Docker: Difference between revisions

From Grid5000
Jump to navigation Jump to search
 
(60 intermediate revisions by 11 users not shown)
Line 1: Line 1:
<!--
{{Maintainer|Florent Didier}}
{{Portal|User}}
{{Portal|User}}
{{Status|In production}}
{{Portal|Tutorial}}
-->
{{TutorialHeader}}
 
'''Docker''' is a software technology that provides operating-system-level virtualization. In this page, we present some tools that are specifically designed to use Docker on Grid'5000.
'''Docker''' is a software technology that provides operating-system-level virtualization. In this page, we present some tools that are specifically designed to use Docker on Grid'5000.


= Installing Docker from a node =
= Installing Docker from a node in the standard environment =
You can install and use Docker from a node with the standard environment by following these instructions:
You can install and use Docker from a node with the standard environment by following these instructions:


; Reserve a node
; Reserve a node
{{Term|location=fnancy|cmd=<code class="command">oarsub</code> <code>-I</code>}}
{{Term|location=fnancy|cmd=<code class="command">oarsub</code> <code>-I</code>}}
(you can also use option <code>-t deploy</code> and Kadeploy if you prefer)


; Install Docker
See [[Getting_Started]] for more reservation options.
The script g5k-setup-docker, available from the standard environment, installs Docker locally. Option -c makes docker command available without needing to log out and reconnect to the node
 
{{Term|location=node|cmd=<code class="command">g5k-setup-docker</code> <code>-c</code>}}
; Install Docker from the standard environment
The script g5k-setup-docker, available from the standard environment, installs Docker locally and makes Docker commands available without user needing to log out (by giving read write permissions to the file /var/run/docker.sock)
{{Term|location=node|cmd=<code class="command">g5k-setup-docker</code> <code>-t</code>}}
 
The <code>-t</code> option allows to use <code>/tmp/</code> to store docker images, which is useful because <code>/tmp/</code> has more disk space available. Technically speaking, it does a bind mount of <code>/tmp/docker</code> on <code>/var/lib/docker</code>.


; Run Docker
; Run Docker
Line 22: Line 22:
{{Term|location=node|cmd=<code class="command">docker run</code> <code>hello-world</code>}}
{{Term|location=node|cmd=<code class="command">docker run</code> <code>hello-world</code>}}


= Using docker-machine and docker-g5k =
= Installing Docker from a deployed node =
The Spirals Team in Lille developped two tools to ease Docker usage on Grid'5000:
 
* a docker-machine driver
In addition to the standard environment, g5k-setup-docker works with the environments '''debian11-nfs''' and '''debian11-big''' (as well as with '''debian10-nfs''' and '''debian10-big''').
* the docker-g5k program
 
Reserve a node, [[Getting_Started#Deploying_your_nodes_to_get_root_access_and_create_your_own_experimental_environment|deploy an environment]], connect to the node and run the script as root with its full path:
 
{{Term|location=root@node| cmd=<code class="command">/grid5000/code/bin/g5k-setup-docker</code>}}
 
You can also use the <code>-t</code> option to store docker images in <code>/tmp/</code> to have more space, but be aware that everything will be deleted if you reboot the node.
 
= Installing nvidia-docker =
On nodes with one or more GPUs, you may want to use Nvidia's Docker container images (e.g. see [https://www.nvidia.com/en-us/gpu-cloud/containers/]). To do so, you have to install Nvidia's [https://github.com/nvidia/nvidia-docker nvidia-docker].
 
To ease this task, Grid'5000 provides a script to automate the installation. Just run :
 
{{Term|location=node| cmd=<code class="command">g5k-setup-nvidia-docker</code> <code>-t</code>}}
 
Options are the same as with the <code>g5k-setup-docker</code> script presented above. Please note that you can use <code>g5k-setup-docker</code> or <code>g5k-setup-nvidia-docker</code>, but not both all together.
 
You can check that nvidia-docker is working using the following command:
 
{{Term|location=node| cmd=<code class="command">docker run --gpus all ubuntu:22.04 nvidia-smi</code>}}
 
= Using docker-cache.grid5000.fr =
 
Due do the rate limiting of docker hub you might experience some troubles to fetch images. As a result you can use docker-cache.grid5000.fr which is a registry mirror.
 
To enable the use of the cache from a Grid'5000 node (as ''root'' or using ''sudo-g5k''), edit <code>/etc/docker/daemon.json</code> with:
{
  "registry-mirrors": [
    "http://docker-cache.grid5000.fr"
  ]
}
 
then restart docker:
 
systemctl restart docker
 
'''Note''': This cache is automatically configured by <code>g5k-setup-docker</code>.
 
= Logging in to dockerhub to bypass rate limiting =


; Provision a node with docker-machine
Even with the Grid'5000 docker cache, you can still be rate-limited by the dockerhub.
The [https://github.com/Spirals-Team/docker-machine-driver-g5k driver for docker-machine] allows you to reserve a node on Grid'5000 and to install a Linux image and Docker Engine on it, from your computer and in one single command.
The reserved node is then available from commands like <code>docker-machine ssh</code> (standard ssh commands don't work when nodes are reserved with docker-machine).


; Create a Swarm with docker-g5k
To bypass the rate-limiting, you can associate the local docker daemon with your dockerhub account:
The [https://github.com/Spirals-Team/docker-g5k docker-g5k] program allows you to reserve several nodes, possibly on different sites, and to install a Linux image and Docker Engine on each node, in one single command.
This command configures a Swarm, i.e. a set of Docker containers distributed over several nodes that communicate with each other.


= Managing Docker images =
* '''Generate a read-only token on dockerhub:''' https://hub.docker.com/settings/security?generateToken=true and select the "Public Repo Read-Only" permission
Users sometimes want to load Docker images quickly or store private Docker images in a registry. Achieving these goals is not easy, because Grid'5000 network connection to the outside has poor performance (<1Gbps). However, we propose the following solutions to manage your images.
* '''Use the token to login on your Grid'5000 machine:'''


; Use docker load/save
  docker login -u yourlogin -p yourtoken
To load and save images quickly, we encourage you to use <code>docker load</code> and <code>docker save</code> commands, with .tar docker images stored in your Grid'5000 home. User's home are NFS mounted in all nodes deployed with the standard environment, with good network performance.


Example:
The credentials will be saved in <code>~/.docker/config.json</code>. If you use your regular Grid'5000 account, then it will be saved in your shared NFS home, and it should be used by all your nodes. If you use the root account to SSH on your nodes, then you need to repeat this configuration on each node.
{{Term|location=node1|
cmd=<code class="command">docker pull</code> <code>centos:7</code><br>
<code class="command">docker save</code> <code>-o ~/centos7.tar centos:7</code><br>
}}
{{Term|location=node2|
cmd=<code class="command">docker load</code> <code>-i ~/centos7.tar</code><br>
<code class="command">docker run</code> <code>-it centos:7</code>
}}


You can also use <code>docker load</code> command instead of retriving the image from Docker Hub, when deploying a Swarm with docker-g5k.
= Avoid network conflict =
The default network used by docker is 172.16.0.1/16 which is use internally on Grid'5000 thus this can be a source of conflict.


Give read rights to your image
If you want to avoid any conflict you can set an other network. On Debian you will have to edit /etc/default/docker and specify the network you want to use like this:
{{Term|location=frontend|cmd=<code class="command">chmod 644</code> <code>~/centos7.tar</code>}}
DOCKER_OPTS="--bip=192.168.42.1/24"


Reserve three nodes in Nancy (activate the Grid'5000 VPN before launching this command)
then restart the docker daemon.
{{Term|location=laptop|cmd=<code class="command">docker-g5k create-cluster</code> <code>--g5k-username "user" --g5k-password "********" --g5k-reserve-nodes "nancy:3"--g5k-image "jessie-x64-std"</code>}}


Load Centos image on each node
= Managing Docker images =
{{Term|location=laptop|cmd=<code>for i in {0..2}; do</code> <code class="command">docker-machine ssh</code> <code>nancy-${i} "docker load -i /home/user/centos7.tar"; done</code>}}
One difficult aspect of using Docker is efficient images management, as it is often required to load such images on many nodes simultaneously.
The following strategies are recommended to manage Docker images:


== Use docker load/save ==
To load and save images quickly, we encourage you to use <code>docker load</code> and <code>docker save</code> commands, with .tar docker images stored in your Grid'5000 home. Users home are NFS mounted, with good network performance.


; Use Inria private registry
; Example:
Inria members can store private Docker images at [https://qlf-sesi-harbor.inria.fr/harbor/sign-in Inria private registry] (also look at the [https://partage.inria.fr/share/page/document-details?nodeRef=workspace://SpacesStore/b33e70e5-ca6e-4121-9051-782ca88603ba documentation]), but network throughput is low.
{{Term|location=node1|
cmd=<code class="command">docker pull</code> <code>alpine</code><br>
<code class="command">docker save</code> <code>-o ~/alpine.tar alpine</code><br>
}}
{{Term|location=node2|
cmd=<code class="command">docker load</code> <code>-i ~/alpine.tar</code><br>
<code class="command">docker run</code> <code>-it alpine</code>
}}


; Use a persistent VM
== Use a persistent virtual machine to host your registry ==
If you want to benefit from a private registry with good network performance, and are ready to manually install your own registry, you can request a [[Persistent_Virtual_Machine|Persistent Virtual Machine]]. You can look at [http://vmware.github.io/harbor/ Harbor] or [http://port.us.org/ Portus] open source projects, in order to install your own registry.
If you want to benefit from a private registry with good network performance, and are ready to manually install your own registry, you can request a [[Persistent_Virtual_Machine|Persistent Virtual Machine]]. You can look at [http://vmware.github.io/harbor/ Harbor] or [http://port.us.org/ Portus] open source projects, in order to install your own registry.

Latest revision as of 08:56, 29 June 2023

Note.png Note

This page is actively maintained by the Grid'5000 team. If you encounter problems, please report them (see the Support page). Additionally, as it is a wiki page, you are free to make minor corrections yourself if needed. If you would like to suggest a more fundamental change, please contact the Grid'5000 team.

Docker is a software technology that provides operating-system-level virtualization. In this page, we present some tools that are specifically designed to use Docker on Grid'5000.

Installing Docker from a node in the standard environment

You can install and use Docker from a node with the standard environment by following these instructions:

Reserve a node
Terminal.png fnancy:
oarsub -I

See Getting_Started for more reservation options.

Install Docker from the standard environment

The script g5k-setup-docker, available from the standard environment, installs Docker locally and makes Docker commands available without user needing to log out (by giving read write permissions to the file /var/run/docker.sock)

Terminal.png node:
g5k-setup-docker -t

The -t option allows to use /tmp/ to store docker images, which is useful because /tmp/ has more disk space available. Technically speaking, it does a bind mount of /tmp/docker on /var/lib/docker.

Run Docker

You can now check that Docker is up and running

Terminal.png node:
docker run hello-world

Installing Docker from a deployed node

In addition to the standard environment, g5k-setup-docker works with the environments debian11-nfs and debian11-big (as well as with debian10-nfs and debian10-big).

Reserve a node, deploy an environment, connect to the node and run the script as root with its full path:

Terminal.png root@node:
/grid5000/code/bin/g5k-setup-docker

You can also use the -t option to store docker images in /tmp/ to have more space, but be aware that everything will be deleted if you reboot the node.

Installing nvidia-docker

On nodes with one or more GPUs, you may want to use Nvidia's Docker container images (e.g. see [1]). To do so, you have to install Nvidia's nvidia-docker.

To ease this task, Grid'5000 provides a script to automate the installation. Just run :

Terminal.png node:
g5k-setup-nvidia-docker -t

Options are the same as with the g5k-setup-docker script presented above. Please note that you can use g5k-setup-docker or g5k-setup-nvidia-docker, but not both all together.

You can check that nvidia-docker is working using the following command:

Terminal.png node:
docker run --gpus all ubuntu:22.04 nvidia-smi

Using docker-cache.grid5000.fr

Due do the rate limiting of docker hub you might experience some troubles to fetch images. As a result you can use docker-cache.grid5000.fr which is a registry mirror.

To enable the use of the cache from a Grid'5000 node (as root or using sudo-g5k), edit /etc/docker/daemon.json with:

{
  "registry-mirrors": [
    "http://docker-cache.grid5000.fr"
  ]
}

then restart docker:

systemctl restart docker

Note: This cache is automatically configured by g5k-setup-docker.

Logging in to dockerhub to bypass rate limiting

Even with the Grid'5000 docker cache, you can still be rate-limited by the dockerhub.

To bypass the rate-limiting, you can associate the local docker daemon with your dockerhub account:

 docker login -u yourlogin -p yourtoken

The credentials will be saved in ~/.docker/config.json. If you use your regular Grid'5000 account, then it will be saved in your shared NFS home, and it should be used by all your nodes. If you use the root account to SSH on your nodes, then you need to repeat this configuration on each node.

Avoid network conflict

The default network used by docker is 172.16.0.1/16 which is use internally on Grid'5000 thus this can be a source of conflict.

If you want to avoid any conflict you can set an other network. On Debian you will have to edit /etc/default/docker and specify the network you want to use like this:

DOCKER_OPTS="--bip=192.168.42.1/24"

then restart the docker daemon.

Managing Docker images

One difficult aspect of using Docker is efficient images management, as it is often required to load such images on many nodes simultaneously. The following strategies are recommended to manage Docker images:

Use docker load/save

To load and save images quickly, we encourage you to use docker load and docker save commands, with .tar docker images stored in your Grid'5000 home. Users home are NFS mounted, with good network performance.

Example
Terminal.png node1:
docker pull alpine
docker save -o ~/alpine.tar alpine
Terminal.png node2:
docker load -i ~/alpine.tar
docker run -it alpine

Use a persistent virtual machine to host your registry

If you want to benefit from a private registry with good network performance, and are ready to manually install your own registry, you can request a Persistent Virtual Machine. You can look at Harbor or Portus open source projects, in order to install your own registry.