* docker scan: using an HTTP proxy
Explain how to use an HTTP proxy in `docker scan`. It's confusing
because it doesn't use the same settings as the engine, the CLI
or Docker Desktop.
Signed-off-by: David Scott <dave.scott@docker.com>
* Update engine/scan/index.md
Clarify proxy:port as proxyAddress:port
Co-authored-by: Paweł Gronowski <me@woland.xyz>
* Update engine/scan/index.md
Capitalize PowerShell
Co-authored-by: Paweł Gronowski <me@woland.xyz>
Co-authored-by: Paweł Gronowski <me@woland.xyz>
These capabilities were reverted in a38b96b8cd,
because the version of containerd and runc that shipped together with
docker 20.10.0 did not support them.
Current versions of containerd and runc support these, so possibly we can
include them again in a patch release, but otherwise support will come in
the next (22.06) release of docker engine.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These were notes about distro versions that have been EOL for a long
time, and an old version of docker engine that's EOL as well.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
containerd, docker engine and the docker cli were split into separate
packages in the 18.09 release. We kept this note on the release-notes
for current releases, but by now it's mostly "old news", so move the
warning to the 18.09 release notes page (which was the release in which
this change was made).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This warning has been in place for a Year, and while there's
still users running on this version of Ubuntu, it's not really
our responsibility to notify them about their distro version
being EOL.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The "nightly" channel hasn't been updated for a long time, so while it's
not actively updated, we should not show instructions for it.
The "test" channel is still updated in preparation of new releases, but
including the instructions in between the regular installation procedure
introduced quite some "noise" that's irrelevant to most users (who would
be installing the "stable" channel).
This patch removes the instructions to enable the nightly and test channels
from the installation instructions.
While making these changes, I also synced somme wording between distros
for consistency, and removed a stray section about storage-drivers, as
that's already outlined in the "optional post-installation steps".
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
See https://tracker.debian.org/news/1305679/accepted-apt-240-source-into-unstable/:
* Install an empty /etc/apt/keyrings directory.
This directory is intended to provide an alternative to
/usr/share/keyrings for placing keys used with signed-by.
See also https://wiki.debian.org/DebianRepository/UseThirdParty?action=diff&rev2=47&rev1=46 (which was edited following a discussion with the APT maintainers about the expected usage):
> If future updates to the key will be managed by an apt/dpkg package as recommended below, then it SHOULD be downloaded into `/usr/share/keyrings` using the same filename that will be provided by the package. If it will be managed locally , it SHOULD be downloaded into `/etc/apt/keyrings` instead.
Signed-off-by: Tianon Gravi <admwiggin@gmail.com>
The example for setting the MTU on the swarm ingress network uses the wrong property:
`--opt com.docker.network.mtu=1200`
instead of
`--opt com.docker.network.driver.mtu=1200`
* Fixed rootlesskit binary path, mention daemon restart
`rootlesskit` lives at `/usr/bin/rootlesskit`. After setting `CAP_NET_BIND_SERVICE` capability daemon has to be restarted.
* Changed rootlesskit binary path to be dynamically resolved
I believe this is the intended meaning, otherwise it is unclear where the name wp_db_secret is coming from when referenced as "keeping the same" by wp_db_password
* Add quick troubleshooting step
If default umask isn't set with global read permissions, the keyring GPG file isn't found when updating the apt repos. The one liner command added will fix this issue.
* Fix grammar
Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
The information about which distro version to use to match upstream
Debian / Ubuntu versions was outdated. Given that Docker does not
officially support, nor tests, installing these packages on Ubuntu
and Debian derivatives, it's better to remove it, and leave it to
the user to find the correct codename; also see
https://docs.docker.com/engine/install/#other-linux-distributions
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This package is no longer needed on all current distro versions we support. From
the package description (https://packages.debian.org/buster/apt-transport-https);
> This is a dummy transitional package - https support has been moved into the
> apt package in 1.5. It can be safely removed.
Verifying the version of apt that's available in Ubuntu and Debian:
Ubuntu:
docker run --rm ubuntu:xenial apt --version
apt 1.2.35 (amd64)
docker run --rm ubuntu:17.04 apt --version
apt 1.4.6 (amd64)
docker run --rm ubuntu:17.10 apt --version
apt 1.5.2 (amd64)
docker run --rm ubuntu:18.04 apt --version
apt 1.6.14 (amd64)
docker run --rm ubuntu:20.04 apt --version
apt 2.0.6 (amd64)
Debian:
docker run --rm debian:stretch apt --version
apt 1.4.11 (amd64)
docker run --rm debian:buster apt --version
apt 1.8.2.3 (amd64)
docker run --rm debian:bullseye apt --version
apt 2.2.4 (amd64)
From the above; all currently supported versions of Ubuntu (18.04 and up), and
Debian (old-stable and stable) have apt > 1.5, so we can remove this dependency
from the installation instructions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Add instructions on installing server and client binaries on Windows:
Signed-off-by: Usha Mandya <usha.mandya@docker.com>
* Apply suggestions from code review
Co-authored-by: Sebastiaan van Stijn <thaJeztah@users.noreply.github.com>
Co-authored-by: Sebastiaan van Stijn <thaJeztah@users.noreply.github.com>
The SELinux workaround for `/run/xtables.lock` is no longer needed
since Docker 20.10.8 (moby/moby PR 42462)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
- sysctl `kernel.unprivileged_userns_clone=1` is no longer needed
- Recommend fuse-overlayfs.
Debian kernel has modprobe option `permit_mounts_in_userns=1` but
still unstable (moby/moby issue 42302)
- Now apt repo has relatively recent version of slirp4netns (1.0.1)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
- Add missing code-hints (console, yaml)
- Consistently add an empty line after code-blocks
- Combine some examples where the output and the command were
put in separate blocks. With the "console" code-hint, this
is no longer nescessary.
- fix indentation in cloud/ecs-integration.md, which caused the
numbered-list to be interrupted.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Added .md files for SLES and RHEL engine installation. Added indexing to _data/toc.yaml and engine/install/index.md. Modified engine/install/index.md, includes/install-script.md, engine/security/rootless.md, storage/storagedriver/device-mapper-driver.md, and storage/storagedriver/select-storage-driver.md to add info for added RHEL and SLES support. Modified engine/install/ubuntu.md to add s390x repos and other info. Added tab target for RHEL and SLES to engine/security/rootless.md along with other info.
Signed-off-by: Nirman Narang <narang@us.ibm.com>
NFS mounts are not currently supported for rootless data-root so there should probably be a note about it so no one gets confused when it doesn't work.
Errors for running rootless containers when your data-root is an NFS mount look like:
```
docker: failed to register layer: ApplyLayer exit status 1 stdout: stderr: open /root/.bash_logout: permission denied.
```
- lowercase "arm" architectures
- swap arm / arm64 columns (as arm 32-bit is only for a single distro)
- remove raspbian arm64 Raspbian is 32 bit, and we don't ship packages
for raspbian arm64
- add (32-bit) mention to arm column
- add "Apple Silicon" to the Docker Desktop table for completeness
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Workaround for outdated slirp4netns on debian
I had issue on debian 11 where the package on the
main apt repositories was too old. This provides workaround, by
adding the testing repos to sources list then upgrading slirp4netns
* pr review
- add console tag
- add newline before console code block
- remove the installation instructions to `slirp4netns` and link to the releases page, which will have it anyway.
* pr review
- add in suggested comment about vpnkit
The correct name is `com.docker.network.container_iface_prefix`, but
the changelog accidentally used `interface` instead of `iface`, because
the libnetwork pull request used that as a title.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Added instructions on how to deal with MacOS security measures
Mac OS prevents downloaded files to be executed.
Added the description how to allow it again.
* Minor style updates
Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
This moves some of the stubs that were still in place for docker enterprise,
and moves the redirects they contained to more sensible locations where possible,
also making these redirect slightly more "visible" for when we're editing.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Change the repository link to open an issue on docker scan plugin
Signed-off-by: Guillaume Lours <guillaume.lours@docker.com>
* Remove the statement on trials
Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
BuildKit allows using alternative Dockerfile syntaxes to introduce new features
without having to update Docker itself. The general recommendation is to always
specify a "syntax" directive in a Dockerfile, so that (if needed) older versions
of Docker can download the correct syntax to build the Dockerfile.
This updates our examples to include a syntax directive, to make users more familiar
with these directives, and to illustrate best-pracitces in our documentation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- btrfs is now supported (moby/moby PR 42253)
- CLI context "rootless" is now created by default (moby/moby PR 42109)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
these commands are hidden in the cli, but functional, and mentioned
in the "working with buildx" introduction.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Added important disambiguation to swarm mode
This really needs to be added, I had no idea people gave up on docker/swarm because of a misunderstanding, but it's common enough we need to clarify it.
From Docker's public #swarm slack channel:
```
andrew grosser 4:45 PM
Hey @channel I am about to give a talk in San Francisco to a bunch of devops experts about swarm using my ingress and reverse proxy controller https://github.com/sfproductlabs/roo and one of the organizers said swarm was deprecated, is that so? It's so much easier than kubernetes, I can't imagine losing it.
sfproductlabs/roo
A zero config distributed edge-router & reverse-proxy (supporting multiple letsencrypt/https hosts). No dependencies.
Stars
40
Language
Go
<https://github.com/sfproductlabs/roo|sfproductlabs/roo>sfproductlabs/roo | Apr 9th | Added by GitHub
4:46
Is there something we don't know?
james_wells 4:48 PM
As of the most recent official Docker release, no Swarm is still officially part of Docker... They merely added native support for Kubernetes
andrew grosser 4:49 PM
🙏 Phew, is there an EOL?
4:49
Thanks @james_wells
4:50
I think they going to get the grenade launchers out if I can't answer these questions
james_wells 4:51 PM
Now that is a good question and my guess is that no, there is no plan to remove it, at least before Docker 3.
andrew grosser 4:52 PM
Amazing thx, I have a system that is a startups dream and is personally saving me more than 10x using swarm, so praying it stays
bmitch:docker: 4:53 PM
Classic container deployed swarm is deprecated (I believe). Swarm mode that's integrated into the engine is still being developed by Mirantis with no EOL set.
4:53
So if someone says swarm is deprecated, make sure to ask "which swarm" they are referring to.
andrew grosser 4:54 PM
Ok thanks @bmitch
4:54
Think that's a brand thing we'll need to help change
james_wells 4:56 PM
@bmitch I am not sure I understand what you are sayin there. Could you please explain the differences
bmitch:docker: 4:56 PM
See the disambiguation section: https://hub.docker.com/r/dockerswarm/swarm
james_wells 4:57 PM
Excellent. Thank you sir
andrew grosser 5:02 PM
Thanks
bmitch:docker: 5:02 PM
See also this link where they are getting ready to archive the standalone swarm, aka classic swarm. https://github.com/docker/classicswarm/issues/2985#issuecomment-640486361
justincormackjustincormack
Comment on #2985 Why have all issues been closed?
The vast majority of issues were from 5 years ago when it was being actively developed, and the recent ones were all mistakes for swarmkit, other than some issues I resolved. Many were issues in components or Moby or other software and may be resolved. It is GitHubs (reasonable) recommendation that you close issues and PRs before archiving a repository so that people know they are not being worked on, and I was also looking to see if anyone came forward to say that they were still working on things or, indeed, actively using Swarm Classic.
<https://github.com/docker/classicswarm|docker/classicswarm>docker/classicswarm | Jun 8th | Added by GitHub
james_wells 5:08 PM
That is really unfortunate... Kubernetes is simply too expensive IMNSHO, Swarm is nice and lightweight.
andrew grosser 5:08 PM
Both the different swarms point to the same point in the documentation in the disambiguation @bmitch
bmitch:docker: 5:09 PM
Swarm mode, aka swarmkit is alive and well.
andrew grosser 5:10 PM
Whoa I can see why they were confused
bmitch:docker: 5:10 PM
If you type docker swarm init you are not running classic swarm
andrew grosser 5:11 PM
Can someone inside docker add this to the swarm docs page? I think it's important
5:12
I think something talking about 2014 was EOLd but this is still current and alive would help.
bmitch:docker: 5:12 PM
Docker themselves isn't maintaining it, that team went to Mirantis, so someone over there would need to submit the PR
andrew grosser 5:12 PM
OK, could I?
bmitch:docker: 5:13 PM
Docs are in GitHub
andrew grosser 5:13 PM
Thanks
```
* Minor edit to the wording to clarify the diff
* Minor update
Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
Certain installations may not have this. Without this, the step
where `/etc/apt/sources.list.d/docker.list` will fail and write
garbled data to the file, potentially breaking apt.
Co-Authored-By: Andrew Kester <akester@cox.net>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This tones down the prompt and command output, so that the commands
to run stand out more clearly.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Looks like the Debian version was updated during review, but the Ubuntu variant
was forgotten in 760bb64ea3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Offering an alternative to apt-key (deprecated)
[Use trusted.gpg.d instead of apt-key · Issue #11625 · docker/docker.github.io](https://github.com/docker/docker.github.io/issues/11625)
As of Debian 10 / Ubuntu 20.10, apt-key is deprecated and will not be available after Debian 11 / Ubuntu 22.04
Although adding keys directly to `/etc/apt/trusted.gpg.d`/ is suggested by apt-key deprecation message, as per [Debian Wiki](https://wiki.debian.org/DebianRepository/UseThirdParty) GPG keys for third party repositories should be added to `/usr/share/keyrings` and referenced with the `signed-by` option in the source.list.d entry.
Providing a binary .gpg key instead of an ASCII Armored one might help shorten the lengthy command by removing the ` | gpg --dearmor ` bit.
This removes the software-properties-common provides add-apt-repository which we don't use anymore
= _includes/install-script.md, engine/install/linux-postinstall.md =
- Remove "Rootless mode is currently available as an experimental feature."
Close issue 12050
= engine/security/rootless.md =
== "Prerequiresites" section ==
- Remove information about old distros (Debian 9, CentOS 7.5-7.6)
== "Distribution-specific hint" section ==
- Tabified (`<div class="tab-content" />`)
== "Known limitations" section ==
- Kernel 5.11 supports rootless overlayfs, without the Ubuntu/Debian patch.
== "Install" section ==
- Promote RPM/DEB installation over TGZ installation.
See docker/roadmap issue 188
== "Uninstall" section ==
- Add "Uninstall" section.
Close issue 12053
== "Usage" section ==
- Added more information about systemd
- Move `nsenter` tips to "Tips for debugging" subsection under "Troubleshooting" section
== "Best practice" section ==
- Remove guide for `lxc-user-nic` network driver due to immaturity.
Will be brought back in future.
See rootless-containers/rootlesskit issue 138 .
== "Troubleshooting" section ==
- Add a guide for "can't open lock file /run/xtables.lock: Permission denied" (SELinux).
See moby/moby issue 41230
- Add a guide for "failed to register layer: ApplyLayer exit status 1 ..." (NFS).
Close docker/for-linux issue 1172
- Improve guides for slirp4netns.
- Remove v19.03 information (e.g., "cgroup v2 is unsupported, use cgroup v1")
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Previously, the `ssh://` helper was only mentioned in `engine/security/index.md`.
The `ssh://` helper is now documented in "Protect the Docker daemon socket"
(`engine/security/protect-access.md`, nee `engine/security/https.md`).
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The documentation curently doesn't contain reference docs for the
unified (version-less) compose-file syntax, so for now replacing
all links to point to the v3 compose-file reference, which is still
present.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Update dotnetcore.md
Adding an example for .Net Core docker files as consumed by build agents and recommended by Microsoft best practices.
* Update engine/examples/dotnetcore.md
Co-authored-by: Guillaume Tardif <guillaume.tardif@gmail.com>
* Format updates
* Update dotnetcore.md
Co-authored-by: Guillaume Tardif <guillaume.tardif@gmail.com>
Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
* Some more details and links
Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
* Minor edits
Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
* Docker now supports cgroup v2 (both rootful and rootless)
* Rootless mode graduated from experimental
* New storage driver: fuse-overlayfs
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The current instructions lead the user through creating a context and running a sample nginx container, but it never shows the user how to go about viewing it. I have added that.
The ssh example was really bad; it even leaks the root password as a plain text in the image :(
This commit removes the sshd example and discourage people to dockerize sshd.
The `running_ssh_service.md` page itself is not removed because there
are hyperlinks on the Internet to that page.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Jerae Duffin
CrazyMax
Justin Chadwell
Sebastiaan van Stijn
Allie Sadler
David Scott
Dora Ribeiro
Jared Boone
Fabio Guarini
Usha Mandya
Sebastiaan van Stijn
Usha Mandya
Tianon Gravi
Allie Sadler
Takuya Noguchi
Anca Iordache
Guillaume Lours
Guillaume Lours
halprin
Chris Crone
Mandraenke
SethuMK
Dan Bámíkíyá
Rahul De
jerae-duffin
Kevin Köllmann
mbehboodian
JayG
Ralph
Ryan Harvey
Peter Dave Hello
Nicolas De Loof
Akihiro Suda
QQ喵
linuxmetel
anujajakhade
Foster Snowhill
Nirman Narang
Thomas de Grenier de Latour
Eli Uriegas
Jem Bishop
cc-wr
Andreas Scheucher
Metal
Matthias Scholz
Visarut Phusua
Anca Iordache
Adrián Tóth
Tibor Vass
Tibor Vass
Jimmy
avivmu
Aaron Stults
Andrew Grosser
Andrew Kester
denis-roy
Akash Borad
Guillaume Tardif
Christian Clauss
fahed dorgaa
Bahadır YARDIM
Batuhan Apaydın
Paco Xu
avichalchum
Ben De St Paer-Gotch
zori
Guillaume Tardif
Charlie Arehart
Fabian M