Andreas/docker-cheat-sheet
1
0
Fork 0
mirror of https://github.com/wsargent/docker-cheat-sheet.git synced 2025-09-22 05:40:50 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add capabilities section.

Browse source
This commit is contained in:
Will Sargent 2016-10-10 17:14:29 -07:00 • committed by GitHub
parent 61468a98d3
commit 92f5e22b04
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
README.md
View file

@ -130,13 +130,13 @@ Restart policies on crashed docker instances are [covered here](http://container
You can limit CPU, either using a percentage of all CPUs, or by using specific cores. You can limit CPU, either using a percentage of all CPUs, or by using specific cores.
For example, you can tell the [`cpu-shares`](https://docs.docker.com/engine/reference/run/#/runtime-constraints-on-resources) setting. The setting is a bit strange -- 1024 means 100% of the CPU, so if you want the container to take 50% of all CPU cores, you should specify 512. See https://goldmann.pl/blog/2014/09/11/resource-management-in-docker/#_cpu for more: For example, you can tell the [`cpu-shares`](https://docs.docker.com/engine/reference/run/#/cpu-share-constraint) setting. The setting is a bit strange -- 1024 means 100% of the CPU, so if you want the container to take 50% of all CPU cores, you should specify 512. See https://goldmann.pl/blog/2014/09/11/resource-management-in-docker/#_cpu for more:
``` ```
docker run -ti --c 512 agileek/cpuset-test docker run -ti --c 512 agileek/cpuset-test
``` ```
You can also only use some CPU cores using `cpuset-cpus`. See https://agileek.github.io/docker/2014/08/06/docker-cpuset/ for details and some nice videos: You can also only use some CPU cores using ``cpuset-cpus`](https://docs.docker.com/engine/reference/run/#/cpuset-constraint). See https://agileek.github.io/docker/2014/08/06/docker-cpuset/ for details and some nice videos:
``` ```
docker run -ti --cpuset-cpus=0,4,6 agileek/cpuset-test docker run -ti --cpuset-cpus=0,4,6 agileek/cpuset-test
@ -149,7 +149,17 @@ Note that Docker can still **see** all of the CPUs inside the container -- it ju
You can also set [memory constraints](https://docs.docker.com/engine/reference/run/#/user-memory-constraints) on Docker: You can also set [memory constraints](https://docs.docker.com/engine/reference/run/#/user-memory-constraints) on Docker:
``` ```
$ docker run -it -m 300M ubuntu:14.04 /bin/bash docker run -it -m 300M ubuntu:14.04 /bin/bash
```
#### Capabilities
Linux capabilities can be set by using `cap-add` and `cap-drop`. See https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities for details. This should be used for greater security.
To mount a FUSE based filesystem, you need to combine both --cap-add and --device:
```
docker run --rm -it --cap-add SYS_ADMIN --device /dev/fuse sshfs
``` ```
### Info ### Info
@ -452,7 +462,6 @@ This is where general Docker best practices and war stories go:
This is where security tips about Docker go. The Docker [security](https://docs.docker.com/engine/articles/security/) page goes into more detail. This is where security tips about Docker go. The Docker [security](https://docs.docker.com/engine/articles/security/) page goes into more detail.
First things first: Docker runs as root. If you are in the `docker` group, you effectively [have root access](http://reventlov.com/advisories/using-the-docker-command-to-root-the-host). If you expose the docker unix socket to a container, you are giving the container [root access to the host](https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container.html). First things first: Docker runs as root. If you are in the `docker` group, you effectively [have root access](http://reventlov.com/advisories/using-the-docker-command-to-root-the-host). If you expose the docker unix socket to a container, you are giving the container [root access to the host](https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container.html).
Docker should not be your only defense. You should secure and harden it. Docker should not be your only defense. You should secure and harden it.