A Docker image bundles application and "platform", that's correct. But usually the image is composed of a base image and the actual application.
So the canonical way to handle security updates is to update the base image, then rebuild your application image.
There is likely a way to view and change the Dockerfile for tomcat, but I can't figure it out after a few minutes. My inelegant solution is to add this line before the chown:
If you want to de-elevate the privileges after (which is recommended) you could add this line:
Alternately, work with an image that has no software installed ...
Not sure if this is considered as abandoned question - stumbled upon this while troubleshooting my issue and now adding my solution now that it's resolved.
To update service with new container, you need to:
upload new container to repository;
trigger task definition update;
trigger container update;
important: make sure service rules allow launching new ...
If you're using systemd-nspawn, start up your container with the --capability=CAP_MKNOD command line switch. This will allow you to create device nodes inside your container. Then create a loop device like this:
# mknod /dev/loop0 b 7 0
Remember that this loop device is shared with the host and is called /dev/loop0 there as well. And that it is now ...
The later release (non-beta) of lxd (v2.0) seems to have resolved my issue. The steps, which may be found in the excellent documentation here, are:
Publish an image (without stopping the container) on host A;
$ lxc publish --force container_name --alias image_name
Container published with fingerprint: d2fd708361...a125d0d5885
Export the image to a file;
Loop devices are provided by a kernel module. Therefore, you need special privileges to access them. You also need them to be exposed into your container, or you need to manually create the device files.
The quick answer
docker run --privileged=true ...
sudo losetup /dev/loop0 test.img
mount /dev/loop0 /mnt
docker run -v /mnt:/mnt ...
TLDR: It's still not possible 2018-11; use docker-compose down or docker-compose run --rm
I want to give an updated answer to this question because it's almost 3 years later. This will save others some searching.
I had the same question and here are the workarounds I found (including the one from the question itself):
which does the ...
Both forms allow multiple operating systems to run on a single physical machine.
With containers, these operating systems are isolated (they have their own file systems, processes, libraries including the libc, IP address, etc.) but they are nevertheless sharing the very same kernel. That's the reason why uname -a showed your host kernel version.
Red Hat is making a huge containerization push. They're building an entire new product, Red Hat Enterprise Linux Atomic Host, around it.
For a less radical approach, take a look at their RHEL7 beta Resource Management and Linux Containers Guide; you'll notice it pushes libvirt-lxc and makes no mention of the lxc tools.
Since Docker 17.09 one can use the --chown flag on ADD/COPY operations in Dockerfile to change the owner in the ADD/COPY step itself rather than a separate RUN operation with chown which increases the size of the image as you have noted. It would have been good to have this as the default mode i.e. the permissions of the user copying the files are applied to ...
But do I need a CPU that supports virtualization to run containerization such as Docker, or since it runs an app using the OS's libraries in a container, can I just run it on a CPU without virtualization?
No, Docker (and other container solutions like LXC) do not require any special hardware support. They are effectively an enhanced version of chroot that ...
Currently the proc filesystem is not "container aware" in mount namespaces, so tools basing their logic on this will get host-related values instead of container-related values.
But a work is in progess, it's called lxc-fs and few releases are available here. This is a user-space workaround that will make possible a bind mount over /proc to get things ...
As Donald mentioned, iptables LOG rules inside containers are suppressed by default.
In kernels <=4.10, this behavior could not be adjusted without patching the kernel. As agrrd mentioned, a work-around is to run ulogd in each container and use iptables NFLOG (or ULOG) rules instead of LOG rules.
However, as of kernel 4.11, running echo 1 > /proc/...
It's not part of the Dockerfile or docker-compose.yml spec, it is only a cli option for the run command, so the answer is no. You will need to rely on something external for enforcing.
If you got some build tool for your project it is usually best to wrap docker-compose tasks with that. For example our gradle projects provide docker related tasks that set ...
What's the conventional wisdom regarding LXC and RHEL-like systems today?
Personally, I find the current setup somewhat lacking. LXC seems more at the forefront -- certainly more maintained.
How are you implementing them?
In terms of offering it as a virtualization option I am not. I find the current technological setup lacking.
No username namespace....
The containers are supposed to be lightweight and interchangeable. If your container has a security problem, you rebuild a version of the container that's patched and deploy the new container. (many containers use a standard base image that uses standard package management tools like apt-get to install their dependencies, rebuilding will pull the updates ...
Docker themselves make this clear: You're expected to run a single process per container.
But, their tools for dealing with linked containers leave much to be desired. They do offer docker-compose (which used to be known as fig) but my developers report that it is finicky and occasionally loses track of linked containers. It also doesn't scale well and is ...
There is a good SO answer at https://stackoverflow.com/a/26149994/684908 on the subject of performance. The tl;dr is that the NAT (port-forwarding in some cases) introduces some latency. Though, it is likely negligible at smaller scales.
I run HAProxy as a container in production with port-forwarding through the Docker NAT bridge. The application and ...
Given the following example output from docker ps:
$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
7e21761c9c44 busybox "top" 22 minutes ago Up 22 minutes agitated_yonath
This is the new behavior from docker-compose and mirrors the behavior of swarm mode. It doesn't impact the ability to connect the containers via the network at all since there are DNS aliases for the service name that are always included, in your case app and db. There's no need for the full container name to connect to a replica of a service using round-...
It's fixed in version 1.23.2:
Reverted a 1.23.0 change that appended random strings to container names
created by docker-compose up, causing addressability issues.
Note: Containers created by docker-compose run will continue to use
randomly generated names to avoid collisions during parallel runs.
Make sure you use kubectl with the the exact same IAM User / Role that you used to create the EKS cluster? Only that IAM User / Role is given system:masters privilege in Kubernetes. If you use a different role you'll see this error, even if that other role has Administrator permissions in its IAM Policy.
For example if you created the EKS cluster while ...
The --link option provides a way for containers on the same machine to find each other, given that IP addresses are assigned dynamically and ports can be re-mapped. However, it is all about socket communication. The idea is that you would be running a program in one container listening on a socket, and you would run another program in the other container ...
Dokku maintainer here.
Providing a custom scheduler - like what software such as Flynn or Nanobox provide - is unlikely to happen. Instead, we are going to support integrating with existing solutions such as ECS, Kubernetes, and Nomad. At the moment, we have a few HA options under development which utilize the plugin architecture to provide alternative ...
One of the developers wrote in this issue about the topic:
This has been closed, but to give a clear answer: lxd (at least as
currently intended) will not do host networking. So in general
you would port-forward to a web-server in a lxd container the same
way you would do with lxc - you can pass in a nic from the host
into the container and have ...
Depending of your current running services, it can be straightforward. Lot of tools are available between these two platforms.
backup your server, jails and every data. If you are using zfs, you can use zfs snapshot with zfs send and zfs receive. If you don't have ZFS, and use standard FreeBSD filesystem, you can use mksnap_ffs. I hope you have decent ...