docker-library / docker Goto Github PK

Docker Official Image packaging for Docker

License: Apache License 2.0

Shell 70.97% Dockerfile 24.78% jq 4.25%

docker's Introduction

https://github.com/docker-library/docker

Maintained by: Tianon (of the Docker Project)

This is the Git repo of the Docker "Official Image" for docker. See the Docker Hub page for the full readme on how to use this Docker image and for information regarding contributing and issues.

The full image description on Docker Hub is generated/maintained over in the docker-library/docs repository, specifically in the docker directory.

See a change merged here that doesn't show up on Docker Hub yet?

For more information about the full official images change lifecycle, see the "An image's source changed in Git, now what?" FAQ entry.

For outstanding docker image PRs, check PRs with the "library/docker" label on the official-images repository. For the current "source of truth" for docker, see the library/docker file in the official-images repository.

Build	Status	Badges	(per-arch)

docker's People

Contributors

Stargazers

Watchers

Forkers

zhangwei5095 infosiftr grahamc armhf-docker-library igenyar midikang reachlin cloudxtreme tiesheng lythimus cadelaren madjam002 15801491881 jack12816 rdgoite makelog runelabs jojow dmitryint endzyme cirocosta sharkvan nathanjhaveri herbertcampelo therightplace joe4q danielguerra69 learningendless qict777 danieldent aktionmed zhqy philliproso masakura bmv437 rassie irfanhabib yamaszone acontes wyatt88 underyx madskristiansen tobygale casess danielmyers zhangyicou erwinverdonk lodexinc clnperez cmjjsnt fasrc aminhjz-old dariko bvis shyam334 mattlk13 amfern cnam ihoro qishengle syseleven subfuzion kleopatra999 topmawei lovubuntu gerey ssaavedra therickys93 arthurliang ram-devsecops jdbrown239 guillaumerose riaan53 mdedonno1337 bnulwh djs55 dilipkumarashok adiea ohze faststarliu friism tewwe jakirpatel maryellenw imimsri ranganath2089 nicolas-mosaix aaronfriel nanhangfei sealucky anuchito github4848 markthink buhijs guofeng0902 alexxnica kryndex thajeztah sekharbrs jamesvandenberg

docker's Issues

Unable to change the group for the docker socket because the group does not exist

I'm running the docker dind image like this:

docker run --rm -it --privileged docker:17.05.0-ce-dind

The very first line of the log is:

could not change group /var/run/docker.sock to docker: group docker not found

And as such, the permissions of the docker socket are completely owned by root. Is this a bug or intentional?

I will be volume-ing the socket to other containers. Those containers run as non-root but are part of the docker group.

Trying to run "dockerd" in the non-dind image is likely to fail

As reported by @stevvooe over in docker-library/official-images#2654, it's a little bit non-obvious that the dind variants are the only place we have the dependencies for properly running Docker-in-Docker (and that the non-dind tags are simply the client).

He suggested having docker-entrypoint.sh (not dockerd-entrypoint.sh) print a warning if $1 is dockerd, something like:

📎 Hey there!  It looks like you're trying to run a Docker daemon.
   You probably should use the "dind" image variant instead, something like:

      docker run ...

docker swarm mode nginx not get client realip

in docker swarm mode ,run nginx container get the client ip is not real ip

for example

docker service ps nginx

everything get 10.255.0.2, no client ip

but no swarm mode is ok

cURL not linking properly in docker:17.09.0-git

If I try to run the following commands in the image docker:17.09.0-git (or build a docker image based on this image):

apk add --no-cache curl
curl

I'll get the following error:

Error relocating /usr/bin/curl: curl_mime_data_cb: symbol not found
Error relocating /usr/bin/curl: curl_mime_name: symbol not found
Error relocating /usr/bin/curl: curl_mime_encoder: symbol not found
Error relocating /usr/bin/curl: curl_mime_init: symbol not found
Error relocating /usr/bin/curl: curl_mime_headers: symbol not found
Error relocating /usr/bin/curl: curl_mime_filedata: symbol not found
Error relocating /usr/bin/curl: curl_mime_free: symbol not found
Error relocating /usr/bin/curl: curl_mime_subparts: symbol not found
Error relocating /usr/bin/curl: curl_mime_type: symbol not found
Error relocating /usr/bin/curl: curl_mime_addpart: symbol not found
Error relocating /usr/bin/curl: curl_mime_filename: symbol not found
Error relocating /usr/bin/curl: curl_mime_data: symbol not found

If I do the same using the image docker:17.09, curl runs without any issue, even if I also install git and openssh-client first

Entrypoint's 'if our command is a valid Docker subcommand, let's invoke it through Docker instead' doesn't work anymore with 1.13

If you run docker run docker:1.12 docker foo --help it will exit with

docker: 'foo' is not a docker command.
See 'docker --help'.

and status code 1. The entrypoint script expects this behavior.

But if you do the same with 1.13 RC, docker run docker:1.13-rc docker foo --help will print the regular help text and exit with status code 0. This will cause the entrypoint script's check to believe that everything is a valid docker subcommand, and it will try to pass everything to docker.

This makes regular usage a bit difficult, for instance docker run docker:1.13-rc true fails, saying docker: 'true' is not a docker command.. Also, notably, this breaks usage with GitLab CI (and probably other CI systems that would use Docker). GitLab CI tries to run some shell commands to set up the container, but they fail with 1.13-rc cause of this.

1.13-git variant doesn't allow you to access the shell?

Current version of the -git tags of docker allowed you to run:

docker run -ti --rm docker:git sh

and access the command line, e.g. to clone out a private repo and/or start performing any pre-build actions upon it, before executing docker build.

The 1.13 rc versions seem to only allow you to run the container with build <repourl>, and that the repo must be public and ready to build as-is.

The entrypoint script seems to suggest that I should be able to run any regular command as long as there isn't a matching docker command?

'overlay' not found

I pull the docker:1.8, run it and get the following error.

/ # docker daemon
ERRO[0000] 'overlay' not found as a supported filesystem on this host. Please ensure kernel is new enough and has overlay support loaded.
INFO[0000] Option DefaultDriver: bridge
INFO[0000] Option DefaultNetwork: bridge
INFO[0000] Listening for HTTP on unix (/var/run/docker.sock)
WARN[0000] Running modprobe bridge nf_nat br_netfilter failed with message: modprobe: can't change directory to '/lib/modules': No such file or directory
, error: exit status 1
FATA[0000] Error starting daemon: Error initializing network controller: Error initializing bridge driver: Setup IP forwarding failed: open /proc/sys/net/ipv4/ip_forward: read-only file system
/ #
/ # uname -a
Linux 94d77ec93ce5 3.13.0-62-generic #102-Ubuntu SMP Tue Aug 11 14:29:36 UTC 2015 x86_64 Linux

According to moby/moby#14489, is it even possible to run docker on alpine?

Docker's Makefile uses "docker" namespace

Docker's development Makefile currently uses the docker namespace for building development images: https://github.com/docker/docker/blob/3ea59f8991a4d70254582759044316e522a09ee9/Makefile#L29

We need to decide if this is a problem, and whether we should fix it by naming this image something else, or by sending a PR to Docker.

Especially wondering @jfrazelle's opinion on this one.

I've just barely reorganized this repo so that we can have docker:latest be just the Docker CLI, and docker:dind include all the hacky bits to do Docker-in-Docker, since they're pretty intrusive and require --privileged, and just being able to use the CLI from inside an image would definitely be useful.

Docker and dind 17.07.0 image fail build with gRPC error

I've been using docker:17 and docker:17-dind for some time now to run DIND builds within Gitlab Runners. Recently I rebuilt my images that extend on them (for the purposes of trusting self-signed certificates) to use docker:17.07.0 and docker:17.07.0-dind and began to receive the following errors executing Docker CLI commands:

$ docker build -t test .
ERRO[0000] failed to dial gRPC: unable to upgrade to h2c, received 501

Reproduction is simple:

# Set up DIND to demo 
$ docker run --rm --name=dind --privileged -it docker:17.07.0-dind

# In new terminal window
# Demo 501 failure with 17.07.0 docker to 17.07.0 dind
$ docker run -it --link dind -e DOCKER_HOST=tcp://dind:2375/ docker:17.07.0 sh -c 'cd /tmp; echo FROM alpine > Dockerfile; docker build -t test .' 
Sending build context to Docker daemon  2.048kB
ERRO[0000] failed to dial gRPC: unable to upgrade to h2c, received 501 
context canceled

What revealed the reason for this problem to me was the following output from the DIND container:

...
ERRO[0097] Handler for POST /session returned error: This experimental feature is disabled by default. Start the Docker daemon in experimental mode in order to enable it. 
ERRO[0097] Handler for POST /build returned error: no active session for 9acfb9acfb9acfb9acfb9acfb9acfb9: context canceled 
...

This problem is also seen when using docker:17.06.0 with docker:17.07.0-dind, but it is less obvious as the DIND output doesn't indicate anything happening as I assume API handlers do not exist for those endpoints.

# Set up DIND to demo 
$ docker run --rm --name=dind --privileged -it docker:17-dind

# In new terminal window
# Demo 404 failure with 17.07.0 docker to 17-dind (17.06.0 presently)
$ docker run -it --link dind -e DOCKER_HOST=tcp://dind:2375/ docker:17.07.0 sh -c 'cd /tmp; echo FROM alpine > Dockerfile; docker build -t test .' 
Sending build context to Docker daemon  2.048kB
ERRO[0000] failed to dial gRPC: unable to upgrade to h2c, received 404 
context canceled

Is there a way to get Alpine 3.4?

I cannot work with Alpine 3.5 because of https://bugs.alpinelinux.org/issues/6628.

Can I somehow pull an old image? Even the tags for older Docker version (docker:1.11) have been updated to Alpine 3.5.

Document DinD modprobe gotcha

Normally the docker daemon runs modprobe for us to include it's dependencies in the kernel.
However DinD can't currently modprobe and outputs:
modprobe: can't change directory to '/lib/modules': No such file or directory

When using different drivers that would have worked on the host, we need to manually modprobe them ahead of time on the host. Especially because this is different from your normal docker experience it's worth documenting this behavior and the workarounds.

Working setup

Freshly booted
Host storage driver: aufs
DinD storage driver: aufs

Host modprobes aufs for us, so DinD automagically runs without issues.

Unexpected error

Freshly booted
Host storage driver: zfs
DinD storage driver: aufs

$ docker run --rm -ti --privileged docker:dind dockerd -s aufs
...
Error starting daemon: error initializing graphdriver: driver not supported

Fixing it

Freshly booted
Host storage driver: zfs
DinD storage driver: aufs

$ sudo modprobe aufs
$ docker run --rm -ti --privileged docker:dind dockerd -s aufs
...
INFO[2017-10-13T15:04:10.504077742Z] Daemon has completed initialization          
INFO[2017-10-13T15:04:10.669436504Z] API listen on /var/run/docker.sock

Permanent solution

(For Ubuntu)

$ echo aufs | sudo tee /etc/modules-load.d/dind.conf

Freshly booted
Host storage driver: zfs
DinD storage driver: aufs

$ docker run --rm -ti --privileged docker:dind dockerd -s aufs
...
INFO[2017-10-13T15:27:00.870223217Z] Docker daemon    commit=afdb6d4 graphdriver(s)=aufs version=17.09.0-ce
INFO[2017-10-13T15:27:00.870565793Z] Daemon has completed initialization          
INFO[2017-10-13T15:27:00.953295479Z] API listen on /var/run/docker.sock

Ability to use different storage drivers

In need a docker-in-docker container to build docker containers in our CI system running on Kubernetes (see kubernetes/kubernetes#33745).

The 1.12.1-dind image looks perfect for this, the only drawback being that I can't select the storage driver at run time as it's hardcoded into https://github.com/docker-library/docker/blob/746d9052066ccfbcb98df7d9ae71cf05d8877419/1.12/dind/dockerd-entrypoint.sh.

Could this be done either through an environment variable with default value vfs or if different storage drivers need different dependencies in separate builds?

Alpine can't fetch updates

14:04:30 Step 2 : RUN apk --update add bash curl && rm -rf /var/cache/apk/*
14:04:31  ---> Running in 2b7a6b342ac5
14:04:31 fetch http://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz
14:04:36 ERROR: http://dl-cdn.alpinelinux.org/alpine/edge/main: temporary error (try again later)
14:04:36 WARNING: Ignoring APKINDEX.066df28d.tar.gz: No such file or directory
14:04:36 fetch http://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
14:04:41 ERROR: http://dl-cdn.alpinelinux.org/alpine/edge/community: temporary error (try again later)
14:04:41 WARNING: Ignoring APKINDEX.b53994b4.tar.gz: No such file or directory
14:04:41 ERROR: unsatisfiable constraints:
14:04:41   bash (missing):
14:04:41     required by: world[bash]
14:04:41   curl (missing):
14:04:41     required by: world[curl]

This only fails if I run docker build... in a docker dind container.
If I run it directly on the host it works.

root@32b513039f0f:/# curl -v http://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz > APKINDEX.tar.gz && ls -al APKINDEX.tar.gz
* Hostname was NOT found in DNS cache
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 151.101.60.249...
* Connected to dl-cdn.alpinelinux.org (151.101.60.249) port 80 (#0)
> GET /alpine/edge/main/x86_64/APKINDEX.tar.gz HTTP/1.1
> User-Agent: curl/7.38.0
> Host: dl-cdn.alpinelinux.org
> Accept: */*
>
< HTTP/1.1 200 OK
< Content-Type: application/x-gzip
< Accept-Ranges: bytes
< ETag: "373865347"
< Last-Modified: Fri, 30 Sep 2016 10:35:16 GMT
* Server lighttpd is not blacklisted
< Server: lighttpd
< Content-Length: 727689
< Accept-Ranges: bytes
< Date: Fri, 30 Sep 2016 12:35:13 GMT
< Via: 1.1 varnish
< Connection: keep-alive
< X-Served-By: cache-lhr6336-LHR
< X-Cache: MISS
< X-Cache-Hits: 0
< X-Timer: S1475238912.936828,VS0,VE221
<
{ [data not shown]
100  710k  100  710k    0     0   872k      0 --:--:-- --:--:-- --:--:--  873k
* Connection #0 to host dl-cdn.alpinelinux.org left intact
-rw-r--r-- 1 root root 727689 Sep 30 12:35 APKINDEX.tar.gz

Versions previous to 1.7

There used to be Dockerfiles here for 1.6.0, 1.6.2 and even 1.5.0 , I wonder why they were removed?
Personally I need 1.6.2 , but shouldn't all versions be available instead of being upgraded in-place?

Invalid Argument Error when mounting volume

If I run dind with a host volume mount it errors out with invalid argument:

docker run -dit --privileged --volume=/Users/rmb938/dindvar:/var/lib/docker --name some-docker docker:dind

Then running docker logs shows:

WARN[0000] /!\ DON'T BIND ON ANY IP ADDRESS WITHOUT setting -tlsverify IF YOU DON'T KNOW WHAT YOU'RE DOING /!\
INFO[0000] New containerd process, pid: 20

FATA[0001] Error starting daemon: invalid argument

Yet without the volume mount it works perfectly fine.

"failed to register layer" error when pulling image in dind

On Mac OSX, when I mount /var/lib/docker and pull a large image from inside docker-in-docker, I get an error:
failed to register layer: ApplyLayer exit status 1 stdout: stderr: function not implemented

Steps to reproduce:

$ docker version
Client:
 Version:      17.06.2-ce
 API version:  1.30
 Go version:   go1.8.3
 Git commit:   cec0b72
 Built:        Tue Sep  5 20:12:06 2017
 OS/Arch:      darwin/amd64

Server:
 Version:      17.06.2-ce
 API version:  1.30 (minimum version 1.12)
 Go version:   go1.8.3
 Git commit:   cec0b72
 Built:        Tue Sep  5 19:59:19 2017
 OS/Arch:      linux/amd64
 Experimental: true

$ docker run --privileged --name dind -v /tmp/dind:/var/lib/docker -P -d docker:stable-dind

$ docker exec -it dind sh

/ # docker version
Client:
 Version:      17.06.2-ce
 API version:  1.30
 Go version:   go1.8.3
 Git commit:   cec0b72
 Built:        Tue Sep  5 19:57:21 2017
 OS/Arch:      linux/amd64

Server:
 Version:      17.06.2-ce
 API version:  1.30 (minimum version 1.12)
 Go version:   go1.8.3
 Git commit:   cec0b72
 Built:        Tue Sep  5 19:59:19 2017
 OS/Arch:      linux/amd64
 Experimental: false
 
/ # docker pull selenium/node-chrome
Using default tag: latest
latest: Pulling from selenium/node-chrome
9fb6c798fa41: Extracting [==================================================>]  47.54MB/47.54MB
3b61febd4aef: Download complete
9d99b9777eb0: Download complete
d010c8cf75d7: Download complete
7fac07fb303e: Download complete
77b9fb326cc3: Download complete
f0014e158459: Download complete
ff1bd93b8ac7: Download complete
2630df279a3d: Download complete
f9e3bfaf1c0b: Download complete
91f158b92bfb: Download complete
2d1384979a3d: Download complete
69b23faac2ea: Download complete
0591360585b8: Download complete
e258f6e75d67: Download complete
ccd4d62979d5: Download complete
8b8c4a8a92c6: Download complete
failed to register layer: ApplyLayer exit status 1 stdout:  stderr: function not implemented

Additional Details:

I tried pulling a different large image (1.3GB) and it also failed with the same error message.
I can docker pull busybox successfully
If I don't mount -v /tmp/dind:/var/lib/docker, I can pull all images successfully
The problem also happens when running dind with --storage-driver=overlay or --storage-driver=overlay2
Dind logs:

$ docker logs dind
time="2017-09-23T18:27:51.103025272Z" level=warning msg="could not change group /var/run/docker.sock to docker: group docker not found"
time="2017-09-23T18:27:51.104058414Z" level=warning msg="[!] DON'T BIND ON ANY IP ADDRESS WITHOUT setting --tlsverify IF YOU DON'T KNOW WHAT YOU'RE DOING [!]"
time="2017-09-23T18:27:51.106068261Z" level=warning msg="libcontainerd: makeUpgradeProof could not open /var/run/docker/libcontainerd/containerd"
time="2017-09-23T18:27:51.107890120Z" level=info msg="libcontainerd: new containerd process, pid: 17"
time="2017-09-23T18:27:52.295935120Z" level=info msg="Graph migration to content-addressability took 0.00 seconds"
time="2017-09-23T18:27:52.299828057Z" level=info msg="Loading containers: start."
time="2017-09-23T18:27:52.306178740Z" level=warning msg="Running modprobe bridge br_netfilter failed with message: modprobe: can't change directory to '/lib/modules': No such file or directory\n, error: exit status 1"
time="2017-09-23T18:27:52.307832088Z" level=warning msg="Running modprobe nf_nat failed with message: `modprobe: can't change directory to '/lib/modules': No such file or directory`, error: exit status 1"
time="2017-09-23T18:27:52.309328810Z" level=warning msg="Running modprobe xt_conntrack failed with message: `modprobe: can't change directory to '/lib/modules': No such file or directory`, error: exit status 1"
time="2017-09-23T18:27:52.544937972Z" level=info msg="Default bridge (docker0) is assigned with an IP address 172.18.0.0/16. Daemon option --bip can be used to set a preferred IP address"
time="2017-09-23T18:27:52.610471031Z" level=info msg="Loading containers: done."
time="2017-09-23T18:27:52.630230787Z" level=info msg="Daemon has completed initialization"
time="2017-09-23T18:27:52.630270942Z" level=info msg="Docker daemon" commit=cec0b72 graphdriver=vfs version=17.06.2-ce
time="2017-09-23T18:27:52.641188307Z" level=info msg="API listen on [::]:2375"
time="2017-09-23T18:27:52.641208984Z" level=info msg="API listen on /var/run/docker.sock"
time="2017-09-23T18:35:34.900786530Z" level=info msg="Attempting next endpoint for pull after error: failed to register layer: ApplyLayer exit status 1 stdout:  stderr: function not implemented"

apt-get update in dind

Hi,

Setup:
Win 10 Host - 1. Layer Docker Container (dind 1.13.0) - 2. Layer Docker Container (Debian:lastest)

I want to apt-get update in dind, everything works as expected in the 1. layer, but in the 2. I´ll get:

root@9d27879cab3f:/# apt-get update
Err http://security.debian.org jessie/updates InRelease
Err http://security.debian.org jessie/updates Release.gpg
  Could not resolve 'security.debian.org'
Err http://httpredir.debian.org jessie InRelease
Err http://httpredir.debian.org jessie-updates InRelease
Err http://httpredir.debian.org jessie Release.gpg
  Could not resolve 'httpredir.debian.org'
Err http://httpredir.debian.org jessie-updates Release.gpg
  Could not resolve 'httpredir.debian.org'
Reading package lists... Done
W: Failed to fetch http://httpredir.debian.org/debian/dists/jessie/InRelease
W: Failed to fetch http://httpredir.debian.org/debian/dists/jessie-updates/InRelease
W: Failed to fetch http://security.debian.org/dists/jessie/updates/InRelease
W: Failed to fetch http://security.debian.org/dists/jessie/updates/Release.gpg  Could not resolve 'security.debian.org'
W: Failed to fetch http://httpredir.debian.org/debian/dists/jessie/Release.gpg  Could not resolve 'httpredir.debian.org'
W: Failed to fetch http://httpredir.debian.org/debian/dists/jessie-updates/Release.gpg  Could not resolve 'httpredir.debian.org'
W: Some index files failed to download. They have been ignored, or old ones used instead.

I asked in the irc channel, but no resolution and was asked for /etc/resolv.conf:

Layer:

search xxx.company.local
nameserver 127.0.0.11
options ndots:0

Layer:

search xxx.company.local
options ndots:0

nameserver 8.8.8.8
nameserver 8.8.4.4

Any ideas?

dind not working if pulling from local registry

I'm using docker:dind in GitLab CI. Its working fine if the image for the service is tagged from official registry.
If I tag it to local registry and push it and next I use it for service image its not working.

I'm testing on this project:
https://gitlab.com/gitlab-examples/docker

pls check this exact issue with gitlab-ci: https://gitlab.com/gitlab-examples/docker/issues/2

DOCKER_HOST variable meanings ?

Hi,

I'm kind of new in Docker, and I'm wondering, what the point of the DOCKER_HOST variable in the example in the README? I can't find out the interest of this environment variable. Can you please provide me some information about it?

Thanks.

OpenSSL not included anymore

I have CI jobs based on this Docker official image and that are using openssl to generate .htaccess files before inclusion in images. Since 5a196ca, the openssl package is not included anymore.

Is it removed on purpose (and I would be totally fine with this)? Or is it a regression you would rather not have?

Thanks!

DIND image for Windows

Are there any plans for a DIND image for Windows? I'm looking to add support in Drone to build docker windows images but I don't currently see a DIND I can base the image on.

devmapper: Udev sync is not supported.

Full error message: devmapper: Udev sync is not supported. This will lead to data loss and unexpected behavior. Install a dynamic binary to use devicemapper or select a different storage driver.

Default the vfs driver is used, which is very slow. The devicemapper driver is the recommended one I think?

Add curl binary back to the image

A few days ago my deployments started failing since the curl binary suddenly got removed from this image.

Any chance to add it back? I guess there are many people depending on it being installed...

docker:17.09 (without trailing '.0') tag missing

I noticed, unlike for other releases, there's no docker:17.09 tag on Docker Hub. Perhaps this is because there's no GA release yet for 17.09, but could also be it was missed 😄

ping @tianon

tune2fs not found in dind container starting 1.9.1

Looks like docker:1.9.1-dind and higher can not use devicemapper because tune2fs is not found.

docker run --privileged=true --rm -ti docker:1.9.1-dind -s devicemapper
Unable to find image 'docker:1.9.1-dind' locally
1.9.1-dind: Pulling from library/docker
4d06f2521e4f: Already exists
99e9f5d463c9: Already exists
a3ed95caeb02: Pull complete
9798e0e4a42a: Pull complete
0e452ef5783c: Pull complete
3a53fe711605: Pull complete
2bf575fb4306: Pull complete
3d883526b97b: Pull complete
Digest: sha256:9d7abad1778df8c3cdfdbf581b922003abeaf74f8da44d115fd8f6dfcb51b2a1
Status: Downloaded newer image for docker:1.9.1-dind
WARN[0000] /!\ DON'T BIND ON ANY IP ADDRESS WITHOUT setting -tlsverify IF YOU DON'T KNOW WHAT YOU'RE DOING /!\
WARN[0000] Udev sync is not supported. This will lead to unexpected behavior, data loss and errors. For more information, see https://docs.docker.com/reference/commandline/daemon/#daemon-storage-driver-option
INFO[0000] API listen on /var/run/docker.sock
INFO[0000] API listen on [::]:2375
WARN[0000] Usage of loopback devices is strongly discouraged for production use. Please use `--storage-opt dm.thinpooldev` or use `man docker` to refer to dm.thinpooldev section.
WARN[0000] XFS is not supported in your system. Either the kernel doesnt support it or mkfs.xfs is not in your PATH. Defaulting to ext4 filesystem
FATA[0024] Error starting daemon: error initializing graphdriver: exec: "tune2fs": executable file not found in $PATH

dind for aarch64?

I'm looking at running docker-in-docker for aarch64 (ARMv8). I don't see an officially supported version in the usual place (https://hub.docker.com/u/aarch64/docker/ is where I'd expect it). Suggestions and what to do next welcomed.

Docker does not respect hosts file

The static docker binary uses the DNS server specified /etc/resolv.conf without consulting /etc/hosts beforehand. The image should contain a /etc/nsswitch.conf containing some minimal configuration which is used by the docker binary.

Docker 17.06-ce installation on Centos 7 failed

I am trying to install 17.06-ce edition on Centos 7 (kernel version 3.10.0-327.22.2.el7.x86_64).

I have been following the instructions listed here -
https://docs.docker.com/engine/installation/linux/docker-ce/centos/#install-using-the-repository

It has been failing with the below listed error message saying it requires container-selinux >= 2.9. Please see the message below -

Can someone please guide what did I miss in the steps.

$ yum install -y docker-ce
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Resolving Dependencies
--> Running transaction check
---> Package docker-ce.x86_64 0:17.06.0.ce-1.el7.centos will be installed
--> Processing Dependency: container-selinux >= 2.9 for package: docker-ce-17.06.0.ce-1.el7.centos.x86_64
--> Processing Dependency: libseccomp.so.2()(64bit) for package: docker-ce-17.06.0.ce-1.el7.centos.x86_64
--> Processing Dependency: libltdl.so.7()(64bit) for package: docker-ce-17.06.0.ce-1.el7.centos.x86_64
--> Running transaction check
---> Package docker-ce.x86_64 0:17.06.0.ce-1.el7.centos will be installed
--> Processing Dependency: container-selinux >= 2.9 for package: docker-ce-17.06.0.ce-1.el7.centos.x86_64
---> Package libseccomp.x86_64 0:2.3.1-2.el7 will be installed
---> Package libtool-ltdl.x86_64 0:2.4.2-22.el7_3 will be installed
--> Finished Dependency Resolution
Error: Package: docker-ce-17.06.0.ce-1.el7.centos.x86_64 (docker-ce-stable)
Requires: container-selinux >= 2.9
You could try using --skip-broken to work around the problem
You could try running: rpm -Va --nofiles --nodigest

exec: "auplink": executable file not found in $PATH

Currently (at least, as of 2016-09-23), auplink isn't available in Alpine (https://pkgs.alpinelinux.org/contents?file=auplink), so for us to include it, we'd have to compile it from source (https://sourceforge.net/p/aufs/aufs-util/).

As I understand it, its use within Docker is primarily for detecting and properly handling hard links between layers, and beyond that particular use case not having it available should be mostly harmless. I'm opening this issue (in spite of already having a TODO in the Dockerfile itself) for tracking/conversation purposes, and to help interested/concerned travellers discover more information about why they're seeing this error in their Docker-in-Docker containers.

So, TL;DR, we don't have auplink because there isn't an Alpine package for it (yet?), but for most users that's harmless anyhow. 👍

Reconsider defaulting to vfs storage driver?

Right now, :dind images set --storage-driver vfs by default. As I understand it, Docker will automatically choose the best applicable driver on loading (e.g.: btrfs, zfs, overlay2). Is there a reason :dind images still default to vfs?

Docker not starting on Windows10Pro64

BUGREPORT

Version :
Version 17.06.2-ce-win27 (13194)
Channel: stable
428bd6c

"C:\Program Files\Docker\Docker\Docker for Windows.exe" threw the below error on startup. However, on subsequent restarts, it worked fine. The log.txt showed lots of errors. Any idea ?

[10:21:30.561][NamedPipeClient][Error ] Unable to send Mount: Docker command did not complete within the allowed timeout. Output:
[10:21:30.565][Notifications ][Error ] Docker command did not complete within the allowed timeout. Output:
[10:21:30.559][NamedPipeServer][Error ] Unable to execute Mount: Docker command did not complete within the allowed timeout. Output: at Docker.Backend.MobyCommand.RunDocker(String arguments, IDictionary2 envVariables, String stdin, Int32 timeoutMs, String cidFile) in C:\gopath\src\github.com\docker\pinata\win\src\Docker.Backend\MobyCommand.cs:line 152 at Docker.Backend.MobyCommand.Run(String commandLine, IDictionary2 envVariables, Boolean load, String stdin, Int32 timeoutMs) in C:\gopath\src\github.com\docker\pinata\win\src\Docker.Backend\MobyCommand.cs:line 49
at Docker.Backend.SambaShare.MountInMoby(String mount, String drive, Credential cred, CredentialInfo credInfo, String options, String ip) in C:\gopath\src\github.com\docker\pinata\win\src\Docker.Backend\SambaShare.cs:line 197
at Docker.Backend.SambaShare.MountInMoby(String drive, Credential credential, Settings settings) in C:\gopath\src\github.com\docker\pinata\win\src\Docker.Backend\SambaShare.cs:line 168
at Docker.Backend.SambaShare.Mount(String drive, Credential credential, Settings settings) in C:\gopath\src\github.com\docker\pinata\win\src\Docker.Backend\SambaShare.cs:line 65
at Docker.Backend.BackendServer.b__5_11(Object[] args) in C:\gopath\src\github.com\docker\pinata\win\src\Docker.Backend\BackendServer.cs:line 54
at Docker.Core.Pipe.NamedPipeServer.RunAction(String action, Object[] parameters) in C:\gopath\src\github.com\docker\pinata\win\src\Docker.Core\pipe\NamedPipeServer.cs:line 145

resources constraints on dind

I created docker container with memory (-m) limit based on docker:1.8-dind while following the howto. When i started several workload containers i been able to use more memory than limited for parent container. Using "docker stats" on parent container doesn't reflect expected child container memory usage. Are resources constraints supported in docker in docker?

Version Support Policy

Can someone please direct me to older versions of DIND, like version 1.2? I use DIND to test compatibility with newer/older versions of Docker/Moby and I can't find older versions prior to 17.* on Docker Hub.

Also, is there a stated support policy on maintaining prior versions of DIND?

Thanks!

undeclared bashisms

docker-entrypoint.sh (i.e. in docker/1.12/docker-entrypoint.sh as well as other places) contains non-portable shell code.

On a debian system with dash as the default shell, it does not work. Declaring #!/bin/bash at the top alleviates the issue.

Dependencies

Here's where we sit now on image sizes:

$ docker images docker | sed 's/  +/\t/' | column -t -s $'\t'
REPOSITORY          TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
docker              1-dind              51f44a8a42de        13 minutes ago      249.2 MB
docker              1.6-dind            51f44a8a42de        13 minutes ago      249.2 MB
docker              dind                51f44a8a42de        13 minutes ago      249.2 MB
docker              1.6.0-dind          51f44a8a42de        13 minutes ago      249.2 MB
docker              1.6                 12535bffb129        13 minutes ago      249.2 MB
docker              1                   12535bffb129        13 minutes ago      249.2 MB
docker              1.6.0               12535bffb129        13 minutes ago      249.2 MB
docker              latest              12535bffb129        13 minutes ago      249.2 MB

Most of this is due to installing all the dependencies of running Docker as a daemon even in the non-dind images:

# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#runtime-dependencies
RUN apt-get update && apt-get install -y \
        curl \
        \
        aufs-tools \
        btrfs-tools \
        ca-certificates \
        e2fsprogs \
        git \
        iptables \
        lxc \
        procps \
        xz-utils \
    --no-install-recommends && rm -rf /var/lib/apt/lists/*

It seems like it'd be worthwhile to only install the daemon-specific dependencies in the dind image. I think we need to play with some size comparisons to see what that actually looks like / saves us, though.

dind behind a proxy

Hi,

I want to run dind behind a proxy.
How/Where can I configure the proxy-settings, when using linked containers of docker:1.12 and docker:dind ?

cURL does not work (anymore)

cURL installed in docker:17.06.0-ce-git release does not seem to work.

# docker run -it --rm docker:17.06.0-ce-git sh -c 'apk add --no-cache curl && curl -vL https://www.google.com'
Unable to find image 'docker:17.06.0-ce-git' locally
17.06.0-ce-git: Pulling from library/docker
88286f41530e: Pull complete 
61bf6059e353: Pull complete 
0b539e28e9a6: Pull complete 
ad3af5fe81b0: Pull complete 
ec33fee374b5: Pull complete 
Digest: sha256:b5ff49006c6d5f6a4962953c6cafe3949c43f342c1eea84c12b76a9f5f4a1777
Status: Downloaded newer image for docker:17.06.0-ce-git
fetch http://dl-cdn.alpinelinux.org/alpine/v3.6/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.6/community/x86_64/APKINDEX.tar.gz
(1/1) Installing curl (7.55.0-r0)
Executing busybox-1.26.2-r5.trigger
OK: 28 MiB in 20 packages
curl: (48) An unknown option was passed in to libcurl

The issue seems to be due to the mismatch between libcurl and curl package versions, Upgrading libcurl fixes the issue (something that apk should automatically do).

# docker run -it --rm docker:17.06.0-ce-git sh -c 'apk upgrade --no-cache libcurl && apk add --no-cache curl && curl -vL https://www.google.com'

Since libcurl is not required by Docker itself, you should probably remove it and any other unused dependencies.

17.03.0-ce doesn't work with docker:1.13-dind

➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --privileged  --name mydaemon -d docker:1.13-dind
2aed075e43f6af214835f1280e96da4aea5355bf6624f101016dc5c655491372
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker version       
Client:
 Version:      17.03.0-ce
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   60ccb22
 Built:        Thu Mar  2 01:11:00 2017
 OS/Arch:      linux/amd64
Cannot connect to the Docker daemon at tcp://docker:2375. Is the docker daemon running?
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:1.8 version
Unable to find image 'docker:1.8' locally
1.8: Pulling from library/docker
c52e3ed763ff: Pull complete 
66d741d85d02: Pull complete 
a3ed95caeb02: Pull complete 
58ec9e194d7d: Pull complete 
61f0fea1506f: Pull complete 
Digest: sha256:65642b1746e8759b4daa0c08916f9695642c1af9f3e0096f408d023a3e49f6f6
Status: Downloaded newer image for docker:1.8
Client:
 Version:      1.8.3
 API version:  1.20
 Go version:   go1.4.2
 Git commit:   f4bf5c7
 Built:        Mon Oct 12 18:01:15 UTC 2015
 OS/Arch:      linux/amd64

Server:
 Version:      1.13.1
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   092cba3
 Built:        2017-02-08T08:47:51.966588829+00:00
 OS/Arch:      linux/amd64
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:latest version
Client:
 Version:      17.03.0-ce
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   60ccb22
 Built:        Thu Mar  2 01:11:00 2017
 OS/Arch:      linux/amd64
Cannot connect to the Docker daemon at tcp://docker:2375. Is the docker daemon running?
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:latest version
^C%                                                                                                                                                                                                                                          ➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:1.13 version  
Unable to find image 'docker:1.13' locally
1.13: Pulling from library/docker
627beaf3eaaf: Already exists 
1ed492db3a66: Already exists 
8168b7823bfe: Already exists 
6c96a51d997f: Already exists 
Digest: sha256:03ebd4ec45fb424085628ca9070307a3649e93559f685ecb98c3906c11eba211
Status: Downloaded newer image for docker:1.13
Client:
 Version:      1.13.1
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   092cba3
 Built:        Wed Feb  8 08:47:51 2017
 OS/Arch:      linux/amd64
Cannot connect to the Docker daemon at tcp://docker:2375. Is the docker daemon running?
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:1.8 version 
Client:
 Version:      1.8.3
 API version:  1.20
 Go version:   go1.4.2
 Git commit:   f4bf5c7
 Built:        Mon Oct 12 18:01:15 UTC 2015
 OS/Arch:      linux/amd64

Server:
 Version:      1.13.1
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   092cba3
 Built:        2017-02-08T08:47:51.966588829+00:00
 OS/Arch:      linux/amd64
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:1.9 version
Unable to find image 'docker:1.9' locally
1.9: Pulling from library/docker
420890c9e918: Pull complete 
ff3485c94857: Pull complete 
a3ed95caeb02: Pull complete 
e3455ebf35e1: Pull complete 
56f96385f12d: Pull complete 
Digest: sha256:1628d1ac5be07a7abb1922e16a0eb5258d30ec1c9d8efbe6256c762c20f728f0
Status: Downloaded newer image for docker:1.9
Client:
 Version:      1.9.1
 API version:  1.21
 Go version:   go1.4.3
 Git commit:   a34a1d5
 Built:        Fri Nov 20 17:56:04 UTC 2015
 OS/Arch:      linux/amd64

Server:
 Version:      1.13.1
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   092cba3
 Built:        2017-02-08T08:47:51.966588829+00:00
 OS/Arch:      linux/amd64
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:1.10 version
Unable to find image 'docker:1.10' locally
1.10: Pulling from library/docker
e110a4a17941: Pull complete 
49e2842bdfdf: Pull complete 
26e60b21b458: Pull complete 
ec51c463b774: Pull complete 
Digest: sha256:d9a95422aa236f1b09a96f1b044f87fe24934f5e29e7e877796dc242d98c4895
Status: Downloaded newer image for docker:1.10
Client:
 Version:      1.10.3
 API version:  1.22
 Go version:   go1.5.3
 Git commit:   20f81dd
 Built:        Thu Mar 10 21:49:11 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.13.1
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   092cba3
 Built:        Wed Feb  8 08:47:51 2017
 OS/Arch:      linux/amd64
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:1.11 version
Unable to find image 'docker:1.11' locally
1.11: Pulling from library/docker
b7f33cc0b48e: Pull complete 
1438997aafae: Pull complete 
c196c61da5ba: Pull complete 
4b1a212f313e: Pull complete 
Digest: sha256:07b15519113cc4ceec0dc9b2b12753f555095f80d19ad1898c5362f589fb7dac
Status: Downloaded newer image for docker:1.11
Client:
 Version:      1.11.2
 API version:  1.23
 Go version:   go1.5.4
 Git commit:   b9f10c9
 Built:        Wed Jun  1 21:20:08 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.13.1
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   092cba3
 Built:        Wed Feb  8 08:47:51 2017
 OS/Arch:      linux/amd64
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:1.12 version
Unable to find image 'docker:1.12' locally
1.12: Pulling from library/docker
b7f33cc0b48e: Already exists 
1438997aafae: Already exists 
4096f0da5ead: Pull complete 
db8d140dbabd: Pull complete 
Digest: sha256:8b17e2c92bedbfe6f8afab3ae2525ac3ff61748698052225b0e29333b4d53fc0
Status: Downloaded newer image for docker:1.12
Client:
 Version:      1.12.6
 API version:  1.24
 Go version:   go1.6.4
 Git commit:   78d1802
 Built:        Wed Jan 11 00:23:16 2017
 OS/Arch:      linux/amd64

Server:
 Version:      1.13.1
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   092cba3
 Built:        Wed Feb  8 08:47:51 2017
 OS/Arch:      linux/amd64
➜  Group15-Dogfood git:(test_insecure_registry) ✗ docker run -it --rm --link mydaemon:docker docker:1.13 version
Client:
 Version:      1.13.1
 API version:  1.26
 Go version:   go1.7.5
 Git commit:   092cba3
 Built:        Wed Feb  8 08:47:51 2017
 OS/Arch:      linux/amd64
Cannot connect to the Docker daemon at tcp://docker:2375. Is the docker daemon running?

docker 1.12 not pushed to dockerhub

Although the docker 1.12 GA files were commitet, the final images are not available from dockerhub - 1.12.0, 1.12.0-dind and 1.12.0-git need to be pushed

17.05.0-ce-rc1 Doesn't support multi-stage builds

While Docker for Mac 17.05.0-ce-rc1 supports multi-stage builds, running when running in this image, I get the following error:

Step 1/12 : ARG GO_VERSION=1.8.1
Please provide a source image with `from` prior to commit

How can I pass --registry-mirror option to library/docker:dind ?

It’s all about particular CI case, when docker:dind is used and it would be great to pass it something like env variable in order to make dockerd use local caching registry.

What do you recommend?

publish arm32v7 image

I wanted to open this issue to track publishing an arm image to the official arm32v7 organization in dockerhub. I see it is currently disabled and was hoping this issue could be used to provide status updates.

# Docker's "armhf" is ARMv7 (as of 2017-06-07, 17.06.0-ce-rc2)
#arm32v6 armhf armhf

If there is anything I can do to help please let me know. I have a number of community members building and testing arm images that I am sure would be happy to lend a hand.

Experimental

Hey,

just wondering, wouldn't it make sense to have an docker:experimental which builds using https://experimental.docker.com/? What do you think?

My main intention is to test docker deploy, which as far as i understand is under experimental right now.

Thx!

Incorrect link in docker docs readme

Hey Guys,

I've just noticed that the link on this page links to nothing.

Specifically [this link](Note: --privileged is required for Docker-in-Docker to function properly, but it should be used with care as it provides full access to the host environment, as explained in the relevant section of the Docker documentation.)

I see in the readme's they mention running ./update.sh but I don't see one in that folder. Should I just push a pull request for that file?

Thanks,
Josh

init Additional property init is not allowed

Trying to deploy a stack with Docker 17.06.2-ce

A service is having 'init:' property set:

version: "3.1"
services:
  dummy:
    image: hello-world
    init: true

Getting an error:

$ docker stack deploy -c dummy.yml dummy
init Additional property init is not allowed

The 'init:' option had been introduced in version 2.2 of 'docker-compose' format. Any clue would be greatly appreciated.

docker-compose

Maybe it makes sense to have docker-compose inside the image? Or for example to have docker:compose version?

docker-compose in docker

I have docker-compose installed on the server like this:

$ docker-compose --version
docker-compose version 1.8.1, build 878cff1
$ which docker-compose
/usr/local/bin/docker-compose

I start my docker container like this:

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock myservice:latest

and myservice:lastest is built from

FROM docker:latest

inside the container I call a bash script that does docker things..and all works fine.
I also want to call docker-compose and have it use the docker-compose on the host in the same as docker does.

Not sure how to do this.....any ideas?

Thanks
Matt

cannot remove containers created during build with docker rm -f $(docker ps -a -q)

after successfully build images/services I´m unable to clean up the environment with docker rm -f $(docker ps -a -q)

Running with gitlab-runner 10.0.0 (2055cfdc)
  on Docker Runner (cf026217)
Using Docker executor with image docker:17.09.0-ce ...
Using docker image sha256:b7fe03622cba84a355d30dc6eb0efd66cd307293e0ba3ba1702bc0a7e0da6e1c for predefined container...
Pulling docker image docker:17.09.0-ce ...
Using docker image docker:17.09.0-ce ID=sha256:8e00cef02fc58f70eb68e1f5f8ddfa2a66195b5402edde6228072c57d17ff9b7 for build container...
Running on runner-cf026217-project-8-concurrent-0 via 83b72742801d...
Fetching changes...
HEAD is now at 22160db Update .gitlab-ci.yml
Checking out 22160dbf as gitlab-ci...
Skipping Git submodules setup
$ docker ps -a
CONTAINER ID        IMAGE                        COMMAND                  CREATED              STATUS                     PORTS               NAMES
514314bc4150        8e00cef02fc5                 "docker-entrypoint..."   15 seconds ago       Up Less than a second                          runner-cf026217-project-8-concurrent-0-build
ed1e355b7a96        b7fe03622cba                 "gitlab-runner-build"    19 seconds ago       Exited (0) 3 seconds ago                       runner-cf026217-project-8-concurrent-0-predefined
ae857fdf7703        wordpress_wordpress:latest   "docker-entrypoint..."   About a minute ago   Up About a minute          80/tcp, 443/tcp     wordtest.org
9449df1915b0        mariadb:latest               "docker-entrypoint..."   About a minute ago   Up About a minute          3306/tcp            wordtest.org_db
19d3f07c9614        wordpress_wordpress:latest   "docker-entrypoint..."   About a minute ago   Up About a minute          80/tcp, 443/tcp     example.com
411f691fec47        mariadb:latest               "docker-entrypoint..."   About a minute ago   Up About a minute          3306/tcp            example.com_db
720be5c226eb        b7fe03622cba                 "gitlab-runner-cac..."   9 minutes ago        Exited (0) 9 minutes ago                       runner-cf026217-project-8-concurrent-0-cache-3c3f060a0374fc8bc39395164f415a70
1f130e35737e        b7fe03622cba                 "gitlab-runner-cac..."   9 minutes ago        Exited (0) 9 minutes ago                       runner-cf026217-project-8-concurrent-0-cache-2ad4863160b155a50a63bfced3d597d7
$ docker rm -f $(docker ps -a -q)
ERROR: Job failed: exit code 137

I do not understand why this job fails.

and here is the part of the gitlab-ci.yml :

cleanup_job:
  stage: clean
  script:
    - docker ps -a
    - docker rm -f $(docker ps -a -q)
    - docker system prune
  when: always

usage of eval instead of exec in docker-entrypoint.sh

I tried to use the container from maven, more precisely the plugin "exec-maven-plugin". The problem is the way the plugin treats parameters. As long as you just call simple docker commands everything looks good but as soon as you get a bit more complicated you are greeted with a 'not found' message from exec...

I exchanged exec and put eval there instead and everything seemed to work much better. Is thera any good reason to use exec or is it a good idea to switch to eval?

docker-entrypoint.txt

PS I renamed the shell script to txt to get it uploaded :-)

Questions: Disk usage and network connection

Sorry if the repo is not ready for public consumption yet, but I'd have two burning questions.

Does this address https://github.com/jpetazzo/dind#important-warning-about-disk-usage and is /var/lib/docker reused from the "outer-docker"?
How to connect to the containers running in the container?

PS: I tried a build and ran a nginx container, which worked quite well so far.