p8952 / bocker

Docker implemented in around 100 lines of bash

Bocker

Docker implemented in around 100 lines of bash.

• Prerequisites
• Example Usage
• Functionality: Currently Implemented
• Functionality: Not Yet Implemented
• License

Prerequisites

The following packages are needed to run bocker.

• btrfs-progs
• curl
• iproute2
• iptables
• libcgroup-tools
• util-linux >= 2.25.2
• coreutils >= 7.5

Because most distributions do not ship a new enough version of util-linux you will probably need to grab the sources from here and compile it yourself.

Additionally your system will need to be configured with the following:

• A btrfs filesystem mounted under /var/bocker
• A network bridge called bridge0 and an IP of 10.0.0.1/24
• IP forwarding enabled in /proc/sys/net/ipv4/ip_forward
• A firewall routing traffic from bridge0 to a physical interface.

For ease of use a Vagrantfile is included which will build the needed environment.

Even if you meet the above prerequisites you probably still want to run bocker in a virtual machine. Bocker runs as root and among other things needs to make changes to your network interfaces, routing table, and firewall rules. I can make no guarantees that it won't trash your system.

Example Usage

$ bocker pull centos 7
######################################################################## 100.0%
######################################################################## 100.0%
######################################################################## 100.0%
Created: img_42150

$ bocker images
IMAGE_ID        SOURCE
img_42150       centos:7

$ bocker run img_42150 cat /etc/centos-release
CentOS Linux release 7.1.1503 (Core)

$ bocker ps
CONTAINER_ID       COMMAND
ps_42045           cat /etc/centos-release

$ bocker logs ps_42045
CentOS Linux release 7.1.1503 (Core)

$ bocker rm ps_42045
Removed: ps_42045

$ bocker run img_42150 which wget
which: no wget in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin)

$ bocker run img_42150 yum install -y wget
Installing : wget-1.14-10.el7_0.1.x86_64                                  1/1
Verifying  : wget-1.14-10.el7_0.1.x86_64                                  1/1
Installed  : wget.x86_64 0:1.14-10.el7_0.1
Complete!

$ bocker ps
CONTAINER_ID       COMMAND
ps_42018           yum install -y wget
ps_42182           which wget

$ bocker commit ps_42018 img_42150
Removed: img_42150
Created: img_42150

$ bocker run img_42150 which wget
/usr/bin/wget

$ bocker run img_42150 cat /proc/1/cgroup
...
4:memory:/ps_42152
3:cpuacct,cpu:/ps_42152

$ cat /sys/fs/cgroup/cpu/ps_42152/cpu.shares
512

$ cat /sys/fs/cgroup/memory/ps_42152/memory.limit_in_bytes
512000000

$ BOCKER_CPU_SHARE=1024 \
	BOCKER_MEM_LIMIT=1024 \
	bocker run img_42150 cat /proc/1/cgroup
...
4:memory:/ps_42188
3:cpuacct,cpu:/ps_42188

$ cat /sys/fs/cgroup/cpu/ps_42188/cpu.shares
1024

$ cat /sys/fs/cgroup/memory/ps_42188/memory.limit_in_bytes
1024000000

Functionality: Currently Implemented

• docker build †
• docker pull
• docker images
• docker ps
• docker run
• docker exec
• docker logs
• docker commit
• docker rm / docker rmi
• Networking
• Quota Support / CGroups

† bocker init provides a very limited implementation of docker build

Functionality: Not Yet Implemented

• Data Volume Containers
• Data Volumes
• Port Forwarding

License

Copyright (C) 2015 Peter Wilmott

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.

bocker's Issues

rename to mocker :)

How does this work?

I would love to understand what each of the commands do, and how they all fit together to arrive at a cohesive solution.

It would be great if there was a blog post (or series of blog posts) with discussion and diagrams of the concepts behind making this work.

All 'containers' have the same IP

This would prevent you from running two webservers on port 80, for instance. If doing dhcp isn't possible, the next best thing would be to maintain a list of currently used IPs.

Data mounts and port forwarding

I was just exploring data mounts and some thing like this

unshare -m -- /bin/sh -c "mount -o bind,noexec,nosuid,nodev /var/bocker/shared '$btrfs_path/$uuid'/var/www/data"

seems to work well enough for basic host to container mounts.

Apart from iptables, socat is also a excellent option for port forwarding with a simple one liner;

socat TCP-LISTEN:80,fork TCP:10.0.0.2:80

bocker bash doesn't display a prompt

It looks like bocker run bash works, but there is no way I can get a prompt. Even 'export PS1="$ "' doesn't work. It is not that big of a problem, but I'm afraid this will just be the tip of the iceberg.

bocker exec fails

Bocker exec fails always, it just outputs a long list of increasing integers. Am I doing something wrong, or is this a bug? I can't find any documentation about exec. All the other commands are working.

Host isolation tested?

@p8952 @frohoff @tst2005
At the moment I have no host to test it...

Is it possible to manipulate the host from inside of a bocker container or is there isolation (by cgroup?! haven't used it before...)

Simple unshare with chroot and proc mounted isn't isolated.

cgcreate -g "$cgroups:/$uuid"
	: "${BOCKER_CPU_SHARE:=512}" && cgset -r cpu.shares="$BOCKER_CPU_SHARE" "$uuid"
	: "${BOCKER_MEM_LIMIT:=512}" && cgset -r memory.limit_in_bytes="$((BOCKER_MEM_LIMIT * 1000000))" "$uuid"
	cgexec -g "$cgroups:$uuid" \
		ip netns exec netns_"$uuid" \
		unshare -fmuip --mount-proc \
		chroot "$btrfs_path/$uuid" \
		/bin/sh -c "/bin/mount -t proc proc /proc && $cmd" \
		2>&1 | tee "$btrfs_path/$uuid/$uuid.log" || true
	ip link del dev veth0_"$uuid"
	ip netns del netns_"$uuid"

If not that executed inside of a Container will reboot the host.

echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-trigger

Question: why this MAC address prefix?

Hi,

A question, why did you choose this MAC address prefix specifically: "02:42:ac:11:00"?

Could it harm if I want to change it?

bocker pull does not support public registry, can't pull from there anymore

bocker pull does not support public registry, can't pull from there anymore.

The api has switched to v2, and the v1 does not seem to work anymore...

is this the coolest thing ever?

.

bocker exec fails #2

See #15

default $IFS is not `unset`

Note in bocker_pull there is a call to manipulate $IFS and then an attempt to revert it by using unset IFS however the default $IFS is actually $' \n\t'. Unsetting $IFS like that I believe will globally affect white space splitting.

~ $ [[ $IFS == $' \t\n' ]] && echo true
true
~ $ read a b <<< "1 2"; echo $a
1
~ $ IFS='' read a b <<< "1 2"; echo $a
1 2

Should be called shocker hahaha `shell docker`

@p8952

Using 'shuf' for uuid generation results in occasional name conflicts.

Ideally uuidgen should be used, but in the current implementation this will not work due to interface names being generated based on uuid's.

how do u define a container?