Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:notes_docker [2025/10/09 17:29] – Jean-Baptiste
+++ tech:notes_docker [2026/05/31 02:12] (Version actuelle) – Jean-Baptiste
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon Docker RedHat Debian Conteneur LVM}}
+# Notes Docker
+Voir :
+* `namespace.unpriv_enable=1`
+* [[Scan de vulnérabilité pour les images de conteneurs]]
+Voir aussi OpenContainers :
+* https://www.opencontainers.org/
+* https://github.com/opencontainers/runtime-tools
+A lire :
+* https://docs.docker.com/get-started/
+* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux_atomic_host/7/html-single/getting_started_with_containers
+* http://nkhare.github.io/data_and_network_containers/storage_backends/
+* https://docs.oracle.com/cd/E52668_01/E75728/html/docker_admin_config.html
+Django: Mise en place de l’HTTPS via Nginx
+* https://nextcloud.inrae.fr/s/gtSrdE98Knp7HGf?openfile=true
+Mise en production de Django via Docker
+* https://nextcloud.inrae.fr/s/rdMSmet4miWkz8Q?openfile=true
+Docker et sécurité :
+* https://resinfo.org/IMG/pdf/secu-docker.pdf
+Autre :
+* https://docs.oracle.com/en/operating-systems/oracle-linux/9/relnotes9.4/ol9-features-Containers.html
+## Trouver et activer les bons dépôts
+https://access.redhat.com/downloads/content/package-browser
+| **App**      | **Dépôt RedHat**             |
+| ------------ | ---------------------------- |
+| Système OS   | rhel-7-server-rpms           |
+| Docker       | rhel-7-server-extras-rpms    |
+| PHP-FPM      | rhel-7-server-optional-rpms  |
+## Install
+### Prérequis
+Vérifier les prérequis :
+# https://github.com/moby/moby/blob/master/contrib/check-config.sh
+https://github.com/opencontainers/runc/blob/main/script/check-config.sh
+### Debian
+`/etc/default/grub`
+~~~bash
+GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1"
+~~~
+~~~bash
+update-grub
+~~~
+### RedHat
+~~~bash
+#grubby --args="user_namespace.enable=1" --update-kernel=/boot/vmlinuz-$(uname -r)
+#grubby --args="user_namespace.enable=1" --update-kernel=$(grubby --default-kernel)
+grubby --args="user_namespace.enable=1" --update-kernel=ALL
+~~~
+Install paquets
+~~~bash
+yum install docker-latest #docker #docker-distribution
+~~~
+### Si conf proxy Docker et SystemD
+Voir https://docs.docker.com/engine/admin/systemd/#httphttps-proxy
+~~~bash
+mkdir /etc/systemd/system/docker-latest.service.d
+~~~
+`/etc/systemd/system/docker-latest.service.d/http-proxy.conf`
+~~~ini
+[Service]
+# Environment = "HTTP_PROXY=http://192.168.56.1:3128/" "HTTPS_PROXY=http://192.168.56.1:3128/"
+Environment = "http_proxy=http://192.168.56.1:3128/" "https_proxy=http://192.168.56.1:3128/"
+~~~
+~~~bash
+#systemctl restart docker
+#systemctl enable docker
+systemctl daemon-reload
+systemctl restart docker-latest
+systemctl enable docker-latest
+~~~
+Vérif
+~~~bash
+systemctl show --property=Environment docker-latest
+~~~
+## Sécurité
+Voir :
+* https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html
+* https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.6_Benchmark_v1.0.0.pdf
+* https://docs.oracle.com/en/operating-systems/oracle-linux/podman/podman-SecurityRecommendations.html
+* https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
+* https://github.com/OWASP/Docker-Security
+* https://wiki.owasp.org/images/d/df/Dirk_Wetter_-_Docker_Top10-AMS.pdf
+* https://connect.ed-diamond.com/MISC/misc-113/attaques-en-environnement-docker-compromission-et-evasion
+### Droits pour utilisateur non root
+**¡¡¡ Attention, grosse faille de sécu !!!**
+~~~bash
+docker run -ti --privileged -v /:/host debian chroot /host
+docker run -ti --userns=host --privileged -v /:/host debian chroot /host
+#List images to use one
+docker images
+#Run the image mounting the host disk and chroot on it
+docker run -it -v /:/host/ ubuntu:18.04 chroot /host/ bash
+# Get full access to the host via ns pid and nsenter cli
+docker run -it --rm --pid=host --privileged ubuntu bash
+nsenter --target 1 --mount --uts --ipc --net --pid -- bash
+# Get full privs in container without --privileged
+docker run -it -v /:/host/ --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined --security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host ubuntu chroot /host/ bash
+~~~
+Voir :
+* `--security-opt apparmor=unconfined`
+* `--security-opt seccomp=unconfined`
+* `--security-opt label:disable`
+Voir : http://www.projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-run-docker-in-centos-fedora-or-rhel/
+~~~bash
+ls -l /var/run/docker.sock
+groupadd docker
+usermod -aG docker process
+#chgrp docker /var/run/docker.sock
+#systemctl restart docker
+systemctl restart docker-latest
+~~~
+Voir :
+* Podman
+* kata-containers
+### Droits montage
+~~~bash
+docker run -v /mnt:/mnt:ro
+~~~
+doesn't really make /mnt inside the container read-only
+Submounts like /mnt/usbdisk are writable
+#### Autres - seccomp
+https://docs.docker.com/engine/security/apparmor/
+~~~bash
+docker run --rm -it --security-opt seccomp=unconfined debian:jessie unshare --map-root-user --user sh -c whoami
+~~~
+## Espace de nom (namespace)
+** Le fichier `/etc/sysconfig/docker` n'est pas utilisé avec SystemD**
+`/etc/sysconfig/docker`
+~~~
+#OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false'
+~~~
+A la place (** Attention, a vérifier, fichier crée sur une Debian**)
+Pour activer le namespace
+`"userns-remap": "default"`
+~~~bash
+sysctl -w kernel.unprivileged_userns_clone=1
+~~~
+`/etc/docker/daemon.json`
+~~~javascript
+{
+        "userns-remap": "default",
+        "log-driver": "journald",
+        "storage-driver": "devicemapper",
+        "graph": "/var/lib/docker",
+        "storage-opts": [
+        "dm.thinpooldev=/dev/mapper/vgos-docker0",
+        "dm.metadatadev=/dev/mapper/vgos-docker0meta",
+        "dm.use_deferred_removal=true",
+        "dm.use_deferred_deletion=true"
+    ]
+}
+~~~
+Voir :
+~~~bash
+man dockerd
+docker daemon --help
+~~~
+~~~bash
+systemctl daemon-reload
+~~~
+## Stockage
+Info :
+~~~bash
+docker info | grep "Data Space"
+~~~
+device-mapper-driver
+~~~bash
+lvcreate -y -l 1%FREE -n docker0meta vgos
+lvcreate -y -l 95%FREE -n docker0 vgos
+lvconvert -y \
+--zero n \
+-c 512K \
+--thinpool vgos/docker0 \
+--poolmetadata vgos/docker0meta
+~~~
+~~~bash
+mkdir /etc/lvm/profile/
+~~~
+`/etc/lvm/profile/docker-thinpool.profile`
+~~~c
+activation {
+  thin_pool_autoextend_threshold=80
+  thin_pool_autoextend_percent=20
+}
+~~~
+~~~bash
+lvchange --metadataprofile docker-thinpool vgos/docker0
+lvs -o+seg_monitor
+~~~
+Pour identifier les conteneurs utilisant un volume spécifique
+~~~bash
+docker ps -a --filter volume=data-nfs3
+~~~
+### Notes RedHat
+`/usr/lib/docker-storage-setup/docker-storage-setup`
+The Docker config is `--storage-driver=devicemapper --storage-opt dm.thinpooldev=/dev/mapper/docker-pool0`
+~~~bash
+docker-storage-setup
+~~~
+`/etc/sysconfig/docker-storage`
+~~~
+#DOCKER_STORAGE_OPTIONS="--storage-driver devicemapper --storage-opt dm.fs=xfs --storage-opt dm.thinpooldev=/dev/mapper/rhel-docker--pool --storage-opt dm.use_deferred_removal=true "
+DOCKER_STORAGE_OPTIONS="--storage-driver devicemapper --storage-opt dm.fs=xfs --storage-opt dm.thinpooldev=/dev/mapper/rhel-docker0 --storage-opt dm.use_deferred_removal=true "
+~~~
+Voir aussi :
+* /usr/lib/docker-storage-setup/docker-storage-setup
+### Debian
+https://stackoverflow.com/questions/40162022/direct-lvm-stops-working-after-reboot
+~~~bash
+apt-get install thin-provisioning-tools
+~~~
+### RedHat 7
+docker-latest
+à la 1ere install
+`/etc/sysconfig/docker-latest-storage`
+~~~ini
+# This file may be automatically generated by an installation program.
+# By default, Docker uses a loopback-mounted sparse file in
+# /var/lib/docker.  The loopback makes it slower, and there are some
+# restrictive defaults, such as 100GB max storage.
+# If your installation did not set a custom storage for Docker, you
+# may do it below.
+# Example: Use a custom pair of raw logical volumes (one for metadata,
+# one for data).
+# DOCKER_STORAGE_OPTIONS = --storage-opt dm.metadatadev=/dev/mylogvol/my-docker-metadata --storage-opt dm.datadev=/dev/mylogvol/my-docker-data
+DOCKER_STORAGE_OPTIONS=
+~~~
+## Réseau
+### List Docker Container Names and IPs
+~~~bash
+function drips(){
+    docker ps -q | xargs -n 1 docker inspect --format '{{ .NetworkSettings.IPAddress }} {{ .Name }}' | sed 's/ \// /'
+}
+~~~
+Source : https://gist.github.com/ipedrazas/2c93f6e74737d1f8a791
+### /etc/hosts
+Default gateway \\
+Le hôte du container est indiqué par `host.containers.internal` (podman)
+`/etc/hosts`
+~~~
+.0.0.1       localhost localhost.localdomain localhost4 localhost4.localdomain4
+::1     localhost localhost.localdomain localhost6 localhost6.localdomain6
+.246.223.27   srv1.acme.local srv1
+.88.0.1       host.containers.internal
+.88.0.176     1264dc4981c1 boring_chaplygin
+~~~
+### Conf Default bridge VLAN
+`/etc/docker/daemon.json`
+~~~javascript
+{
+"bip": "192.168.10.1/24"
+}
+~~~
+## Vérif
+~~~bash
+docker info | grep -i warn
+systemctl status docker
+~~~
+## Import / Export images Docker
+Enregistrer / Sauvegarder l'image Docker(tarball) :
+~~~bash
+docker save -o <save image to path> <image name>
+~~~
+Importer l'image sur un autre système, par exemple
+~~~bash
+docker load -i <path to image tar file>
+~~~
+## Debug
+Test
+~~~bash
+docker run --rm hello-world
+~~~
+~~~bash
+#systemctl stop docker
+systemctl stop docker-latest ; rm -rf /var/lib/docker ; /usr/bin/docker daemon --debug --storage-driver 'devicemapper' --storage-opt 'dm.thinpooldev=/dev/mapper/docker-pool0' --storage-opt 'dm.fs=xfs' --storage-opt 'dm.use_deferred_removal=true'
+~~~
+## Autres
+Dépôt (Docker Registry)
+* https://sites.google.com/site/grow4wiki/documentation/docker
+### Architecture x86 amd64 arm
+~~~bash
+docker run --platform linux/amd64 --publish 8000:8080 ghcr.io/mermaid-js/mermaid-live-editor
+~~~
+### Notes brouillon
+#### Namespace
+Voir :
+* https://blog.yadutaf.fr/2016/04/14/docker-for-your-users-introducing-user-namespace/
+* https://www.devoteam.com/fr/expert-view/la-migration-vers-podman-est-elle-la-solution-pour-se-passer-de-docker/
+* `/proc/sys/user/max_user_namespaces`
+`/etc/subuid`
+~~~
+dockremap:100000:65536
+~~~
+`/etc/subgid`
+~~~
+dockremap:100000:65536
+~~~
+## Perf strest test pour prod
+https://hub.docker.com/r/monitoringartist/docker-killer/
+## Pb
+~~~bash
+docker run --rm hello-world
+~~~
+~~~
+nsenter: unable to unshare namespaces: Invalid argument
+container_linux.go:247: starting container process caused "process_linux.go:245: running exec setns process for init caused \"exit status 1\""
+/usr/bin/docker-current: Error response from daemon: invalid header field value "oci runtime error: container_linux.go:247: starting container process caused \"process_linux.go:245: running exec setns process for init caused \\\"exit status 1\\\"\"\n".
+~~~
+--------
+# Notes Docker old
+Note sécurité :
+* http://w3blog.fr/2016/02/23/docker-securite-10-bonnes-pratiques/
+Voir :
+* http://blog.kaliop.com/blog/2015/05/26/docker-dans-la-vraie-vie-les-parties-delicates/
+* http://merrigrove.blogspot.fr/2015/10/visualizing-docker-containers-and-images.html
+* http://mmckeen.net/blog/2013/12/14/docker-all-the-things-nginx-and-supervisor/
+* https://www.youtube.com/watch?v=Pe6a8Jbvi9E
+* http://slopjong.de/2014/09/17/install-and-run-a-web-server-in-a-docker-container/
+* http://blog.octo.com/en/docker-registry-first-steps/
+* http://fr.slideshare.net/jpetazzo/docker-en-production-docker-paris
+* https://goldmann.pl/blog/2014/09/11/resource-management-in-docker/
+* https://chimeracoder.github.io/docker-without-docker/#17
+* http://www.jamescoyle.net/how-to/1512-export-and-import-a-docker-image-between-nodes
+* http://tuhrig.de/difference-between-save-and-export-in-docker/
+Docker avec tous les services (ssh, cron, initlike)
+* http://phusion.github.io/baseimage-docker/
+Nginx reverse proxy pour Docker
+* https://www.digitalocean.com/community/questions/how-to-bind-multiple-domains-ports-80-and-443-to-docker-contained-applications
+** Pb de sécurité  **
+~~~bash
+docker run -ti --privileged -v /:/host fedora chroot /host
+~~~
+Voir http://www.projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-run-docker-in-centos-fedora-or-rhel/
+Voir aussi
+~~~
+Usage of loopback devices is strongly discouraged for production use. Either use `--storage-opt dm.thinpooldev` or use `--storage-opt dm.no_warn_on_loop_devices=true` to suppress this warning.
+~~~
+~~~
+# docker -d
+INFO[0000] Listening for HTTP on unix (/var/run/docker.sock)
+INFO[0000] [graphdriver] using prior storage driver "devicemapper"
+WARN[0000] Your kernel does not support cgroup memory limit: mountpoint for memory not found
+WARN[0000] mountpoint for cpu not found
+FATA[0000] Error mounting devices cgroup: mountpoint for devices not found
+~~~
+### Proxy
+~~~bash
+export ALL_PROXY="http://192.168.56.1:3128/"
+~~~
+### Construire un Docker avec un Dockerfile
+~~~bash
+cd MonDossierQuiContientUnDockerfile
+docker build -t mondocker .
+~~~
+Exemple de commandes
+~~~bash
+docker pull debian
+docker images
+docker images -q
+docker info
+docker version
+docker ps -a
+docker ps -q -n 1
+docker ps -f name=etherpad1
+docker logs --tail 0 -f <container_id>
+docker run -ti -p 53:53 -p 53:53/udp --name bind debian /bin/bash
+docker ps
+docker exec -it a6cc3efa1aa1 /bin/bash
+~~~
+~~~bash
+cat context.tar | docker build -
+run builder_image | docker build -
+docker run -v /:/my_host ubuntu:ro ls /my_host
+docker port
+docker inspect
+~~~
+Connaître le "CONTAINER ID"
+~~~bash
+#docker run -d <nom image>
+JOB1=$(docker run -d conteneur)
+docker logs $JOB1
+docker stop $JOB1
+~~~
+~~~bash
+docker pull debian
+docker run -i -t debian /bin/bash
+docker rm $(docker ps -q -a)
+~~~
+-----
+~~~bash
+adduser jean docker
+docker run -d -p 7777:8000 zerobin su -l www-data -c 'zerobin --settings-file=settings.py'
+docker run -d -p 80:80 --name my_wiki mprasil/dokuwiki
+~~~
+Liens :
+* https://hub.docker.com/r/istepanov/dokuwiki/
+* http://linuxfr.org/news/docker-tutoriel-pour-manipuler-les-conteneurs
+* http://www.it-connect.fr/debuter-avec-docker-et-les-containers-sous-debian-8/
+* http://douche.name/presentation-docker/#58
+* http://sametmax.com/le-deploiement-par-conteneurs-avec-docker/
+## Suis-je dans un conteneur (container) ?
+~~~bash
+grep 'systemd:/system.slice/docker-' /proc/self/cgroup
+~~~
+## Notes gestion des process services grâce à supervisor
+~~~bash
+mkdir /var/log/supervisor
+~~~
+Liens :
+* http://blogduyax.madyanne.fr/supervisor-gestion-de-processus.html
+* https://www.digitalocean.com/community/tutorials/how-to-install-and-manage-supervisor-on-ubuntu-and-debian-vps
+* https://serversforhackers.com/monitoring-processes-with-supervisord
+* https://gist.github.com/didip/802561
+* http://stackful-dev.com/simplify-unix-process-herding-with-supervisor.html
+* http://www.onurguzel.com/supervisord-restarting-and-reloading/
+* http://ryanmckern.com/2013/01/daemon-ize-your-processes-on-the-cheap-part-two-supervisor/
+~~~ini
+stdout_logfile=/var/log/supervisor/%(program_name)s.log
+stderr_logfile=/var/log/supervisor/%(program_name)s.log
+numprocs=4
+~~~
+## Notes supervision
+Machine de dev, commit effectué dans des images non nommé (doit être zero)
+~~~bash
+docker images | sed -e '1d' | grep '^<none>' | awk '{print $3}' | wc -l
+~~~
+Logs d'erreur
+~~~bash
+grep CRIT /var/lib/docker/containers/*/*.log
+~~~
+## Notes DNS Bind9
+Sur l'hôte
+~~~bash
+docker run -ti -p 53:53 -p 53:53/udp --name bind debian /bin/bash
+~~~
+Dans le conteneur
+~~~bash
+apt-get install --no-install-recommends bind9 bind9-doc bind9-host dnsutils
+apt-get install --no-install-recommends supervisor vim file netcat tmux traceroute mtr net-tools dnsutils bind9 bind9-doc bind9utils
+apt-get install --no-install-recommends lsb-release wget ca-certificates
+~~~
+### Pb
+Limitation limite de mémoire `-m 512m`
+~~~bash
+docker run -ti -m 512m --name madebian1 debian /bin/bash
+~~~
+Erreur
+~~~
+WARNING: Your kernel does not support memory limit capabilities. Limitation discarded.
+~~~
+`/etc/default/grub`
+~~~ini
+GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1"
+~~~
+~~~bash
+update-grub
+~~~
+### Pb 2
+http://stackoverflow.com/questions/31197724/shutting-down-docker-containers-via-supervisor
+J'ai le même pb.
+A l’arrêt de l'hôte les conteneurs ne sont pas correctement stop et supprimés par supervisord.
+Je dois faire manuellement après un reboot :
+~~~bash
+docker rm $(docker -a -q)
+~~~
+Pour faire les choses proprement c'est à supervisord de n'en occuper
+### Pb 3 Unable to enable SKIP DNAT rule
+Sur RedHat
+Source : https://github.com/wodby/docker4drupal/issues/211
+~~~
+Internal Server Error ("Failed to Setup IP tables: Unable to enable SKIP DNAT rule: (iptables failed: iptables --wait -t nat -I DOCKER -i br-38e86077394a -j RETURN: iptables: No chain/target/match by that name.\n (exit status 1))")"
+~~~
+Solution
+~~~bash
+sudo iptables -t filter -N DOCKER
+sudo systemctl restart docker
+~~~
+Cela se produit quand Docker est installé quand le pare-feu (firewalld) est démarré, puis qu'il a été désactivé par la suite.
+### Autre
+~~~bash
+docker save -o plop.tar.gz acme/jibe
+~~~
+#### Notes console TTY
+https://github.com/docker/docker/issues/2838
+Starting with docker 0.6.5, you can add -t to the docker run command, which will attach a pseudo-TTY. Then you can type Control-C to detach from the container without terminating it.
+If you use -t and -i then Control-C will terminate the container. When using -i with -t then you have to use Control-P Control-Q to detach without terminating.
+#### Notes Haute dispo / Cluster
+docker swarm
+#### Notes catalogue images
+CentOS7
+~~~bash
+docker pull centos:centos7
+~~~
+--------------------
+# Notes Docker
+~~~bash
+#docker save acme/plop1 -o acme-plop1.tar
+docker save acme/plop1 | pigz > acme-plop1.tar.gz
+~~~
+Une sorte de **top**
+~~~bash
+docker stats
+~~~
+~~~bash
+docker history IMAGES --no-trunc
+~~~
+~~~bash
+docker top CONTAINER -o pid,user,%mem,rss,vsize,cmd --sort rss
+docker top CONTAINER
+~~~
+~~~bash
+cat > Dockerfile <<EOF
+FROM alpine
+# on déclare un volume
+VOLUME /opt/data
+# pas la peine le de le laisser tourner
+# les volumes sont accessibles même
+# quand le conteneur ne tourne plus
+CMD ["true"]
+EOF
+~~~
+~~~bash
+docker build -t $USER/dataexample .
+docker run -it -d --name data $USER/dataexample
+docker run --rm -it --volumes-from data alpine sh
+touch /opt/data/foo
+exit
+$ docker run --rm -it --volumes-from data alpine sh
+ls /opt/data
+foo
+~~~
+Plop
+~~~bash
+docker run -it --volume /opt/data --name data2 busybox
+docker inspect --format "{{ .Mounts }}" data2
+docker inspect -f '{{ .Mounts }}' my-container
+docker volume create --name dataa
+docker run --rm -it -v dataa:/data alpine
+docker volume ls
+docker volume rm $(docker volume ls | awk '{print $2}' | sed '1d')
+~~~
+Arrêter tous les containers
+~~~bash
+docker stop $(docker ps | awk '{print $1}' | sed '1d')
+~~~
+Effacer tous les containers
+~~~bash
+docker rm $(docker ps -a | awk '{print $1}' | sed '1d')
+~~~
+Autres
+~~~bash
+docker system df
+docker system prune
+docker ps --all -q -f status=dead
+alias docker_clean_images='docker rmi $(docker images -a --filter=dangling=true -q)'
+alias docker_clean_ps='docker rm $(docker ps --filter=status=exited --filter=status=created -q)'
+~~~
+## Cli / API
+~~~
+$ docker-machine.exe env master
+export DOCKER_TLS_VERIFY="1"
+export DOCKER_HOST="tcp://192.168.99.103:2376"
+export DOCKER_CERT_PATH="C:\Users\FORMATION\.docker\machine\machines\master"
+export DOCKER_MACHINE_NAME="master"
+export COMPOSE_CONVERT_WINDOWS_PATHS="true"
+~~~