From 6df95bba9306897644298d89d302ae8ca65dd0d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?T=C3=B5nis=20Tiigi?= Date: Thu, 20 Apr 2017 20:11:26 -0700 Subject: [PATCH 1/6] Merge pull request #32684 from scjane/patch-3 Update builder.md (cherry picked from commit 831066337743fc29ff122fce51afe44b8b3b3ba9) Signed-off-by: Sebastiaan van Stijn Upstream-commit: bc66821abbcf50c721ce9b8f52b339fda102d389 Component: engine --- components/engine/docs/reference/builder.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/engine/docs/reference/builder.md b/components/engine/docs/reference/builder.md index 2571511b64..502e41dfbb 100644 --- a/components/engine/docs/reference/builder.md +++ b/components/engine/docs/reference/builder.md @@ -94,8 +94,8 @@ instructions. Whenever possible, Docker will re-use the intermediate images (cache), to accelerate the `docker build` process significantly. This is indicated by the `Using cache` message in the console output. -(For more information, see the [Build cache section](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#/build-cache)) in the -`Dockerfile` best practices guide: +(For more information, see the [Build cache section](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#build-cache) in the +`Dockerfile` best practices guide): $ docker build -t svendowideit/ambassador . Sending build context to Docker daemon 15.36 kB From c377be45992e292f5c21831c25ca1b870cf3c4ac Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Wed, 26 Apr 2017 15:30:09 +0200 Subject: [PATCH 2/6] Merge pull request #32724 from PatrickLang/patricklang-win-memory Adding more on -m and --memory (cherry picked from commit c3fbca106552f2dadcb89510ff87945b50f36419) Signed-off-by: Sebastiaan van Stijn Upstream-commit: b4047a849bd3018f8a8eabf34613a4fca57f818e Component: engine --- .../engine/docs/reference/commandline/run.md | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/components/engine/docs/reference/commandline/run.md b/components/engine/docs/reference/commandline/run.md index ecb676dc20..2216319415 100644 --- a/components/engine/docs/reference/commandline/run.md +++ b/components/engine/docs/reference/commandline/run.md @@ -745,6 +745,41 @@ PS C:\> docker run -d --isolation default microsoft/nanoserver powershell echo h PS C:\> docker run -d --isolation hyperv microsoft/nanoserver powershell echo hyperv ``` +### Specify hard limits on memory available to containers (-m, --memory) + +These parameters always set an upper limit on the memory available to the container. On Linux, this +is set on the cgroup and applications in a container can query it at `/sys/fs/cgroup/memory/memory.limit_in_bytes`. + +On Windows, this will affect containers differently depending on what type of isolation is used. + +- With `process` isolation, Windows will report the full memory of the host system, not the limit to applications running inside the container + ```powershell + docker run -it -m 2GB --isolation=process microsoft/nanoserver powershell Get-ComputerInfo *memory* + + CsTotalPhysicalMemory : 17064509440 + CsPhyicallyInstalledMemory : 16777216 + OsTotalVisibleMemorySize : 16664560 + OsFreePhysicalMemory : 14646720 + OsTotalVirtualMemorySize : 19154928 + OsFreeVirtualMemory : 17197440 + OsInUseVirtualMemory : 1957488 + OsMaxProcessMemorySize : 137438953344 + ``` +- With `hyperv` isolation, Windows will create a utility VM that is big enough to hold the memory limit, plus the minimal OS needed to host the container. That size is reported as "Total Physical Memory." + ```powershell + docker run -it -m 2GB --isolation=hyperv microsoft/nanoserver powershell Get-ComputerInfo *memory* + + CsTotalPhysicalMemory : 2683355136 + CsPhyicallyInstalledMemory : + OsTotalVisibleMemorySize : 2620464 + OsFreePhysicalMemory : 2306552 + OsTotalVirtualMemorySize : 2620464 + OsFreeVirtualMemory : 2356692 + OsInUseVirtualMemory : 263772 + OsMaxProcessMemorySize : 137438953344 + ``` + + ### Configure namespaced kernel parameters (sysctls) at runtime The `--sysctl` sets namespaced kernel parameters (sysctls) in the From aa4ab28f5ce3f5c152deb24f3c9a97d0c079ea4e Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 25 Apr 2017 10:18:16 -0700 Subject: [PATCH 3/6] Merge pull request #32735 from bhavin192/patch-1 Add note about host-dir in VOLUME (cherry picked from commit f2fff9d913a8ab0436dd56033189a7c3713a59a2) Signed-off-by: Sebastiaan van Stijn Upstream-commit: 8fd6547fc3eb67e7efa7efb007ae6a4494cd2bb3 Component: engine --- components/engine/docs/reference/builder.md | 30 ++++++++++++++------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/components/engine/docs/reference/builder.md b/components/engine/docs/reference/builder.md index 502e41dfbb..f8ef9cf56b 100644 --- a/components/engine/docs/reference/builder.md +++ b/components/engine/docs/reference/builder.md @@ -1281,18 +1281,28 @@ This Dockerfile results in an image that causes `docker run`, to create a new mount point at `/myvol` and copy the `greeting` file into the newly created volume. -> **Note**: -> When using Windows-based containers, the destination of a volume inside the -> container must be one of: a non-existing or empty directory; or a drive other -> than C:. +### Notes about specifying volumes -> **Note**: -> If any build steps change the data within the volume after it has been -> declared, those changes will be discarded. +Keep the following things in mind about volumes in the `Dockerfile`. -> **Note**: -> The list is parsed as a JSON array, which means that -> you must use double-quotes (") around words not single-quotes ('). +- **Volumes on Windows-based containers**: When using Windows-based containers, + the destination of a volume inside the container must be one of: + + - a non-existing or empty directory + - a drive other than `C:` + +- **Changing the volume from within the Dockerfile**: If any build steps change the + data within the volume after it has been declared, those changes will be discarded. + +- **JSON formatting**: The list is parsed as a JSON array. + You must enclose words with double quotes (`"`)rather than single quotes (`'`). + +- **The host directory is declared at container run-time**: The host directory + (the mountpoint) is, by its nature, host-dependent. This is to preserve image + portability. since a given host directory can't be guaranteed to be available + on all hosts.For this reason, you can't mount a host directory from + within the Dockerfile. The `VOLUME` instruction does not support specifying a `host-dir` + parameter. You must specify the mountpoint when you create or run the container. ## USER From 25d0a85dce58456d6b91475e8d78601fa5a8b7ac Mon Sep 17 00:00:00 2001 From: Brian Goff Date: Mon, 24 Apr 2017 08:53:30 -0400 Subject: [PATCH 4/6] Merge pull request #32791 from djalal/patch-1 fix typo (cherry picked from commit 32a52716b964373b4ac464052e73ea5da79856c6) Signed-off-by: Sebastiaan van Stijn Upstream-commit: fcbd93f52032593cc71b298c00a46fd354356650 Component: engine --- components/engine/docs/reference/commandline/node_ls.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/engine/docs/reference/commandline/node_ls.md b/components/engine/docs/reference/commandline/node_ls.md index 224642c2e5..2f9c2becdf 100644 --- a/components/engine/docs/reference/commandline/node_ls.md +++ b/components/engine/docs/reference/commandline/node_ls.md @@ -89,7 +89,7 @@ ID HOSTNAME STATUS AVAILABILITY MANAGER STATUS 1bcef6utixb0l0ca7gxuivsj0 swarm-worker2 Ready Active ``` -#### membersip +#### membership The `membership` filter matches nodes based on the presence of a `membership` and a value `accepted` or `pending`. From 74c45938b062dba2fa3d73db80b3f89200ad5af1 Mon Sep 17 00:00:00 2001 From: Doug Davis Date: Fri, 28 Apr 2017 18:39:52 -0400 Subject: [PATCH 5/6] Merge pull request #32804 from bbodenmiller/patch-1 remove extra word (cherry picked from commit 9db03bd8cdad3c8804105cb5794ebad5e728f48f) Signed-off-by: Sebastiaan van Stijn Upstream-commit: 3eaec0071c3ce1b7201e37859afe5bcb78d4f215 Component: engine --- components/engine/docs/reference/run.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/engine/docs/reference/run.md b/components/engine/docs/reference/run.md index b209343b58..817c20c969 100644 --- a/components/engine/docs/reference/run.md +++ b/components/engine/docs/reference/run.md @@ -1123,7 +1123,7 @@ by default a container is not allowed to access any devices, but a the documentation on [cgroups devices](https://www.kernel.org/doc/Documentation/cgroup-v1/devices.txt)). When the operator executes `docker run --privileged`, Docker will enable -to access to all devices on the host as well as set some configuration +access to all devices on the host as well as set some configuration in AppArmor or SELinux to allow the container nearly all the same access to the host as processes running outside containers on the host. Additional information about running with `--privileged` is available on the From 9d1aaaa2978bec0c44f0af9a585479443ec31615 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 8 Jun 2017 01:09:45 +0200 Subject: [PATCH 6/6] Merge pull request #33572 from hsluoyz/patch-1 Add Casbin plugin to the list of Authorization plugins in docs. (cherry picked from commit 220831d541bfe9bf566c1038773198d431560dd3) Signed-off-by: Sebastiaan van Stijn Upstream-commit: 0ad3e3294e74f443130b5e1fb1ef6b31f4f92366 Component: engine --- components/engine/docs/extend/legacy_plugins.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/components/engine/docs/extend/legacy_plugins.md b/components/engine/docs/extend/legacy_plugins.md index 68bba59f46..dc77743b86 100644 --- a/components/engine/docs/extend/legacy_plugins.md +++ b/components/engine/docs/extend/legacy_plugins.md @@ -87,8 +87,9 @@ Plugin Plugin | Description ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ - [Twistlock AuthZ Broker](https://github.com/twistlock/authz) | A basic extendable authorization plugin that runs directly on the host or inside a container. This plugin allows you to define user policies that it evaluates during authorization. Basic authorization is provided if Docker daemon is started with the --tlsverify flag (username is extracted from the certificate common name). - [HBM plugin](https://github.com/kassisol/hbm) | An authorization plugin that prevents from executing commands with certains parameters. +[Casbin AuthZ Plugin](https://github.com/casbin/casbin-authz-plugin) | An authorization plugin based on [Casbin](https://github.com/casbin/casbin), which supports access control models like ACL, RBAC, ABAC. The access control model can be customized. The policy can be persisted into file or DB. +[HBM plugin](https://github.com/kassisol/hbm) | An authorization plugin that prevents from executing commands with certains parameters. +[Twistlock AuthZ Broker](https://github.com/twistlock/authz) | A basic extendable authorization plugin that runs directly on the host or inside a container. This plugin allows you to define user policies that it evaluates during authorization. Basic authorization is provided if Docker daemon is started with the --tlsverify flag (username is extracted from the certificate common name). ## Troubleshooting a plugin