docker.txt

# Install for current user to run docker cmd without sudo
curl https://get.docker.com | sudo bash && sudo usermod -aG docker $USER

# Oneliner install 
curl https://get.docker.com | bash

# Install on Debian for production: https://docs.docker.com/install/linux/docker-ce/debian/
sudo apt-get -qq update && \
sudo apt-get -qq install \
    apt-transport-https \
    ca-certificates \
    curl \
    gnupg2 \
    software-properties-common && \
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add - && \
sudo add-apt-repository \
   "deb [arch=amd64] https://download.docker.com/linux/debian \
   $(lsb_release -cs) \
   stable" && \
 sudo apt-get -qq update && \
 sudo apt-get -qq install docker-ce docker-ce-cli containerd.io


# Change location of data-root via systemd
# sudo vim /usr/lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd --data-root /home/DATAROOT_DIR

# To set the default subnet and DNS
echo '{"bip":"10.254.0.1/20", "dns": ["8.8.8.8", "8.8.4.4"]}' > /etc/docker/daemon.json && \
systemctl restart docker && ip addr

Test with:
docker run -p 80:80 -dit nginx

# Use private insecure or untrusted registry: /etc/docker/daemon.json
{
  "insecure-registries" : ["myregistrydomain.com:5000"]
}

# Set log options (Remember to restart docker service afterwards)
# https://docs.docker.com/config/containers/logging/json-file/
# /etc/docker/daemon.json
cat <<EOF | sudo tee /etc/docker/daemon.json
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "5m",
    "max-file": "3"
  }
}
EOF
sudo systemctl restart docker

# Auto-start container: no, on-failure, unless-stopped, always
# https://docs.docker.com/engine/admin/start-containers-automatically/
docker run -dit --restart always redis

# Run docker as current uid
# https://github.com/moby/moby/issues/3124
# Useful when mounting volumes such that dir on host is owned by that uid
docker run --user $(id -u) --name airflow --mount source=airflow,target=/srv/airflow -it debian:stretch bash

# Allow container to perform network-related ops
# https://docs.docker.com/engine/reference/run/ 
docker run --cap-add=NET_ADMIN

# Mount host directory with SELinux enabled: https://stackoverflow.com/a/31334443
# Use -Z flag to relabel the shared volumes (-Z allow 1 container, -z multiple containers)
docker run -v /host/dir:/container/dir:Z <image>

# Mounting sshfs folder and share it with host. Use :shared option
# https://github.com/moby/moby/issues/21278
/foo:/bar:shared

# Install on Fedora 26
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager \
    --add-repo \
    https://download.docker.com/linux/fedora/docker-ce.repo
sudo dnf -y install docker-ce
# Optionally, to allow user1 to run docker without sudo 
sudo usermod -aG docker user1
sudo systemctl start docker && systemctl status docker

# Prevent docker container from exiting immediately
# https://stackoverflow.com/questions/28212380/why-docker-container-exits-immediately

-d, --detach      : Run container in background and print container ID
-i, --interactive : Keep STDIN open even if not attached
-t, --tty         : Allocate a pseudo-TTY

docker run -dit ubuntu
docker exec -it <container_id> /bin/bash

# check available images
docker image ls
docker images  

docker run -d nginx:latest
docker run -d nginx:1.10.0  # detached
# Passing environment variables: -e option
docker run --name some-postgres -e POSTGRES_PASSWORD=mysecretpassword -d postgres

# From a file
docker run --env-file ./.env.local ubuntu bash

docker ps
docker ps -aq  # all, quiet (only id)
docker ps --format "{{.ID}} {{.Image}} {{.Names}}"

docker inspect <cid|name>
docker inspect -f '{{.Name}} - {{.NetworkSettings.IPAddress }}' $(sudo docker ps -aq)  # format the inspection only to key: name, ip address

docker stop <cid>
docker rm <cid>

# Remove all running containers
docker ps --format={{.ID}} | xargs docker rm -f
# OR
docker ps -q | xargs docker rm -f

# Remove unused data (general)
docker system prune --all --force --volumes

# Clean up Docker resources
# https://stackoverflow.com/questions/32723111/how-to-remove-old-and-unused-docker-images

# Remove all stopped containers
docker container prune --force --filter "until=3h"

# Remove all unreferenced images
# And also dangling images with --all option
docker image prune --force --all --filter "until=6h"

# Remove all unused local volumes (unused means not referenced by any containers)
docker volume prune --force

# Be careful with removing network(s) because they may still be needed by 
# stopped containers
docker network prune

# Delete only images older than 48h
# Note: "until" filter is not supported with "--volumes"
docker image prune --all --filter until=48h

# Docker remove volume not in use
docker volume prune

# Clean up volumes
# https://gist.github.com/bastman/5b57ddb3c11942094f8d0a97d461b430
docker volume rm $(docker volume ls -qf dangling=true)

# Stop all running containers
# https://linuxize.com/post/how-to-remove-docker-images-containers-volumes-and-networks/
docker container stop $(docker container ls -aq)

# Remove all containers (even running ones) -a/all -q/quiet
docker container rm -f $(docker container ls -aq)

# Remove all stopped containers
docker container prune [-f]

# Remove unused docker images
docker image prune -f

# Remove unused volumes
docker volume prune -f

# Remove untagged images 
docker rmi $(docker images | grep "^<none>" | awk '{print $3}')

# Log to /dev/stdout from Application
# https://github.com/moby/moby/issues/19616
Write to /proc/1/fd/1  # e.g. echo "Hello" > /proc/1/fd/1

# Limit log size 
# https://stackoverflow.com/questions/31829587/docker-container-logs-taking-all-my-disk-space
docker run --log-opt max-size=50m debian

# Enable FUSE with a container
# https://github.com/moby/moby/issues/514
docker run --rm -it --cap-add SYS_ADMIN --device /dev/fuse debian

# Docker in Docker (dind) by sharing socket with the host.
# The container will start a sibling container instead.
# https://www.develves.net/blogs/asd/2016-05-27-alternative-to-docker-in-docker/
docker run -v /var/run/docker.sock:/var/run/docker.sock debian

Networking
============================================================
http://stackoverflow.com/questions/30545023/how-to-communicate-between-docker-containers-via-hostname
https://docs.docker.com/engine/userguide/networking/

docker network inspect bridge

============================================================
# Hint: http://stackoverflow.com/questions/35122773/single-command-to-stop-and-remove-docker-container/35122830
docker rm -f <cid>  # Force remove even if it's running
docker run --rm <image>  # Remove container when stopped
============================================================

docker build -t <name:tag> <path>

# Build with latest base image
docker build --pull -t MYTAG .

# Build with no cache
docker build --no-cache

# Build with args
docker build --build-arg HTTP_PROXY=http://10.20.30.2:1234 --build-arg FTP_PROXY=http://40.50.60.5:4567 .

Create a tag from existing image tag
============================================================
docker tag monolith:1.0.0 <your username>/monolith:1.0.0  

Creating network
============================================================
docker network create --subnet=172.18.0.0/16 net1
# Then,
docker run --net net1 --ip 172.18.0.2 -it ubuntu bash
# To check the subnet
docker netwwork inspect net1
# To delete: docker network rm

Volumes
============================================================
# Create volume
docker volume create --name $VOLUME_NAME
docker run -v $VOLUME_NAME:/path/on/container -it debian:stretch

# https://github.com/wsargent/docker-cheat-sheet
============================================================
docker create - creates a container but does not start it.
docker run - creates and starts a container in one operation.
docker stop - stops it.
docker start - will start it again.
docker restart - restarts a container.
docker rm - deletes a container.  ( -f remove even when the container is running)
docker kill - sends a SIGKILL to a container.
docker attach - will connect to a running container.
docker wait - blocks until container stops.

docker run --rm  -name container-foo # transient container
docker rm -v     # remove volumes associated with the container
docker run -t -i <myimage> <myshell>       # open tty from an image
docker exec -t -i <mycontainer> <myshell>  # open tty from a running container
# Exec as user
docker exec -it -u postgres CONTAINER_ID psql

# https://stackoverflow.com/questions/30960686/difference-between-docker-attach-and-docker-exec
docker attach, for getting to existing process, docker exec to run new process
docker attach CONTAINER_ID -it

# http://stackoverflow.com/questions/22907231/copying-files-from-host-to-docker-container
docker cp foo.txt CONTAINER_ID:/foo.txt
docker cp CONTAINER_ID:/foo.txt foo.txt

docker commit [OPTIONS] CONTAINER [REPOSITORY[:TAG]]

docker logs -f CONTAINER_ID
docker logs -f --tail 3 CONTAINER_ID
docker logs --since 36m / 3h / 2013-01-02T13:23:37 CONTAINER_ID

# Rename container
docker rename [OPTIONS] OLD_NAME NEW_NAME

# Install Weave Scope: Nice web UI to view running containers
# https://github.com/weaveworks/scope
sudo curl -L git.io/scope -o /usr/local/bin/scope \
&& sudo chmod a+x /usr/local/bin/scope \
&& scope launch

# Sample SDK and examples of using the client
https://docs.docker.com/develop/sdk/#unofficial-libraries
https://docs.docker.com/develop/sdk/examples/

Windows
===================================================
docker-machine create --driver virtualbox my-default
docker-machine ls  # List available machines
# Configure powershell
docker-machine env --shell powershell default | Invoke-Expression

docker-machine subcommands
---------------------------
https://docs.docker.com/machine/reference/
active config create env help inspect ip kill ls regenerate-certs restart rm scp ssh start status stop upgrade url

Load fedora base tar img
------------------------
docker load -i .\Fedora-Docker-Base-23-20151030.x86_64.tar.xz
docker run -it --rm Fedora-Docker-Base-23-20151030.x86_64 bash

Run apache
----------
docker run -p 80:80 -it --rm fedora-webserver /usr/sbin/httpd -DFOREGROUND

Install on Ubuntu
============================================================
sudo apt-get remove docker docker-engine docker.io && \
sudo apt-get update && \
sudo apt-get install -y apt-transport-https ca-certificates curl && \
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - && \
sudo apt-key fingerprint 0EBFCD88 && \
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" && \
sudo apt-get update && \
sudo apt-get install -y docker-ce

Using private SSL certificate
============================================================
Example when pulling from private artifactory which uses private cert

Look for: rhasselbaum commented on Jan 20, 2015
https://github.com/moby/moby/issues/8849

Ubuntu:
1. Copy CA Cert (my.domain.crt) to /usr/local/share/ca-certificates
2. sudo update-ca-certificates
3. sudo systemctl restart docker

Dockerfile Tips
============================================================
# Useful to not let system sleeps
CMD ["sleep", "infinity"]

# Clean up apt-get
# https://docs.docker.com/develop/develop-images/dockerfile_best-practices/
rm -rf /var/lib/apt/lists/*

# Copy with diff permissions / owner
COPY --chown=NEWUSER . /home/newuser/app/

# Ignore files copied
# Use .dockerignore
*/folder-anywhere/

Sample Dockerfile
============================================================
FROM dockerfile/python

LABEL maintainer "David Heryanto <david.heryanto@hotmail.com>"

# Install Node.js
RUN \
  cd /tmp && \
  wget http://nodejs.org/dist/node-latest.tar.gz && \
  tar xvzf node-latest.tar.gz && \
  rm -f node-latest.tar.gz && \
  cd node-v* && \
  ./configure && \
  CXX="g++ -Wno-unused-local-typedefs" make && \
  CXX="g++ -Wno-unused-local-typedefs" make install && \
  cd /tmp && \
  rm -rf /tmp/node-v* && \
  npm install -g npm && \
  printf '\n# Node.js\nexport PATH="node_modules/.bin:$PATH"' >> /root/.bashrc

# Define working directory.
WORKDIR /data

CMD ["bash"]

ENV abc=value1 def=value2

============================================================
Common Images
============================================================
# RabbitMQ: https://store.docker.com/images/rabbitmq
docker run -d --hostname my-rabbit --name some-rabbit -e RABBITMQ_DEFAULT_USER=user -e RABBITMQ_DEFAULT_PASS=password rabbitmq:3-management


Docker Compose
============================================================
# Installation
sudo curl -L https://github.com/docker/compose/releases/download/1.21.2/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose && \
sudo chmod +x /usr/local/bin/docker-compose

# Common commands
docker-compose up
docker-compose up -d

# Good example from Stackoverflow
# https://stackoverflow.com/questions/41294305/docker-compose-difference-between-network-and-link

# vim docker-compose.yaml
```
# Do not forget the version line, this file syntax is invalid without it
version: '2'

services:
  redis:
    image: redis:latest
    ports:
    - "6379:6379"
    networks:
    - lognet

  app:
    container_name: web-app
    build:
      context: .
      dockerfile: Dockerfile
    ports:
    - "3000:3000"
    volumes:
    - ".:/webapp"
    depends_on:
    - redis
    networks:
    - lognet

    # Additional Extra stuff
    dns:
    - 8.8.8.8
    - 9.9.9.9
    dns_search:
    - dc1.example.com
    - dc2.example.com

    # The last one wins
    env_file:
    - ./common.env
    - ./apps/web.env
    - /opt/secrets.env

    # This will override values in env_file
    # For variable with only key (no value), the value is retrieved from the host
    environment:
      RACK_ENV: development
      # To prevent YML parser to convert boolean values 'true' to True or False
      SHOW: 'true'
      SESSION_SECRET:

    # Add values to /etc/hosts
    extra_hosts:
   - "somehost:162.242.195.82"
   - "otherhost:50.31.209.229"

   # Adjust limits on resources 
   ulimits:
    nproc: 65535
    nofile:
      soft: 20000
      hard: 40000

networks:
  lognet:
    driver: bridge
```

# Search docker hub
docker search QUERY
docker search --filter=stars=50 QUERY  # at least 50 stars

# Start OpenSSH server
apt-get -y install openssh-server
service ssh start

# Generate gcr.io credfile using an access token
# https://kind.sigs.k8s.io/docs/user/private-registries/#use-an-access-token

DOCKER_CONFIG=$(mktemp -d)
export DOCKER_CONFIG

gcloud auth print-access-token | \
  docker login -u oauth2accesstoken --password-stdin https://gcr.io

# config.json file in $DOCKER_CONFIG folder contains cred to pull private image

# CFS (Completely Fair Scheduling) issue in Linux Kernel before 2020
# Related issue: https://github.com/kubernetes/kubernetes/issues/67577
#
# Test incorrect expiry of time slices
https://gist.github.com/bobrik/2030ff040fad360327a5fab7a09c4ff1
#
# After the correction, throttling for workload in high core count machines
# https://github.com/kubernetes/kubernetes/issues/67577#issuecomment-476333869
https://github.com/indeedeng/fibtest

# Start Docker registry service
docker run -d -p 5000:5000 --restart always --name registry registry:2