Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende ÜberarbeitungLetzte ÜberarbeitungBeide Seiten der Revision | ||
content:serverbasics:docker [2023/12/21 09:42] – [Optional Docker- Directory] Daniel | content:serverbasics:docker [2024/05/19 08:56] – [Check Docker install] Daniel | ||
---|---|---|---|
Zeile 1: | Zeile 1: | ||
- | ====== Docker ====== | + | ====== Docker |
Docker is a powerful solution for setting up Services. This on will give you hints how to setup Docker in a good way. | Docker is a powerful solution for setting up Services. This on will give you hints how to setup Docker in a good way. | ||
Currently i am Experimenting on that topic, so maybe this documentation will be ready to use, maybe not. | Currently i am Experimenting on that topic, so maybe this documentation will be ready to use, maybe not. | ||
- | |||
- | ===== Docker rootless ===== | ||
Docker itself is nice, but it will run as root per default, which is a no-go at all. This will setup Docker in rootless- mode on OpenSuSE (currently Leap 15.5). | Docker itself is nice, but it will run as root per default, which is a no-go at all. This will setup Docker in rootless- mode on OpenSuSE (currently Leap 15.5). | ||
- | ==== Package | + | ===== Filesystem Layout ===== |
- | While Docker-Rootless is not in the main Repositories, first add the AddOn- Repository: | + | Mind, that at the time writing, '' |
- | Then install the package | + | I personally dislike xfs, especially while its not rubust and won't shrink. I use it anyway, because of its srong advise to do so - with kernel 5.19+ it should be possible to get overlay2 working on btrfs, but still there are thinks that may not work even with that kernel. |
- | ==== User ==== | + | |
- | Create a new user and maybe give this user another home-directory, as it will store all files of docker. | + | So make sure, that the Home-Directory |
- | Let's say choose home ''/ | + | Warning: you may have umask set your way - i prefer 007 as writte before. But if you change umask and permissions be very cautious, as docker |
- | Also it may be a good choice, not to have this user added to '' | + | __**STRONG WARNING: Don't change permissions or ownership of docker- directories on the Host directly |
- | ==== Install rootless Docker ==== | + | |
- | Warning: You CANNOT sudo to this user and install docker | + | __**The only way to manage Volume- File- Permissions is to bash inside the running container itself |
+ | ===== Packages NOT to install | ||
+ | |||
+ | I had really a lot of troubles with the package in the AddOn- Repository: '' | ||
+ | |||
+ | So i disabled the following packages and locked them to never install: | ||
+ | |||
+ | * docker | ||
+ | * docker-compose | ||
+ | * containerd | ||
+ | |||
+ | Check out beneath for install the docker way. | ||
+ | |||
+ | ===== Docker- User ===== | ||
+ | |||
+ | Create a new **group** | ||
+ | |||
+ | Attention: The Home Directory should be on a volume having XFS as btrfs or others are not fully supported right now (20.04.2024 - patches in new Kernel 5.19 are incoming, but this Kernel is not released until now and still there are some problems open in developement there). | ||
+ | |||
+ | ===== cGroups v2 ===== | ||
+ | |||
+ | OpenSuSE Leap 15.5 does not have cGroups v2 enabled, which are needed by docker. | ||
+ | |||
+ | You may see a warning (later) when running '' | ||
+ | |||
+ | '' | ||
+ | |||
+ | According to this documentation [[https:// | ||
+ | |||
+ | '' | ||
+ | |||
+ | and also the delegation for the user of cpu is needed: | ||
< | < | ||
+ | $ sudo mkdir -p / | ||
+ | $ cat <<EOF | sudo tee / | ||
+ | [Service] | ||
+ | Delegate=cpu cpuset io memory pids | ||
+ | EOF | ||
+ | $ sudo systemctl daemon-reload | ||
+ | |||
+ | </ | ||
+ | |||
+ | after this, reboot and check if ''/ | ||
+ | |||
+ | After installing docker (see beneath), check if '' | ||
+ | < | ||
+ | |||
+ | Cgroup Driver: systemd | ||
+ | Cgroup Version: 2 | ||
+ | |||
+ | </ | ||
+ | |||
+ | Than, its fine. | ||
+ | |||
+ | ===== Install rootless Docker ===== | ||
+ | |||
+ | Warning: You CANNOT sudo to the user and install docker, while logon via pam is needed, which is not when you sudo. You need to ssh into your machine, or yust logon in a usual way: | ||
+ | |||
+ | < | ||
If you login in the system using either of | If you login in the system using either of | ||
- graphical session | - graphical session | ||
Zeile 35: | Zeile 88: | ||
</ | </ | ||
- | I chose to ssh into my machine directly: | + | I chose to ssh into my machine directly, than check your umask to be secure and install docker like this: |
- | <file> | + | <code> |
- | #> ssh localhost -l docker | + | # ~> ssh localhost -l docker |
- | #> pwd | + | Password: |
- | / | + | Have a lot of fun... |
- | #> dockerd-rootless-setuptool.sh check | + | docker@pcserver2023: |
- | [INFO] Requirements are satisfied | + | 0007 |
- | #> dockerd-rootless-setuptool.sh install | + | docker@pcserver2023: |
- | [INFO] Creating /srv/docker-user/ | + | # Installing stable version 25.0.2 |
+ | # Executing docker rootless install script, commit: 3b2a83b | ||
+ | % Total % Received % Xferd Average Speed | ||
+ | | ||
+ | 100 68.2M 100 68.2M 0 | ||
+ | % Total % Received % Xferd Average Speed | ||
+ | | ||
+ | 100 19.7M 100 19.7M 0 | ||
+ | + PATH=/ | ||
+ | + / | ||
+ | [INFO] Creating /home/ | ||
[INFO] starting systemd service docker.service | [INFO] starting systemd service docker.service | ||
+ systemctl --user start docker.service | + systemctl --user start docker.service | ||
Zeile 52: | Zeile 115: | ||
+ systemctl --user --no-pager --full status docker.service | + systemctl --user --no-pager --full status docker.service | ||
● docker.service - Docker Application Container Engine (Rootless) | ● docker.service - Docker Application Container Engine (Rootless) | ||
- | | + | Loaded: loaded (/home/ |
- | Active: active (running) since Tue 2023-12-19 17:53:39 CET; 3s ago | + | |
- | Docs: https:// | + | |
- | Main PID: 6774 (rootlesskit) | + | |
- | CGroup: / | + | |
- | ├─ | + | |
- | p=auto --disable-host-loopback --port-driver=builtin --copy-up=/ | + | CPU: 224ms |
- | in/ | + | CGroup: / |
- | ├─ | + | |
- | comp=auto --disable-host-loopback --port-driver=builtin --copy-up=/ | + | |
- | r/ | + | |
- | ├─ | + | |
- | 85 tap0 | + | |
- | ├─ | + | |
- | └─ | + | |
+ DOCKER_HOST=unix:/// | + DOCKER_HOST=unix:/// | ||
- | + /usr/bin/docker version | + | + /home/docker/bin/docker version |
Client: | Client: | ||
- | Version: | + | Version: |
- | API version: | + | API version: |
- | Go version: | + | Go version: |
- | Git commit: | + | Git commit: |
- | Built: | + | |
- | OS/ | + | |
- | Context: | + | |
- | Server: | + | Server: |
- | Engine: | + | |
- | | + | Version: |
- | API version: | + | API version: |
- | Go version: | + | Go version: |
- | Git commit: | + | Git commit: |
- | | + | Built: |
- | | + | OS/ |
- | | + | Experimental: |
- | containerd: | + | |
- | | + | Version: |
- | | + | GitCommit: |
- | runc: | + | |
- | | + | Version: |
- | | + | GitCommit: |
- | docker-init: | + | |
- | | + | Version: |
- | | + | GitCommit: |
- | rootlesskit: | + | |
- | | + | Version: |
- | | + | ApiVersion: |
- | | + | NetworkDriver: |
- | | + | PortDriver: |
- | | + | StateDir: |
- | slirp4netns: | + | vpnkit: |
- | | + | Version: |
- | | + | |
+ systemctl --user enable docker.service | + systemctl --user enable docker.service | ||
- | Created symlink /srv/docker-user/ | + | Created symlink /home/ |
- | config/ | + | |
[INFO] Installed docker.service successfully. | [INFO] Installed docker.service successfully. | ||
[INFO] To control docker.service, | [INFO] To control docker.service, | ||
Zeile 118: | Zeile 177: | ||
[INFO] Make sure the following environment variable(s) are set (or add them to ~/.bashrc): | [INFO] Make sure the following environment variable(s) are set (or add them to ~/.bashrc): | ||
- | export PATH=/usr/bin:$PATH | + | export PATH=/home/docker/bin:$PATH |
[INFO] Some applications may require the following environment variable too: | [INFO] Some applications may require the following environment variable too: | ||
export DOCKER_HOST=unix:/// | export DOCKER_HOST=unix:/// | ||
- | </file> | + | </code> |
- | So, this looks nice. | + | So, this looks very nice. **Important: |
- | Mind, that now your volumes | + | ===== Check Docker install ===== |
- | ==== Optional | + | |
+ | Log out of docker user if you are still in from install. Then, log back in to apply the bashrc- settings. | ||
+ | |||
+ | Ceck the Environement to have the settings: | ||
+ | |||
+ | < | ||
+ | docker@pcserver2023: | ||
+ | Connection to localhost closed. | ||
+ | obel1x@pcserver2023: | ||
+ | Password: | ||
+ | Last login: Sat Apr 20 15:18:56 2024 from ::1 | ||
+ | Have a lot of fun... | ||
+ | docker@pcserver2023: | ||
+ | unix:/// | ||
+ | |||
+ | </ | ||
+ | |||
+ | Now check '' | ||
+ | < | ||
+ | docker@pcserver2023: | ||
+ | Client: | ||
+ | | ||
+ | | ||
+ | Debug Mode: false | ||
+ | |||
+ | Server: | ||
+ | | ||
+ | Running: 0 | ||
+ | Paused: 0 | ||
+ | Stopped: 0 | ||
+ | | ||
+ | | ||
+ | | ||
+ | Backing Filesystem: xfs | ||
+ | Supports d_type: true | ||
+ | Using metacopy: false | ||
+ | Native Overlay Diff: false | ||
+ | userxattr: true | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | Volume: local | ||
+ | Network: bridge host ipvlan macvlan null overlay | ||
+ | Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog | ||
+ | | ||
+ | | ||
+ | | ||
+ | Init Binary: docker-init | ||
+ | | ||
+ | runc version: v1.1.12-0-g51d5e94 | ||
+ | init version: de40ad0 | ||
+ | | ||
+ | seccomp | ||
+ | | ||
+ | rootless | ||
+ | cgroupns | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | CPUs: 8 | ||
+ | Total Memory: 30.79GiB | ||
+ | Name: pcserver2023 | ||
+ | ID: 45699224-ea9c-4865-8dea-a53bb20b788c | ||
+ | | ||
+ | Debug Mode: false | ||
+ | | ||
+ | | ||
+ | 127.0.0.0/8 | ||
+ | Live Restore Enabled: false | ||
+ | | ||
+ | |||
+ | </ | ||
+ | |||
+ | ==== Additional knowledge ==== | ||
+ | |||
+ | * Storage driver and FS-Type : overlay2 should always be used, btrfs is outdated! XFS and d_type are important! | ||
+ | * CGroup Version needs to be 2 or better | ||
+ | * If you see Docker complaining about Module aufs at start: do not care about - that module is obsolete | ||
+ | |||
+ | ===== IP-Filter ===== | ||
+ | |||
+ | When starting Docker, an the log says: | ||
+ | |||
+ | < | ||
+ | level=warning msg=" | ||
+ | level=info msg=" | ||
+ | |||
+ | </ | ||
+ | |||
+ | You first need to load the module with modprobe. | ||
+ | |||
+ | For system startup, use ''/ | ||
+ | |||
+ | |||
+ | ===== IPTables ===== | ||
+ | |||
+ | If you see '' | ||
+ | |||
+ | < | ||
+ | WARNING: bridge-nf-call-iptables is disabled | ||
+ | WARNING: bridge-nf-call-ip6tables is disabled | ||
+ | |||
+ | </ | ||
+ | |||
+ | This should be fixed by: | ||
+ | |||
+ | < | ||
+ | # sudo echo "net.bridge.bridge-nf-call-iptables = 1">> | ||
+ | # sudo echo " | ||
+ | # sudo modprobe br_netfilter | ||
+ | # sudo sysctl --system | ||
+ | |||
+ | </ | ||
+ | |||
+ | |||
+ | ===== Configuring | ||
in rootless-mode, | in rootless-mode, | ||
Zeile 134: | Zeile 310: | ||
'' | '' | ||
- | by default, the path and the file is not existent, | + | **by default, the path and the file is not existent, |
- | + | ||
- | For example use another directory für your data in that file: | + | |
+ | For example, enable IPv6. See [[https:// | ||
< | < | ||
+ | |||
{ | { | ||
- | " | ||
- | " | ||
" | " | ||
" | " | ||
- | " | + | " |
- | " | + | " |
" | " | ||
" | " | ||
Zeile 154: | Zeile 328: | ||
</ | </ | ||
- | Here, ipv6 support has been turned on. See [[https:// | + | You need to adjust cidr to match your network, check first 4 blocks of '' |
+ | Notice: Don't use '' | ||
- | ===== Filesystem Layout | + | ===== Install docker compose |
- | Mind, that at the time writing | + | The command |
- | For checking which filesystem is in use, see '' | + | Installing it the manual way: |
- | < | + | |
- | Storage Driver: overlay2 | + | |
- | | + | |
- | | + | |
- | Using metacopy: false | + | |
- | | + | |
- | | + | |
- | </file> | + | Edit the File '' |
+ | <code> | ||
- | If you create a XFS-Filesystem with Leap 15.5 it will have '' | + | export DOCKER_CONFIG=${DOCKER_CONFIG: |
- | For me, i like btrfs a bit more than xfs, so i chose to have three different locations for docker on two filesystems (which are raided lvms. Check out the other docs here): | + | </ |
- | < | + | Then relog to the docker |
- | #> mount | grep /srv | + | |
- | / | + | |
- | / | + | |
- | </file> | + | <code> |
+ | docker@pcserver2023: | ||
+ | docker@pcserver2023: | ||
+ | % Total % Received % Xferd Average Speed | ||
+ | | ||
+ | 0 | ||
+ | 100 59.8M 100 59.8M 0 | ||
+ | docker@pcserver2023: | ||
+ | docker@pcserver2023: | ||
+ | Docker Compose version v2.26.1 | ||
+ | docker@pcserver2023: | ||
- | and in /srv i have | + | </code> |
- | <file> | + | |
- | #> ls /srv/ | grep docker | + | Your done with the compose |
- | docker #-> for storing docker-data using xfs | + | |
- | docker-compose | + | |
- | docker-user #-> this is the home of the docker user, containing the executables in user-space | + | |
- | </ | + | ===== Update ===== |
- | ==== ... and the permissions of the files ==== | + | If you want to update your docker- installation, |
- | For me i would like the files only be read/writeable for user docker and group docker: | + | < |
- | < | + | #!/bin/bash |
+ | # | ||
+ | systemctl --user stop docker | ||
+ | rm -f ~/ | ||
+ | curl -fsSL https:// | ||
+ | #need to give the new binary permissions to acces privileged network ports (beneath 1024) | ||
+ | sudo setcap ' | ||
- | #:~ # cd /srv | + | # If you installed docker compose, check the newest version first at https://github.com/docker/ |
- | #:/srv # chown docker | + | curl -SL https:// |
- | #:/srv # chgrp docker docker* | + | |
- | #:/srv # setfacl -m d:u::rwX -R docker* | + | |
- | #:/srv # setfacl -m d:g::rwX -R docker* | + | |
- | #:/srv # setfacl | + | |
- | #:/srv # setfacl | + | |
- | #:/srv # setfacl -m u::rwX -R docker* | + | |
- | #:/srv # setfacl | + | |
- | </code> | + | </file> |
- | Unfortunatelly, | ||
- | So if you would like to have your files really secured from other user, you can create the volume with an umask - e.g.: | + | ===== Create a place for Yamls ===== |
- | '' | + | Now, that you have compose, you can use it to setup your services with YAML- Files. Each service should have a directory for its own. |
- | That would make all files in the Volume | + | |
- | In Docker-Compose use this in your yml: | + | Make a directory with '' |
- | + | ||
- | < | + | |
- | volumes: | + | |
- | volumename: | + | |
- | driver_opts: | + | |
- | device: "" | + | |
- | type: "" | + | |
- | o: " | + | |
- | + | ||
- | </ | + | |
- | + | ||
- | Device | + | |
===== First Docker App: Portainer ===== | ===== First Docker App: Portainer ===== | ||
- | Now - finally its time for our first running Container. As the Portainer- App is the most important Management- Software in Docker, let's run it in a safe userspaced way now. | + | Now - finally its time for our first running Container. As the Portainer- App is an important Management- Software in Docker |
- | As always, SSH into your docker- user and than create the folders and yml-files for portainer. | + | As always, SSH into your docker- user and than create the folders and yml-files for docker compose and portainer. |
+ | < | ||
- | < | ||
obel1x@server: | obel1x@server: | ||
- | |||
Password: | Password: | ||
- | docker@server:~> cd /srv/ | + | docker@pcserver2023:~> cd ~/docker_compose |
- | docker@server:~> mkdir portainer | + | docker@pcserver2023:~/ |
- | docker@server:/srv/ | + | docker@pcserver2023:~/docker_compose> cd portainer |
- | docker@server:/srv/docker-compose/ | + | docker@pcserver2023:~/docker_compose> |
- | # file: . | + | docker@pcserver2023:~/docker_compose> |
- | # owner: docker | + | |
- | # group: docker | + | |
- | user::rwx | + | |
- | group:: | + | |
- | other:: | + | |
- | default: | + | |
- | default: | + | |
- | default: | + | |
- | + | ||
- | docker@server:/srv/ | + | |
</ | </ | ||
- | put the following into that file: | + | Put the following into that file: |
< | < | ||
- | version: " | ||
services: | services: | ||
| | ||
- | | + | |
| | ||
| | ||
- 9000:9000 | - 9000:9000 | ||
+ | - 9433:9433 | ||
| | ||
- portainer_data:/ | - portainer_data:/ | ||
Zeile 275: | Zeile 421: | ||
volumes: | volumes: | ||
| | ||
- | | ||
- | | ||
- | type: "" | ||
- | o: " | ||
</ | </ | ||
- | now start your app: | + | Check, that the Socket- Path is the correct one. |
- | < | + | Now start your app and look the magic: |
- | docker@server: | + | |
- | [...] | + | |
- | ⠿ Container portainer-portainer-1 | + | |
- | + | ||
- | </ | + | |
- | + | ||
- | Check the volume has been created at the right location | + | |
< | < | ||
- | docker@server:~> docker | + | docker@pcserver2023:~/ |
- | [ | + | [+] Running 12/12 |
- | { | + | ✔ portainer Pulled |
- | " | + | ✔ 379538b6d68e Pull complete |
- | " | + | ✔ 4ea3e2c3a39b Pull complete |
- | " | + | ✔ 5171176db7f2 Pull complete |
- | "com.docker.compose.project": | + | ✔ 52e9438966a5 Pull complete |
- | "com.docker.compose.version": | + | ✔ 43d4775415ac Pull complete |
- | "com.docker.compose.volume": | + | ✔ c1cad9f5200f Pull complete |
- | }, | + | ✔ 22eab514564f Pull complete |
- | " | + | ✔ 962b9fa821a2 Pull complete |
- | " | + | ✔ c153fefda5ce Pull complete |
- | " | + | ✔ bed990c4615b Pull complete |
- | " | + | ✔ 4f4fb700ef54 Pull complete |
- | **" | + | [+] Running 3/3 |
- | " | + | ✔ Network portainer_default |
- | }, | + | ✔ Volume |
- | " | + | ✔ Container portainer-portainer-1 |
- | } | + | docker@pcserver2023:~/ |
- | ] | + | |
</ | </ | ||
- | and finally if the files have been created only readable by the user: | + | Now you can go to [[http:// |
- | + | ||
- | < | + | |
- | ls / | + | |
- | -rw——- 1 docker docker 77 21. Dez 09:37 / | + | |
- | + | ||
- | / | + | |
- | insgesamt 40 | + | |
- | drwx——+ 2 docker docker 6 21. Dez 09:37 bin | + | |
- | drwx——+ 2 docker docker 37 21. Dez 09:37 certs | + | |
- | drwx——+ 2 docker docker 29 21. Dez 09:37 chisel | + | |
- | drwx——+ 2 docker docker 6 21. Dez 09:37 compose | + | |
- | drwx——+ 2 docker docker 25 21. Dez 09:37 docker_config | + | |
- | -rw——- 1 docker docker 65536 21. Dez 09:37 portainer.db | + | |
- | -rw——- 1 docker docker 227 21. Dez 09:37 portainer.key | + | |
- | -rw——- 1 docker docker 190 21. Dez 09:37 portainer.pub | + | |
- | drwx——+ 2 docker docker 6 21. Dez 09:37 tls | + | |
- | + | ||
- | / | + | |
- | insgesamt 0 | + | |
- | + | ||
- | / | + | |
- | insgesamt 8 | + | |
- | -rw——- 1 docker docker 518 21. Dez 09:37 cert.pem | + | |
- | -rw——- 1 docker docker 227 21. Dez 09:37 key.pem | + | |
- | + | ||
- | / | + | |
- | insgesamt 4 | + | |
- | -rw——- 1 docker docker 227 21. Dez 09:37 private-key.pem | + | |
- | + | ||
- | / | + | |
- | insgesamt 0 | + | |
- | + | ||
- | / | + | |
- | insgesamt 4 | + | |
- | -rw-r—– 1 docker docker 389 21. Dez 09:37 config.json | + | |
- | + | ||
- | / | + | |
- | insgesamt 0 | + | |
- | + | ||
- | </ | + | |
- | + | ||
- | this is amazing, right ;) ? | + | |
- | + | ||
- | Now you can go to [[http:// | + | |
{{ .: | {{ .: | ||
- | Thats all here, cheers! | + | Thats all: Docker is running and serving your services, cheers! |