Docker (on Ubuntu)
Table of Contents
No Kubernetes: docker compose + haproxy - https://statusdude.com/blog/zero-downtime-docker-compose
Watchtower replacement - dockcheck
https://github.com/mag37/dockcheck
mkdir -p ~/.local/binwget -O ~/.local/bin/dockcheck.sh "https://raw.githubusercontent.com/mag37/dockcheck/main/dockcheck.sh" && chmod +x ~/.local/bin/dockcheck.shGet IPs for each Docker
docker ps -q | xargs -n1 docker inspect --format '{{.Name}} {{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' | sed 's#^/##'Lazydocker
curl https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | bashecho 'PATH=$PATH:~/.local/bin' >> ~/.bashrcMove docker to another disk / path
systemctl stop docker docker.socketrsync -avxHAX /var/lib/docker /mnt/newmv /var/lib/docker /var/lib/docker.backupecho '{ "data-root": "/mnt/new/docker" }' >> /etc/docker/daemon.jsonvi /etc/docker/daemon.jsonsystemctl start dockerDocker one-liner
wget -O - https://get.docker.com | sudo bashRootless Docker
Create non-root user (if doesn’t exist):
NEWUSER='ubuntu'sudo adduser $NEWUSERsudo usermod -aG sudo $NEWUSER #add user to sudo group, to enable passwordless sudoecho '%sudo ALL=(ALL) NOPASSWD: ALL' | sudo tee /etc/sudoers.d/sudo_nopasswd > /dev/nullsudo vi /etc/shadow # place `*` on the password field to prevent password loginrsync --archive --chown=$NEWUSER:$NEWUSER ~/.ssh /home/$NEWUSER #copy SSH keyssudo apt-get install -y dbus-user-session uidmap slirp4netns && exit# after re-login:sudo apt-mark hold slirp4netns
wget -O - https://get.docker.com | sudo bash
sudo systemctl disable --now docker.service docker.socketsudo rm /var/run/docker.sockdockerd-rootless-setuptool.sh install
sudo loginctl enable-linger `id -nu`sudo setcap cap_net_bind_service=ep $(which rootlesskit)systemctl --user restart docker
sudo bash -c "echo 'net.ipv4.ip_unprivileged_port_start=0' > /etc/sysctl.d/20-any_port_for_anyone.conf"sudo sysctl --systemsudo sysctl net.ipv4.ip_unprivileged_port_start # shall be 0
sudo tee -a ~/.bashrc >> /dev/null << 'EOF'export PATH=/usr/bin:$PATHexport DOCKER_HOST=unix:///run/user/1000/docker.sockEOFUsing pasta on rootless docker:
sudo apt remove slirp4netnssudo apt install passtsystemctl --user set-environment PATH=/usr/bin:/usr/local/bin:$PATH
mkdir -p ~/.config/systemd/user/docker.service.dcat > ~/.config/systemd/user/docker.service.d/override.conf <<'EOF'[Service]Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_NET=pasta"Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=implicit"EOF
systemctl --user daemon-reloadsystemctl --user restart dockerroot docker (with firewalls):
// /etc/docker/daemon.json{ "firewall-backend": "nftables"}Disable localhost isolation
In rootless mode, localhost is isolated (fuck you, Docker developers). Related links:
[Service]Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK=false"that goes to vi ~/.config/systemd/user/docker.service.d/override.conf
Uninstall
dockerd-rootless-setuptool.sh uninstallsudo systemctl enable --now docker.service docker.socketsudo systemctl start --now docker.service docker.socketDocker (on Ubuntu)
wget -O - https://get.docker.com | sudo bashInstallation one liner
wget -O - https://raw.githubusercontent.com/alexander-potemkin/quickies/main/docker_ubuntu.sh | bashsudo apt-get install docker-compose-pluginsudo usermod -aG docker `whoami`Uninstall from Ubuntu
sudo apt-get purge docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin docker-ce-rootless-extrassudo rm -rf /var/lib/dockersudo rm -rf /var/lib/containerdCleanup space
# VERIFY BACKUPS ARE IN PLACE FIRST!docker system prune -adocker volume rm $(docker volume ls -qf dangling=true)Migrate volume
https://stackoverflow.com/questions/21597463/how-to-port-data-only-volumes-from-one-host-to-another
Various docker commands
ToDo:
Run anything in one line
docker run -d --restart=unless-stopped --name='tinyproxy' -p 6666:8888 dannydirect/tinyproxy:latest ANYmake container always running (restart)
as per StackOverflow
docker update --restart=always container_nameDocker
Connect to the Docker instance
sudo docker exec -it `sudo docker ps --filter name=certbot -q` /bin/shStop all Docker containers
docker ps --format "{{.Names}}" | sort | xargs --verbose --max-args=1 -- docker stopRemove all Docker containers:
docker ps --format "{{.Names}}" -a | sort | xargs --verbose --max-args=1 -- docker rmClear Docker build cache
sudo docker builder prune --allGet resources map for the Dockers
sudo docker stats --allSee the logs
watch 'docker ps --format "{{.Names}}" | sort | xargs --verbose --max-args=1 -- docker logs --tail=8 --timestamps'