Docker/Dockerhub - Revision history

Admin: /* Security */

2017-09-23T18:55:00Z

Security

← Older revision		Revision as of 18:55, 23 September 2017
Line 98:		Line 98:
	Note that, as mentioned above, the --privileged flag allows Docker the same privileges as the user who ran the command.		Note that, as mentioned above, the --privileged flag allows Docker the same privileges as the user who ran the command.

			=Flags=

			{{DockerFlag}}
	{{~~Docker~~}}

Admin at 20:09, 24 March 2017

2017-03-24T20:09:14Z

← Older revision		Revision as of 20:09, 24 March 2017
Line 1:		Line 1:
			Docker hub is basically one of the ways to get docker images and share dockerfiles.

			Docker hub: https://hub.docker.com/

	=Docker Hub=		=Docker Hub=

	~~To use~~ docker hub, ~~visit~~ https://hub.docker.com/		Link: https://hub.docker.com/

			Here is an example of a docker container on docker hub. This is httpd, the Apache web server: https://hub.docker.com/_/httpd/

	httpd ~~repository: https://hub~~.docker.~~com/_/~~httpd/		This container is provided as-is, and can be used by just calling it by its name (httpd). What that does is, it starts a very simple Docker container with all the default Apache docker container settings set.

			That means all it does is run apache httpd on port 80, nothing else.

	==Docker pull==		==Docker pull==
Line 84:		Line 92:
	Docker command line: https://docs.docker.com/engine/reference/commandline/cli/		Docker command line: https://docs.docker.com/engine/reference/commandline/cli/

	=Security ~~Notes~~=		=Security=

	Being in the docker group gives you serious root-level powers. Info about attack surface of Docker: https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface		Being in the docker group gives you serious root-level powers. Info about attack surface of Docker: https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface

	Note that, as mentioned above, the --privileged flag allows Docker the same privileges as the user who ran the command.		Note that, as mentioned above, the --privileged flag allows Docker the same privileges as the user who ran the command.



			{{Docker}}

Admin: Created page with "=Docker Hub= To use docker hub, visit https://hub.docker.com/ httpd repository: https://hub.docker.com/_/httpd/ ==Docker pull== The docker pull command will basically fetc..."

2017-03-24T20:05:06Z

Created page with "=Docker Hub= To use docker hub, visit https://hub.docker.com/ httpd repository: https://hub.docker.com/_/httpd/ ==Docker pull== The docker pull command will basically fetc..."

New page

=Docker Hub=

To use docker hub, visit https://hub.docker.com/

httpd repository: https://hub.docker.com/_/httpd/

==Docker pull==

The docker pull command will basically fetch the latest version of a particular docker image, without any modifications. (The alternative is to customize the image by creating a Dockerfile based on the Dockerfile contained on Docker hub.)

<pre>
$ docker pull httpd
latest: Pulling from httpd
c1f98057d627: Pull complete
c35ece8820ad: Pull complete
eeeee05b2d97: Pull complete
b356f7d0a4b0: Pull complete
cff60f000364: Pull complete
f66e93df25da: Pull complete
5aa754215a2b: Pull complete
ed544656f0fa: Pull complete
ffafc39cb69f: Pull complete
4c5d8313f629: Pull complete
55a6feaaae56: Pull complete
c1aa308548aa: Pull complete
919bf0916a6a: Pull complete
eb58b1ce0fcd: Pull complete
ce15017ba45e: Pull complete
617bdb3e78f6: Pull complete
738ba280808d: Pull complete
017d0384902a: Pull complete
d61c615e53ce: Pull complete
Digest: sha256:a5b5747c921fdac4e53197d2624ddad22fa9a13dfe31b305273be5149882c3e9
Status: Downloaded newer image for httpd:latest
</pre>

Can also pull other docker containers. Here is a shorter list of dependencies/layers:

<pre>
$ docker pull debian

latest: Pulling from debian
0aa3f9bb64ef: Pull complete
c1f98057d627: Already exists
Digest: sha256:fa8fd9718d2697730acc9a374dc2e1d54719177f474abbc8d5f74ebad5cb8a30
Status: Downloaded newer image for debian:latest
</pre>

==Docker images==

To see the docker container images that are installed, use the <code>docker images</code> command:

<pre>
$ docker images
REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE
httpd latest d61c615e53ce 2 days ago 176.9 MB
debian latest 0aa3f9bb64ef 2 days ago 123.4 MB
hello-world latest 7a5a2d73abce 9 weeks ago 1.84 kB
</pre>

==Running docker images==

If you want to run one of the images, use the docker run command. Give the container a name, and tell it what image to use.

<pre>
$ docker run --name test -it debian
</pre>

This also connects a TTY console to the container, so you have a basic bash shell on the virtual machine that runs the container.

==Docker Internals==

One of the interesting things you can do is run Docker using the privileged flag, which basically gives Docker the same rights as root or as the user who ran Docker:

{{Quote|The --privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.

[https://docs.docker.com/engine/reference/commandline/run/#full-container-capabilities---privileged Use the Docker command line]
}}

<pre>
$ docker run -t -i --privileged ubuntu bash
</pre>

Docker command line: https://docs.docker.com/engine/reference/commandline/cli/

=Security Notes=

Being in the docker group gives you serious root-level powers. Info about attack surface of Docker: https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface

Note that, as mentioned above, the --privileged flag allows Docker the same privileges as the user who ran the command.