gvisor.dev/gvisor@v0.0.0-20240520182842-f9d4d51c7e0f/g3doc/user_guide/tutorials/docker-in-gvisor.md (about)

     1  # Docker in gVisor
     2  
     3  Docker is a platform designed to help developers build, share, and run container
     4  applications.
     5  
     6  In gVisor, all basic docker commands should function as expected. However, it's
     7  important to note that, currently, only the host network driver is supported.
     8  This means that both 'docker run' and 'docker build' commands must be executed
     9  with the `--network=host` option.
    10  
    11  ## How to run Docker in a gVisor container
    12  
    13  First, prepare a container image with pre-installed Docker:
    14  
    15  ```shell
    16  $ cd images/basic/docker/
    17  $ docker build -t docker-in-gvisor .
    18  ```
    19  
    20  Since Docker requires root privileges and a full set of capabilities, a gVisor
    21  sandbox needs to be started in privileged mode:
    22  
    23  ```shell
    24  $ docker run --runtime runsc -d --rm --privileged --name docker-in-gvisor docker-in-gvisor
    25  ```
    26  
    27  Now, we can build and run Docker containers.
    28  
    29  Let's enter in the gvisor sandbox and run some docker commands:
    30  
    31  ```shell
    32  docker exec -it docker-in-gvisor bash
    33  ```
    34  
    35  ```shell
    36  $ mkdir whalesay && cd whalesay
    37  $ cat > Dockerfile <<EOF
    38  FROM ubuntu
    39  
    40  RUN apt-get update && apt-get install -y cowsay curl
    41  RUN mkdir -p /usr/share/cowsay/cows/
    42  RUN curl -o /usr/share/cowsay/cows/docker.cow https://raw.githubusercontent.com/docker/whalesay/master/docker.cow
    43  ENTRYPOINT ["/usr/games/cowsay", "-f", "docker.cow"]
    44  EOF
    45  $ docker build --network=host -t whalesay .
    46  ....
    47  Successfully tagged whalesay:latest
    48  $ docker run --network host -it --rm whalesay "Containers do not contain, but gVisor-s do!"
    49   _________________________________________
    50  / Containers do not contain, but gVisor-s \
    51  \ do!                                     /
    52   -----------------------------------------
    53     \               ##         .
    54      \        ## ## ##        ==
    55            ## ## ## ##       ===
    56         /""""""""""""""""\___/ ===
    57    ~~~ {~~ ~~~~ ~~~ ~~~~ ~~ ~ /  ===- ~~~
    58         \______ o          __/
    59           \    \        __/
    60            \____\______/
    61  
    62  ```