Propellor.Property.Docker

Docker support for propellor

The existance of a docker container is just another Property of a system, which propellor can set up. See config.hs for an example.

Host properties

installed :: Property

configured :: Property

Configures docker with an authentication file, so that images can be pushed to index.docker.io. Optional.

container :: ContainerName -> Image -> Host

Starts accumulating the properties of a Docker container.

 container "web-server" "debian"
    & publish "80:80"
    & Apt.installed {"apache2"]
    & ...

docked :: [Host] -> ContainerName -> RevertableProperty

Ensures that a docker container is set up and running, finding its configuration in the passed list of hosts.

The container has its own Properties which are handled by running propellor inside the container.

Additionally, the container can have DNS attributes, such as a CNAME. These become attributes of the host(s) it's docked in.

Reverting this property ensures that the container is stopped and removed.

memoryLimited :: Property

Configures the kernel to respect docker memory limits.

This assumes the system boots using grub 2. And that you don't need any other GRUB_CMDLINE_LINUX_DEFAULT settings.

Only takes effect after reboot. (Not automated.)

garbageCollected :: Property

Causes *any* docker images that are not in use by running containers to be deleted. And deletes any containers that propellor has set up before that are not currently running. Does not delete any containers that were not set up using propellor.

Generally, should come after the properties for the desired containers.

type Image = String

A docker image, that can be used to run a container.

type ContainerName = String

A short descriptive name for a container. Should not contain whitespace or other unusual characters, only [a-zA-Z0-9_-] are allowed

Container configuration

dns :: String -> Property

Set custom dns server for container.

hostname :: String -> Property

Set container host name.

name :: String -> Property

Set name for container. (Normally done automatically.)

publish :: String -> Property

Publish a container's port to the host (format: ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort)

expose :: String -> Property

Expose a container's port without publishing it.

user :: String -> Property

Username or UID for container.

volume :: String -> Property

Mount a volume Create a bind mount with: [host-dir]:[container-dir]:[rw|ro] With just a directory, creates a volume in the container.

volumes_from :: ContainerName -> Property

Mount a volume from the specified container into the current container.

workdir :: String -> Property

Work dir inside the container.

memory :: String -> Property

Memory limit for container. Format: numberunit, where unit = b, k, m or g

Note: Only takes effect when the host has the memoryLimited property enabled.

cpuShares :: Int -> Property

CPU shares (relative weight).

By default, all containers run at the same priority, but you can tell the kernel to give more CPU time to a container using this property.

link :: ContainerName -> ContainerAlias -> Property

Link with another container on the same host.

type ContainerAlias = String

A short alias for a linked container. Each container has its own alias namespace.

Internal use

chain :: String -> IO ()

Called when propellor is running inside a docker container. The string should be the container's ContainerId.

This process is effectively init inside the container. It even needs to wait on zombie processes!

Fork a thread to run the SimpleSh server in the background. In the foreground, run an interactive bash (or sh) shell, so that the user can interact with it when attached to the container.

When the system reboots, docker restarts the container, and this is run again. So, to make the necessary services get started on boot, this needs to provision the container then. However, if the container is already being provisioned by the calling propellor, it would be redundant and problimatic to also provisoon it here.

The solution is a flag file. If the flag file exists, then the container was already provisioned. So, it must be a reboot, and time to provision again. If the flag file doesn't exist, don't provision here.