@@ -3,17 +3,18 @@ title: Docker in Environments
3
3
description : Learn how to enable support for secure Docker inside Environments.
4
4
---
5
5
6
- If you're a site admin or a site manager, you can enable [ container-based
7
- virtual machines (CVMs)] ( ../../environments/cvms.md ) as an environment
8
- deployment option. CVMs allow users to run system-level programs, such as Docker
9
- and systemd, in their environments.
6
+ If you're a site admin or a site manager, you can enable
7
+ [ container-based virtual machines (CVMs)] ( ../../environments/cvms.md ) as an
8
+ environment deployment option. CVMs allow users to run system-level programs,
9
+ such as Docker and systemd, in their environments.
10
10
11
11
## Infrastructure Requirements
12
12
13
- - CVMs leverage the [ sysbox container
14
- runtime] ( https://github.com/nestybox/sysbox ) , so the Kubernetes Node must run
15
- a supported Linux distro with the minimum Kernel version (see [ Sysbox Distro
16
- Compatibility] ( https://github.com/nestybox/sysbox/blob/master/docs/distro-compat.md )
13
+ - CVMs leverage the
14
+ [ sysbox container runtime] ( https://github.com/nestybox/sysbox ) , so the
15
+ Kubernetes Node must run a supported Linux distro with the minimum Kernel
16
+ version (see
17
+ [ Sysbox Distro Compatibility] ( https://github.com/nestybox/sysbox/blob/master/docs/distro-compat.md )
17
18
for more information)
18
19
- The cluster must allow privileged containers and ` hostPath ` mounts. Read more
19
20
about why this is still secure [ here] ( #security ) .
@@ -28,8 +29,8 @@ such as Istio.
28
29
29
30
## Setting Up Your Cluster
30
31
31
- The following sections show how you can set up your K8 clusters hosted by Google,
32
- Azure, and Amazon to support CVMs.
32
+ The following sections show how you can set up your K8 clusters hosted by
33
+ Google, Azure, and Amazon to support CVMs.
33
34
34
35
### Google Cloud Platform w/ GKE
35
36
@@ -52,46 +53,46 @@ gcloud beta container clusters create "YOUR_NEW_CLUSTER" \
52
53
53
54
### Azure Kubernetes Service
54
55
55
- If you're using Kubernetes version 1.18, Azure defaults to the correct Ubuntu node
56
- base image. When creating your cluster, set ` --kubernetes-version ` to ` 1.18.x `
57
- or newer for CVMs.
56
+ If you're using Kubernetes version 1.18, Azure defaults to the correct Ubuntu
57
+ node base image. When creating your cluster, set ` --kubernetes-version ` to
58
+ ` 1.18.x ` or newer for CVMs.
58
59
59
60
### Amazon Web Services w/ EKS
60
61
61
62
You can modify an existing [ AWS-hosted container] ( ../../setup/kubernetes/aws.md )
62
- to support CVMs by [ creating a
63
- nodegroup] ( https://eksctl.io/usage/managing-nodegroups/#creating-a-nodegroup-from-a-config-file )
63
+ to support CVMs by
64
+ [ creating a nodegroup] ( https://eksctl.io/usage/managing-nodegroups/#creating-a-nodegroup-from-a-config-file )
64
65
and updating your ` eksctl ` config spec.
65
66
66
67
1 . Define your config file in the location of your choice (we've named the file
67
68
` coder-node.yaml ` , but you can call it whatever you'd like):
68
69
69
- ``` yaml
70
- apiVersion : eksctl.io/v1alpha5
71
- kind : ClusterConfig
70
+ ``` yaml
71
+ apiVersion : eksctl.io/v1alpha5
72
+ kind : ClusterConfig
72
73
73
- metadata :
74
- version : " 1.17"
75
- name : <YOUR_CLUSTER_NAME>
76
- region : <YOUR_AWS_REGION>
74
+ metadata :
75
+ version : " 1.17"
76
+ name : <YOUR_CLUSTER_NAME>
77
+ region : <YOUR_AWS_REGION>
77
78
78
- nodeGroups :
79
- - name : coder-node-group
80
- amiFamily : Ubuntu1804
81
- ` ` `
79
+ nodeGroups :
80
+ - name : coder-node-group
81
+ amiFamily : Ubuntu1804
82
+ ` ` `
82
83
83
84
1. Create your nodegroup (be sure to provide the correct file name):
84
85
85
- ` ` ` console
86
- eksctl create nodegroup --config-file=coder-node.yaml
87
- ```
86
+ ` ` ` console
87
+ eksctl create nodegroup --config-file=coder-node.yaml
88
+ ```
88
89
89
90
## Security
90
91
91
92
The [ Container-based Virtual Machine] ( ../../environments/cvms.md ) deployment
92
- option leverages the [sysbox container
93
- runtime](https://github.com/nestybox/sysbox) to offer a VM-like user experience
94
- while retaining the footprint of a typical container.
93
+ option leverages the
94
+ [ sysbox container runtime] ( https://github.com/nestybox/sysbox ) to offer a
95
+ VM-like user experience while retaining the footprint of a typical container.
95
96
96
97
Coder first launches a supervising container with additional privileges. This
97
98
container is standard and included with the Coder release package. During the
@@ -101,8 +102,8 @@ inner container is the user’s [environment](../../environments/index.md).
101
102
102
103
The user cannot gain access to the supervising container at any point. The
103
104
isolation between the user's environment container and its outer, supervising
104
- container is what provides [strong
105
- isolation](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/security.md).
105
+ container is what provides
106
+ [ strong isolation] ( https://github.com/nestybox/sysbox/blob/master/docs/user-guide/security.md ) .
106
107
107
108
## Image Configuration
108
109
@@ -111,8 +112,8 @@ and Docker for use in CVMs.
111
112
112
113
### systemd
113
114
114
- If your image's OS distribution doesn't link the `systemd` init to
115
- ` /sbin/init ` , you'll need to do this manually in your Dockerfile.
115
+ If your image's OS distribution doesn't link the ` systemd ` init to ` /sbin/init ` ,
116
+ you'll need to do this manually in your Dockerfile.
116
117
117
118
The following snippet shows how you can specify ` systemd ` as the init in your
118
119
image:
@@ -133,9 +134,9 @@ a `PID` of 1.
133
134
134
135
### Docker
135
136
136
- To add Docker, install the `docker` packages into your image. For a
137
- seamless experience, use [systemd](#systemd) and register the `docker` service
138
- so `dockerd` runs automatically during initialization.
137
+ To add Docker, install the ` docker ` packages into your image. For a seamless
138
+ experience, use [ systemd] ( #systemd ) and register the ` docker ` service so
139
+ ` dockerd ` runs automatically during initialization.
139
140
140
141
The following snippet shows how your image can register the ` docker ` services in
141
142
its Dockerfile.
0 commit comments