4. Docker containers are both hardware-agnostic and platform-agnostic. This means that they can run
anywhere, from your laptop to the largest EC2 compute instance and everything in between - and they don't
require that you use a particular language, framework or packaging system. That makes them great building
blocks for deploying and scaling web apps, databases and backend services without depending on a
particular stack or provider.
5. デモ環境
[root@lxcbase-local dockerwk]# go version
go version go1.1 linux/amd64
[root@lxcbase-local dockerwk]# docker version
Version: 0.3.4
Git Commit: 1c09165+CHANGES
[root@lxcbase-local dockerwk]# uname -a
Linux lxcbase-local.qloog.ne.jp 3.9.4-QLOOG #2 SMP PREEMPT Sat Jun
1 02:59:16 JST 2013 x86_64 x86_64 x86_64 GNU/Linux
[root@lxcbase-local dockerwk]# ls
./ aufs-aufs-util/ docker/ go1.1.linux-amd64.tar.gz libarchive-
3.1.2.tar.gz util-linux-2.23.1.tar.xz
../ aufs-aufs3-standalone/ go/ libarchive-3.1.2/ util-linux-2.23.1/
dockerのデモ
6. デーモン起動
[root@lxcbase-local docker]# docker -d -b lxcbr1 >/var/log/docker.log 2>&1 &
イメージの検索とインストール(busybox)
[root@lxcbase-local docker]# docker search busy
2013/05/31 23:23:31 GET /v1.1/images/search?term=busy
Found 8 results matching your query ("busy")
NAME DESCRIPTION
test422/busybox
shykes/busybox
lopter/busybox
kencochrane/busybox
busybox
vieux/busybox
vieux/busybox.test
vieux/busyboxreadme
[root@lxcbase-local /]# docker pull busybox
2013/06/01 03:03:38 POST /v1.1/images/create?fromImage=busybox®istry=&tag=
Pulling repository busybox from https://index.docker.io/v1
Pulling image e9aa60c60128cad1 (latest) from busybox
7. イメージ上でコンテナプロセスを生成(これだけ!)
[root@lxcbase-local ~]# docker run -i -t busybox /bin/sh
BusyBox v1.19.3 (Ubuntu 1:1.19.3-7ubuntu1.1) built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ # uname -a
Linux 9526b79d150a 3.9.4-QLOOG #2 SMP PREEMPT Sat Jun 1 02:59:16 JST 2013
x86_64 GNU/Linux
/ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
45: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen
1000
link/ether be:6d:92:19:da:5e brd ff:ff:ff:ff:ff:ff
inet 10.20.30.12/24 brd 10.20.30.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::bc6d:92ff:fe19:da5e/64 scope link
valid_lft forever preferred_lft forever
8. 続き
/ # while :; do sleep 1; echo test; done
test
test
test
test
先ほどコンテナを起動したコマンドのプロセスを強制終了
[root@lxcbase-local /]# pgrep -lf busybox
7540 docker run -i -t busybox /bin/sh
[root@lxcbase-local /]# kill -9 7540
コンテナプロセスの一覧の表示(まだ裏で動いている)
[root@lxcbase-local /]# docker ps
ID IMAGE COMMAND CREATED STATUS PORTS
9526b79d150a busybox:latest /bin/sh 7 minutes ago Up 7 minutes
そのコンテナにアタッチ
[root@lxcbase-local /]# docker attach 9526b79d150a
test
test
test
test
^C
/ #
15. 1576 /*
1577 * Exceptional case: normally we are not allowed to unhash a busy
1578 * directory. In this case, however, we can do it - no aliasing problems
1579 * due to the way we treat inodes.
1580 *
1581 * Rewrite the inode's ownerships here because the owning task may
have
1582 * performed a setuid(), etc.
1583 *
1584 * Before the /proc/pid/status file was created the only way to read
1585 * the effective uid of a /process was to stat /proc/pid. Reading
1586 * /proc/pid/status is slow enough that procps and other packages
1587 * kept stating /proc/pid. To keep the rules in /proc simple I have
1588 * made this apply to all per process world readable and executable
1589 * directories.
1590 */
1591 int pid_revalidate(struct dentry *dentry, unsigned int flags)
1592 {
1593 struct inode *inode;
1594 struct task_struct *task;
1595 const struct cred *cred;
1596
1597 if (flags & LOOKUP_RCU)
1598 return –ECHILD;
挿げ替え前の実装(3.9のもの)
http://lxr.free-electrons.com/source/fs/proc/base.c#L1591
1599
1600 inode = dentry->d_inode;
1601 task = get_proc_task(inode);
1602
1603 if (task) {
1604 if ((inode->i_mode ==
(S_IFDIR|S_IRUGO|S_IXUGO)) ||
1605 task_dumpable(task)) {
1606 rcu_read_lock();
1607 cred = __task_cred(task);
1608 inode->i_uid = cred->euid;
1609 inode->i_gid = cred->egid;
1610 rcu_read_unlock();
1611 } else {
1612 inode->i_uid = GLOBAL_ROOT_UID;
1613 inode->i_gid = GLOBAL_ROOT_GID;
1614 }
1615 inode->i_mode &= ~(S_ISUID | S_ISGID);
1616 security_task_to_inode(task, inode);
1617 put_task_struct(task);
1618 return 1;
1619 }
1620 d_drop(dentry);
1621 return 0;
1622 }
16. 自前のkernel モジュールをビルド(エラーは無視してね^^;)
[root@lxcbase-local km]# ./build
make -C /lib/modules/3.9.4-QLOOG/build M=/home/qloog/kmodwk/km clean
make[1]: Entering directory `/home/qloog/kernels/linux-3.9.4-q'
CLEAN /home/qloog/kmodwk/km/.tmp_versions
CLEAN /home/qloog/kmodwk/km/Module.symvers
make[1]: Leaving directory `/home/qloog/kernels/linux-3.9.4-q'
rm -f Module* tests/mmap-mprotect-test
make -C /lib/modules/3.9.4-QLOOG/build M=/home/qloog/kmodwk/km modules
make[1]: Entering directory `/home/qloog/kernels/linux-3.9.4-q'
CC [M] /home/qloog/kmodwk/km/core.o
/home/qloog/kmodwk/km/core.c: In function 'qloog_kmod_allow_file':
/home/qloog/kmodwk/km/core.c:208: warning: the frame size of 1328 bytes is larger than 1024 bytes
CC [M] /home/qloog/kmodwk/km/module.o
CC [M] /home/qloog/kmodwk/km/security.o
/home/qloog/kmodwk/km/security.c: In function 'qloog_kmod_pid_revalidate':
/home/qloog/kmodwk/km/security.c:227: warning: unused variable 'ops'
/home/qloog/kmodwk/km/security.c:231: warning: ignoring return value of 'kstrtol', declared with attribute warn_unused_result
/home/qloog/kmodwk/km/security.c: In function 'hijack_syscalls':
/home/qloog/kmodwk/km/security.c:311: warning: ISO C90 forbids mixed declarations and code
CC [M] /home/qloog/kmodwk/km/symbols.o
CC [M] /home/qloog/kmodwk/km/malloc.o
CC [M] /home/qloog/kmodwk/km/sysctl.o
CC [M] /home/qloog/kmodwk/km/hijacks.o
CC [M] /home/qloog/kmodwk/km/arch/x86/lib/inat.o
CC [M] /home/qloog/kmodwk/km/arch/x86/lib/insn.o
LD [M] /home/qloog/kmodwk/km/qloog_kmod.o
Building modules, stage 2.
MODPOST 1 modules
CC /home/qloog/kmodwk/km/qloog_kmod.mod.o
LD [M] /home/qloog/kmodwk/km/qloog_kmod.ko
make[1]: Leaving directory `/home/qloog/kernels/linux-3.9.4-q'