netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

g3doc/docker-in-gvisor: don't require mounting cgroups

Browse Source 
Now, containers are started with all mounted cgroups.

PiperOrigin-RevId: 613811100
This commit is contained in:
Andrei Vagin
2024-03-07 21:58:27 -08:00
committed by gVisor bot
parent b27d4b5834
commit 9b28a3f2ee
1 changed files with 4 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
g3doc/user_guide/tutorials/docker-in-gvisor.md
+4 -15
View File
@@ -21,28 +21,17 @@ Since Docker requires root privileges and a full set of capabilities, a gVisor
sandbox needs to be started in privileged mode:
```shell
$ docker run --runtime runsc -it --rm --privileged docker-in-gvisor bash
$ docker run --runtime runsc -d --rm --privileged --name docker-in-gvisor docker-in-gvisor
```
All following commands have to be executed inside a gVsior sandbox.
Now, we can build and run Docker containers.
For the Docker daemon to operate correctly, the devices cgroup must be mounted
using the following commands:
Let's enter in the gvisor sandbox and run some docker commands:
```shell
mount -t tmpfs cgroups /sys/fs/cgroup
mkdir /sys/fs/cgroup/devices
mount -t cgroup -o devices devices /sys/fs/cgroup/devices
docker exec -it docker-in-gvisor bash
```
Afterwards, the daemon can be started with the following command:
```shell
/usr/bin/dockerd --bridge=none --iptables=false --ip6tables=false
```
Now, we can build and run Docker containers
```shell
$ mkdir whalesay && cd whalesay
$ cat > Dockerfile <<EOF