구차니의 잡동사니 모음

Stops containers and removes containers, networks, volumes, and images created by up.

By default, the only things removed are:

• Containers for services defined in the Compose file
• Networks defined in the networks section of the Compose file
• The default network, if one is used

Networks and volumes defined as external are never removed. 

$ docker run -dit --restart unless-stopped redis 

restart

no is the default restart policy, and it doesn’t restart a container under any circumstance. When always is specified, the container always restarts. The on-failure policy restarts a container if the exit code indicates an on-failure error.

  - restart: no
  - restart: always 

  - restart: on-failure 

version: '2'

services:

  web:

    image: nginx

    restart: always 

type=AVC msg=audit(1553061777.728:1930): avc:  denied  { open } for  pid=23358 comm="python" path="/cql/create-keyspace.cql" dev="dm-0" ino=35212277 scontext=system_u:system_r:container_t:s0:c203,c1009 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=1 

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 cql/create-keyspace.cql 

# cat /etc/selinux/targeted/contexts/lxc_contexts

process = "system_u:system_r:svirt_lxc_net_t:s0"

content = "system_u:object_r:virt_var_lib_t:s0"

file = "system_u:object_r:svirt_sandbox_file_t:s0"

sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"

sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"

sandbox_lxc_process = "system_u:system_r:svirt_lxc_net_t:s0"

# chcon -Rt svirt_sandbox_file_t /var/db

If a file is labeled svirt_sandbox_file_t, then by default all containers can read it. But if the containers write into a directory that has svirt_sandbox_file_t ownership, they write using their own category (which in this case is "c186,c641). If you start the same container twice, it will get a new category the second time ( a different category than it had the first time). The category system isolates containers from one another. 

Creating network "docker_default" with the default driver

ERROR: Failed to Setup IP tables: Unable to enable SKIP DNAT rule:  (iptables failed: iptables --wait -t nat -I DOCKER -i br-7d5a8bad2e77 -j RETURN: iptables: No chain/target/match by that name.

 (exit status 1)) 

[Unit]

Description=Docker Application Container Engine

Documentation=http://docs.docker.com

After=network.target

Wants=docker-storage-setup.service

Requires=docker-cleanup.timer 

After=network.target docker.socket

Requires=network.target docker.socket 

이미지는 컨테이너 실행에 필요한 파일과 설정값등을 포함하고 있는 것으로 상태값을 가지지 않고 변하지 않습니다(Immutable). 

컨테이너는 이미지를 실행한 상태라고 볼 수 있고 추가되거나 변하는 값은 컨테이너에 저장됩니다. 

 도커 이미지 생성

$ docker build -t django-sample .

앱 컨테이너를 실행

$ docker run -it --rm \

    -p 8000:8000 \

    django-sample \

    ./manage.py runserver 0:8000

데이터베이스 컨테이너 실행

$ docker run -it --rm \

    postgres:9.6.1

앱 컨테이너를 실행한 후 PostgreSQL 컨테이너를 실행했습니다. 그런데 컨테이너는 실행 직후부터 컨테이너 외부의 상황과 격리됩니다. 따라서 PostgreSQL 컨테이너가 실행되었는지 알지 못하죠.

db 컨테이너를 지우면, 데이터베이스 데이터가 사라짐

docker 단일 컨테이너를 관리합니다.

docker-compose 은 여러 컨테이너 애플리케이션을 관리합니다.

docker-compose의 사용 에는 3 단계가 필요합니다.

Dockerfile을 사용 하여 앱 환경 정의

docker-compose.yml 에 앱 서비스 정의

docker-compose up 실행하여 앱을 시작하고 실행합니다.