Docker inside CT

Since OpenVZ kernel 042stab105.4 it is possible to run Docker inside containers. This article describes how.
This page is applicable for OpenVZ 6 (for Virtuozzo 7 see here).

Prerequisites

• Kernel 042stab105.4 or later version
• Kernel modules tun, veth and bridge loaded on host (not required since vzctl 4.9 as it loads it automatically)

Container creation and tuning

• Create CentOS 7 container with enough disk space:

vzctl create $veid --ostemplate centos-7-x86_64 --diskspace 20G

• Turn on bridge feature to allow docker creating bridged network:

vzctl set $veid --features bridge:on --save

• Setup Container veth-based network:

vzctl set $veid --netif_add eth0 --save

• Allow all iptables modules to be used in containers:

vzctl set $veid --netfilter full --save

• Enable tun device access for container:

vzctl set $veid --devnodes net/tun:rw --save

• Configure custom cgroups in systemd:

systemd reads /proc/cgroups and mounts all cgroups enabled there, though it doesn't know there's a restriction that only freezer,devices and cpuacct,cpu,cpuset can be mounted in container, but not freezer, cpu etc. separately

vzctl mount $veid
echo "JoinControllers=cpu,cpuacct,cpuset freezer,devices" >> /vz/root/$veid/etc/systemd/system.conf

• Start the container:

vzctl start $veid

• If you use Debian Wheezy for your CT which does not support systemd, you can run:

mount -t tmpfs tmpfs /sys/fs/cgroup
mkdir /sys/fs/cgroup/freezer,devices
mount -t cgroup cgroup /sys/fs/cgroup/freezer,devices -o freezer,devices
mkdir /sys/fs/cgroup/cpu,cpuacct,cpuset
mount -t cgroup cgroup /sys/fs/cgroup/cpu,cpuacct,cpuset/ -o cpu,cpuacct,cpuset

Prepare Docker in container

These steps are to be performed inside the container.

• Install Docker:

yum -y install docker-io

• Start docker daemon

dockerd -s vfs

or change line in /etc/sysconfig/docker to:

OPTIONS='--selinux-enabled -s vfs'

and

service docker start

Example usage

Wordpress

Use Docker to start Wordpress (official, standard way).

• Start mysql docker:

docker run --name test-mysql -e MYSQL_ROOT_PASSWORD=123 -d mysql

• Start wordpress:

docker run --name test-wordpress --link test-mysql:mysql -p 8080:80 -d wordpress

• Access wordpress server by container IP and port 8080:

  http://container_ip:8080

Limitations

• Only "vfs" Docker graph driver is currently supported
• Checkpointing and live migration of a container with Docker containers inside is not supported
• Bridges cannot be created inside Docker containers running inside OpenVZ container

See also

• Docker inside CT demo video.