Docker/en: Difference between revisions

Line 151:

=== Rootless Docker ===

Rootless Docker lets you run the Docker daemon as a non-root user for improved security. ~~Set~~ the ~~<code>rootless</code>~~ option ~~[[#Advanced~~|~~as shown above]]~~. ~~The <code>~~setSocketVariable~~</code> option adds~~ the <code>DOCKER_HOST</code> variable ~~pointing~~ to ~~your~~ rootless Docker instance.

[https://docs.docker.com/engine/security/rootless/ Rootless Docker] lets you run the Docker daemon as a non-root user for improved security. To do so, enable {{nixos:option|virtualisation.docker.rootless}}. This activates the user-level systemd Docker service. Additionally, the option {{nixos:option|virtualisation.docker.rootless.setSocketVariable|setSocketVariable}} configures the <code>DOCKER_HOST</code> environment variable to point to the rootless Docker instance.

~~After enabling rootless mode, Docker can be started with:~~

virtualisation.docker = {

~~$ systemctl --user~~ enable -~~-now docker~~

# Consider disabling the system wide Docker daemon

enable = false;

rootless = {

enable = true;

setSocketVariable = true;

# Optionally customize rootless Docker daemon settings

daemon.settings = {

dns = [ "1.1.1.1" "8.8.8.8" ];

registry-mirrors = [ "https://mirror.gcr.io" ];

};

</syntaxhighlight>

~~This creates the 'docker.service' file which~~ is required to ~~start Docker~~. ~~Note that~~ the ~~service will not start at boot by this command. You will have to~~ set ~~it up~~ in ~~your NixOS configuration. Now~~ the following ~~command will work~~:

A system reboot is required for these changes to take effect. Alternatively, the environment variable can be set manually in the current shell session, and the user Docker service can be started with the following commands:

$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock

$ systemctl --user start docker

</syntaxhighlight>

~~Check its~~ status ~~with~~:

{{note|User services do not persist after logging out by default. This will cause any Docker containers to stop if a user logs out. Set option {{nixos:option|users.users.*.linger|users.users.<name>.linger}} to true for Docker containers to persist. See [[Systemd/User Services#Keeping user services running after logout]] for more details.}}

To verify the status of the rootless Docker service:

$ systemctl --user status docker

</syntaxhighlight>

To confirm that Docker is running in rootless mode:

$ docker info -f "{{println .SecurityOptions}}" | grep rootless

</syntaxhighlight>

=== Using Privileged Ports for Rootless Docker ===

Rootless containers are not able to ports from 0 to 1023 as such port can only be used by privileged users. This problem can be solved by using port forwarding.

Assume you'd like a rootless container to make use of ports 53 (DNS; TPC and UDP) and 80 (web; TCP). We may force the container to use port 8000 while the firewall is instructed for forward traffic from port 80 to 8000. Same logic applies for port 53. Refer to the following example:<syntaxhighlight lang="nixos"># Firewall

networking.firewall = {

enable = true;

allowedTCPPorts = [ 80 8000 53 5300 ];

allowedUDPPorts = [ 53 5300 ];

};

boot.kernel.sysctl = {

"net.ipv4.conf.eth0.forwarding" = 1; # enable port forwarding

};

networking = {

firewall.extraCommands = ''

iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 8000

iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 53 -j REDIRECT --to-port 5300

iptables -A PREROUTING -t nat -i eth0 -p UDP --dport 53 -j REDIRECT --to-port 5300

'';

};</syntaxhighlight>Whilst the docker-compose.yaml might look like this:<syntaxhighlight lang="dockerfile">

services:

myserver:

image: ...

restart: always

ports:

- "5300:53/tcp"

- "5300:53/udp"

- "8000:80"

</syntaxhighlight>

=== Creating images with Nix ===

Line 353:

Line 407:

];

</syntaxhighlight>

to provide access to <code>/var/run/mysqld/mysqld.sock</code>

to provide access to <code>/var/run/mysqld/mysqld.sock</code>. Sadly, this means you'll have to restart the container when /var/run/mysqld is replaced, e.g. on an upgrade.

=== Running the docker daemon from nix-the-package-manager - not NixOS ===

Line 363:

Line 418:

== Troubleshooting ==

~~=== Common issues ===~~

=== Cannot connect to the Docker daemon ===

==== Cannot connect to the Docker daemon ====

If you encounter errors connecting to the Docker daemon, check that:

- The Docker service is running: `systemctl status docker`

- The Docker service is running: <code>systemctl status docker</code>

- Your user is in the docker group: `groups | grep docker`

- Your user is in the docker [[User management#Adding User to a group|group]]: <code>groups | grep docker</code>

- You've logged out and back in after adding your user to the docker group

==== Storage space issues ====

=== Storage space issues ===

When Docker uses too much disk space:

Line 388:

Line 441:

</syntaxhighlight>

==== Network conflicts ====

=== Network conflicts ===

Docker's default subnet (`172.17.0.0/16`) might conflict with your existing network. Configure a different subnet in your `configuration.nix`:

Line 418:

Line 471:

</syntaxhighlight>

Restarting the container or Docker might be required.

== References ==

@@ Line 151: / Line 151: @@
 === Rootless Docker ===
-Rootless Docker lets you run the Docker daemon as a non-root user for improved security. Set the <code>rootless</code> option [[#Advanced|as shown above]]. The <code>setSocketVariable</code> option adds the <code>DOCKER_HOST</code> variable pointing to your rootless Docker instance.
+[https://docs.docker.com/engine/security/rootless/ Rootless Docker] lets you run the Docker daemon as a non-root user for improved security. To do so, enable {{nixos:option|virtualisation.docker.rootless}}. This activates the user-level systemd Docker service. Additionally, the option {{nixos:option|virtualisation.docker.rootless.setSocketVariable|setSocketVariable}} configures the <code>DOCKER_HOST</code> environment variable to point to the rootless Docker instance.
-After enabling rootless mode, Docker can be started with:
+<syntaxhighlight lang="nix">
-<syntaxhighlight lang="bash">
+virtualisation.docker = {
-$ systemctl --user enable --now docker
+  # Consider disabling the system wide Docker daemon
+  enable = false;
+  rootless = {
+    enable = true;
+    setSocketVariable = true;
+    # Optionally customize rootless Docker daemon settings
+    daemon.settings = {
+      dns = [ "1.1.1.1" "8.8.8.8" ];
+      registry-mirrors = [ "https://mirror.gcr.io" ];
+    };
+  };
+};
 </syntaxhighlight>
-This creates the 'docker.service' file which is required to start Docker. Note that the service will not start at boot by this command. You will have to set it up in your NixOS configuration. Now the following command will work:
+A system reboot is required for these changes to take effect. Alternatively, the environment variable can be set manually in the current shell session, and the user Docker service can be started with the following commands:
-<syntaxhighlight lang="bash">
+<syntaxhighlight lang="console">
+$ export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock
 $ systemctl --user start docker
 </syntaxhighlight>
-Check its status with:
+{{note|User services do not persist after logging out by default. This will cause any Docker containers to stop if a user logs out. Set option {{nixos:option|users.users.*.linger|users.users.<name>.linger}} to true for Docker containers to persist. See [[Systemd/User Services#Keeping user services running after logout]] for more details.}}
-<syntaxhighlight lang="bash">
+To verify the status of the rootless Docker service:
+<syntaxhighlight lang="console">
 $ systemctl --user status docker
 </syntaxhighlight>
+To confirm that Docker is running in rootless mode:
+<syntaxhighlight lang="console">
+$ docker info -f "{{println .SecurityOptions}}" | grep rootless
+</syntaxhighlight>
+=== Using Privileged Ports for Rootless Docker ===
+Rootless containers are not able to ports from 0 to 1023 as such port can only be used by privileged users.  This problem can be solved by using port forwarding.
+Assume you'd like a rootless container to make use of ports 53 (DNS; TPC and UDP) and 80 (web; TCP).  We may force the container to use port 8000 while the firewall is instructed for forward traffic from port 80 to 8000.  Same logic applies for port 53.  Refer to the following example:<syntaxhighlight lang="nixos"># Firewall
+networking.firewall = {
+  enable = true;
+  allowedTCPPorts = [ 80 8000 53 5300 ];
+  allowedUDPPorts = [ 53 5300 ];
+};
+boot.kernel.sysctl = {
+  "net.ipv4.conf.eth0.forwarding" = 1;    # enable port forwarding
+};
+networking = {
+  firewall.extraCommands = ''
+    iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 80 -j REDIRECT --to-port 8000
+    iptables -A PREROUTING -t nat -i eth0 -p TCP --dport 53 -j REDIRECT --to-port 5300
+    iptables -A PREROUTING -t nat -i eth0 -p UDP --dport 53 -j REDIRECT --to-port 5300
+  '';
+};</syntaxhighlight>Whilst the docker-compose.yaml might look like this:<syntaxhighlight lang="dockerfile">
+services:
+  myserver:
+    image: ...
+    restart: always
+    ports:
+      - "5300:53/tcp"
+      - "5300:53/udp"
+      - "8000:80"
+</syntaxhighlight>
 === Creating images with Nix ===
@@ Line 353: / Line 407: @@
        ];
 </syntaxhighlight>
-to provide access to <code>/var/run/mysqld/mysqld.sock</code>
+to provide access to <code>/var/run/mysqld/mysqld.sock</code>. Sadly, this means you'll have to restart the container when /var/run/mysqld is replaced, e.g. on an upgrade.
 === Running the docker daemon from nix-the-package-manager - not NixOS ===
@@ Line 363: / Line 418: @@
 == Troubleshooting ==
-=== Common issues ===
+=== Cannot connect to the Docker daemon ===
-==== Cannot connect to the Docker daemon ====
 If you encounter errors connecting to the Docker daemon, check that:
-- The Docker service is running: `systemctl status docker`
+- The Docker service is running: <code>systemctl status docker</code>
-- Your user is in the docker group: `groups | grep docker`
+- Your user is in the docker [[User management#Adding User to a group|group]]: <code>groups | grep docker</code>
 - You've logged out and back in after adding your user to the docker group
-==== Storage space issues ====
+=== Storage space issues ===
 When Docker uses too much disk space:
@@ Line 388: / Line 441: @@
 </syntaxhighlight>
-==== Network conflicts ====
+=== Network conflicts ===
 Docker's default subnet (`172.17.0.0/16`) might conflict with your existing network. Configure a different subnet in your `configuration.nix`:
@@ Line 418: / Line 471: @@
 </syntaxhighlight>
 Restarting the container or Docker might be required.
 == References ==