From 9b28a3f2eeff35d57549f96842ac4f7c39a2911a Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Thu, 7 Mar 2024 21:55:13 -0800 Subject: [PATCH] g3doc/docker-in-gvisor: don't require mounting cgroups Now, containers are started with all mounted cgroups. PiperOrigin-RevId: 613811100 --- .../user_guide/tutorials/docker-in-gvisor.md | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/g3doc/user_guide/tutorials/docker-in-gvisor.md b/g3doc/user_guide/tutorials/docker-in-gvisor.md index 43b6e8121..3565e405d 100644 --- a/g3doc/user_guide/tutorials/docker-in-gvisor.md +++ b/g3doc/user_guide/tutorials/docker-in-gvisor.md @@ -21,28 +21,17 @@ Since Docker requires root privileges and a full set of capabilities, a gVisor sandbox needs to be started in privileged mode: ```shell -$ docker run --runtime runsc -it --rm --privileged docker-in-gvisor bash +$ docker run --runtime runsc -d --rm --privileged --name docker-in-gvisor docker-in-gvisor ``` -All following commands have to be executed inside a gVsior sandbox. +Now, we can build and run Docker containers. -For the Docker daemon to operate correctly, the devices cgroup must be mounted -using the following commands: +Let's enter in the gvisor sandbox and run some docker commands: ```shell -mount -t tmpfs cgroups /sys/fs/cgroup -mkdir /sys/fs/cgroup/devices -mount -t cgroup -o devices devices /sys/fs/cgroup/devices +docker exec -it docker-in-gvisor bash ``` -Afterwards, the daemon can be started with the following command: - -```shell -/usr/bin/dockerd --bridge=none --iptables=false --ip6tables=false -``` - -Now, we can build and run Docker containers - ```shell $ mkdir whalesay && cd whalesay $ cat > Dockerfile <