Docker inside CT

2016-08-15T16:43:40Z

Vitaly Lipatov: /* Prepare Docker in container */

Since OpenVZ kernel [[Download/kernel/rhel6-testing/042stab105.4|042stab105.4]] it is possible to run Docker inside containers. This article describes how.
<br>'''This page is applicable for OpenVZ 6''' (for Virtuozzo 7 see [[Docker inside CT vz7| '''here''']]).

== Prerequisites ==

* Kernel 042stab105.4 or later version
* Kernel modules '''tun''', '''veth''' and '''bridge''' loaded on host (not required since vzctl 4.9 as it loads it automatically)

== Container creation and tuning ==

* Create CentOS 7 container with enough disk space:
vzctl create $veid --ostemplate centos-7-x86_64 --diskspace 20G
* Turn on bridge feature to allow docker creating bridged network:
vzctl set $veid --features bridge:on --save
* Setup Container veth-based network:
vzctl set $veid --netif_add eth0 --save
* Allow all iptables modules to be used in containers:
vzctl set $veid --netfilter full --save
* Enable tun device access for container:
vzctl set $veid --devnodes net/tun:rw --save
* Configure custom cgroups in systemd:
: <small>''systemd reads /proc/cgroups and mounts all cgroups enabled there, though it doesn't know there's a restriction that only freezer,devices and cpuacct,cpu,cpuset can be mounted in container, but not freezer, cpu etc. separately''</small>
vzctl mount $veid
echo "JoinControllers=cpu,cpuacct,cpuset freezer,devices" >> /vz/root/$veid/etc/systemd/system.conf
* Start the container:
vzctl start $veid
* If you use Debian Wheezy for your CT which does not support systemd, you can run:
mount -t tmpfs tmpfs /sys/fs/cgroup
mkdir /sys/fs/cgroup/freezer,devices
mount -t cgroup cgroup /sys/fs/cgroup/freezer,devices -o freezer,devices
mkdir /sys/fs/cgroup/cpu,cpuacct,cpuset
mount -t cgroup cgroup /sys/fs/cgroup/cpu,cpuacct,cpuset/ -o cpu,cpuacct,cpuset

== Prepare Docker in container ==

These steps are to be performed inside the container.

* Install Docker:
yum -y install docker-io
* Start docker daemon
dockerd -s vfs
or change line in /etc/sysconfig/docker to:
OPTIONS='--selinux-enabled -s vfs'
and
service docker start

== Example usage ==

=== Wordpress ===

Use Docker to start Wordpress (official, standard way).

* Start mysql docker:
docker run --name test-mysql -e MYSQL_ROOT_PASSWORD=123 -d mysql
* Start wordpress:
docker run --name test-wordpress --link test-mysql:mysql -p 8080:80 -d wordpress
* Access wordpress server by container IP and port 8080: <pre><nowiki>http://container_ip:8080</nowiki></pre>

== Limitations ==

* Only "vfs" Docker graph driver is currently supported
* [[Checkpointing and live migration]] of a container with Docker containers inside is not supported
* Bridges cannot be created inside Docker containers running inside OpenVZ container

== See also ==
* [http://www.youtube.com/watch?v=rh4oPpLtdYc Docker inside CT demo video].

[[Category:HOWTO]]
[[Category: TRD]]

OpenVZ Virtuozzo Containers Wiki - User contributions [en]

Docker inside CT