Docker: Difference between revisions

(9 intermediate revisions by 8 users not shown)

Line 32:

To install Docker on NixOS, add the virtualization.docker module to your system configuration at <code>/etc/nixos/configuration.nix</code>:<ref>https://nixos.org/manual/nixos/stable/options#opt-virtualisation.docker.enable</ref>

(Note that it may take a restart for the group changes to take effect.)

</translate>

Line 52:

Line 53:

== Configuration ==

</translate>

Line 276:

Line 278:

$ systemctl --user start docker

</syntaxhighlight>

{{note|User services do not persist after logging out by default. This will cause any Docker containers to stop if a user logs out. Set option {{nixos:option|users.users.*.linger|users.users.<name>.linger}} to true for Docker containers to persist. See [[Systemd/User Services#Keeping user services running after logout]] for more details.}}

Line 292:

Line 296:

=== Using Privileged Ports for Rootless Docker ===

Rootless containers are not able to ports from 0 to 1023 as such port can only be used by privileged users. This problem can be solved by using port forwarding.

Rootless containers are not able to bind ports from 0 to 1023 as such port can only be used by privileged users. This problem can be solved by using port forwarding.

Assume you'd like a rootless container to make use of ports 53 (DNS; TPC and UDP) and 80 (web; TCP). We may force the container to use port 8000 while the firewall is instructed for forward traffic from port 80 to 8000. Same logic applies for port 53. Refer to the following example:<syntaxhighlight lang="nixos"># Firewall

Line 299:

Line 303:

allowedTCPPorts = [ 80 8000 53 5300 ];

allowedUDPPorts = [ 53 5300 ];

extraCommands = ''

iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 8000

iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 53 -j REDIRECT --to-port 5300

iptables -A PREROUTING -t nat -i eth0 -p UDP --dport 53 -j REDIRECT --to-port 5300

'';

};

boot.kernel.sysctl = {

"net.ipv4.conf.eth0.forwarding" = 1; # enable port forwarding

};

~~networking = {~~

~~firewall.extraCommands = ''~~

~~iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 8000~~

~~iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 53 -j REDIRECT --to-port 5300~~

~~iptables -A PREROUTING -t nat -i eth0 -p UDP --dport 53 -j REDIRECT --to-port 5300~~

~~'';~~

};</syntaxhighlight>Whilst the docker-compose.yaml might look like this:<syntaxhighlight lang="dockerfile">

services:

Line 387:

Line 388:

An alternative, if using [[flakes]], is to do <code>created = builtins.~~substring 0 8~~ self.~~lastModifiedDate~~</code>, which uses the commit date, and is therefore reproducible.

An alternative, if using [[flakes]], is to do <code>created = "@" + builtins.toString self.lastModified</code>, which uses the commit date, and is therefore reproducible.

</translate>

==== Calculating the sha256 for a pulled Docker image ====

</translate>

Line 607:

Line 609:

to provide access to <code>/var/run/mysqld/mysqld.sock</code>

to provide access to <code>/var/run/mysqld/mysqld.sock</code>. Sadly, this means you'll have to restart the container when /var/run/mysqld is replaced, e.g. on an upgrade.

</translate>

Line 716:

Line 719:

Restarting the container or Docker might be required.

</translate>

=== NVIDIA Docker Containers ===

If attempting to pass your nvidia gpu through to docker container(s), you will need to install <code>nvidia-container-toolkit</code> and enable cdi.

{{File|3={

# virtualisation.docker.enable = true; # This option is deprecated, please set hardware.nvidia-container-toolkit.enable instead.

hardware.nvidia-container-toolkit.enable = true;

# Prevents: - Option enableNvidia on x86_64 requires 32-bit support libraries

# Regular Docker

virtualisation.docker.daemon.settings.features.cdi = true;

# If using Rootless Docker

# virtualisation.docker.rootless.daemon.settings.features.cdi = true;

}|name=configuration.nix|lang=nix}}

You may also need to adjust your docker compose file to use cdi instead of the nvidia driver.

{{File|3=services:

ollama:

image: ollama/ollama

volumes:

- ollama:/root/.ollama

ports:

- 11434:11434

deploy:

resources:

reservations:

devices:

# Go from this:

# - driver: nvidia

# count: all

# capabilities: [gpu]

# To this:

- driver: cdi

capabilities: [gpu]

device_ids:

- nvidia.com/gpu=all

volumes:

ollama: {}|name=compose.yml|lang=yaml}}

Line 723:

Line 765:

== See also ==

*[https://nixcademy.com/posts/auto-update-containers/ Run and Auto-Update Docker Containers on NixOS, Nixcademy]

[[Category:Applications]]

@@ Line 32: / Line 32: @@
 <!--T:7-->
 To install Docker on NixOS, add the virtualization.docker module to your system configuration at <code>/etc/nixos/configuration.nix</code>:<ref>https://nixos.org/manual/nixos/stable/options#opt-virtualisation.docker.enable</ref>
+(Note that it may take a restart for the group changes to take effect.)
 </translate>
 <syntaxhighlight lang="nix">
@@ Line 52: / Line 53: @@
 <translate>
 == Configuration == <!--T:9-->
 </translate>
@@ Line 276: / Line 278: @@
 $ systemctl --user start docker
 </syntaxhighlight>
+{{note|User services do not persist after logging out by default. This will cause any Docker containers to stop if a user logs out. Set option {{nixos:option|users.users.*.linger|users.users.<name>.linger}} to true for Docker containers to persist. See [[Systemd/User Services#Keeping user services running after logout]] for more details.}}
 <translate>
@@ Line 292: / Line 296: @@
 === Using Privileged Ports for Rootless Docker ===
-Rootless containers are not able to ports from 0 to 1023 as such port can only be used by privileged users.  This problem can be solved by using port forwarding.
+Rootless containers are not able to bind ports from 0 to 1023 as such port can only be used by privileged users.  This problem can be solved by using port forwarding.
 Assume you'd like a rootless container to make use of ports 53 (DNS; TPC and UDP) and 80 (web; TCP).  We may force the container to use port 8000 while the firewall is instructed for forward traffic from port 80 to 8000.  Same logic applies for port 53.  Refer to the following example:<syntaxhighlight lang="nixos"># Firewall
@@ Line 299: / Line 303: @@
    allowedTCPPorts = [ 80 8000 53 5300 ];
    allowedUDPPorts = [ 53 5300 ];
+  extraCommands = ''
+    iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 8000
+    iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 53 -j REDIRECT --to-port 5300
+    iptables -A PREROUTING -t nat -i eth0 -p UDP --dport 53 -j REDIRECT --to-port 5300
+  '';
 };
 boot.kernel.sysctl = {
    "net.ipv4.conf.eth0.forwarding" = 1;    # enable port forwarding
-};
-networking = {
-  firewall.extraCommands = ''
-    iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 8000
-    iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 53 -j REDIRECT --to-port 5300
-    iptables -A PREROUTING -t nat -i eth0 -p UDP --dport 53 -j REDIRECT --to-port 5300
-  '';
 };</syntaxhighlight>Whilst the docker-compose.yaml might look like this:<syntaxhighlight lang="dockerfile">
 services:
@@ Line 387: / Line 388: @@
 <translate>
 <!--T:48-->
-An alternative, if using [[flakes]], is to do <code>created = builtins.substring 0 8 self.lastModifiedDate</code>, which uses the commit date, and is therefore reproducible.
+An alternative, if using [[flakes]], is to do <code>created = "@" + builtins.toString self.lastModified</code>, which uses the commit date, and is therefore reproducible.
 </translate>
 <translate>
 ==== Calculating the sha256 for a pulled Docker image ==== <!--T:49-->
 </translate>
@@ Line 607: / Line 609: @@
 <translate>
 <!--T:77-->
-to provide access to <code>/var/run/mysqld/mysqld.sock</code>
+to provide access to <code>/var/run/mysqld/mysqld.sock</code>. Sadly, this means you'll have to restart the container when /var/run/mysqld is replaced, e.g. on an upgrade.
 </translate>
@@ Line 716: / Line 719: @@
 Restarting the container or Docker might be required.
 </translate>
+=== NVIDIA Docker Containers ===
+If attempting to pass your nvidia gpu through to docker container(s), you will need to install <code>nvidia-container-toolkit</code> and enable cdi.
+{{File|3={
+  # virtualisation.docker.enable = true; # This option is deprecated, please set hardware.nvidia-container-toolkit.enable instead.
+  hardware.nvidia-container-toolkit.enable = true;
+  # Prevents: - Option enableNvidia on x86_64 requires 32-bit support libraries
+  # Regular Docker
+  virtualisation.docker.daemon.settings.features.cdi = true;
+  # If using Rootless Docker
+  # virtualisation.docker.rootless.daemon.settings.features.cdi = true;
+}|name=configuration.nix|lang=nix}}
+You may also need to adjust your docker compose file to use cdi instead of the nvidia driver.
+{{File|3=services:
+  ollama:
+    image: ollama/ollama
+    volumes:
+      - ollama:/root/.ollama
+    ports:
+      - 11434:11434
+    deploy:
+      resources:
+        reservations:
+          devices:
+            # Go from this:
+            # - driver: nvidia
+            #   count: all
+            #   capabilities: [gpu]
+            # To this:
+            - driver: cdi
+              capabilities: [gpu]
+              device_ids:
+                - nvidia.com/gpu=all
+volumes:
+  ollama: {}|name=compose.yml|lang=yaml}}
 <translate>
@@ Line 723: / Line 765: @@
 <references/>
+== See also ==
+*[https://nixcademy.com/posts/auto-update-containers/ Run and Auto-Update Docker Containers on NixOS, Nixcademy]
 [[Category:Applications]]