Docker can now run within Docker

http://blog.docker.io/2013/09/docker-can-now-run-within-docker/

by jpetazzo • 13 years ago

150 43 13 years ago

blog.docker.io

jpetazzo8• 13 years ago

This is one of the many potential applications of the new "-privileged" flag of Docker. This is very exciting, because it means that we will soon run Docker CI within Docker itself (instead of ad-hoc VMs), among other things!

contingencies• 13 years ago

To be fair this is a standard feature of Linux Control Groups that's existed for years now. For more info on how that works, see https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt

jpetazzo8• 13 years ago

Cgroups and namespaces. Even though some namespaces are nested (typically, the PID namespace) why others don't need to be.

There is nothing special with nesting cgroups and namespaces from the kernel point of view. The interesting part is to work around the little details (as anybody who ran nested LXC containers will know) :-)

andrewmunsell3• 13 years ago

The big thing for me about the privileged flag is the ability to run VPN software on the containers-- this way, they can talk to each other cross-physical-machine as well as between containers on the same host.

jpetazzo8• 13 years ago

We're on the same page. That's my next hack — an OpenVPN server within Docker. The blog post, Dockerfile, and helper scripts should be out next week :-)

tlrobinson2• 13 years ago

Mostly-unrelated question: could one build a desktop Linux distribution around Docker? Or rather, how difficult would it be? I assume OS X's application sandboxing uses a technology similar to LXC.

joffreyf• 13 years ago

You might be looking for something akin to http://coreos.com/ !

tlrobinson2• 13 years ago

CoreOS could be a good starting point, but it's intended for servers so it's very bare bones (and the service discovery stuff might not make much sense)

wmf• 13 years ago

Some people are working in that direction, see https://people.gnome.org/~alexl/glick2/ and http://lwn.net/Articles/562138/ Because this stuff is older than Docker it tends to be Dockerish but not actually Docker.

jpetazzo8• 13 years ago

Depends what you have in mind, I guess.

You could run most essential system components (syslog, ssh, cron...) inside containers, and bind-mount /home when it makes sense. Since those components need elevated privileges, I don't know if containers would be that useful... And then systemd already puts services in cgroups; it's a nice approach (IMHO).

Or you could use containers a bit like virtualenvs. If you're a Python developer familiar with virtualenvwrapper, you probably use mkvirtualenv when you start working on a new project (or on a different setup for an existing project). Containers could be used in a similar manner with some clever wrappers.

arnley• 13 years ago

so meta

nnnnni• 13 years ago

Also "yo dawg...".

Now that the obligatory comments have been covered, we can move on. Yay!

jpetazzo8• 13 years ago

Yeah... Note for future self: make all the mandatory lame jokes in the blog post itself, so people don't feel obligated to do them on HN instead. ;-)

mrmondo• 13 years ago

I take it you break out of docker-docker when you here the theme from inception starting to play.

segeek• 13 years ago

Very nice!

One thing that I am looking forward to is Docker support for Windows. Would really like to see that feature.

yebyen2• 13 years ago

There is Docker within Vagrant, I have a Windows 7 desktop in front of me and all I need to do to enter my CoreOS system is "vagrant up; vagrant ssh" from the git shell.

I don't think there will be direct Docker support for Windows (erm... hrm)

http://coreos.com/blog/coreos-vagrant-images/

yebyen2• 13 years ago

Actually I do remember hearing that docker/lxc was only the beginning, can you be more specific? What virtualization tech in Windows do you want to see Docker containers running in?

There's no reason you can't run CoreOS in qemu or CoreOS in VirtualBox, but all of those things are still coming back to Linux Containers. Did you have an idea of another way?

jpetazzo8• 13 years ago

Are you looking forward to run the Docker CLI in Windows (i.e., being able to use Docker commands from a Windows machine, while the containers run on a remote box), or run the containers themselves on a Windows box?

csears• 13 years ago

I wouldn't expect Windows support anytime soon, especially Windows containers running in a Linux host using LXC as the "hypervisor".

Windows containers running in a Windows host is much more likely. Commercial solutions like Virtuozzo Containers offer Windows on Windows support today [1]. Someone could implement a Virtuozzo-for-Windows provider for Docker, but that seems like a long shot.

[1] http://www.parallels.com/products/pvc/what-s-new-for-windows...

gcr4• 13 years ago

Would each container run on something like coLinux?

(coLinux is a port of the Linux kernel to run as an ordinary Windows program, so you can run the Linux kernel as a Windows userland program by double-clicking on "linux.exe"; then you can SSH in and mess around, etc)

songgao• 13 years ago

Another feature liberated by `-privilege ` that I like a lot is ability to run `mknod`, which is necessary for using TUN/TAP interface.

outside1234• 13 years ago

Does anyone know if there are plans for when docker will be able to run in 32-bit?

dsissitka• 13 years ago

It'll work now if you remove this if block...

https://github.com/dotcloud/docker/blob/master/server.go#L12...

...and create your own images.

It's unsupported, but it'll work.

pearjuice2• 13 years ago

I remember running VMs in VMs when I was younger and wondered how far I could go before my computer would implode. Infinite recursion is amazing. Let me rephrase that; infinity is amazing.

null_ptr• 13 years ago

How far did you get? :-)

kozhevnikov• 13 years ago

To infinity and beyond.

pearjuice2• 13 years ago

After three to four iterations (cannot remember precisely) I couldn't split up my computer its capacities any further to qualify for any decent OS its specifications which could run another VM. Please note that this was years ago, I suggest you should try it!

Unless you want to waste a lot of time installing the nested OS's, like I did, I suggest using pre-installed images you can throw right in.

likeclockwork2• 13 years ago

When will Docker support distros other than Ubuntu?

jpetazzo8• 13 years ago

There is already some support for Gentoo and Archlinux, and if you are willing to use a "foreign" kernel, Red Hat / Fedora / CentOS work as well.

There is some significant work in progress to add compatibility for non-AUFS systems. I don't have an accurate timeline at this point, but expect something (or at least an announcement) at the end of the month!

jlgreco• 13 years ago

Good to hear. I've played around with Docker a bit but I don't have a compelling enough use for it yet to keep on building AUFS kernels.

gcr4• 13 years ago

Last I checked, using Docker on Arch required a custom kernel with the AUFS patch. Is that still true?

Edit: yes, docker on arch still requires a custom kernel. See http://docs.docker.io/en/latest/installation/archlinux/

likeclockwork2• 13 years ago

Thanks for the information!

tachion• 13 years ago

It is nice to see, especially because fast moving project is always an enjoyable thing to observer. As a sidenote, to increase overall awareness, FreeBSD has capability for hierarchical Jails (Jails inside of Jails) for a while.

bachback• 13 years ago

Amazing. What do the docker guys think of coreOS?

Docker can now run within Docker

Related Stories