Skip to content

docker.md

Latest commit

 

History

History
278 lines (207 loc) · 7.81 KB

docker.md

File metadata and controls

278 lines (207 loc) · 7.81 KB
Raw

+

Lifecycle

# Given: yi moby-engine
sudo dockerd
# ||
sudo systemctl start docker.service

docker pull ubuntu
docker run ubuntu bash -c "apt-get -y install nginx"
docker run -it ubuntu bash
# Redirect port
docker run -p 3000:3000 foo

docker container ls
docker ps -l
docker commit 5976e4ae287c ubuntu-nginx
docker images
docker run ubuntu-nginx whereis nginx

# From Dockerfile
docker build -t container_name .
docker run container_name

# Detached
docker run -d IMAGE
docker logs -f CONTAINER_ID_OR_NAME
docker exec -it CONTAINER_ID_OR_NAME /bin/bash
docker attach CONTAINER_ID_OR_NAME

# Detached, keep running
docker run -dit IMAGE sh

# Kill
docker ps | awk '/[0-9a-f]+/{print $1}' | xargs -i docker stop {}

References

Dockerfile

https://github.com/LiveOverflow/pwn_docker_example/blob/master/challenge/Dockerfile

reconstructing from image

docker history --no-trunc johndoe/foobar --format '{{ .CreatedBy }}'
# ||
docker pull johndoe/foobar:1.2.3
docker save johndoe/foobar:1.2.3 > foobar.tar
tar xvf foobar.tar
jq . manifest.json  # Take config hash as $config
jq .history "$config.json"  # Take entry where empty_layer=true as $layer
cd "$layer/"
tar tf layer.tf

https://theartofmachinery.com/2021/03/18/reverse_engineering_a_docker_image.html

create vm for containers

GitHub - docker/machine: Machine management for a container-centric world

docker-machine create -d virtualbox default
eval "$(docker-machine env default)"

optimizations

permissions

mkdir -p /data1/Downloads
docker run -it -v /data1/Downloads:/Downloads ubuntu bash
# ||
docker volume create \
    --driver local \
    --name hello \
    --opt type=none \
    --opt device=/data1/Downloads \
    --opt o=uid=root,gid=root \
    --opt o=bind 
docker run -it -v hello:/Downloads ubuntu bash
# || Given: selinux enabled
docker run -it -v hello:/Downloads:z ubuntu bash

avoiding root

DOCKER_OPTS="--userns-remap=1000:1000"

daemon socket

monitoring

docker stats
curl -v --unix-socket /var/run/docker.sock \
  http://localhost/containers/$CONTAINER_ID/stats | jq
cat /sys/fs/cgroup/blkio/docker/$CONTAINER_ID/blkio.throttle.io_service_bytes
cat /proc/$CONTAINER_PID/net/dev

build

# Given: $PWD/Dockerfile
docker build . --tag whipper/whipper
docker images | grep 'whipper/whipper'
# Cleanup:
docker images --filter "dangling=true" -q --no-trunc | xargs -I{} docker rmi {}
# ||
docker image prune -af

architeture, e.g. 32bit vs 64bit

standard_init_linux.go:190: exec user process caused "exec format error"

Reported architecture inside container is from host => ENTRYPOINT ["linux32"] - https://stackoverflow.com/questions/26490935/how-to-fake-cpu-architecture-in-docker-container

container path

system info - cpu architecture

docker inspect
- https://docs.docker.com/engine/reference/commandline/inspect/

Editing running container

# Edit /var/lib/docker/containers/CONTAINER_ID/hostconfig.json
systemctl restart docker
docker start CONTAINER_ID_OR_NAME

persistence, updates

binding user ids

Multiple containers

docker-compose build
docker-compose up

docker network create --driver bridge
docker run --network=foo --name=bar

Delete containers

docker system purge -af
@echo off
FOR /f "tokens=*" %%i IN ('docker ps -aq') DO docker rm %%i
FOR /f "tokens=*" %%i IN ('docker images --format "{{.ID}}"') DO docker rmi %%i
docker ps -aq | foreach {docker rm -f $_}
docker images -aq | foreach {docker rmi -f $_}

Nesting, docker-in-docker

bind-mounting the host machine's Docker socket in the container

TODO

debug processes across pid namespaces

# against host
docker run -it --rm --pid=host myhtop

# against another container
docker run --name my_redis -d redis
docker run -it --pid=container:my_redis my_strace_docker_image bash
strace -p 1

https://docs.docker.com/engine/reference/run/#pid-settings---pid

ip address

docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' CONTAINER_ID_OR_NAME
docker ps \
    | awk '/[0-9a-f]{12}/{print $1}' \
    | xargs -I{} docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' {}

alternatives

lxc

lxc image list images: os=Fedora
lxc launch images:fedora/35 foo
lxc exec foo -- sudo /bin/bash

lxc network attach enp3s0 foo eth0
lxc restart foo

case studies