DOCKER(1) Docker User Manuals DOCKER(1) (NAME) docker-run - (SYNOPSIS) docker run [-a|--attach[=[]]] [--add-host[=[]]] [--annotation[=[]]] [--blkio-weight[=[BLKIO-WEIGHT]]] [--blkio-weight-device[=[]]] [-c|--cpu-shares[=0]] [--cap-add[=[]]] [--cap-drop[=[]]] [--cgroupns[=[]]] [--cgroup-parent[=CGROUP-PATH]] [--cidfile[=CIDFILE]] [--cpu-count[=0]] [--cpu-percent[=0]] [--cpu-period[=0]] [--cpu- quota[=0]] [--cpu-rt-period[=0]] [--cpu-rt-runtime[=0]] [--cpus[=0.0]] [--cpuset-cpus[=CPUSET-CPUS]] [--cpuset-mems[=CPUSET-MEMS]] [-d|--detach] [--detach-keys[=[]]] [--device[=[]]] [--device-cgroup- rule[=[]]] [--device-read-bps[=[]]] [--device-read-iops[=[]]] [--device-write-bps[=[]]] [--device-write-iops[=[]]] [--dns[=[]]] [--dns-option[=[]]] [--dns-search[=[]]] [--domainname[=DOMAINNAME]] [-e|--env[=[]]] [--entrypoint[=ENTRYPOINT]] [--env-file[=[]]] [--expose[=[]]] [--group-add[=[]]] [-h|--hostname[=HOSTNAME]] [--help] [--init] [-i|--interactive] [--ip[=IPv4-ADDRESS]] [--ip6[=IPv6-ADDRESS]] [--ipc[=IPC]] [--isolation[=default]] [-l|--label[=[]]] [--label-file[=[]]] [--link[=[]]] [--link-local- ip[=[]]] [--log-driver[=[]]] [--log-opt[=[]]] [-m|--memory[=MEMORY]] [--mac-address[=MAC-ADDRESS]] [--memory-reservation[=MEMORY- RESERVATION]] [--memory-swap[=LIMIT]] [--memory-swappiness[=MEMORY- SWAPPINESS]] [--mount[=[MOUNT]]] [--name[=NAME]] [--network-alias[=[]]] [--network[="bridge"]] [--oom-kill-disable] [--oom-score-adj[=0]] [-P|--publish-all] [-p|--publish[=[]]] [--pid[=[PID]]] [--userns[=[]]] [--pids-limit[=PIDS_LIMIT]] [--privileged] [--read-only] [--restart[=RESTART]] [--rm] [--security-opt[=[]]] [--storage-opt[=[]]] [--stop-signal[=SIGNAL]] [--stop-timeout[=TIMEOUT]] [--shm-size[=[]]] [--sig-proxy[=true]] [--sysctl[=[]]] [-t|--tty] [--tmpfs[=[CONTAINER- DIR[:OPTIONS]]] [-u|--user[=USER]] [--ulimit[=[]]] [--uts[=[]]] [-v|--volume[=[[HOST-DIR:]CONTAINER-DIR[:OPTIONS]]]] [--volume- driver[=DRIVER]] [--volumes-from[=[]]] [-w|--workdir[=WORKDIR]] IMAGE [COMMAND] [ARG...] (DESCRIPTION) . docker run . (IMAGE) docker run . docker run Docker . (IMAGE) docker run docker pull IMAGE . (OPTIONS) -a, --attach=[] STDIN STDOUT STDERR. ( -d ) docker run . TTY ( ) . -a stdin stdout stderr . --add-host=[] IP ( host=ip host:ip). /etc/hosts. hostname=ip hostname:ip . --add-host . --annotation=[] (annotation) ( OCI). OCI . --blkio-weight=0 / ( ) 10 1000 . --blkio-weight-device=[] / ( : DEVICE_NAME:WEIGHT). -c, --cpu-shares=0 ( ) . . 1024 -c --cpu-shares 2 . . . . 1024 512 . . 1024 . . . . . . {C0} -c=512 {C1} -c=1024 : PID container CPU CPU share 100 {C0} 0 100% of CPU0 101 {C1} 1 100% of CPU1 102 {C1} 2 100% of CPU2 --cap-add=[] (Linux capabilities) --cap-drop=[] (Linux capabilities) --cgroupns="" cgroup : host: cgroup private: cgroup "": () (host cgroup v1 private cgroup v2) --cgroup-parent="" cgroups cgroup . cgroups init . cgroups . --cidfile="" --cpu-count=0 . Windows Server . Windows Server (mutually exclusive) CPUCount CPUShares CPUPercent . --cpu-percent=0 . Windows Server CPUCount CPUShares CPUPercent . --cpu-period=0 CFS ( ) . . --cpuset-cpus="" ( 0-3 0,1) --cpuset-mems="" (MEMs) (0-3 0,1). NUMA . (0-3) --cpuset-mems=0,1 . --cpu-quota=0 (quota) CFS ( ) . . . --cpu-rt-period=0 (real-time) . . --cpu-rt-runtime=0 (real-time runtime) . . ,, , . cgroup . --cpus=0.0 . 0.0 . -d, --detach=true|false (Detached): . false . docker ps . docker attach . tty ( ). CTRL-p CTRL-q . --detach-keys . config-json(5) . --detach-keys=key key [a-Z] ctrl-value value : a- z @ ^ [ , _. --device=onhost:incontainer[:mode] onhost incontainer. mode r ( ) w ( ) m ( mknod(2)) . --device=/dev/sdc:/dev/xvdc:rwm /dev/sdc /dev/xvdc . --device-cgroup-rule="type major:minor mode" cgroup. (Documentation/cgroup-v1/devices.txt): - type: a () c () b () - major minor: * - mode: r () w () m (mknod(2)). : --device-cgroup-rule "c 1:3 mr": 1:3 . --device-read-bps=[] ( --device-read- bps=/dev/sda:1mb) --device-read-iops=[] ( --device-read- iops=/dev/sda:1000) --device-write-bps=[] ( --device-write-bps=/dev/sda:1mb) --device-write-iops=[] ( --device-write-iops=/dev/sda:1000) --dns-search=[] DNS ( --dns-search=. ) --dns-option=[] DNS --dns=[] DNS DNS . DNS ( 127.0.0.1). --dns . --domainname="" NIS NIS ( setdomainname(2) ) . -e, --env=[] . --entrypoint="" ENTRYPOINT Dockerfile . (ENTRYPOINT) COMMAND () . ENTRYPOINT COMMAND . ENTRYPOINT --entrypoint ENTRYPOINT . --env-file=[] --expose=[] ( --expose=3300-3310) . (links) . --group-add=[] -h, --hostname="" . --help --init init -i, --interactive=true|false STDIN . false . true . --ip="" IPv4 ( 172.23.0.9) --network . --ip6="" IPv6 ( 2001:db8::1b99) --network . --ipc="" IPC . : +---------------------+----------------------------------------------------------------------------------+ | | | +---------------------+----------------------------------------------------------------------------------+ |() | . | +---------------------+----------------------------------------------------------------------------------+ |none | IPC | | | /dev/shm. | +---------------------+----------------------------------------------------------------------------------+ |private | IPC . | +---------------------+----------------------------------------------------------------------------------+ |shareable | IPC | | | | | | . | +---------------------+----------------------------------------------------------------------------------+ |container:name-or-ID | IPC | | | ( "shareable"). | +---------------------+----------------------------------------------------------------------------------+ |host | IPC | | | . | +---------------------+----------------------------------------------------------------------------------+ private shareable . --isolation="default" (Isolation) . process hyperv . default . -l, --label key=value ( --label com.example.key=value). --label-file=[] --link=name-or-id[:alias] . --link . . --link-local-ip=[] IPv4/IPv6 - (link-local) --log-driver="json- file|syslog|journald|gelf|fluentd|awslogs|splunk|etwlogs|gcplogs|none" () . --log-driver . : docker logs json-file journald . --log-opt=[] . -m, --memory=number[*S] S b k m g . . (swap) -m RAM . 0 ( -m) . ( ). --memory-reservation=number[*S] S b k m g . . --memory . . --memory-swap=number[S] (swap) S b k m g . --memory . --memory . --memory . swap -1 . --mac-address="" MAC ( 92:d0:c6:0a:29:33) MAC . link-local IPv6 MAC RFC4862 . --mount type=TYPE,TYPE-SPECIFIC-OPTION[,...] (TYPES) bind volume tmpfs . : type=bind,source=/path/on/host,destination=/path/in/container type=volume,source=my-volume,destination=/path/in/container,volume- label="color=red" type=tmpfs,tmpfs-size=512M,destination=/path/in/container : o src, source: bind volume. bind . o dst, destination, target: . o ro, readonly: true false (). : readonly bind mount . bind-recursive . bind: o bind-propagation: shared slave private rshared rslave rprivate (). mount(2) . o consistency: consistent () cached delegated. Docker for Mac . o bind-recursive: enabled () disabled writable readonly: enabled bind mount . disabled bind mount . writable bind mount . readonly bind mount . volume: o volume-driver: volume-driver. o volume-label: . o volume-nocopy: true () false. false . o volume-opt: . tmpfs: o tmpfs-size: tmpfs . . o tmpfs-mode: (file mode) tmpfs () ( 700 0700). 1777 . --name="" : o (long ID): f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778 o (short ID): f78375b1c487 o (Name): evil_ptolemy --name . ( --link ) ( ) . . --network=type . : +------------------------+--------------------------+ | | | +------------------------+--------------------------+ |none | | | | | | | . | +------------------------+--------------------------+ |bridge | | | | | | | | | | | | | | | | | | | | | | veth. | +------------------------+--------------------------+ |host | | | | | | | | | | | | | | | | . | +------------------------+--------------------------+ |container:name|id | | | | | | | | | | | | | | | | name id | | | | | | . | +------------------------+--------------------------+ |network-name|network-id | | | | | | | | | | | | | | | | ( | | | docker | | | network create). | +------------------------+--------------------------+ bridge . --network-alias=[] --oom-kill-disable=true|false OOM Killer . --oom-score-adj="" OOM ( -1000 1000 ) -P, --publish-all=true|false . false . true . false . -P ( -p) . -P (ephemeral port range) /proc/sys/net/ipv4/ip_local_port_range . docker port(1) . -p, --publish ip:[hostPort]:containerPort | [hostPort:]containerPort . hostPort containerPort . . : -p 1234-1236:1222-1224 -p 127.0.0.1:$HOSTPORT:$CONTAINERPORT. docker port(1) docker port CONTAINER $CONTAINERPORT. --pid="" PID PID 'container:': PID 'host': PID . : host PID . --userns="" usernamespace userns-remap . host: ( pid=host --privileged). --pids-limit="" (pids). -1 pid . --uts=type UTS . type host UTS . : host . --privileged [true|false] . (privileged) . docker run --privileged AppArmor . --read-only=true|false . . --read-only . --restart policy . : +-------------------------+--------------------------------+ | | | +-------------------------+--------------------------------+ |no | | | | | | | | | | | | | | | | | | | . | +-------------------------+--------------------------------+ |on-failure[:max-retries] | | | | | | | | | | | | | | | | | | | . | | | | | | | | | | | | | | | | | | | | | . | +-------------------------+--------------------------------+ |always | | | | | | | | | | | | | | | | | | | | | | . | | | always | | | | | | | | | | | | | | | | | | | | | | | | | | | . | | | | | | | | | | | | | | | | | | | | | | | | | | | . | +-------------------------+--------------------------------+ |unless-stopped | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | . | +-------------------------+--------------------------------+ no . --rm true|false . false . --rm -d . none . --security-opt value[,...] . : +------------------------+--------------------------------------+ | | | +------------------------+--------------------------------------+ |"label=user:USER" | | | | | | | | +------------------------+--------------------------------------+ |"label=role:ROLE" | | | | | | | | +------------------------+--------------------------------------+ |"label=type:TYPE" | | | | | | | | +------------------------+--------------------------------------+ |"label=level:LEVEL" | | | | | | | | +------------------------+--------------------------------------+ |"label=disable" | | | | | | | | | | | +------------------------+--------------------------------------+ |"no-new-privileges" | | | | | | | | | | | | | | +------------------------+--------------------------------------+ |"seccomp=unconfined" | | | | seccomp | | | | +------------------------+--------------------------------------+ |"seccomp=profile.json" | Json | | | seccomp | | | | | | | +------------------------+--------------------------------------+ |"apparmor=unconfined" | | | | apparmor | | | | +------------------------+--------------------------------------+ |"apparmor=your-profile" | | | | apparmor | | | | +------------------------+--------------------------------------+ --storage-opt $ docker run -it --storage-opt size=120G fedora /bin/bash (size) rootfs 120G . btrfs overlay2 zfs . btrfs zfs Default BaseFS Size . overlay2 size xfs pquota . . --stop-signal="" . --stop-signal . SIG SIGKILL syscall 9. STOPSIGNAL STOPSIGNAL SIGTERM . --stop-timeout ( ) -1 . --stop-timeout ( --stop-signal ) . SIGKILL . --stop-timeout -1 . . --shm-size="" /dev/shm. . number 0 . b () k () m () g () . . 64m . --sysctl=SYSCTL IPC - sysctl: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem, kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced, and sysctls beginning with fs.mqueue.* --ipc=host sysctl . - sysctl: Sysctls beginning with net.* --network=host sysctl . --sig-proxy=true|false ( -TTY). SIGCHLD SIGSTOP SIGKILL . true . --memory-swappiness="" swappiness . 0 100 . -t, --tty=true|false -TTY. false . true pseudo-tty . . false . -t (redirection) . --tmpfs=[] tmpfs (tmpfs) : $ docker run -d --tmpfs /tmp:rw,size=787448k,mode=1777 my_image tmpfs /tmp . mount . : rw,noexec,nosuid,nodev,size=65536k. --mount --tmpfs --volume . --tmpfs --mount . -u, --user="" UID GID . : --user [user | user:group | uid | uid:gid | user:gid | uid:group ] (root) . --ulimit=[] Ulimit -v|--volume[=[[HOST-DIR:]CONTAINER-DIR[:OPTIONS]]] bind mount. -v /HOST- DIR:/CONTAINER-DIR /HOST-DIR /CONTAINER-DIR bind mount . 'HOST-DIR' . OPTIONS : o [rw|ro] o [z|Z] o [[r]shared|[r]slave|[r]private] o [delegated|cached|consistent] o [nocopy] CONTAINER-DIR /src/docs . HOST-DIR name . name - a-z0-9 _ ( ) . () - ( ) . / () . HOST-DIR bind-mount . name name . /foo foo HOST-DIR . /foo bind mount . foo . -v . --volumes-from . bind mount . :ro :rw - . - . : :consistent () :cached :delegated. :ro,cached. SELinux . . . :z :Z . . z . . / . Z . . bind mount private . . (volume mount propagation) . shared . slave . :[r]shared :[r]slave :[r]private . bind mount . ( ) . shared . slave shared slave . df findmnt -o TARGET,PROPAGATION . findmnt /proc/self/mountinfo . optional fields . shared:X shared master:X slave private . mount . /foo bind mount mount --bind /foo /foo mount --make-private --make-shared /foo . /foo shared . . / /foo mount --make-shared / / shared . : systemd systemd MountFlags . . slave shared rshared . nocopy . nocopy bind mount . --mount --tmpfs --volume . --volume --mount . --volume-driver="" . VOLUME Dockerfile docker run -v . docker-volume- create(1) . --volumes-from=[] ( ) . . --volumes-from . . (- ) . :ro :rw . . -w, --workdir="" (/) . WORKDIR Dockerfile . -w . (EXIT STATUS) docker run . docker run chroot : 125 (itself) $ docker run --foo busybox; echo $? # flag provided but not defined: --foo See 'docker run --help'. 125 126 (contained command) $ docker run busybox /etc; echo $? # exec: "/etc": permission denied docker: Error response from daemon: Contained command could not be invoked 126 127 (contained command) $ docker run busybox foo; echo $? # exec: "foo": executable file not found in $PATH docker: Error response from daemon: Contained command not found or does not exist 127 (contained command) $ docker run busybox /bin/sh -c 'exit 3' # 3 (EXAMPLES) (Running container in read-only mode) usr/. (production) . (volumes) . --read-only . . . tmpfs run/ tmp/ . # docker run --read-only --tmpfs /run --tmpfs /tmp -i -t fedora /bin/bash (Exposing log messages from the container to the host's log) syslog/journal dev/log/ bind mount : # docker run -v /dev/log:/dev/log -i -t fedora /bin/bash : (bash)# logger "Hello from my container" journal : # exit # journalctl -b | grep Hello logger . STDIN STDOUT STDERR (Attaching to one or more from STDIN, STDOUT, STDERR) -a (stdin,stdout,stderr) . : # docker run -a stdin -a stdout -i -t fedora /bin/bash IPC (Sharing IPC between containers) shm_server.c : https://www.cs.cf.ac.uk/Dave/C/node27.html --ipc=host: httpd : $ sudo ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status 0x01128e25 0 root 600 1000 7 : $ docker run -it shm ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status --ipc=host httpd : $ docker run -it --ipc=host shm ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status 0x01128e25 0 root 600 1000 7 --ipc=container:CONTAINERID: : $ docker run -it shm bash $ sudo shm/shm_server & $ sudo ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status 0x0000162e 0 root 666 27 1 : $ docker run shm ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status --ipc=container:CONTAINERID : $ docker run -it --ipc=container:ed735b2264ac shm ipcs -m $ sudo ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status 0x0000162e 0 root 666 27 1 (Linking Containers) : (bridge) " (legacy links)" . --link DNS /etc/hosts . link . Dockerfile 80 : # docker run --name=link-test -d -i -t fedora/httpd linker --link=: httpd link-test : # docker run -t -i --link=link-test:lt --name=linker fedora /bin/bash linker lt link-test . env linker LT ( ) (LT_) : # env HOSTNAME=668231cb0978 TERM=xterm LT_PORT_80_TCP=tcp://172.17.0.3:80 LT_PORT_80_TCP_PORT=80 LT_PORT_80_TCP_PROTO=tcp LT_PORT=tcp://172.17.0.3:80 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin PWD=/ LT_NAME=/linker/lt SHLVL=1 HOME=/ LT_PORT_80_TCP_ADDR=172.17.0.3 _=/usr/bin/env . (bridge) linked /etc/hosts . : /etc/hosts /etc/hosts . . (Mapping Ports for External Usage) -p . 80 httpd 8080 : # docker run -p 8080:80 -d -i -t fedora/httpd (Creating and Mounting a Data Volume Container) . Data Volume Container . var/volume1/ tmp/volume2/ . RUN mkdir fedora-data : # docker run --name=data -v /var/volume1 -v /tmp/volume2 -i -t fedora-data true # docker run --volumes-from=data --name=fedora-container1 -i -t fedora bash --volumes-from . DATA fedora-container1 : # docker run --volumes-from=fedora-container1 --name=fedora-container2 -i -t fedora bash (Mounting External Volumes) : # docker run -v /var/db:/data1 -i -t fedora bash SELinux SELinux . SELinux /var/db . "Permission Denied" :avc syslog . SELinux : # chcon -Rt svirt_sandbox_file_t /var/db data1/ var/db/ . (Using alternative security labeling) --security-opt . MCS/MLS MLS . : # docker run --security-opt label=level:s0:c100,c200 -i -t fedora bash MLS : # docker run --security-opt label=level:TopSecret -i -t rhel7 bash --permissive : # docker run --security-opt label=disable -i -t fedora bash . : # docker run --security-opt label=type:svirt_apache_t -i -t centos bash : svirt_apache_t . (Setting device weight) /dev/sda 200 --blkio-weight-device . : # docker run -it --blkio-weight-device "/dev/sda:200" ubuntu (--isolation) (Specify isolation technology for container (--isolation)) Microsoft Windows . --isolation . default . : $ docker run -d busybox top $ docker run -d --isolation default busybox top Microsoft Windows : o default: --exec-opt . daemon Microsoft Windows process . o process: (Namespace isolation). o hyperv: Hyper-V. Microsoft Windows daemon : $ docker run -d --isolation default busybox top $ docker run -d --isolation process busybox top --exec-opt isolation=hyperv hyperv : $ docker run -d --isolation default busybox top $ docker run -d --isolation hyperv busybox top (Sysctls) (Setting Namespaced Kernel Parameters (Sysctls)) --sysctl (sysctls) . IP (IP forwarding) : $ docker run --sysctl net.ipv4.ip_forward=1 someimage : sysctl . sysctl . sysctl . sysctl --sysctl . (HISTORY) William Henry (whenry at redhat dot com) docker.com . Sven Dowideit SvenDowideit@home.org.au Sven Dowideit SvenDowideit@home.org.au Sally O'Malley somalley@redhat.com (SEE ALSO) docker(1), docker-container-run(1), docker-create(1) Docker Community JUNE 2014 DOCKER(1)