Docker: Difference between revisions

<languages/>

[https://www.docker.com/ Docker] is a platform for building, packaging, and distributing applications inside containers. Containers bundle an application's code, configurations, and dependencies into a single object that runs consistently across different computing environments. Docker works well with NixOS through the virtualization module.<ref>https://www.docker.com/resources/what-container/</ref>

To temporarily use Docker in a shell environment, you can run:

<syntaxhighlight lang="bash">

nix-shell -p docker

</syntaxhighlight>

This will provide a shell with Docker CLI available, but note that the Docker daemon will not be running. For full functionality, you'll need a system-level installation.

To install Docker on NixOS, add the virtualization.docker module to your system configuration at <code>/etc/nixos/configuration.nix</code>:<ref>https://nixos.org/manual/nixos/stable/options#opt-virtualisation.docker.enable</ref>

<syntaxhighlight lang="nix">

# In /etc/nixos/configuration.nix

{{evaluate}}

For a comprehensive list of configuration options, refer to the {{nixos:option|virtualisation.docker}} module options.

The basic Docker configuration on NixOS includes several options you can set in your <code>configuration.nix</code> file:

<syntaxhighlight lang="nix">

virtualisation.docker = {

</syntaxhighlight>

For more advanced configuration, you can customize Docker daemon options and networking:

<syntaxhighlight lang="nix">

virtualisation.docker = {

</syntaxhighlight>

Currently, there are two options to use Docker Compose with NixOS: Arion or Compose2Nix.

Compose2Nix, generates all necessary configs directly from the <code>docker-compose.yml</code>, which is easier when using an already existing Docker Compose project. The result is similar to that from Arion: a systemd service is created that handles starting and stopping the container.

[https://docs.hercules-ci.com/arion/ Arion] is created for running Nix-based projects in Docker Compose. It uses the NixOS module system for configuration, it can bypass <code>docker build</code> and lets you use dockerTools or use the store directly in the containers. The images/containers can be typical dockerTools style images or full NixOS configs.

To use Arion, you first need to add its module to your NixOS configuration:

<syntaxhighlight lang="nix">

</syntaxhighlight>

After that, you can access its options under

<syntaxhighlight lang="nix">

virtualisation.arion = {}

</syntaxhighlight>

A config for a simple container could look like this:

<syntaxhighlight lang="nix">

</syntaxhighlight>

nix shell github:aksiksi/compose2nix

compose2nix -h

compose2nix = {

   url = "github:aksiksi/compose2nix";

   inputs.nixpkgs.follows = "nixpkgs";

};

environment.systemPackages = [

   inputs.compose2nix.packages.x86_64-linux.default

</syntaxhighlight>

After you have installed <code>compose2nix</code>, you can run <code>compose2nix</code> in the directory with your <code>docker-compose.yml</code>, which will output a <code>docker-compose.nix</code>.

compose2nix -inputs input.yml -output output.nix -runtime docker

If you use the [[btrfs]] file system, you might need to set the {{nixos:option|virtualisation.docker.storageDriver|storageDriver}} option:

<syntaxhighlight lang="nix">

virtualisation.docker.storageDriver = "btrfs";

</syntaxhighlight>

</syntaxhighlight>

$ systemctl --user start docker

</syntaxhighlight>

$ systemctl --user status docker

</syntaxhighlight>

There is an entry for [https://nixos.org/nixpkgs/manual/#sec-pkgs-dockerTools dockerTools] in the Nixpkgs manual for reference. In the linked page, they give the following example config:

<syntaxhighlight lang="nix">

</syntaxhighlight>

More examples can be found in the [https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/docker/examples.nix nixpkgs] repo.

Also check out the excellent article by [https://lucabrunox.github.io/2016/04/cheap-docker-images-with-nix_15.html lethalman] about building minimal docker images with nix.

The manual advises against using <code>created = "now"</code>, as that prevents images from being reproducible.

An alternative, if using [[flakes]], is to do <code>created = builtins.substring 0 8 self.lastModifiedDate</code>, which uses the commit date, and is therefore reproducible.

The <code>sha256</code> argument of the <code>dockerTools.pullImage</code> function is the checksum of the archive generated by Skopeo. Since the archive contains the name and the tag of the image, Skopeo arguments used to fetch the image have to be identical to those used by the <code>dockerTools.pullImage</code> function.

For instance, the SHA of the following image

<syntaxhighlight lang="nix">

pkgs.dockerTools.pullImage{

</syntaxhighlight>

can be manually generated with the following shell commands

<syntaxhighlight lang="bash">

</syntaxhighlight>

Instead of copying Nix packages into Docker image layers, Docker can be configured to directly utilize the <code>nix-store</code> by integrating with [https://github.com/pdtpartners/nix-snapshotter nix-snapshotter].

This will significantly reduce data duplication and the time it takes to pull images.

<syntaxhighlight lang="nix">

# Enable Podman in configuration.nix

</syntaxhighlight>

By default, the Docker daemon stores images, containers, and build context on the root file system. To use a different storage location, specify a new <code>data-root</code> in your configuration:

<syntaxhighlight lang="nix">

virtualisation.docker.daemon.settings = {

</syntaxhighlight>

You can run Docker containers as systemd services using the <code>oci-containers</code> module:

<syntaxhighlight lang="nix">

virtualisation.oci-containers = {

</syntaxhighlight>

A more advanced example:

<syntaxhighlight lang="nix">

{ config, pkgs, ... }:

</syntaxhighlight>

See [https://search.nixos.org/options?from=0&size=50&sort=alpha_asc&query=virtualisation.oci-containers oci-containers] for further options.

Unless otherwise specified, NixOS uses Podman to run OCI containers. Note that these are '''user-specific''', so running commands with or without sudo can change your output.

# podman ps

# podman restart hackagecompare

# podman ls

# podman rm hackagecompare

# podman rmi c0d9a5f58afe

# podman pull chrissound/hackagecomparestats-webserver:latest

# podman exec -ti $ContainerId /bin/sh

</syntaxhighlight>

If you have a service running on the host that you want to connect to from the container, you could try connecting to the hostname <code>host.containers.internal</code> (or <code>host.docker.internal</code> for podman), but this might require additional networking setup

If you have a service running on the host that exposes a socket, such as mariadb, you can also expose that socket to the container instead. You'll want to expose the folder the socket is in as a volume - so:

<syntaxhighlight lang="bash">

       volumes = [

       ];

</syntaxhighlight>

This is not supported. You're better off installing the docker daemon [https://docs.docker.com/engine/install/ "the normal non-nix way"].

See the discourse discussion: [https://discourse.nixos.org/t/how-to-run-docker-daemon-from-nix-not-nixos/43413 How to run docker daemon from nix (not NixOS)] for more.

If you encounter errors connecting to the Docker daemon, check that:

- You've logged out and back in after adding your user to the docker group

When Docker uses too much disk space:

<syntaxhighlight lang="bash">

# Remove unused containers, networks, images, and volumes

</syntaxhighlight>

Docker's default subnet (`172.17.0.0/16`) might conflict with your existing network. Configure a different subnet in your `configuration.nix`:

<syntaxhighlight lang="nix">

virtualisation.docker.daemon.settings = {

</syntaxhighlight>

When connecting to a public Wi-Fi, where the login page's IP-Address is within the Docker network range, accessing the Internet might not be possible. This has been reported when trying to connect to the WIFIonICE of the Deutsche Bahn (DB). They use the <code>172.18.x.x</code> address range.

This can be resolved by changing the default address pool that Docker uses.

<syntaxhighlight lang="nix">

virtualisation.docker = {

};

</syntaxhighlight>

Restarting the container or Docker might be required.

<references/>