github.com/flavio/docker@v0.1.3-0.20170117145210-f63d1a6eec47/man/src/container/create.md

github.com/flavio/docker@v0.1.3-0.20170117145210-f63d1a6eec47/man/src/container/create.md (about)

1 Creates a writeable container layer over the specified image and prepares it for
2 running the specified command. The container ID is then printed to STDOUT. This
3 is similar to **docker run -d** except the container is never started. You can
4 then use the **docker start <container_id>** command to start the container at
5 any point.
6
7 The initial status of the container created with **docker create** is 'created'.
8
9 # OPTIONS
10
11 The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR`
12 can be an absolute path or a `name` value. A `name` value must start with an
13 alphanumeric character, followed by `a-z0-9`, `_` (underscore), `.` (period) or
14 `-` (hyphen). An absolute path starts with a `/` (forward slash).
15
16 If you supply a `HOST-DIR` that is an absolute path, Docker bind-mounts to the
17 path you specify. If you supply a `name`, Docker creates a named volume by that
18 `name`. For example, you can specify either `/foo` or `foo` for a `HOST-DIR`
19 value. If you supply the `/foo` value, Docker creates a bind-mount. If you
20 supply the `foo` specification, Docker creates a named volume.
21
22 You can specify multiple **-v** options to mount one or more mounts to a
23 container. To use these same mounts in other containers, specify the
24 **--volumes-from** option also.
25
26 You can add `:ro` or `:rw` suffix to a volume to mount it read-only or
27 read-write mode, respectively. By default, the volumes are mounted read-write.
28 See examples.
29
30 Labeling systems like SELinux require that proper labels are placed on volume
31 content mounted into a container. Without a label, the security system might
32 prevent the processes running inside the container from using the content. By
33 default, Docker does not change the labels set by the OS.
34
35 To change a label in the container context, you can add either of two suffixes
36 `:z` or `:Z` to the volume mount. These suffixes tell Docker to relabel file
37 objects on the shared volumes. The `z` option tells Docker that two containers
38 share the volume content. As a result, Docker labels the content with a shared
39 content label. Shared volume labels allow all containers to read/write content.
40 The `Z` option tells Docker to label the content with a private unshared label.
41 Only the current container can use a private volume.
42
43 By default bind mounted volumes are `private`. That means any mounts done
44 inside container will not be visible on host and vice-a-versa. One can change
45 this behavior by specifying a volume mount propagation property. Making a
46 volume `shared` mounts done under that volume inside container will be
47 visible on host and vice-a-versa. Making a volume `slave` enables only one
48 way mount propagation and that is mounts done on host under that volume
49 will be visible inside container but not the other way around.
50
51 To control mount propagation property of volume one can use `:[r]shared`,
52 `:[r]slave` or `:[r]private` propagation flag. Propagation property can
53 be specified only for bind mounted volumes and not for internal volumes or
54 named volumes. For mount propagation to work source mount point (mount point
55 where source dir is mounted on) has to have right propagation properties. For
56 shared volumes, source mount point has to be shared. And for slave volumes,
57 source mount has to be either shared or slave.
58
59 Use `df <source-dir>` to figure out the source mount and then use
60 `findmnt -o TARGET,PROPAGATION <source-mount-dir>` to figure out propagation
61 properties of source mount. If `findmnt` utility is not available, then one
62 can look at mount entry for source mount point in `/proc/self/mountinfo`. Look
63 at `optional fields` and see if any propagaion properties are specified.
64 `shared:X` means mount is `shared`, `master:X` means mount is `slave` and if
65 nothing is there that means mount is `private`.
66
67 To change propagation properties of a mount point use `mount` command. For
68 example, if one wants to bind mount source directory `/foo` one can do
69 `mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This
70 will convert /foo into a `shared` mount point. Alternatively one can directly
71 change propagation properties of source mount. Say `/` is source mount for
72 `/foo`, then use `mount --make-shared /` to convert `/` into a `shared` mount.
73
74 > **Note**:
75 > When using systemd to manage the Docker daemon's start and stop, in the systemd
76 > unit file there is an option to control mount propagation for the Docker daemon
77 > itself, called `MountFlags`. The value of this setting may cause Docker to not
78 > see mount propagation changes made on the mount point. For example, if this value
79 > is `slave`, you may not be able to use the `shared` or `rshared` propagation on
80 > a volume.
81
82
83 To disable automatic copying of data from the container path to the volume, use
84 the `nocopy` flag. The `nocopy` flag can be set on bind mounts and named volumes.
85
86 # EXAMPLES
87
88 ## Specify isolation technology for container (--isolation)
89
90 This option is useful in situations where you are running Docker containers on
91 Windows. The `--isolation=<value>` option sets a container's isolation
92 technology. On Linux, the only supported is the `default` option which uses
93 Linux namespaces. On Microsoft Windows, you can specify these values:
94
95 * `default`: Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value.
96 * `process`: Namespace isolation only.
97 * `hyperv`: Hyper-V hypervisor partition-based isolation.
98
99 Specifying the `--isolation` flag without a value is the same as setting `--isolation="default"`.