my first docker article
This commit is contained in:
203
content/post/docker.md
Normal file
203
content/post/docker.md
Normal file
@ -0,0 +1,203 @@
|
|||||||
|
---
|
||||||
|
title: "Docker"
|
||||||
|
date: 2021-11-13
|
||||||
|
---
|
||||||
|
|
||||||
|
# deploy docker container
|
||||||
|
|
||||||
|
## systemd service file
|
||||||
|
Generic systemd service file starting docker container using `docker compose`
|
||||||
|
```
|
||||||
|
[Unit]
|
||||||
|
Description=%N service with docker compose
|
||||||
|
Requires=docker.service
|
||||||
|
After=docker.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Restart=always
|
||||||
|
TimeoutStartSec=1200
|
||||||
|
|
||||||
|
WorkingDirectory=/etc/docker-compose/%N
|
||||||
|
|
||||||
|
# Remove old containers, images and volumes and update it
|
||||||
|
ExecStartPre=/usr/bin/docker compose down -v
|
||||||
|
ExecStartPre=/usr/bin/docker compose rm -fv
|
||||||
|
ExecStartPre=/usr/bin/docker compose pull
|
||||||
|
|
||||||
|
# Compose up
|
||||||
|
ExecStart=/usr/bin/docker compose up
|
||||||
|
|
||||||
|
# Compose down, remove containers and volumes
|
||||||
|
ExecStop=/usr/bin/docker compose down -v
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
```
|
||||||
|
|
||||||
|
Create a folder /etc/docker-compose/<service-name> and place your docker-compose.yml there.
|
||||||
|
Then symlink or copy the systemd service file to /etc/systemd/system/<service-name>.service.
|
||||||
|
|
||||||
|
You can start the container using
|
||||||
|
```
|
||||||
|
systemctl start <service-name>
|
||||||
|
```
|
||||||
|
|
||||||
|
To automatically start the container when your server is booting enable the systemd service like any other service on your machine
|
||||||
|
```
|
||||||
|
systemctl enable <service-name>
|
||||||
|
```
|
||||||
|
|
||||||
|
## docker-compose examples
|
||||||
|
### portainer
|
||||||
|
[Portainer](https://portainer.io) is a nice looking and easy to use web based frontend for managing all your docker containers.
|
||||||
|
```
|
||||||
|
version: '3'
|
||||||
|
|
||||||
|
services:
|
||||||
|
portainer:
|
||||||
|
image: portainer/portainer-ce:latest
|
||||||
|
container_name: portainer
|
||||||
|
restart: unless-stopped
|
||||||
|
security_opt:
|
||||||
|
- no-new-privileges:true
|
||||||
|
volumes:
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
- /opt/portainer:/data
|
||||||
|
ports:
|
||||||
|
- 9000:9000
|
||||||
|
```
|
||||||
|
|
||||||
|
### watchtower
|
||||||
|
[Watchtower](https://containrrr.dev/watchtower/) keeps all your docker container up to date.
|
||||||
|
The following compose file uses `WATCHTOWER_SCHEDULE` to configure execution time of the updates.
|
||||||
|
```
|
||||||
|
version: '3'
|
||||||
|
|
||||||
|
services:
|
||||||
|
watchtower:
|
||||||
|
image: containrrr/watchtower
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
- /etc/timezone:/etc/timezone:ro
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
environment:
|
||||||
|
- WATCHTOWER_CLEANUP=true
|
||||||
|
- WATCHTOWER_INCLUDE_RESTARTING=true
|
||||||
|
- WATCHTOWER_SCHEDULE=0 0 23 * * *
|
||||||
|
ports:
|
||||||
|
- 8002:8080
|
||||||
|
```
|
||||||
|
|
||||||
|
### monit
|
||||||
|
["Your faithful employee, Monit"](https://mmonit.com/monit/) ;-)
|
||||||
|
A simple and easy to use monitoring solution for all of your services.
|
||||||
|
```
|
||||||
|
version: '3'
|
||||||
|
|
||||||
|
services:
|
||||||
|
monit:
|
||||||
|
image: maltyxx/monit:latest
|
||||||
|
container_name: monit
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
- /opt/docker/monit/etc:/etc/monit
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||||
|
ports:
|
||||||
|
- 2812:2812
|
||||||
|
environment:
|
||||||
|
- "MONIT_USERNAME=admin"
|
||||||
|
- "MONIT_PASSWORD=someSecretPassword"
|
||||||
|
```
|
||||||
|
|
||||||
|
### smokeping
|
||||||
|
[Smokeping](https://oss.oetiker.ch/smokeping/) is a great way to blame your ISP.
|
||||||
|
"My services die when my roundtrip time to <random target server on the other side end of the world> exceeds 20ms".
|
||||||
|
And best of all, it is written in perl.
|
||||||
|
```
|
||||||
|
version: '3'
|
||||||
|
|
||||||
|
services:
|
||||||
|
smokeping:
|
||||||
|
image: linuxserver/smokeping:latest
|
||||||
|
container_name: smokeping
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
- /opt/docker/smokeping/config:/config
|
||||||
|
- /opt/docker/smokeping/data:/data
|
||||||
|
ports:
|
||||||
|
- 8001:80
|
||||||
|
```
|
||||||
|
|
||||||
|
### ipv6nat
|
||||||
|
A little tweak for dockers "great" IPv6 support :-/
|
||||||
|
```
|
||||||
|
version: '3'
|
||||||
|
|
||||||
|
services:
|
||||||
|
ipv6nat:
|
||||||
|
image: robbertkl/ipv6nat:latest
|
||||||
|
container_name: ipv6nat
|
||||||
|
restart: always
|
||||||
|
privileged: true
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||||
|
- /usr/lib/modules:/lib/modules:ro
|
||||||
|
cap_drop:
|
||||||
|
- ALL
|
||||||
|
cap_add:
|
||||||
|
- NET_RAW
|
||||||
|
- NET_ADMIN
|
||||||
|
- SYS_MODULE
|
||||||
|
network_mode: "host"
|
||||||
|
```
|
||||||
|
|
||||||
|
### atlas-probe
|
||||||
|
A software probe for the [RIPE ATLAS](https://atlas.ripe.net/) project.
|
||||||
|
One of the more advanced examples I use.
|
||||||
|
|
||||||
|
The file creates a new network with IPv6 ULA addresses.
|
||||||
|
Yes I know ... but docker seem to lack such bleeding edge technology (aka prober IPv6 support).
|
||||||
|
It limits resource usage (CPU, RAM) of the docker container as well.
|
||||||
|
```
|
||||||
|
version: '3'
|
||||||
|
|
||||||
|
services:
|
||||||
|
atlas-probe:
|
||||||
|
image: jamesits/ripe-atlas:latest
|
||||||
|
container_name: atlas-probe
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
- /opt/docker/atlas-probe/etc:/var/atlas-probe/etc
|
||||||
|
- /opt/docker/atlas-probe/status:/var/atlas-probe/status
|
||||||
|
cap_drop:
|
||||||
|
- ALL
|
||||||
|
cap_add:
|
||||||
|
- CHOWN
|
||||||
|
- SETUID
|
||||||
|
- SETGID
|
||||||
|
- DAC_OVERRIDE
|
||||||
|
- NET_RAW
|
||||||
|
environment:
|
||||||
|
- RXTXRPT=yes
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: "64M"
|
||||||
|
reservations:
|
||||||
|
memory: "64M"
|
||||||
|
networks:
|
||||||
|
- ripe-atlas-network
|
||||||
|
networks:
|
||||||
|
ripe-atlas-network:
|
||||||
|
name: ripe-atlas-network
|
||||||
|
enable_ipv6: true
|
||||||
|
ipam:
|
||||||
|
config:
|
||||||
|
- subnet: fd00:a1a3::/48
|
||||||
|
```
|
||||||
Reference in New Issue
Block a user