5:32 a.m.
Hello Env & Stack team,
I have tested docker from beginners or "dummy" point of view, like me:)
I've got information from [1] ,
where it navigates me how to create a my docker file.
"Really" only 4 rows are needed:) Awesome.
Creating of docker file for http and checking whether process starts
I have create Dockerfile like:
FROM fedora:21
RUN yum install httpd -y
CMD ["ps -ef | grep http"]
sudo docker build -t phracek/fedora21-http
Image was build successfully.
I now that it is a stupid docker file but I wanted to test them. I
wanted to know what should be mentioned on
Fedora page. For beginners of course. Many of you are experts.
What should be (or I like to have) on Fedora page like
docker.fedoraproject.org?
1) [Tab How to install docker on Fedora]
How to Install on Fedora 21:
- install docker-io fedora-dockerfiles #fedora-dockerfile contains a
really good examples. Needs to be updated
- sudo systemctl start docker
- sudo docker run -i -t fedora /bin/bash
for test whether docker is running.
- adding to group docker
I think that package fedora-dockerfiles is more or less needed. There
are most information and useful Dockerfiles.
2) [Docker useful commands]
Some useful commands like in Fedora.
- building docker image
- starting docker image
- deleting docker image (docker rmi ..)
- link to empty or dummy Dockerfile like from [1]
- may be example Dockerfile would be also good.
Some command are already mentioned here [2].
3) [Links to documentation]
Some links to docker.io page would be welcome???? This is under
discussion and of course
we don't want to duplicate pages.
4) [Fedora docker WEB UI interface]
WEB UI interface for creating Dockerfiles
How can it look like?
- Tab for creating Dockerfile
- It can contain important directives like EXPOSE, RUN, ADD etc.
and Popup window discovers where user can write
- Immediately your see how docker file look like.
- Tool can merge repeated commands like yum on several lines
(sorted them)
- Tab for validation users dockerfiles
- Tab for building images and container execution. User could be able to
run ssh window with container.
That's all. Currently now I know how to build/run docker files and what
could help beginners on Fedora:)
I missed some useful commands on the one page.
Let's continue with new challenges. I think that the web UI is more or
less important for propagation Fedora as
distro for docker.
[1] https://docs.docker.com/userguide/dockerimages/
[2] http://fedoraproject.org/wiki/Docker
--
Petr Hracek
Software Engineer
Developer Experience
Red Hat, Inc
Mob: +420777056169
email: phracek(a)redhat.com
6:41 a.m.
On 4.3.2015 12:32, Petr Hracek wrote:
Hello Env & Stack team,
I have tested docker from beginners or "dummy" point of view, like me:)
I've got information from [1] ,
where it navigates me how to create a my docker file.
"Really" only 4 rows are needed:) Awesome.
Creating of docker file for http and checking whether process starts
I have create Dockerfile like:
FROM fedora:21
RUN yum install httpd -y
CMD ["ps -ef | grep http"]
I have a bit of a problem with this example -
it's complete nonsense:)
If you want really simple Dockerfile just to show that something like
that exists, you could use
FROM fedora
CMD echo "Hello I am "$(cat /etc/os-release | grep PRETTY_NAME | sed
"s/.*=//")
And that's really the simplest thing you can get. If you want something
that makes at least some sense, you could use...
FROM fedora
RUN yum -y install httpd
CMD /usr/sbin/httpd -D FOREGDROUND
sudo docker build -t phracek/fedora21-http
Image was build successfully.
I now that it is a stupid docker file but I wanted to test them. I
wanted to know what should be mentioned on
Fedora page. For beginners of course. Many of you are experts.
What should be (or I like to have) on Fedora page like
docker.fedoraproject.org?
1) [Tab How to install docker on Fedora]
How to Install on Fedora 21:
- install docker-io fedora-dockerfiles #fedora-dockerfile contains a
really good examples. Needs to be updated
- sudo systemctl start docker
- sudo docker run -i -t fedora /bin/bash
for test whether docker is running.
- adding to group docker
I think that package fedora-dockerfiles is more or less needed. There
are most information and useful Dockerfiles.
2) [Docker useful commands]
Some useful commands like in Fedora.
- building docker image
- starting docker image
- deleting docker image (docker rmi ..)
- link to empty or dummy Dockerfile like from [1]
- may be example Dockerfile would be also good.
Some command are already mentioned here [2].
3) [Links to documentation]
Some links to docker.io page would be welcome???? This is under
discussion and of course
we don't want to duplicate pages.
I'd call this part "Docs Hub"
and link to docker.io, ProjectAtomic.io,
OpenShift, Cent OS docs...
4) [Fedora docker WEB UI interface]
WEB UI interface for creating Dockerfiles
How can it look like?
- Tab for creating Dockerfile
- It can contain important directives like EXPOSE, RUN, ADD etc.
and Popup window discovers where user can write
- Immediately your see how docker file look like.
- Tool can merge repeated commands like yum on several lines
(sorted them)
- Tab for validation users dockerfiles
- Tab for building images and container execution. User could be able to
run ssh window with container.
That's all. Currently now I know how to build/run docker files and what
could help beginners on Fedora:)
I missed some useful commands on the one page.
Let's continue with new challenges. I think that the web UI is more or
less important for propagation Fedora as
distro for docker.
[1] https://docs.docker.com/userguide/dockerimages/
[2] http://fedoraproject.org/wiki/Docker
Otherwise looks good. Thanks a lot Petr. I had something like this in my
mind for a long time and it's great somebody finally put it in words!
Thanks,
Vašek
--
Lead Infrastructure Engineer
Developer Experience
Brno, Czech Republic
4 a.m.
On 4 March 2015 at 22:41, Václav Pavlín <vpavlin(a)redhat.com> wrote:
On 4.3.2015 12:32, Petr Hracek wrote:
>
> Hello Env & Stack team,
>
>
>
> I have tested docker from beginners or "dummy" point of view, like me:)
>
>
>
> I've got information from [1] ,
>
> where it navigates me how to create a my docker file.
>
> "Really" only 4 rows are needed:) Awesome.
>
>
>
> Creating of docker file for http and checking whether process starts
>
> I have create Dockerfile like:
>
> FROM fedora:21
>
> RUN yum install httpd -y
>
> CMD ["ps -ef | grep http"]
I have a bit of a problem with this example - it's complete nonsense:) If
you want really simple Dockerfile just to show that something like that
exists, you could use
FROM fedora
CMD echo "Hello I am "$(cat /etc/os-release | grep PRETTY_NAME | sed
"s/.*=//")
And that's really the simplest thing you can get.
I like that one, since it transfers nicely to also being used as an
"atomic run" example later.
For the rest, Petr's ideas sound good to me as a starting point, and
then we can iterate from there.
Cheers,
Nick.
--
Nick Coghlan | ncoghlan(a)gmail.com | Brisbane, Australia
4:35 a.m.
Quoting Petr Hracek (2015-03-04 12:32:34)
FROM fedora:21
RUN yum install httpd -y
CMD ["ps -ef | grep http"]
I don't think this will start httpd process (unless you are using
systemd-container inside and httpd is somehow enabled after installation — which
you would have to do by yourself anyway)
sudo docker build -t phracek/fedora21-http
Put yourself in docker group, why would you run docker client as root?
1) [Tab How to install docker on Fedora]
How to Install on Fedora 21:
- install docker-io fedora-dockerfiles #fedora-dockerfile contains a
really good examples. Needs to be updated
- sudo systemctl start docker
- sudo docker run -i -t fedora /bin/bash
for test whether docker is running.
'docker version' could be a better example, since it won't create a container
(I
would be really scared by the new prompt)
or
docker run --rm -ti fedora /bin/bash
- adding to group docker
I think that package fedora-dockerfiles is more or less needed. There
are most information and useful Dockerfiles.
I like this section! Especially fedora-dockerfiles part: example dockerfiles
right away
2) [Docker useful commands]
Some useful commands like in Fedora.
- building docker image
- starting docker image
- deleting docker image (docker rmi ..)
If you are still talking about beginners, they don't know what an image is and
why they want to create their own images. I know that we were talking about
making the page for more experienced users, hence my question: will this webpage
be for beginners or powerusers?
- link to empty or dummy Dockerfile like from [1]
- may be example Dockerfile would be also good.
Number two could be some sample django application with browser output.
Some command are already mentioned here [2].
3) [Links to documentation]
Some links to docker.io page would be welcome???? This is under
discussion and of course
we don't want to duplicate pages.
4) [Fedora docker WEB UI interface]
WEB UI interface for creating Dockerfiles
How can it look like?
- Tab for creating Dockerfile
- It can contain important directives like EXPOSE, RUN, ADD etc.
and Popup window discovers where user can write
- Immediately your see how docker file look like.
- Tool can merge repeated commands like yum on several lines
(sorted them)
- Tab for validation users dockerfiles
- Tab for building images and container execution. User could be able to
run ssh window with container.
This is a really big task. Being a terminal freak, it wouldn't be very useful
for me (I would actually prefer dockerfile syntax coloring with syntax checker
in vim). But for beginners this could be _very_ helpful. Great idea Peto!
That's all. Currently now I know how to build/run docker files
and what
could help beginners on Fedora:)
I missed some useful commands on the one page.
Let's continue with new challenges. I think that the web UI is more or
less important for propagation Fedora as
distro for docker.
[1] https://docs.docker.com/userguide/dockerimages/
[2] http://fedoraproject.org/wiki/Docker
--
Petr Hracek
Software Engineer
Developer Experience
Red Hat, Inc
Mob: +420777056169
email: phracek(a)redhat.com
_______________________________________________
env-and-stacks mailing list
env-and-stacks(a)lists.fedoraproject.org
https://lists.fedoraproject.org/mailman/listinfo/env-and-stacks
7:04 a.m.
On Thu, Mar 5, 2015, at 05:35 AM, Tomas Tomecek wrote:
Put yourself in docker group, why would you run docker client as root?
https://lists.projectatomic.io/projectatomic-archives/atomic-devel/2015-J...
4:03 a.m.
----- Original Message -----
On Thu, Mar 5, 2015, at 05:35 AM, Tomas Tomecek wrote:
>
> Put yourself in docker group, why would you run docker client as root?
https://lists.projectatomic.io/projectatomic-archives/atomic-devel/2015-J...
Interesting, thanks for sharing.
This makes me wonder how DevAssistant should approach this. Up until now, DevAssistant
just added the invoking user to the "docker" group and then communicated with
docker using docker-py library. Now, if we're not supposed to add the user to
"docker" group, we can't use the library, because all the calls will fail -
or we'd need to ask user to run DevAssistant as root, which is IMO wrong.
AFAIK there's no way to elevate DevAssistant permissions temporarily just to do the
docker call. So what is the recommended approach to do this? (This is a general problem, I
think, for code that needs to communicate with local Docker server.)
Thanks,
Slavek
5:46 a.m.
On 6 March 2015 at 20:03, Bohuslav Kabrda <bkabrda(a)redhat.com> wrote:
----- Original Message -----
> On Thu, Mar 5, 2015, at 05:35 AM, Tomas Tomecek wrote:
> >
> > Put yourself in docker group, why would you run docker client as root?
>
>
https://lists.projectatomic.io/projectatomic-archives/atomic-devel/2015-J...
Interesting, thanks for sharing.
This makes me wonder how DevAssistant should approach this. Up until now, DevAssistant
just added the invoking user to the "docker" group and then communicated with
docker using docker-py library. Now, if we're not supposed to add the user to
"docker" group, we can't use the library, because all the calls will fail -
or we'd need to ask user to run DevAssistant as root, which is IMO wrong.
AFAIK there's no way to elevate DevAssistant permissions temporarily just to do the
docker call. So what is the recommended approach to do this? (This is a general problem, I
think, for code that needs to communicate with local Docker server.)
I believe you should be able to use sudo for this, at least in
principle. We do that in Beaker's provisioning system to give system's
under test the ability to synchronously delete their own netboot files
without giving them any other access to the TFTP root directories.
Specifically, we drop this file into sudoers.d to give the apache
process access to a trusted command we wrote specifically to handle
that task:
https://git.beaker-project.org/cgit/beaker/tree/LabController/sudoers.d/b...
It seems to me that DevAssistant should be able to provide a similar
script that it runs with elevated privileges, so only that script
needs to be checked for being safe to run as a member of the docker
group.
Regards,
Nick.
--
Nick Coghlan | ncoghlan(a)gmail.com | Brisbane, Australia
7:15 a.m.
On Fri, Mar 6, 2015, at 05:03 AM, Bohuslav Kabrda wrote:
This makes me wonder how DevAssistant should approach this. Up until now, DevAssistant
just added the invoking user to the "docker" group and then communicated with
docker using docker-py library. Now, if we're not supposed to add the user to
"docker" group, we can't use the library, because all the calls will fail -
or we'd need to ask user to run DevAssistant as root, which is IMO wrong.
AFAIK there's no way to elevate DevAssistant permissions temporarily just to do the
docker call. So what is the recommended approach to do this? (This is a general problem, I
think, for code that needs to communicate with local Docker server.)
There's no easy answer. Historically, most *local* daemons have been using DBus and
PolicyKit for authorization. Docker is HTTP-based, which means it's easier to remote,
but on the other hand, there's no way to do system-local authorization in HTTP.
Possibly we could create a shim process which had a PolicyKit-authorized DBus API that
returned a file descriptor to the Docker socket. That would require patching apps that
use it, but it would be more fully under admin control.
BTW, with respect to mock - now that mockchain is added, a user in the mock group can run
arbitrary code as uid 0 locally - just put it in the %post of the build dependency.
Modern mock uses systemd-nspawn which is more secure, but uid 0 in containers should
currently be treated as uid 0 outside.
9:43 a.m.
On 6 March 2015 at 23:15, Colin Walters <walters(a)verbum.org> wrote:
On Fri, Mar 6, 2015, at 05:03 AM, Bohuslav Kabrda wrote:
>
> This makes me wonder how DevAssistant should approach this. Up until now,
DevAssistant just added the invoking user to the "docker" group and then
communicated with docker using docker-py library. Now, if we're not supposed to add
the user to "docker" group, we can't use the library, because all the calls
will fail - or we'd need to ask user to run DevAssistant as root, which is IMO wrong.
> AFAIK there's no way to elevate DevAssistant permissions temporarily just to do
the docker call. So what is the recommended approach to do this? (This is a general
problem, I think, for code that needs to communicate with local Docker server.)
There's no easy answer. Historically, most *local* daemons have been using DBus and
PolicyKit for authorization. Docker is HTTP-based, which means it's easier to remote,
but on the other hand, there's no way to do system-local authorization in HTTP.
What level of granularity of "system-local authorization" are you
referring to there? The reason I ask is because my understanding is
that the FreeIPA folks are aiming to enable at least user level local
authorization for web services through sssd. An Apache-focused
write-up of the overall scheme is at
http://www.freeipa.org/page/Web_App_Authentication
Now, the nature of FreeIPA means that's more focused at *org* level
authentication and authorization than local system auth, but it does
provide some interesting possibilities for tinkering with
authorization at the HTTP level. Since Docker really *wants* to be
treated as a remote web service, perhaps it would be feasible to teach
DevAssistant to talk to a local Docker daemon over HTTP, and use some
of the FreeIPA (and perhaps iptables) tooling to automate setting up
appropriate local permissions for it to do that?
Or am I missing something fundamental that makes this an inherently
unworkable idea? (I know its an overly *complicated* idea, but I don't
think "simple" is one of the options on the table at this point)
Regards,
Nick.
--
Nick Coghlan | ncoghlan(a)gmail.com | Brisbane, Australia
5:27 a.m.
Quoting Colin Walters (2015-03-05 14:04:31)
On Thu, Mar 5, 2015, at 05:35 AM, Tomas Tomecek wrote:
>
> Put yourself in docker group, why would you run docker client as root?
https://lists.projectatomic.io/projectatomic-archives/atomic-devel/2015-J...
Interesting, I didn't know that. Thanks for headsup.
It would be worth mentioning what users should put to /etc/sudoers so they can
use docker, something like:
user localhost = (root) /usr/bin/docker
(can this be improved?)
Tomas
5:39 a.m.
Dne 5.3.2015 v 14:04 Colin Walters napsal(a):
On Thu, Mar 5, 2015, at 05:35 AM, Tomas Tomecek wrote:
> Put yourself in docker group, why would you run docker client as root?
https://lists.projectatomic.io/projectatomic-archives/atomic-devel/2015-J...
Similar issues apply to vagrant-libvirt:
https://bugzilla.redhat.com/show_bug.cgi?id=1187019
Vít
5:41 a.m.
Dne 6.3.2015 v 12:39 Vít Ondruch napsal(a):
Dne 5.3.2015 v 14:04 Colin Walters napsal(a):
> On Thu, Mar 5, 2015, at 05:35 AM, Tomas Tomecek wrote:
>> Put yourself in docker group, why would you run docker client as root?
>
https://lists.projectatomic.io/projectatomic-archives/atomic-devel/2015-J...
>
Similar issues apply to vagrant-libvirt:
https://bugzilla.redhat.com/show_bug.cgi?id=1187019
BTW I was suggested to explore how mock is done and mock is using
consolehelper to my knowledge. But that is all I know :)
Vít
3342
days inactive
3345
days old
env-and-stacks@lists.fedoraproject.org
11 comments
7 participants
participants (7)
-
Bohuslav Kabrda -
Colin Walters -
Nick Coghlan -
Petr Hracek -
Tomas Tomecek -
Václav Pavlín -
Vít Ondruch