From 3178f96da6447e495deaf620428996100577d60e Mon Sep 17 00:00:00 2001 From: Evan Phoenix Date: Sun, 3 Nov 2024 14:43:40 -0800 Subject: [PATCH] Update docker-in-gvisor.md to mention raw sockets --- g3doc/user_guide/tutorials/docker-in-gvisor.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/g3doc/user_guide/tutorials/docker-in-gvisor.md b/g3doc/user_guide/tutorials/docker-in-gvisor.md index 94646c4f9..faf5dd0b5 100644 --- a/g3doc/user_guide/tutorials/docker-in-gvisor.md +++ b/g3doc/user_guide/tutorials/docker-in-gvisor.md @@ -6,6 +6,24 @@ applications. In gVisor, all basic docker commands should function as expected. The host network driver and the bridge network driver are tested and supported. +### NOTE on runsc setup + +To run docker within gvisor, runsc must be enable to to allow raw sockets. This is +not the default, `--net-raw` must be passed to runsc. To use the following tutorial, +that means having the following configuration in `/etc/docker/daemon.json`: + +```json + "runsc": { + "path": "/usr/local/bin/runsc", + "runtimeArgs": [ + "--net-raw" + ] + } +``` + +If you have an existing entry for `runsc`, likely created by `runsc install`, then +edit the entry and add the `"runtimeArgs"` key and value to the existing entry. + ## How to run Docker in a gVisor container First, prepare a container image with pre-installed Docker: