content:serverbasics:docker
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.
| Beide Seiten, vorherige ÜberarbeitungVorherige ÜberarbeitungNächste Überarbeitung | Vorherige Überarbeitung | ||
| content:serverbasics:docker [2024/08/04 01:32] – [First Docker App: Portainer] obel1x | content:serverbasics:docker [2026/03/01 11:44] (aktuell) – [Fast Stop of all Containers] obel1x | ||
|---|---|---|---|
| Zeile 9: | Zeile 9: | ||
| __**Warning: | __**Warning: | ||
| - | So just: Don't set up Docker | + | So just: Don't set up Docker |
| ===== Filesystem Layout ===== | ===== Filesystem Layout ===== | ||
| - | Mind, that at the time writing, '' | + | Mind, that at the time writing, '' |
| - | I personally dislike xfs, especially while its not rubust and won't shrink. I use it anyway, because of its srong advise to do so - with kernel 5.19+ it should be possible to get overlay2 working on btrfs, but still there are things that may not work even with that kernel. | + | I personally dislike xfs, especially while its not rubust and won't shrink. I use it anyway, because of its srong advise to do so - with kernel 5.19+ it should be possible to get overlay2 working on btrfs, but still there are things that may not work even with that kernel |
| So make sure, that the Home-Directory of you docker user is on XFS. The ftype is already ok on SuSE 15.5, check output of '' | So make sure, that the Home-Directory of you docker user is on XFS. The ftype is already ok on SuSE 15.5, check output of '' | ||
| - | Warning: you may have umask set your way - i prefer 007 as writte | + | Warning: you may have umask set your way - i prefer 007 as written |
| That may change the ownership in a way, that even the docker user on the host cannot access the Files, which is OK ! | That may change the ownership in a way, that even the docker user on the host cannot access the Files, which is OK ! | ||
| - | __**STRONG WARNING: Don't change permissions or ownership of docker- directories on the Host directly as this will chage them in the container and break your Services !!!**__ | + | __**STRONG WARNING: Don't change permissions or ownership of docker- directories on the Host directly as this will change |
| __**The only way to manage Volume- File- Permissions is to bash inside the running container itself and to change them there (to the right values of course)!**__ | __**The only way to manage Volume- File- Permissions is to bash inside the running container itself and to change them there (to the right values of course)!**__ | ||
| + | A short hint: Docker rootless uses Sub(g)uids, which is a feature of Linux. That means each user has a range of userids (quite a huge range) and groupid which the user may use. Those will be exclusive reserved for that user. But it does not mean, that the User can acces the Files created by those Subuids! Also the UIDs are onyl a number - not a real user in Linux having a username- They cannot be used to logon or to work with. Docker manages internally which Host-Subuserid is assigned to which caontainer and to which userid inside the running container/ | ||
| + | |||
| + | ===== Which Devices / Raid- Level ===== | ||
| + | |||
| + | I strongly do not advise to use Raid5 with classical harddrives to run docker on it. If you plan to have large Data in / | ||
| + | |||
| + | For me, i switched to RAID1 on SSD an mounted that to / | ||
| ===== Packages NOT to install ===== | ===== Packages NOT to install ===== | ||
| Zeile 43: | Zeile 49: | ||
| ===== Docker- User ===== | ===== Docker- User ===== | ||
| - | Create a new **group** called **docker** and a new **user** called **docker**. Make the user is in the **default group docker**. | + | Create a new **group** |
| Attention: The Home Directory should be on a volume having XFS as btrfs or others are not fully supported right now (20.04.2024 - patches in new Kernel 5.19 are incoming, but this Kernel is not released until now and still there are some problems open in developement there). | Attention: The Home Directory should be on a volume having XFS as btrfs or others are not fully supported right now (20.04.2024 - patches in new Kernel 5.19 are incoming, but this Kernel is not released until now and still there are some problems open in developement there). | ||
| - | |||
| ===== cGroups v2 ===== | ===== cGroups v2 ===== | ||
| Zeile 325: | Zeile 330: | ||
| { | { | ||
| - | " | ||
| " | " | ||
| - | " | + | " |
| + | " | ||
| + | " | ||
| + | " | ||
| " | " | ||
| " | " | ||
| Zeile 342: | Zeile 349: | ||
| You need to adjust cidr to some unique ULA. ULAs are non internet routable adresses (like 192.X.X.X in ipv4). Select an unique adress only for that internal Docker network - you can choose anything that is not assigned anywhere else on your network to not cause trouble. | You need to adjust cidr to some unique ULA. ULAs are non internet routable adresses (like 192.X.X.X in ipv4). Select an unique adress only for that internal Docker network - you can choose anything that is not assigned anywhere else on your network to not cause trouble. | ||
| - | Maybe use this tool to generate: https:// | + | Maybe use this tool to generate: |
| + | |||
| + | |||
| + | ==== The default Network is not IPV6- enabled by default ==== | ||
| + | |||
| + | If you specify no network, or use the network: default - than as the time of writing, IPV6 will not be enabled by default. | ||
| + | |||
| + | So, in your docker-compose.yml you need the lines: | ||
| + | < | ||
| + | |||
| + | networks: | ||
| + | # Still needs to be defined while without it won't enable ipv6 | ||
| + | default: | ||
| + | driver: bridge | ||
| + | enable_ipv6: | ||
| + | |||
| + | </ | ||
| ===== Networking in Docker rootless ===== | ===== Networking in Docker rootless ===== | ||
| Zeile 350: | Zeile 373: | ||
| Instead the network is encapsulated in the environement of rootlesskit and not visible to the host. From the Hosts view Docker is just another Application running on your Host talking to the internet like some app would do. | Instead the network is encapsulated in the environement of rootlesskit and not visible to the host. From the Hosts view Docker is just another Application running on your Host talking to the internet like some app would do. | ||
| + | ===== Performance ===== | ||
| + | |||
| + | when you install pasta- networking driver, you can edit your docker systemd and use a much improved networking-driver. | ||
| + | |||
| + | Also you can make Docker a higher Priority and Nice-Value: | ||
| + | |||
| + | < | ||
| + | docker@server: | ||
| + | |||
| + | [Service] | ||
| + | # Higher Prio for Docker | ||
| + | Nice=10 | ||
| + | IOSchedulingClass=best-effort | ||
| + | IOSchedulingPriority=7 | ||
| + | # Use Pasta- network Driver (of your Host - Pasta needs to be installed) | ||
| + | Environment=" | ||
| + | Environment=" | ||
| + | Environment=" | ||
| + | |||
| + | </ | ||
| ===== Install docker compose ===== | ===== Install docker compose ===== | ||
| - | **This Chapter may be obsolete as since docker v27 the compose plugin is part of installation script - check your output of '' | + | **This Chapter may be obsolete as since docker v27 the compose plugin is part of installation script - check your output of '' |
| - | The command '' | + | The command '' |
| Installing it the manual way: | Installing it the manual way: | ||
| - | Edit the File '' | + | Edit the File '' |
| < | < | ||
| Zeile 383: | Zeile 426: | ||
| Your done with the compose plugin | Your done with the compose plugin | ||
| - | |||
| ===== Update ===== | ===== Update ===== | ||
| Zeile 392: | Zeile 434: | ||
| #!/bin/bash | #!/bin/bash | ||
| #Upgrade docker rootless and plugin | #Upgrade docker rootless and plugin | ||
| + | ./ | ||
| + | sleep 5 | ||
| systemctl --user stop docker | systemctl --user stop docker | ||
| + | sleep 5 | ||
| + | #uninstall | ||
| rm -f ~/ | rm -f ~/ | ||
| + | rm ~/ | ||
| + | mv ~/ | ||
| + | #reinstall docker compose | ||
| + | COMPOSE_VER=' | ||
| + | rm $DOCKER_CONFIG/ | ||
| + | echo " | ||
| + | curl -SL https:// | ||
| + | chmod +x $DOCKER_CONFIG/ | ||
| + | #install docker | ||
| curl -fsSL https:// | curl -fsSL https:// | ||
| #need to give the new binary permissions to acces privileged network ports (beneath 1024) | #need to give the new binary permissions to acces privileged network ports (beneath 1024) | ||
| sudo setcap ' | sudo setcap ' | ||
| - | + | #this should be everything | |
| - | # If you installed docker compose, check the newest version first at https:// | + | docker |
| - | # NO NEED since v27 any more | + | |
| - | #curl -SL https:// | + | |
| </ | </ | ||
| - | |||
| ===== Create a place for Yamls ===== | ===== Create a place for Yamls ===== | ||
| Zeile 416: | Zeile 468: | ||
| As always, SSH into your docker- user and than create the folders and yml-files for docker compose and portainer. | As always, SSH into your docker- user and than create the folders and yml-files for docker compose and portainer. | ||
| - | |||
| < | < | ||
| + | |||
| obel1x@server: | obel1x@server: | ||
| Password: | Password: | ||
| Zeile 476: | Zeile 528: | ||
| Now you can go to [[http:// | Now you can go to [[http:// | ||
| - | {{ | + | {{ |
| Thats all: Docker is running and serving your services, cheers! | Thats all: Docker is running and serving your services, cheers! | ||
| Zeile 484: | Zeile 536: | ||
| This makes life easy '' | This makes life easy '' | ||
| < | < | ||
| - | |||
| #!/bin/bash | #!/bin/bash | ||
| docker stop $(docker ps -a -q) | docker stop $(docker ps -a -q) | ||
| Zeile 490: | Zeile 541: | ||
| </ | </ | ||
| + | ===== Find the latest Commit in git ===== | ||
| + | |||
| + | Sometimes the Repository does not offer a latest Tatg, so its hard to find the right Tag to use. Maybe this coding helps (not testet wheter to get the right commitid for the Image): | ||
| + | |||
| + | < | ||
| + | if [ -z ${TVHEADEND_COMMIT+x} ]; then \ | ||
| + | TVHEADEND_COMMIT=$(curl -sX GET https:// | ||
| + | | jq -r '. | .sha' | ||
| + | fi && \ | ||
| + | |||
| + | </ | ||
content/serverbasics/docker.1722727979.txt.gz · Zuletzt geändert: von obel1x