diff --git a/docs/admin/ambassador_pattern_linking.md b/docs/admin/ambassador_pattern_linking.md index 772142e258..7622d2796a 100644 --- a/docs/admin/ambassador_pattern_linking.md +++ b/docs/admin/ambassador_pattern_linking.md @@ -70,7 +70,7 @@ On the Docker host (192.168.1.52) that Redis will run on: # start actual redis server $ docker run -d --name redis crosbymichael/redis - # get a redis-cli container for connection testing + # get a redis-cli image for connection testing $ docker pull relateiq/redis-cli # test the redis server by talking to it directly diff --git a/docs/admin/index.md b/docs/admin/index.md index 5b4017187d..e65807f9cf 100644 --- a/docs/admin/index.md +++ b/docs/admin/index.md @@ -25,7 +25,7 @@ or `systemd` to manage the `docker` daemon's start and stop. ### Running the docker daemon directly -The `docker` daemon can be run directly using the `dockerd` command. By default it listens on +The Docker daemon can be run directly using the `dockerd` command. By default it listens on the Unix socket `unix:///var/run/docker.sock` $ dockerd @@ -38,9 +38,9 @@ the Unix socket `unix:///var/run/docker.sock` ### Configuring the docker daemon directly -If you're running the `docker` daemon directly by running `docker daemon` instead +If you're running the Docker daemon directly by running `dockerd` instead of using a process manager, you can append the configuration options to the `docker` run -command directly. Other options can be passed to the `docker` daemon to configure it. +command directly. Other options can be passed to the Docker daemon to configure it. Some of the daemon's options are: @@ -51,7 +51,7 @@ Some of the daemon's options are: | `--tls=false` | Enable or disable TLS. By default, this is false. | -Here is an example of running the `docker` daemon with configuration options: +Here is an example of running the Docker daemon with configuration options: $ dockerd -D --tls=true --tlscert=/var/docker/server.pem --tlskey=/var/docker/serverkey.pem -H tcp://192.168.59.3:2376 diff --git a/docs/admin/logging/awslogs.md b/docs/admin/logging/awslogs.md index 3f90c41426..fce53aee6b 100644 --- a/docs/admin/logging/awslogs.md +++ b/docs/admin/logging/awslogs.md @@ -22,7 +22,7 @@ and Command Line Tools](http://docs.aws.amazon.com/cli/latest/reference/logs/ind You can configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=awslogs + dockerd --log-driver=awslogs You can set the logging driver for a specific container by using the `--log-driver` option to `docker run`: diff --git a/docs/admin/logging/fluentd.md b/docs/admin/logging/fluentd.md index 238bd06a40..575fb0efe4 100644 --- a/docs/admin/logging/fluentd.md +++ b/docs/admin/logging/fluentd.md @@ -39,7 +39,7 @@ Some options are supported by specifying `--log-opt` as many times as needed: Configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=fluentd + dockerd --log-driver=fluentd To set the logging driver for a specific container, pass the `--log-driver` option to `docker run`: @@ -107,7 +107,7 @@ aggregate store. 2. Launch Fluentd container with this configuration file: - $ docker run -it -p 24224:24224 -v /path/to/conf/test.conf:/fluentd/etc -e FLUENTD_CONF=test.conf fluent/fluentd:latest + $ docker run -it -p 24224:24224 -v /path/to/conf/test.conf:/fluentd/etc/test.conf -e FLUENTD_CONF=test.conf fluent/fluentd:latest 3. Start one or more containers with the `fluentd` logging driver: diff --git a/docs/admin/logging/gcplogs.md b/docs/admin/logging/gcplogs.md index d19afefa1e..834082962d 100644 --- a/docs/admin/logging/gcplogs.md +++ b/docs/admin/logging/gcplogs.md @@ -18,7 +18,7 @@ Logging. You can configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=gcplogs + dockerd --log-driver=gcplogs You can set the logging driver for a specific container by using the `--log-driver` option to `docker run`: diff --git a/docs/admin/logging/index.md b/docs/admin/logging/index.md index b47686bf8a..c01d4552ad 100644 --- a/docs/admin/logging/index.md +++ b/docs/admin/logging/index.md @@ -21,3 +21,4 @@ weight=9 * [Amazon CloudWatch Logs logging driver](awslogs.md) * [Splunk logging driver](splunk.md) * [ETW logging driver](etwlogs.md) +* [Google Cloud Logging driver](gcplogs.md) \ No newline at end of file diff --git a/docs/admin/logging/journald.md b/docs/admin/logging/journald.md index 8476dd062f..d4991cfb59 100644 --- a/docs/admin/logging/journald.md +++ b/docs/admin/logging/journald.md @@ -30,7 +30,7 @@ driver stores the following metadata in the journal with each message: You can configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=journald + dockerd --log-driver=journald You can set the logging driver for a specific container by using the `--log-driver` option to `docker run`: diff --git a/docs/admin/logging/overview.md b/docs/admin/logging/overview.md index 2cad6061aa..4c4c16304a 100644 --- a/docs/admin/logging/overview.md +++ b/docs/admin/logging/overview.md @@ -45,7 +45,7 @@ to manually start the daemon with the `json-file` driver, and include additional attributes in the output, run the following command: ```bash -$ docker daemon \ +$ dockerd \ --log-driver=json-file \ --log-opt labels=foo \ --log-opt env=foo,fizz diff --git a/docs/admin/logging/splunk.md b/docs/admin/logging/splunk.md index d33f964778..b1a4d85c23 100644 --- a/docs/admin/logging/splunk.md +++ b/docs/admin/logging/splunk.md @@ -20,7 +20,7 @@ in Splunk Enterprise and Splunk Cloud. You can configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=splunk + dockerd --log-driver=splunk You can set the logging driver for a specific container by using the `--log-driver` option to `docker run`: diff --git a/docs/admin/systemd.md b/docs/admin/systemd.md index 6d560335d5..5c0c699e1d 100644 --- a/docs/admin/systemd.md +++ b/docs/admin/systemd.md @@ -53,7 +53,7 @@ following: EnvironmentFile=-/etc/sysconfig/docker-storage EnvironmentFile=-/etc/sysconfig/docker-network ExecStart= - ExecStart=/usr/bin/docker daemon -H fd:// $OPTIONS \ + ExecStart=/usr/bin/dockerd -H fd:// $OPTIONS \ $DOCKER_STORAGE_OPTIONS \ $DOCKER_NETWORK_OPTIONS \ $BLOCK_REGISTRY \ @@ -90,7 +90,7 @@ In this example, we'll assume that your `docker.service` file looks something li [Service] Type=notify - ExecStart=/usr/bin/docker daemon -H fd:// + ExecStart=/usr/bin/dockerd -H fd:// LimitNOFILE=1048576 LimitNPROC=1048576 TasksMax=1048576 @@ -104,7 +104,7 @@ directory: [Service] ExecStart= - ExecStart=/usr/bin/docker daemon -H fd:// --graph="/mnt/docker-data" --storage-driver=overlay + ExecStart=/usr/bin/dockerd -H fd:// --graph="/mnt/docker-data" --storage-driver=overlay You can also set other environment variables in this file, for example, the `HTTP_PROXY` environment variables described below. @@ -114,7 +114,7 @@ by a new configuration as follows: [Service] ExecStart= - ExecStart=/usr/bin/docker daemon -H fd:// --bip=172.17.42.1/16 + ExecStart=/usr/bin/dockerd -H fd:// --bip=172.17.42.1/16 If you fail to specify an empty configuration, Docker reports an error such as: diff --git a/docs/extend/index.md b/docs/extend/index.md index 8a061e4e29..4e77c698e6 100644 --- a/docs/extend/index.md +++ b/docs/extend/index.md @@ -1,22 +1,272 @@ +# Docker Engine managed plugin system -## Extending Docker Engine +This document describes the plugin system available today in the **experimental +build** of Docker 1.12: -Currently, you can extend Docker Engine by adding a plugin. This section contains the following topics: +* [How to operate an existing plugin](#how-to-operate-a-plugin) +* [How to develop a plugin](#how-to-develop-a-plugin) -* [Understand Docker plugins](plugins.md) -* [Write a volume plugin](plugins_volume.md) -* [Write a network plugin](plugins_network.md) -* [Write an authorization plugin](plugins_authorization.md) -* [Docker plugin API](plugin_api.md) +Unlike the legacy plugin system, you now manage plugins using Docker Engine: + +* install plugins +* start plugins +* stop plugins +* remove plugins + +The current Docker Engine plugin system only supports volume drivers. We are +adding more plugin driver types in the future releases. + +For information on Docker Engine plugins generally available in Docker Engine +1.12 and earlier, refer to [Understand legacy Docker Engine plugins](legacy_plugins.md). + +## How to operate a plugin + +Plugins are distributed as Docker images, so develpers can host them on Docker +Hub or on a private registry. + +You install the plugin using a single command: `docker plugin install `. +The `plugin install` command pulls the plugin from the Docker Hub or private +registry. If necessary the CLI prompts you to accept any privilige requriements. +For example the plugin may require access to a device on the host system. +Finally it enables the plugin. + +Run `docker plugin ls` to check the status of installed plugins. The Engine +markes plugins that are started without issues as `ENABLED`. + +After you install a plugin, the plugin behavior is the same as legacy plugins. +The following example demonstrates how to install the `sshfs` plugin and use it +to create a volume. + +1. Install the `sshfs` plugin. + + ```bash + $ docker plugin install vieux/sshfs + + Plugin "vieux/sshfs" is requesting the following privileges: + - network: [host] + - capabilities: [CAP_SYS_ADMIN] + Do you grant the above permissions? [y/N] y + + vieux/sshfs + ``` + + The plugin requests 2 privileges, the `CAP_SYS_ADMIN` capability to be able + to do mount inside the plugin and `host networking`. + +2. Check for a value of `true` the `ENABLED` column to verify the plugin +started without error. + + ```bash + $ docker plugin ls + + NAME TAG ENABLED + vieux/sshfs latest true + ``` + +3. Create a volume using the plugin. + + ```bash + $ docker volume create \ + -d vieux/sshfs \ + --name sshvolume \ + -o sshcmd=user@1.2.3.4:/remote + + sshvolume + ``` + +4. Use the volume `sshvolume`. + + ```bash + $ docker run -v sshvolume:/data busybox ls /data + + + ``` + +5. Verify the plugin successfully created the volume. + + ```bash + $ docker volume ls + + DRIVER NAME + vieux/sshfs sshvolume + ``` + + You can stop a plugin with the `docker plugin disable` + command or remove a plugin with `docker plugin remove`. + +See the [command line reference](../reference/commandline/index.md) for more +information. + +## How to develop a plugin + +Plugin creation is currently a manual process. We plan to add automation in a +future release with a command such as `docker plugin build`. + +This section describes the format of an existing enabled plugin. You have to +create and format the plugin files by hand. + +Plugins are stored in `/var/lib/docker/plugins`. For instance: + +```bash +# ls -la /var/lib/docker/plugins +total 20 +drwx------ 4 root root 4096 Aug 8 18:03 . +drwx--x--x 12 root root 4096 Aug 8 17:53 .. +drwxr-xr-x 3 root root 4096 Aug 8 17:56 cd851ce43a403 +-rw------- 1 root root 2107 Aug 8 18:03 plugins.json +``` + +`plugins.json` is an inventory of all installed plugins. For example: + +```bash +# cat plugins.json +{ + "cd851ce43a403": { + "plugin": { + "Manifest": { + "Args": { + "Value": null, + "Settable": null, + "Description": "", + "Name": "" + }, + "Env": null, + "Devices": null, + "Mounts": null, + "Capabilities": [ + "CAP_SYS_ADMIN" + ], + "ManifestVersion": "v0.1", + "Description": "sshFS plugin for Docker", + "Documentation": "https://docs.docker.com/engine/extend/plugins/", + "Interface": { + "Socket": "sshfs.sock", + "Types": [ + "docker.volumedriver/1.0" + ] + }, + "Entrypoint": [ + "/go/bin/docker-volume-sshfs" + ], + "Workdir": "", + "User": {}, + "Network": { + "Type": "host" + } + }, + "Config": { + "Devices": null, + "Args": null, + "Env": [], + "Mounts": [] + }, + "Active": true, + "Tag": "latest", + "Name": "vieux/sshfs", + "Id": "cd851ce43a403" + } + } +} +``` + +Each folder represents a plugin. For example: + +```bash +# ls -la /var/lib/docker/plugins/cd851ce43a403 +total 12 +drwx------ 19 root root 4096 Aug 8 17:56 rootfs +-rw-r--r-- 1 root root 50 Aug 8 17:56 plugin-config.json +-rw------- 1 root root 347 Aug 8 17:56 manifest.json +``` + +`rootfs` represents the root filesystem of the plugin. In this example, it was +created from a Dockerfile as follows: + +>**Note:** `/run/docker/plugins` is mandatory for docker to communicate with +the plugin._ + +```bash +$ git clone https://github.com/vieux/docker-volume-sshfs +$ cd docker-volume-sshfs +$ docker build -t rootfs . +$ id=$(docker create rootfs true) # id was cd851ce43a403 when the image was created +$ mkdir -p /var/lib/docker/plugins/$id/rootfs +$ docker export "$id" | tar -x -C /var/lib/docker/plugins/$id/rootfs +$ docker rm -vf "$id" +$ docker rmi rootfs +``` + +`manifest.json` describes the plugin and `plugin-config.json` contains some +runtime parameters. For example: + +```bash +# cat manifest.json +{ + "manifestVersion": "v0.1", + "description": "sshFS plugin for Docker", + "documentation": "https://docs.docker.com/engine/extend/plugins/", + "entrypoint": ["/go/bin/docker-volume-sshfs"], + "network": { + "type": "host" + }, + "interface" : { + "types": ["docker.volumedriver/1.0"], + "socket": "sshfs.sock" + }, + "capabilities": ["CAP_SYS_ADMIN"] +} +``` + +In this example, you can see the plugin is a volume driver, requires the +`CAP_SYS_ADMIN` capability, `host networking`, `/go/bin/docker-volume-sshfs` as +entrypoint and is going to use `/run/docker/plugins/sshfs.sock` to communicate +with the Docker Engine. + +```bash +# cat plugin-config.json +{ + "Devices": null, + "Args": null, + "Env": [], + "Mounts": [] +} +``` + +This plugin doesn't require runtime parameters. + +Both `manifest.json` and `plugin-config.json` are part of the `plugins.json`. +`manifest.json` is read-only and `plugin-config.json` is read-write. + +To summarize, follow the steps below to create a plugin: + +0. Choose a name for the plugin. Plugin name uses the same format as images, +for example: `/`. +1. Create a rootfs in `/var/lib/docker/plugins/$id/rootfs`. +2. Create manifest.json file in `/var/lib/docker/plugins/$id/`. +3. Create a `plugin-config.json` if needed. +4. Create or add a section to `/var/lib/docker/plugins/plugins.json`. Use + `/` as “Name” and `$id` as “Id”. +5. Restart the Docker Engine. +6. Run `docker plugin ls`. + * If your plugin is listed as `ENABLED=true`, you can push it to the + registry. + * If the plugin is not listed or if `ENABLED=false`, something went wrong. + Check the daemon logs for errors. +7. If you are not already logged in, use `docker login` to authenticate against + a registry. +8. Run `docker plugin push /` to push the plugin. diff --git a/docs/extend/plugins.md b/docs/extend/legacy_plugins.md similarity index 95% rename from docs/extend/plugins.md rename to docs/extend/legacy_plugins.md index 72d50bd150..d9d4e5d192 100644 --- a/docs/extend/plugins.md +++ b/docs/extend/legacy_plugins.md @@ -1,15 +1,20 @@ -# Understand Engine plugins +# Use Docker Engine plugins + +This document describes the Docker Engine plugins generally available in Docker +Engine. To view information on plugins managed by Docker Engine currently in +experimental status, refer to [Docker Engine plugin system](index.md). You can extend the capabilities of the Docker Engine by loading third-party plugins. This page explains the types of plugins and provides links to several @@ -17,7 +22,7 @@ volume and network plugins for Docker. ## Types of plugins -Plugins extend Docker's functionality. They come in specific types. For +Plugins extend Docker's functionality. They come in specific types. For example, a [volume plugin](plugins_volume.md) might enable Docker volumes to persist across multiple Docker hosts and a [network plugin](plugins_network.md) might provide network plumbing. @@ -51,7 +56,7 @@ Plugin ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [Azure File Storage plugin](https://github.com/Azure/azurefile-dockervolumedriver) | Lets you mount Microsoft [Azure File Storage](https://azure.microsoft.com/blog/azure-file-storage-now-generally-available/) shares to Docker containers as volumes using the SMB 3.0 protocol. [Learn more](https://azure.microsoft.com/blog/persistent-docker-volumes-with-azure-file-storage/). [Blockbridge plugin](https://github.com/blockbridge/blockbridge-docker-volume) | A volume plugin that provides access to an extensible set of container-based persistent storage options. It supports single and multi-host Docker environments with features that include tenant isolation, automated provisioning, encryption, secure deletion, snapshots and QoS. -[Contiv Volume Plugin](https://github.com/contiv/volplugin) | An open source volume plugin that provides multi-tenant, persistent, distributed storage with intent based consumption using ceph underneath. +[Contiv Volume Plugin](https://github.com/contiv/volplugin) | An open source volume plugin that provides multi-tenant, persistent, distributed storage with intent based consumption. It has support for Ceph and NFS. [Convoy plugin](https://github.com/rancher/convoy) | A volume plugin for a variety of storage back-ends including device mapper and NFS. It's a simple standalone executable written in Go and provides the framework to support vendor-specific extensions such as snapshots, backups and restore. [DRBD plugin](https://www.drbd.org/en/supported-projects/docker) | A volume plugin that provides highly available storage replicated by [DRBD](https://www.drbd.org). Data written to the docker volume is replicated in a cluster of DRBD nodes. [Flocker plugin](https://clusterhq.com/docker-plugin/) | A volume plugin that provides multi-host portable volumes for Docker, enabling you to run databases and other stateful containers and move them around across a cluster of machines. @@ -72,7 +77,7 @@ Plugin ### Authorization plugins - Plugin | Description + Plugin | Description ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ [Twistlock AuthZ Broker](https://github.com/twistlock/authz) | A basic extendable authorization plugin that runs directly on the host or inside a container. This plugin allows you to define user policies that it evaluates during authorization. Basic authorization is provided if Docker daemon is started with the --tlsverify flag (username is extracted from the certificate common name). diff --git a/docs/extend/menu.md b/docs/extend/menu.md new file mode 100644 index 0000000000..4b9955038a --- /dev/null +++ b/docs/extend/menu.md @@ -0,0 +1,15 @@ + + + + diff --git a/docs/extend/plugin_api.md b/docs/extend/plugin_api.md index a799a13520..5801ba9151 100644 --- a/docs/extend/plugin_api.md +++ b/docs/extend/plugin_api.md @@ -5,7 +5,7 @@ description = "How to write Docker plugins extensions " keywords = ["API, Usage, plugins, documentation, developer"] [menu.main] parent = "engine_extend" -weight=1 +weight=7 +++ @@ -14,9 +14,13 @@ weight=1 Docker plugins are out-of-process extensions which add capabilities to the Docker Engine. +This document describes the Docker Engine plugin API. To view information on +plugins managed by Docker Engine currently in experimental status, refer to +[Docker Engine plugin system](index.md). + This page is intended for people who want to develop their own Docker plugin. If you just want to learn about or use Docker plugins, look -[here](plugins.md). +[here](legacy_plugins.md). ## What plugins are diff --git a/docs/extend/plugins_authorization.md b/docs/extend/plugins_authorization.md index 4c11fa26ca..4447465f1a 100644 --- a/docs/extend/plugins_authorization.md +++ b/docs/extend/plugins_authorization.md @@ -6,13 +6,17 @@ keywords = ["security, authorization, authentication, docker, documentation, plu aliases = ["/engine/extend/authorization/"] [menu.main] parent = "engine_extend" -weight = -1 +weight = 4 +++ # Create an authorization plugin +This document describes the Docker Engine plugins generally available in Docker +Engine. To view information on plugins managed by Docker Engine currently in +experimental status, refer to [Docker Engine plugin system](index.md). + Docker's out-of-the-box authorization model is all or nothing. Any user with permission to access the Docker daemon can run any Docker client command. The same is true for callers using Docker's remote API to contact the daemon. If you @@ -106,7 +110,7 @@ Enable the authorization plugin with a dedicated command line flag in the value. This value can be the plugin’s socket or a path to a specification file. ```bash -$ docker daemon --authorization-plugin=plugin1 --authorization-plugin=plugin2,... +$ dockerd --authorization-plugin=plugin1 --authorization-plugin=plugin2,... ``` Docker's authorization subsystem supports multiple `--authorization-plugin` parameters. diff --git a/docs/extend/plugins_network.md b/docs/extend/plugins_network.md index ec1ccddfea..7a107e2ce3 100644 --- a/docs/extend/plugins_network.md +++ b/docs/extend/plugins_network.md @@ -5,11 +5,16 @@ description = "Network driver plugins." keywords = ["Examples, Usage, plugins, docker, documentation, user guide"] [menu.main] parent = "engine_extend" +weight=5 +++ # Engine network driver plugins +This document describes Docker Engine network driver plugins generally +available in Docker Engine. To view information on plugins +managed by Docker Engine, refer to [Docker Engine plugin system](index.md). + Docker Engine network plugins enable Engine deployments to be extended to support a wide range of networking technologies, such as VXLAN, IPVLAN, MACVLAN or something completely different. Network driver plugins are supported via the @@ -41,7 +46,7 @@ commands. For example, $ docker network create --driver weave mynet -Some network driver plugins are listed in [plugins](plugins.md) +Some network driver plugins are listed in [plugins](legacy_plugins.md) The `mynet` network is now owned by `weave`, so subsequent commands referring to that network will be sent to the plugin, diff --git a/docs/extend/plugins_volume.md b/docs/extend/plugins_volume.md index 66afa7d439..f9c93a3de1 100644 --- a/docs/extend/plugins_volume.md +++ b/docs/extend/plugins_volume.md @@ -5,6 +5,7 @@ description = "How to manage data with external volume plugins" keywords = ["Examples, Usage, volume, docker, data, volumes, plugin, api"] [menu.main] parent = "engine_extend" +weight=6 +++ @@ -12,8 +13,8 @@ parent = "engine_extend" Docker Engine volume plugins enable Engine deployments to be integrated with external storage systems, such as Amazon EBS, and enable data volumes to persist -beyond the lifetime of a single Engine host. See the [plugin -documentation](plugins.md) for more information. +beyond the lifetime of a single Engine host. See the +[plugin documentation](legacy_plugins.md) for more information. ## Changelog diff --git a/docs/getstarted/step_four.md b/docs/getstarted/step_four.md index e925c90568..4baf9002d3 100644 --- a/docs/getstarted/step_four.md +++ b/docs/getstarted/step_four.md @@ -185,7 +185,7 @@ In this step, you verify the new images is on your computer and then you run you This command, you might remember, lists the images you have locally. $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE docker-whale latest 7d9495d03763 4 minutes ago 273.7 MB docker/whalesay latest fb434121fc77 4 hours ago 247 MB hello-world latest 91c95931e552 5 weeks ago 910 B diff --git a/docs/getstarted/step_one.md b/docs/getstarted/step_one.md index 13ae76d942..81821617a6 100644 --- a/docs/getstarted/step_one.md +++ b/docs/getstarted/step_one.md @@ -64,7 +64,7 @@ If you have an earlier Windows system that doesn't meet the Docker for Windows p See [Docker Toolbox Overview](/toolbox/overview.md) for help on installing Docker with Toolbox. ### Docker for Linux -Docker Engine runs navitvely on Linux distributions. +Docker Engine runs natively on Linux distributions. For full instructions on getting Docker for various Linux distributions, see [Install Docker Engine](/engine/installation/index.md). diff --git a/docs/getstarted/step_six.md b/docs/getstarted/step_six.md index 6f81a942d5..7855919db2 100644 --- a/docs/getstarted/step_six.md +++ b/docs/getstarted/step_six.md @@ -31,7 +31,7 @@ If you don't already have a terminal open, open one now: 2. At the prompt, type `docker images` to list the images you currently have: $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE docker-whale latest 7d9495d03763 38 minutes ago 273.7 MB 5dac217f722c 45 minutes ago 273.7 MB docker/whalesay latest fb434121fc77 4 hours ago 247 MB @@ -61,7 +61,7 @@ If you don't already have a terminal open, open one now: 7. Type the `docker images` command again to see your newly tagged image. $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE maryatdocker/docker-whale latest 7d9495d03763 5 minutes ago 273.7 MB docker-whale latest 7d9495d03763 2 hours ago 273.7 MB 5dac217f722c 5 hours ago 273.7 MB @@ -116,7 +116,7 @@ from the hub — why would it? The two images are identical. 2. At the prompt, type `docker images` to list the images you currently have on your local machine. $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE maryatdocker/docker-whale latest 7d9495d03763 5 minutes ago 273.7 MB docker-whale latest 7d9495d03763 2 hours ago 273.7 MB 5dac217f722c 5 hours ago 273.7 MB diff --git a/docs/getstarted/step_three.md b/docs/getstarted/step_three.md index a00439618e..aaf77ef508 100644 --- a/docs/getstarted/step_three.md +++ b/docs/getstarted/step_three.md @@ -99,7 +99,7 @@ Make sure Docker is running. On Docker for Mac and Docker for Windows, this is i `docker/whalesay` in the list. $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE docker/whalesay latest fb434121fc77 3 hours ago 247 MB hello-world latest 91c95931e552 5 weeks ago 910 B diff --git a/docs/reference/api/docker_remote_api_v1.20.md b/docs/reference/api/docker_remote_api_v1.20.md index 43f1174c3b..c614d0647e 100644 --- a/docs/reference/api/docker_remote_api_v1.20.md +++ b/docs/reference/api/docker_remote_api_v1.20.md @@ -2357,4 +2357,4 @@ To set cross origin requests to the remote api please give values to `--api-cors-header` when running Docker in daemon mode. Set * (asterisk) allows all, default or blank means CORS disabled - $ docker daemon -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" + $ dockerd -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" diff --git a/docs/reference/api/docker_remote_api_v1.21.md b/docs/reference/api/docker_remote_api_v1.21.md index 4eb8ca90a4..a05cb5a964 100644 --- a/docs/reference/api/docker_remote_api_v1.21.md +++ b/docs/reference/api/docker_remote_api_v1.21.md @@ -2923,4 +2923,4 @@ To set cross origin requests to the remote api please give values to `--api-cors-header` when running Docker in daemon mode. Set * (asterisk) allows all, default or blank means CORS disabled - $ docker daemon -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" + $ dockerd -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" diff --git a/docs/reference/api/docker_remote_api_v1.22.md b/docs/reference/api/docker_remote_api_v1.22.md index 610df35fca..8f03a7b674 100644 --- a/docs/reference/api/docker_remote_api_v1.22.md +++ b/docs/reference/api/docker_remote_api_v1.22.md @@ -3258,4 +3258,4 @@ To set cross origin requests to the remote api please give values to `--api-cors-header` when running Docker in daemon mode. Set * (asterisk) allows all, default or blank means CORS disabled - $ docker daemon -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" + $ dockerd -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" diff --git a/docs/reference/api/docker_remote_api_v1.23.md b/docs/reference/api/docker_remote_api_v1.23.md index 1c9e2732eb..ee7e57af7d 100644 --- a/docs/reference/api/docker_remote_api_v1.23.md +++ b/docs/reference/api/docker_remote_api_v1.23.md @@ -3374,4 +3374,4 @@ To set cross origin requests to the remote api please give values to `--api-cors-header` when running Docker in daemon mode. Set * (asterisk) allows all, default or blank means CORS disabled - $ docker daemon -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" + $ dockerd -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" diff --git a/docs/reference/api/docker_remote_api_v1.24.md b/docs/reference/api/docker_remote_api_v1.24.md index 02e371a06a..38b56666e2 100644 --- a/docs/reference/api/docker_remote_api_v1.24.md +++ b/docs/reference/api/docker_remote_api_v1.24.md @@ -2405,7 +2405,7 @@ Get container events from docker, in real time via streaming. Docker containers report the following events: - attach, commit, copy, create, destroy, detach, die, exec_create, exec_detach, exec_start, export, kill, oom, pause, rename, resize, restart, start, stop, top, unpause, update + attach, commit, copy, create, destroy, detach, die, exec_create, exec_detach, exec_start, export, health_status, kill, oom, pause, rename, resize, restart, start, stop, top, unpause, update Docker images report the following events: @@ -4142,7 +4142,7 @@ Inspect swarm `POST /swarm/init` -Initialize a new swarm +Initialize a new swarm. The body of the HTTP response includes the node ID. **Example request**: @@ -4164,8 +4164,12 @@ Initialize a new swarm **Example response**: HTTP/1.1 200 OK - Content-Length: 0 - Content-Type: text/plain; charset=utf-8 + Content-Length: 28 + Content-Type: application/json + Date: Thu, 01 Sep 2016 21:49:13 GMT + Server: Docker/1.12.0 (linux) + + "7v2t30z9blmxuhnyo6s4cpenp" **Status codes**: diff --git a/docs/reference/api/hub_registry_spec.md b/docs/reference/api/hub_registry_spec.md index f2517c2386..87c4c88482 100644 --- a/docs/reference/api/hub_registry_spec.md +++ b/docs/reference/api/hub_registry_spec.md @@ -12,7 +12,7 @@ parent="smn_hub_ref" # The Docker Hub and the Registry v1 This API is deprecated as of 1.7. To view the old version, see the [go -here](hub_registry_spec.md) in +here](https://docs.docker.com/v1.7/docker/reference/api/hub_registry_spec/) in the 1.7 documentation. If you want an overview of the current features in Docker Hub or other image management features see the [image management overview](../../userguide/eng-image/image_management.md) in the current documentation set. diff --git a/docs/reference/builder.md b/docs/reference/builder.md index c63bcf5347..cba4ddb518 100644 --- a/docs/reference/builder.md +++ b/docs/reference/builder.md @@ -1068,7 +1068,7 @@ user 0m 0.03s sys 0m 0.03s ``` -> **Note:** you can over ride the `ENTRYPOINT` setting using `--entrypoint`, +> **Note:** you can override the `ENTRYPOINT` setting using `--entrypoint`, > but this can only set the binary to *exec* (no `sh -c` will be used). > **Note**: diff --git a/docs/reference/commandline/create.md b/docs/reference/commandline/create.md index 3b550c0464..276391f632 100644 --- a/docs/reference/commandline/create.md +++ b/docs/reference/commandline/create.md @@ -90,6 +90,7 @@ Options: --read-only Mount the container's root filesystem as read only --restart string Restart policy to apply when a container exits (default "no") Possible values are: no, on-failure[:max-retry], always, unless-stopped + --rm Automatically remove the container when it exits --runtime string Runtime to use for this container --security-opt value Security Options (default []) --shm-size string Size of /dev/shm, default value is 64MB. diff --git a/docs/reference/commandline/dockerd.md b/docs/reference/commandline/dockerd.md index ead462d5f0..db5cf6eb93 100644 --- a/docs/reference/commandline/dockerd.md +++ b/docs/reference/commandline/dockerd.md @@ -574,7 +574,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`. **size** cannot be smaller than **btrfs.min_space**. Example use: - $ docker daemon -s btrfs --storage-opt btrfs.min_space=10G + $ dockerd -s btrfs --storage-opt btrfs.min_space=10G #### Overlay2 options @@ -594,6 +594,14 @@ The Docker daemon relies on a (invoked via the `containerd` daemon) as its interface to the Linux kernel `namespaces`, `cgroups`, and `SELinux`. +By default, the Docker daemon automatically starts `containerd`. If you want to +control `containerd` startup, manually start `containerd` and pass the path to +the `containerd` socket using the `--containerd` flag. For example: + +```bash +$ dockerd --containerd /var/run/dev/docker-containerd.sock +``` + Runtimes can be registered with the daemon either via the configuration file or using the `--add-runtime` command line argument. @@ -1212,7 +1220,7 @@ The `--tls*` options enable use of specific certificates for individual daemons. Example script for a separate “bootstrap” instance of the Docker daemon without network: ```bash -$ docker daemon \ +$ dockerd \ -H unix:///var/run/docker-bootstrap.sock \ -p /var/run/docker-bootstrap.pid \ --iptables=false \ diff --git a/docs/reference/commandline/events.md b/docs/reference/commandline/events.md index 18b92fccb4..1900d09c2b 100644 --- a/docs/reference/commandline/events.md +++ b/docs/reference/commandline/events.md @@ -24,7 +24,7 @@ Options: Docker containers report the following events: - attach, commit, copy, create, destroy, detach, die, exec_create, exec_detach, exec_start, export, kill, oom, pause, rename, resize, restart, start, stop, top, unpause, update + attach, commit, copy, create, destroy, detach, die, exec_create, exec_detach, exec_start, export, health_status, kill, oom, pause, rename, resize, restart, start, stop, top, unpause, update Docker images report the following events: diff --git a/docs/reference/commandline/login.md b/docs/reference/commandline/login.md index 4c5670ea53..3308ae5d6b 100644 --- a/docs/reference/commandline/login.md +++ b/docs/reference/commandline/login.md @@ -38,9 +38,6 @@ You can log into any public or private repository for which you have credentials. When you log in, the command stores encoded credentials in `$HOME/.docker/config.json` on Linux or `%USERPROFILE%/.docker/config.json` on Windows. -> **Note**: When running `sudo docker login` credentials are saved in `/root/.docker/config.json`. -> - ## Credentials store The Docker Engine can keep user credentials in an external credentials store, diff --git a/docs/reference/commandline/network_create.md b/docs/reference/commandline/network_create.md index 67884bb0b9..2414fadb55 100644 --- a/docs/reference/commandline/network_create.md +++ b/docs/reference/commandline/network_create.md @@ -11,7 +11,7 @@ parent = "smn_cli" # network create ```markdown -Usage: docker network create [OPTIONS] +Usage: docker network create [OPTIONS] NETWORK Create a network diff --git a/docs/reference/commandline/plugin_inspect.md b/docs/reference/commandline/plugin_inspect.md old mode 100644 new mode 100755 index 80da2dcd0e..555e3a983f --- a/docs/reference/commandline/plugin_inspect.md +++ b/docs/reference/commandline/plugin_inspect.md @@ -12,9 +12,9 @@ parent = "smn_cli" # plugin inspect (experimental) ```markdown -Usage: docker plugin inspect PLUGIN +Usage: docker plugin inspect [OPTIONS] PLUGIN [PLUGIN...] -Inspect a plugin +Display detailed information on one or more plugins Options: --help Print usage diff --git a/docs/reference/commandline/run.md b/docs/reference/commandline/run.md index 449e09e3e1..cd7882aec9 100644 --- a/docs/reference/commandline/run.md +++ b/docs/reference/commandline/run.md @@ -657,7 +657,7 @@ network namespace, run this command: $ docker run --sysctl net.ipv4.ip_forward=1 someimage -> **Note**: Not all sysctls are namespaced. docker does not support changing sysctls +> **Note**: Not all sysctls are namespaced. Docker does not support changing sysctls > inside of a container that also modify the host system. As the kernel > evolves we expect to see more sysctls become namespaced. diff --git a/docs/reference/commandline/service_create.md b/docs/reference/commandline/service_create.md index 0090832c98..5a0da6794b 100644 --- a/docs/reference/commandline/service_create.md +++ b/docs/reference/commandline/service_create.md @@ -140,9 +140,9 @@ metadata](../../userguide/labels-custom-metadata.md). ### Set service mode -Is this a replicated service or a global service. A replicated service runs as -many tasks as specified, while a global service runs on each active node in the -swarm. +You can set the service mode to "replicated" (default) or to "global". A +replicated service runs as many tasks as specified, while a global service +runs on each active node in the swarm. The following command creates a "global" service: diff --git a/docs/reference/commandline/swarm_join.md b/docs/reference/commandline/swarm_join.md index a9528ab884..540ebf27ef 100644 --- a/docs/reference/commandline/swarm_join.md +++ b/docs/reference/commandline/swarm_join.md @@ -87,10 +87,6 @@ name, the default port 2377 will be used. This flag is generally not necessary when joining an existing swarm. -### `--manager` - -Joins the node as a manager - ### `--token string` Secret value required for nodes to join the swarm diff --git a/docs/reference/run.md b/docs/reference/run.md index 404bbb6270..883726bd98 100644 --- a/docs/reference/run.md +++ b/docs/reference/run.md @@ -645,7 +645,7 @@ allows you to share the same content between containers. > **Note**: Automatic translation of MLS labels is not currently supported. To disable the security labeling for this container versus running with the -`--permissive` flag, use the following command: +`--privileged` flag, use the following command: $ docker run --security-opt label=disable -it fedora bash diff --git a/docs/security/https.md b/docs/security/https.md index 04f72b32ea..b106471de9 100644 --- a/docs/security/https.md +++ b/docs/security/https.md @@ -136,7 +136,7 @@ prevent accidental damage: Now you can make the Docker daemon only accept connections from clients providing a certificate trusted by our CA: - $ docker daemon --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem \ + $ dockerd --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem \ -H=0.0.0.0:2376 To be able to connect to Docker and validate its certificate, you now diff --git a/docs/security/https/Makefile b/docs/security/https/Makefile index 3c84697461..a346a43e22 100644 --- a/docs/security/https/Makefile +++ b/docs/security/https/Makefile @@ -13,7 +13,7 @@ cert: build certs: cert run: - sudo docker daemon -D --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H=0.0.0.0:6666 --pidfile=$(pwd)/docker.pid --graph=$(pwd)/graph + sudo dockerd -D --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H=0.0.0.0:6666 --pidfile=$(pwd)/docker.pid --graph=$(pwd)/graph client: sudo docker --tls --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=$(HOST):6666 version diff --git a/docs/swarm/admin_guide.md b/docs/swarm/admin_guide.md index 515095c32a..7df810a119 100644 --- a/docs/swarm/admin_guide.md +++ b/docs/swarm/admin_guide.md @@ -32,7 +32,7 @@ This article covers the following swarm administration tasks: * [Forcefully removing a node](#force-remove-a-node) * [Recovering from disaster](#recover-from-disaster) -Refer to [How swarm mode nodes work](how-swarm-mode-works/nodes.md) +Refer to [How nodes work](how-swarm-mode-works/nodes.md) for a brief overview of Docker Swarm mode and the difference between manager and worker nodes. diff --git a/docs/swarm/how-swarm-mode-works/nodes.md b/docs/swarm/how-swarm-mode-works/nodes.md index 825939e5b8..ac8dc76b3f 100644 --- a/docs/swarm/how-swarm-mode-works/nodes.md +++ b/docs/swarm/how-swarm-mode-works/nodes.md @@ -86,6 +86,7 @@ You can also demote a manager node to a worker node. See [node demote](../../reference/commandline/node_demote.md). -## What's Next +## Learn More * Read about how swarm mode [services](services.md) work. +* Learn how [PKI](pki.md) works in swarm mode diff --git a/docs/swarm/how-swarm-mode-works/pki.md b/docs/swarm/how-swarm-mode-works/pki.md new file mode 100644 index 0000000000..6f2698c3f7 --- /dev/null +++ b/docs/swarm/how-swarm-mode-works/pki.md @@ -0,0 +1,72 @@ + + +# How PKI works in swarm mode + +The swarm mode public key infrastructure (PKI) system built into Docker Engine +makes it simple to securely deploy a container orchestration system. The nodes +in a swarm use mutual Transport Layer Security (TLS) to authenticate, authorize, +and encrypt the communications between themselves and other nodes in the swarm. + +When you create a swarm by running `docker swarm init`, the Docker Engine +designates istself as a manager node. By default, the manager node generates +itself a new root Certificate Authority (CA) along with a key pair to secure +communications with other nodes that join the swarm. If you prefer, you can pass +the `--external-ca` flag to specify a root CA external to the swarm. Refer to +the [docker swarm init](../../reference/commandline/swarm_init.md) CLI +reference. + +The manager node also generates two tokens to use when you join additional nodes +to the swarm: one worker token and one manager token. Each token includes the +digest of the root CA's certificate and a randomly generated secret. When a node +joins the swarm, it uses the digest to validate the root CA certificate from the +remote manager. It uses the secret to ensure the node is an approved node. + +Each time a new node joins the swarm, the manager issues a certificate to the +node that contains a randomly generated node id to identify the node under the +certificate common name (CN) and the role under the organizational unit (OU). +The node id serves as the cryptographically secure node identity for the +lifetime of the node in the current swarm. + +The diagram below illustrates how worker manager nodes and worker nodes encrypt +communications using a minimum of TLS 1.2. + +![tls diagram](../images/tls.png) + + +The example below shows the information from a certificate from a worker node: + +```bash +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 3b:1c:06:91:73:fb:16:ff:69:c3:f7:a2:fe:96:c1:73:e2:80:97:3b + Signature Algorithm: ecdsa-with-SHA256 + Issuer: CN=swarm-ca + Validity + Not Before: Aug 30 02:39:00 2016 GMT + Not After : Nov 28 03:39:00 2016 GMT + Subject: O=ec2adilxf4ngv7ev8fwsi61i7, OU=swarm-worker, CN=dw02poa4vqvzxi5c10gm4pq2g +...snip... +``` + +By default, each node in the swarm renews its certificate every three months. +You can run `docker swarm update --cert-expiry