2. $whoami
Principal Development Engineer at DellEMC
1st half of my career was in CGI & VMware
2nd half of my career has been in System Integration Testing
Docker Captain (since 2016)
Docker Bangalore Meetup Organizer ( 7700+ Registered Users)
DockerLabs Incubator
Ajeet Singh Raina
Twitter: @ajeetsraina
GitHub: ajeetraina
15. Not all SYSCTL are Namespaced
CURRENTLY SUPPORTED SYSCTLS
.
IPC Namespace:
kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem, kernel.shmall, kernel.shmmax,
kernel.shmmni, kernel.shm_rmid_forced
Sysctls beginning with fs.mqueue.*
If you use the --ipc=host option these sysctls will not be allowed.
Network Namespace:
Sysctls beginning with net.*
If you use the --network=host option using these sysctls will not be allowed.
18. Rootless Mode
Allow running dockerd as a non-root user
Docker 19.03.0 is the first release which support Rootless Docker Mode
Allow running dockerd as a non-root user
Don’t Confuse it with
docker run --user foo
- Executes the process in the container as a non-root
- The dockerd, containerd and runc still running as the root
USER instruction in Dockerfile
- Same as above
- Notably you can’t RUN dnf install ..
19. Don’t Confuse it with
Usermod –aG docker foo
- Allow non-root user to connect to /var/run/docker.sock
sudo docker or chmod +s dockerd
- Nope
dockerd –userns-remap
- Execute containers as a non-root user(dockremap), using user
namespaces
- Inside the container, dockremap behave as if it is a root
24. Device in Containers on Windows
By default, Windows containers are given minimal access to host devices--just like Linux
containers.
There are certain workloads where it is beneficial--or even imperative--to access and
communicate with host hardware devices.
25. The container host must be running Windows Server 2019 or Windows 10, version 1809
or newer.
Your container base image version must be 1809 or later.
Your containers must be Windows containers running in process-isolated mode.
The container host must be running Docker Engine 19.03 or newer.
Requirement: