Docker: Difference between revisions
m Modify the flake reproducible image dates section to use a snippet which doesn't exclude the the time of the commit. The original snippet intentionally cut the time so the `date` command would accept the input of `self.lastModifiedDate`. By using `self.lastModified` (seconds since epoch of commit) and prepending "@", the date command can interpret the full datetime and embed it into the resulting image. |
m →Using Privileged Ports for Rootless Docker: remove unneeded blank line |
||
| (5 intermediate revisions by 5 users not shown) | |||
| Line 17: | Line 17: | ||
To temporarily use Docker in a shell environment, you can run: | To temporarily use Docker in a shell environment, you can run: | ||
</translate> | </translate> | ||
<syntaxhighlight lang= | <syntaxhighlight lang=console> | ||
nix-shell -p docker | $ nix-shell -p docker | ||
</syntaxhighlight> | </syntaxhighlight> | ||
<translate> | <translate> | ||
| Line 32: | Line 32: | ||
<!--T:7--> | <!--T:7--> | ||
To install Docker on NixOS, add the virtualization.docker module to your system configuration at <code>/etc/nixos/configuration.nix</code>:<ref>https://nixos.org/manual/nixos/stable/options#opt-virtualisation.docker.enable</ref> | To install Docker on NixOS, add the virtualization.docker module to your system configuration at <code>/etc/nixos/configuration.nix</code>:<ref>https://nixos.org/manual/nixos/stable/options#opt-virtualisation.docker.enable</ref> | ||
(Note that it may take a restart for the group changes to take effect.) | |||
</translate> | </translate> | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
| Line 52: | Line 53: | ||
<translate> | <translate> | ||
== Configuration == <!--T:9--> | == Configuration == <!--T:9--> | ||
</translate> | </translate> | ||
| Line 181: | Line 183: | ||
To use <code>compose2nix</code> with <code>nix-shell</code> you can use | To use <code>compose2nix</code> with <code>nix-shell</code> you can use | ||
</translate> | </translate> | ||
<syntaxhighlight lang= | <syntaxhighlight lang=console> | ||
nix shell github:aksiksi/compose2nix | $ nix shell github:aksiksi/compose2nix | ||
compose2nix -h | $ compose2nix -h | ||
</syntaxhighlight> | </syntaxhighlight> | ||
<translate> | <translate> | ||
| Line 217: | Line 219: | ||
Alternatively, you can specify the input and output files with the following flags | Alternatively, you can specify the input and output files with the following flags | ||
</translate> | </translate> | ||
<syntaxhighlight lang= | <syntaxhighlight lang=console> | ||
compose2nix -inputs input.yml -output output.nix -runtime docker | $ compose2nix -inputs input.yml -output output.nix -runtime docker | ||
</syntaxhighlight> | </syntaxhighlight> | ||
<translate> | <translate> | ||
| Line 260: | Line 262: | ||
# Optionally customize rootless Docker daemon settings | # Optionally customize rootless Docker daemon settings | ||
daemon.settings = { | daemon.settings = { | ||
data-root = "~/.local/docker"; | |||
dns = [ "1.1.1.1" "8.8.8.8" ]; | dns = [ "1.1.1.1" "8.8.8.8" ]; | ||
registry-mirrors = [ "https://mirror.gcr.io" ]; | registry-mirrors = [ "https://mirror.gcr.io" ]; | ||
| Line 301: | Line 304: | ||
allowedTCPPorts = [ 80 8000 53 5300 ]; | allowedTCPPorts = [ 80 8000 53 5300 ]; | ||
allowedUDPPorts = [ 53 5300 ]; | allowedUDPPorts = [ 53 5300 ]; | ||
extraCommands = '' | |||
iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 8000 | |||
iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 53 -j REDIRECT --to-port 5300 | |||
iptables -A PREROUTING -t nat -i eth0 -p UDP --dport 53 -j REDIRECT --to-port 5300 | |||
''; | |||
}; | }; | ||
boot.kernel.sysctl = { | boot.kernel.sysctl = { | ||
"net.ipv4.conf.eth0.forwarding" = 1; # enable port forwarding | "net.ipv4.conf.eth0.forwarding" = 1; # enable port forwarding | ||
};</syntaxhighlight>Whilst the docker-compose.yaml might look like this:<syntaxhighlight lang="dockerfile"> | };</syntaxhighlight>Whilst the docker-compose.yaml might look like this:<syntaxhighlight lang="dockerfile"> | ||
services: | services: | ||
| Line 323: | Line 323: | ||
- "8000:80" | - "8000:80" | ||
</syntaxhighlight> | </syntaxhighlight> | ||
<translate> | <translate> | ||
| Line 393: | Line 392: | ||
<translate> | <translate> | ||
==== Calculating the sha256 for a pulled Docker image ==== <!--T:49--> | ==== Calculating the sha256 for a pulled Docker image ==== <!--T:49--> | ||
</translate> | </translate> | ||
| Line 420: | Line 418: | ||
</translate> | </translate> | ||
<syntaxhighlight lang= | <syntaxhighlight lang=console> | ||
skopeo copy docker://lnl7/nix@sha256:632268d5fd9ca87169c65353db99be8b4e2eb41833b626e09688f484222e860f docker-archive:///tmp/image.tgz:lnl7/nix:2.0 | $ skopeo copy docker://lnl7/nix@sha256:632268d5fd9ca87169c65353db99be8b4e2eb41833b626e09688f484222e860f docker-archive:///tmp/image.tgz:lnl7/nix:2.0 | ||
$ nix-hash --base32 --flat --type sha256 /tmp/image.tgz | |||
nix-hash --base32 --flat --type sha256 /tmp/image.tgz | |||
1x00ks05cz89k3wc460i03iyyjr7wlr28krk7znavfy2qx5a0hfd | 1x00ks05cz89k3wc460i03iyyjr7wlr28krk7znavfy2qx5a0hfd | ||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 603: | Line 596: | ||
If you have a service running on the host that exposes a socket, such as mariadb, you can also expose that socket to the container instead. You'll want to expose the folder the socket is in as a volume - so: | If you have a service running on the host that exposes a socket, such as mariadb, you can also expose that socket to the container instead. You'll want to expose the folder the socket is in as a volume - so: | ||
</translate> | </translate> | ||
<syntaxhighlight lang= | <syntaxhighlight lang=nix> | ||
volumes = [ | |||
"/var/run/mysqld:/mysqld" | |||
]; | |||
</syntaxhighlight> | </syntaxhighlight> | ||
<translate> | <translate> | ||
<!--T:77--> | <!--T:77--> | ||
to provide access to <code>/var/run/mysqld/mysqld.sock</code>. Sadly, this means you'll have to restart the container when /var/run/mysqld is replaced, e.g. on an upgrade. | to provide access to <code>/var/run/mysqld/mysqld.sock</code>. Sadly, this means you'll have to restart the container when /var/run/mysqld is replaced, e.g. on an upgrade. | ||
</translate> | </translate> | ||
| Line 661: | Line 653: | ||
When Docker uses too much disk space: | When Docker uses too much disk space: | ||
</translate> | </translate> | ||
<syntaxhighlight lang= | <syntaxhighlight lang=nix> | ||
# Remove unused containers, networks, images, and volumes | # Remove unused containers, networks, images, and volumes | ||
docker system prune -a --volumes | docker system prune -a --volumes | ||
| Line 680: | Line 672: | ||
<translate> | <translate> | ||
<!--T:91--> | <!--T:91--> | ||
Docker's default subnet (`172.17.0.0/16`) might conflict with your existing network. Configure a different subnet in your | Docker's default subnet (`172.17.0.0/16`) might conflict with your existing network. Configure a different subnet in your <code>configuration.nix</code>: | ||
</translate> | </translate> | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
| Line 725: | Line 717: | ||
{{File|3={ | {{File|3={ | ||
virtualisation.docker.enable = true; | # virtualisation.docker.enable = true; # This option is deprecated, please set hardware.nvidia-container-toolkit.enable instead. | ||
hardware.nvidia-container-toolkit.enable = true; | hardware.nvidia-container-toolkit.enable = true; | ||
# Prevents: - Option enableNvidia on x86_64 requires 32-bit support libraries | |||
# Regular Docker | # Regular Docker | ||
virtualisation.docker.daemon.settings.features.cdi = true; | virtualisation.docker.daemon.settings.features.cdi = true; | ||
| Line 758: | Line 751: | ||
volumes: | volumes: | ||
ollama: {}|name=compose.yml|lang=yaml}} | ollama: {}|name=compose.yml|lang=yaml}} | ||
<translate> | <translate> | ||