You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Feb 24, 2023. It is now read-only.
Copy file name to clipboardExpand all lines: README.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,9 @@
1
1
systemd-docker
2
2
==============
3
3
4
-
This is a wrapper for `docker run` so that you can sanely run Docker containers under systemd. The key thing that this wrapper does is move the container process from the cgroups setup by Docker to the service unit's cgroup. This handles a bunch of other quirks so please read through documentation to get understand all the implications of running Docker under systemd.
4
+
This is a wrapper for `docker run` so that you can sanely run Docker containers under systemd. The key thing that this wrapper does is move the container process from the cgroups setup by Docker to the service unit's cgroup. This handles a bunch of other quirks so please read through documentation to get an understanding of all the implications of running Docker under systemd.
5
5
6
-
Using this wrapper you can manages containers through `systemctl` or `docker` CLI and everything should just stay in sync. Additionally you can leverage all the cgroup functionality of systemd and the systemd-notify.
6
+
Using this wrapper you can manage containers through `systemctl` or the `docker` CLI and everything should just stay in sync. Additionally you can leverage all the cgroup functionality of systemd and systemd-notify.
7
7
8
8
Why I wrote this?
9
9
=================
@@ -19,7 +19,7 @@ Copy `systemd-docker` to `/opt/bin` (really anywhere you want). You can downloa
19
19
Quick Usage
20
20
===========
21
21
22
-
Basically, in your unit file use `systemd-docker run` instead of `docker run`. Here's and example unit file that runs nginx.
22
+
Basically, in your unit file use `systemd-docker run` instead of `docker run`. Here's an example unit file that runs nginx.
23
23
24
24
```ini
25
25
[Unit]
@@ -45,26 +45,26 @@ WantedBy=multi-user.target
45
45
Special Note About Named Containers
46
46
===================================
47
47
48
-
In short, it's best to always have `--name %n --rm` in your unit files`ExecStart`.
48
+
In short, it's best to always have `--name %n --rm` in your unit file's`ExecStart`.
49
49
50
50
The best way I've found to run containers under systemd is to always assign the container a name. Even better is to put `--name %n` in your unit file and then the name of the container will match the name of the service unit.
51
51
52
52
If you don't name your container, you will essentially be creating a new container on every start that will get orphaned. You're probably clever and thinking you can just add `--rm` and that will take care of the orphans. The problem with this is that `--rm` is not super reliable. By naming your container, `systemd-docker` will take extra care to keep the systemd unit and the container in sync. For example, if you do `--name %n --rm`, `systemd-docker` will ensure that the container is really deleted each time. The issue with `--rm` is that the remove is done from the client side. If the client dies, the container is not deleted.
53
53
54
-
If you do `--name %n --rm``systemd-docker` on start will look for the named container. If it exists and is stopped, it will be deleted. This is really important if you ever change your unit file. If you change your `ExecStart` command, and it is a named container, the old values will be saved in the stopped container. By ensuring the container is always deleted, you ensure the args in `ExecStart` are always in sync.
54
+
If you do `--name %n --rm`,`systemd-docker` on start will look for the named container. If it exists and is stopped, it will be deleted. This is really important if you ever change your unit file. If you change your `ExecStart` command, and it is a named container, the old values will be saved in the stopped container. By ensuring the container is always deleted, you ensure the args in `ExecStart` are always in sync.
55
55
56
56
Options
57
57
=======
58
58
59
59
Logging
60
60
-------
61
-
By default the containers stdout/stderr will be piped to the journal. If you do not want to use the journal, the add `--logs=false` to the beginning of the command. For example
61
+
By default the container's stdout/stderr will be piped to the journal. If you do not want to use the journal, add `--logs=false` to the beginning of the command. For example:
62
62
63
63
`ExecStart=/opt/bin/systemd-docker --logs=false run --rm --name %n nginx`
64
64
65
65
Environment Variables
66
66
---------------------
67
-
Using `Environment=` and `EnvironmentFile=` systemd can setup environment variables for you, but then unfortunately you have to do `run -e ABC=${ABC} -e XYZ=${XYZ}` in your unit file. You can have the systemd environment variables automatically transfered to your docker container by adding `--env`. This will essentially read all the current environ variable and add `-e ...` to your docker run command. For example
67
+
Using `Environment=` and `EnvironmentFile=`, systemd can set up environment variables for you, but then unfortunately you have to do `run -e ABC=${ABC} -e XYZ=${XYZ}` in your unit file. You can have the systemd environment variables automatically transfered to your docker container by adding `--env`. This will essentially read all the current environment variables and add the appropriate `-e ...`flags to your docker run command. For example:
68
68
69
69
```
70
70
EnvironmentFile=/etc/environment
@@ -76,12 +76,12 @@ The contents of `/etc/environment` will be added to your docker run command
76
76
Cgroups
77
77
-------
78
78
79
-
The main magic of how this works is that the container processes are moved from the Docker cgroups to the system unit cgroups. By default all application cgroups will be moved. This means by default you can't use `--cpuset` or `-m` in Docker. If you don't want to use the systemd cgroups, but instead use the Docker cgroups, you can control which cgroups are transfered using the `--cgroups` option. **Minimally you must set name=systemd otherwise systemd will lose track of the container**. For example
79
+
The main magic of how this works is that the container processes are moved from the Docker cgroups to the system unit cgroups. By default all application cgroups will be moved. This means by default you can't use `--cpuset` or `-m` in Docker. If you don't want to use the systemd cgroups, but instead use the Docker cgroups, you can control which cgroups are transfered using the `--cgroups` option. **Minimally you must set `name=systemd`; otherwise, systemd will lose track of the container**. For example
80
80
81
81
82
82
`ExecStart=/opt/bin/systemd-docker --cgroups name=systemd --cgroups=cpu run --rm --name %n nginx`
83
83
84
-
The above will use the `name=systemd` and `cpu` cgroups of systemd but then use Docker's cgroups for all the others, like the freezer cgroup.
84
+
The above command will use the `name=systemd` and `cpu` cgroups of systemd but then use Docker's cgroups for all the others, like the freezer cgroup.
85
85
86
86
Pid File
87
87
--------
@@ -98,7 +98,7 @@ By default `systemd-docker` will send READY=1 to the systemd notification socket
98
98
99
99
`ExecStart=/opt/bin/systemd-docker --notify run --rm --name %n nginx`
100
100
101
-
What this will do is setup a bind mount for the notification socket and then set the NOTIFY_SOCKET environment variable. If you are going to use this feature of systemd take some time to understand the quirks of it. More info in this [mailing list thread](http://comments.gmane.org/gmane.comp.sysutils.systemd.devel/18649). In short, systemd-notify is not reliable because often the child dies before systemd has time to determine which cgroup it is a member of
101
+
What this will do is set up a bind mount for the notification socket and then set the NOTIFY_SOCKET environment variable. If you are going to use this feature of systemd, take some time to understand the quirks of it. More info in this [mailing list thread](http://comments.gmane.org/gmane.comp.sysutils.systemd.devel/18649). In short, systemd-notify is not reliable because often the child dies before systemd has time to determine which cgroup it is a member of
0 commit comments