diff --git a/g3doc/user_guide/tutorials/BUILD b/g3doc/user_guide/tutorials/BUILD index f2a474d3a..e305c55be 100644 --- a/g3doc/user_guide/tutorials/BUILD +++ b/g3doc/user_guide/tutorials/BUILD @@ -63,3 +63,21 @@ doc( subcategory = "Tutorials", weight = "50", ) + +doc( + name = "docker_in_gvisor", + src = "docker-in-gvisor.md", + category = "User Guide", + permalink = "/docs/tutorials/docker-in-gvisor/", + subcategory = "Tutorials", + weight = "50", +) + +doc( + name = "docker_in_gke_sandbox", + src = "docker-in-gke-sandbox.md", + category = "User Guide", + permalink = "/docs/tutorials/docker-in-gke-sandbox/", + subcategory = "Tutorials", + weight = "50", +) diff --git a/g3doc/user_guide/tutorials/docker-in-gke-sandbox.md b/g3doc/user_guide/tutorials/docker-in-gke-sandbox.md new file mode 100644 index 000000000..d28011cbb --- /dev/null +++ b/g3doc/user_guide/tutorials/docker-in-gke-sandbox.md @@ -0,0 +1,95 @@ +# Docker in gVisor + +Docker is a platform designed to help developers build, share, and run container +applications. + +In gVisor, all basic docker commands should function as expected. However, it's +important to note that, currently, only the host network driver is supported. +This means that both 'docker run' and 'docker build' commands must be executed +with the `--network=host` option. + +# How to run Docker in a GKE Sandbox + +First, install a GKE cluster (1.29.0 or higher) and deploy a node pool with +gVisor enabled. You can view the full documentation [here][gke-sandbox-docs]. + +Prepare a container image with pre-installed Docker: + +```shell +$ cd g3doc/user_guide/tutorials/docker-in-gke-sandbox/ +$ docker build -t {registry_url}/docker-in-gvisor:latest . +$ docker push {registry_url}/docker-in-gvisor:latest +``` + +Create a Kubernetes pod YAML file (docker.yaml) with the following content: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: docker-in-gvisor +spec: + runtimeClassName: gvisor + containers: + - name: docker-in-gvisor + image: {registry_url}/docker-in-gvisor:latest + securityContext: + capabilities: + add: ["all"] + volumeMounts: + - name: docker + mountPath: /var/lib/docker + volumes: + - name: docker + emptyDir: {} +``` + +This YAML file defines a Kubernetes Pod named docker-in-gvisor that will run a +single container from the avagin/docker-in-gvisor:0.1 image. + +Apply the pod YAML to your GKE cluster using the kubectl apply command: + +```shell +$ kubectl apply -f docker.yaml +``` + +Verify that the docker-in-gvisor pid is running successfully: `shell $ kubectl +get pods | grep docker-in-gvisor` + +You can access the container by executing a shell inside it. Use the following +command: + +```shell +kubectl exec -it docker-in-gvisor -- bash +``` + +Now, we can build and run Docker containers. + +```shell +$ mkdir whalesay && cd whalesay +$ cat > Dockerfile <