int) error
type Repository ¶
type Runtime ¶
type Runtime struct {
// contains filtered or unexported fields
}
func NewRuntime ¶
func NewRuntimeFromDirectory ¶
func (*Runtime) Commit ¶
Commit creates a new filesystem image from the current state of a container. The image can optionally be tagged into a repository
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
func (*Server) CmdHistory ¶
func (*Server) CmdInspect ¶
func (*Server) CmdRestart ¶
func (*Server) CmdVersion ¶
'docker version': show version information