From 5ff04b09d72b454118aab2478c4cf81de5107969 Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@gmail.com>
Date: Fri, 26 Jan 2024 17:57:25 -0800
Subject: [PATCH] g3doc: how to run docker in a GKE sandbox

---
 g3doc/user_guide/tutorials/BUILD              | 18 ++++
 .../tutorials/docker-in-gke-sandbox.md        | 97 +++++++++++++++++++
 .../docker-in-gke-sandbox/Dockerfile          |  8 ++
 .../docker-in-gke-sandbox/docker-run.sh       | 25 +++++
 .../docker-in-gke-sandbox/docker.yaml         | 18 ++++
 .../{ => tutorials}/docker-in-gvisor.md       |  0
 website/BUILD                                 |  2 +
 7 files changed, 168 insertions(+)
 create mode 100644 g3doc/user_guide/tutorials/docker-in-gke-sandbox.md
 create mode 100644 g3doc/user_guide/tutorials/docker-in-gke-sandbox/Dockerfile
 create mode 100755 g3doc/user_guide/tutorials/docker-in-gke-sandbox/docker-run.sh
 create mode 100644 g3doc/user_guide/tutorials/docker-in-gke-sandbox/docker.yaml
 rename g3doc/user_guide/{ => tutorials}/docker-in-gvisor.md (100%)

diff --git a/g3doc/user_guide/tutorials/BUILD b/g3doc/user_guide/tutorials/BUILD
index f2a474d3a..e305c55be 100644
--- a/g3doc/user_guide/tutorials/BUILD
+++ b/g3doc/user_guide/tutorials/BUILD
@@ -63,3 +63,21 @@ doc(
     subcategory = "Tutorials",
     weight = "50",
 )
+
+doc(
+    name = "docker_in_gvisor",
+    src = "docker-in-gvisor.md",
+    category = "User Guide",
+    permalink = "/docs/tutorials/docker-in-gvisor/",
+    subcategory = "Tutorials",
+    weight = "50",
+)
+
+doc(
+    name = "docker_in_gke_sandbox",
+    src = "docker-in-gke-sandbox.md",
+    category = "User Guide",
+    permalink = "/docs/tutorials/docker-in-gke-sandbox/",
+    subcategory = "Tutorials",
+    weight = "50",
+)
diff --git a/g3doc/user_guide/tutorials/docker-in-gke-sandbox.md b/g3doc/user_guide/tutorials/docker-in-gke-sandbox.md
new file mode 100644
index 000000000..1f992dbeb
--- /dev/null
+++ b/g3doc/user_guide/tutorials/docker-in-gke-sandbox.md
@@ -0,0 +1,97 @@
+# Docker in gVisor
+
+Docker is a platform designed to help developers build, share, and run container
+applications.
+
+In gVisor, all basic docker commands should function as expected. However, it's
+important to note that, currently, only the host network driver is supported.
+This means that both 'docker run' and 'docker build' commands must be executed
+with the `--network=host` option.
+
+# How to run Docker in a GKE Sandbox
+
+First, install a GKE cluster (1.29.0 or higher) and deploy a node pool with
+gVisor enabled. You can view the full documentation [here][gke-sandbox-docs].
+
+Prepare a container image with pre-installed Docker:
+
+```shell
+$ cd g3doc/user_guide/tutorials/docker-in-gke-sandbox/
+$ docker build -t {registry_url}/docker-in-gvisor:latest .
+$ docker push {registry_url}/docker-in-gvisor:latest
+```
+
+Create a Kubernetes pod YAML file (docker.yaml) with the following content:
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: docker-in-gvisor
+spec:
+  runtimeClassName: gvisor
+  containers:
+  - name: docker-in-gvisor
+    image: {registry_url}/docker-in-gvisor:latest
+    securityContext:
+      capabilities:
+        add: ["all"]
+    volumeMounts:
+      - name: docker
+        mountPath: /var/lib/docker
+  volumes:
+  - name: docker
+    emptyDir: {}
+```
+
+This YAML file defines a Kubernetes Pod named docker-in-gvisor that will run a
+single container from the avagin/docker-in-gvisor:0.1 image.
+
+Apply the pod YAML to your GKE cluster using the kubectl apply command:
+
+```shell
+$ kubectl apply -f docker.yaml
+```
+
+Verify that the docker-in-gvisor pid is running successfully:
+```shell
+$ kubectl get pods | grep docker-in-gvisor
+```
+
+You can access the container by executing a shell inside it. Use the following
+command:
+
+```shell
+kubectl exec -it docker-in-gvisor -- bash
+```
+
+Now, we can build and run Docker containers.
+
+```shell
+$ mkdir whalesay && cd whalesay
+$ cat > Dockerfile <<EOF
+FROM ubuntu
+
+RUN apt-get update && apt-get install -y cowsay curl
+RUN mkdir -p /usr/share/cowsay/cows/
+RUN curl -o /usr/share/cowsay/cows/docker.cow https://raw.githubusercontent.com/docker/whalesay/master/docker.cow
+ENTRYPOINT ["/usr/games/cowsay", "-f", "docker.cow"]
+EOF
+$ docker build --network=host -t whalesay .
+....
+Successfully tagged whalesay:latest
+$ docker run --network host -it --rm whalesay "Containers do not contain, but gVisor-s do!"
+ _________________________________________
+/ Containers do not contain, but gVisor-s \
+\ do!                                     /
+ -----------------------------------------
+   \               ##         .
+    \        ## ## ##        ==
+          ## ## ## ##       ===
+       /""""""""""""""""\___/ ===
+  ~~~ {~~ ~~~~ ~~~ ~~~~ ~~ ~ /  ===- ~~~
+       \______ o          __/
+         \    \        __/
+          \____\______/
+
+```
diff --git a/g3doc/user_guide/tutorials/docker-in-gke-sandbox/Dockerfile b/g3doc/user_guide/tutorials/docker-in-gke-sandbox/Dockerfile
new file mode 100644
index 000000000..5a7124578
--- /dev/null
+++ b/g3doc/user_guide/tutorials/docker-in-gke-sandbox/Dockerfile
@@ -0,0 +1,8 @@
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND="noninteractive"
+RUN apt-get update && apt-get install -y docker.io
+
+COPY docker-run.sh /usr/local/bin/docker-run.sh
+
+CMD /usr/local/bin/docker-run.sh
diff --git a/g3doc/user_guide/tutorials/docker-in-gke-sandbox/docker-run.sh b/g3doc/user_guide/tutorials/docker-in-gke-sandbox/docker-run.sh
new file mode 100755
index 000000000..19271f95d
--- /dev/null
+++ b/g3doc/user_guide/tutorials/docker-in-gke-sandbox/docker-run.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Copyright 2024 The gVisor Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -xe
+
+test -f /sys/fs/cgroup/devices/tasks || {
+  mount -t tmpfs cgroups /sys/fs/cgroup
+  mkdir /sys/fs/cgroup/devices
+  mount -t cgroup -o devices devices /sys/fs/cgroup/devices
+}
+
+exec /usr/bin/dockerd --bridge=none --iptables=false --ip6tables=false "$@"
diff --git a/g3doc/user_guide/tutorials/docker-in-gke-sandbox/docker.yaml b/g3doc/user_guide/tutorials/docker-in-gke-sandbox/docker.yaml
new file mode 100644
index 000000000..fd0cc11a6
--- /dev/null
+++ b/g3doc/user_guide/tutorials/docker-in-gke-sandbox/docker.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: docker-in-gvisor
+spec:
+  runtimeClassName: gvisor
+  containers:
+  - name: docker-in-gvisor
+    image: avagin/docker-in-gvisor:0.1
+    securityContext:
+      capabilities:
+        add: ["all"]
+    volumeMounts:
+      - name: docker
+        mountPath: /var/lib/docker
+  volumes:
+  - name: docker
+    emptyDir: {}
diff --git a/g3doc/user_guide/docker-in-gvisor.md b/g3doc/user_guide/tutorials/docker-in-gvisor.md
similarity index 100%
rename from g3doc/user_guide/docker-in-gvisor.md
rename to g3doc/user_guide/tutorials/docker-in-gvisor.md
diff --git a/website/BUILD b/website/BUILD
index 993b5ed83..d9176969a 100644
--- a/website/BUILD
+++ b/website/BUILD
@@ -171,6 +171,8 @@ docs(
         "//g3doc/user_guide/tutorials:cni",
         "//g3doc/user_guide/tutorials:docker",
         "//g3doc/user_guide/tutorials:docker_compose",
+        "//g3doc/user_guide/tutorials:docker_in_gke_sandbox",
+        "//g3doc/user_guide/tutorials:docker_in_gvisor",
         "//g3doc/user_guide/tutorials:falco",
         "//g3doc/user_guide/tutorials:knative",
         "//g3doc/user_guide/tutorials:kubernetes",