|
...
|
...
|
@@ -1,8 +1,8 @@
|
|
1
|
|
-page_title: Docker Run Reference
|
|
|
1
|
+page_title: Docker run reference
|
|
2
|
2
|
page_description: Configure containers at runtime
|
|
3
|
3
|
page_keywords: docker, run, configure, runtime
|
|
4
|
4
|
|
|
5
|
|
-# Docker Run Reference
|
|
|
5
|
+# Docker run reference
|
|
6
|
6
|
|
|
7
|
7
|
**Docker runs processes in isolated containers**. When an operator
|
|
8
|
8
|
executes `docker run`, she starts a process with its own file system,
|
|
...
|
...
|
@@ -14,7 +14,7 @@ the container from the image. That's the main reason
|
|
14
|
14
|
[*run*](/reference/commandline/cli/#run) has more options than any
|
|
15
|
15
|
other `docker` command.
|
|
16
|
16
|
|
|
17
|
|
-## General Form
|
|
|
17
|
+## General form
|
|
18
|
18
|
|
|
19
|
19
|
The basic `docker run` command takes this form:
|
|
20
|
20
|
|
|
...
|
...
|
@@ -39,7 +39,7 @@ behavior, allowing them to override all defaults set by
|
|
39
|
39
|
the developer during `docker build` and nearly all the defaults set by
|
|
40
|
40
|
the Docker runtime itself.
|
|
41
|
41
|
|
|
42
|
|
-## Operator Exclusive Options
|
|
|
42
|
+## Operator exclusive options
|
|
43
|
43
|
|
|
44
|
44
|
Only the operator (the person executing `docker run`) can set the
|
|
45
|
45
|
following options.
|
|
...
|
...
|
@@ -55,7 +55,7 @@ following options.
|
|
55
|
55
|
- [Runtime Constraints on CPU and Memory](#runtime-constraints-on-cpu-and-memory)
|
|
56
|
56
|
- [Runtime Privilege, Linux Capabilities, and LXC Configuration](#runtime-privilege-linux-capabilities-and-lxc-configuration)
|
|
57
|
57
|
|
|
58
|
|
-## Detached vs Foreground
|
|
|
58
|
+## Detached vs foreground
|
|
59
|
59
|
|
|
60
|
60
|
When starting a Docker container, you must first decide if you want to
|
|
61
|
61
|
run the container in the background in a "detached" mode or in the
|
|
...
|
...
|
@@ -97,7 +97,7 @@ For interactive processes (like a shell) you will typically want a tty
|
|
97
|
97
|
as well as persistent standard input (`STDIN`), so you'll use `-i -t`
|
|
98
|
98
|
together in most interactive cases.
|
|
99
|
99
|
|
|
100
|
|
-## Container Identification
|
|
|
100
|
+## Container identification
|
|
101
|
101
|
|
|
102
|
102
|
### Name (–-name)
|
|
103
|
103
|
|
|
...
|
...
|
@@ -116,7 +116,7 @@ add meaning to a container since you can use this name when defining
|
|
116
|
116
|
other place you need to identify a container). This works for both
|
|
117
|
117
|
background and foreground Docker containers.
|
|
118
|
118
|
|
|
119
|
|
-### PID Equivalent
|
|
|
119
|
+### PID equivalent
|
|
120
|
120
|
|
|
121
|
121
|
Finally, to help with automation, you can have Docker write the
|
|
122
|
122
|
container ID out to a file of your choosing. This is similar to how some
|
|
...
|
...
|
@@ -131,7 +131,7 @@ While not strictly a means of identifying a container, you can specify a version
|
|
131
|
131
|
image you'd like to run the container with by adding `image[:tag]` to the command. For
|
|
132
|
132
|
example, `docker run ubuntu:14.04`.
|
|
133
|
133
|
|
|
134
|
|
-## Network Settings
|
|
|
134
|
+## Network settings
|
|
135
|
135
|
|
|
136
|
136
|
--dns=[] : Set custom dns servers for the container
|
|
137
|
137
|
--net="bridge" : Set the Network mode for the container
|
|
...
|
...
|
@@ -213,7 +213,7 @@ container itself as well as `localhost` and a few other common things. The
|
|
213
|
213
|
::1 localhost ip6-localhost ip6-loopback
|
|
214
|
214
|
86.75.30.9 db-static
|
|
215
|
215
|
|
|
216
|
|
-## Clean Up (–-rm)
|
|
|
216
|
+## Clean up (–-rm)
|
|
217
|
217
|
|
|
218
|
218
|
By default a container's file system persists even after the container
|
|
219
|
219
|
exits. This makes debugging a lot easier (since you can inspect the
|
|
...
|
...
|
@@ -225,7 +225,7 @@ the container exits**, you can add the `--rm` flag:
|
|
225
|
225
|
|
|
226
|
226
|
--rm=false: Automatically remove the container when it exits (incompatible with -d)
|
|
227
|
227
|
|
|
228
|
|
-## Security Configuration
|
|
|
228
|
+## Security configuration
|
|
229
|
229
|
--security-opt="label:user:USER" : Set the label user for the container
|
|
230
|
230
|
--security-opt="label:role:ROLE" : Set the label role for the container
|
|
231
|
231
|
--security-opt="label:type:TYPE" : Set the label type for the container
|
|
...
|
...
|
@@ -261,7 +261,7 @@ Note:
|
|
261
|
261
|
|
|
262
|
262
|
You would have to write policy defining a `svirt_apache_t` type.
|
|
263
|
263
|
|
|
264
|
|
-## Runtime Constraints on CPU and Memory
|
|
|
264
|
+## Runtime constraints on CPU and memory
|
|
265
|
265
|
|
|
266
|
266
|
The operator can also adjust the performance parameters of the
|
|
267
|
267
|
container:
|
|
...
|
...
|
@@ -279,7 +279,7 @@ get the same proportion of CPU cycles, but you can tell the kernel to
|
|
279
|
279
|
give more shares of CPU time to one or more containers when you start
|
|
280
|
280
|
them via Docker.
|
|
281
|
281
|
|
|
282
|
|
-## Runtime Privilege, Linux Capabilities, and LXC Configuration
|
|
|
282
|
+## Runtime privilege, Linux capabilities, and LXC configuration
|
|
283
|
283
|
|
|
284
|
284
|
--cap-add: Add Linux capabilities
|
|
285
|
285
|
--cap-drop: Drop Linux capabilities
|
|
...
|
...
|
@@ -347,7 +347,7 @@ Note that in the future, a given host's docker daemon may not use LXC, so this
|
|
347
|
347
|
is an implementation-specific configuration meant for operators already
|
|
348
|
348
|
familiar with using LXC directly.
|
|
349
|
349
|
|
|
350
|
|
-## Overriding Dockerfile Image Defaults
|
|
|
350
|
+## Overriding Dockerfile image defaults
|
|
351
|
351
|
|
|
352
|
352
|
When a developer builds an image from a [*Dockerfile*](/reference/builder/#dockerbuilder)
|
|
353
|
353
|
or when she commits it, the developer can set a number of default parameters
|
|
...
|
...
|
@@ -367,7 +367,7 @@ Dockerfile instruction and how the operator can override that setting.
|
|
367
|
367
|
- [USER](#user)
|
|
368
|
368
|
- [WORKDIR](#workdir)
|
|
369
|
369
|
|
|
370
|
|
-## CMD (Default Command or Options)
|
|
|
370
|
+## CMD (default command or options)
|
|
371
|
371
|
|
|
372
|
372
|
Recall the optional `COMMAND` in the Docker
|
|
373
|
373
|
commandline:
|
|
...
|
...
|
@@ -383,7 +383,7 @@ image), you can override that `CMD` instruction just by specifying a new
|
|
383
|
383
|
If the image also specifies an `ENTRYPOINT` then the `CMD` or `COMMAND`
|
|
384
|
384
|
get appended as arguments to the `ENTRYPOINT`.
|
|
385
|
385
|
|
|
386
|
|
-## ENTRYPOINT (Default Command to Execute at Runtime)
|
|
|
386
|
+## ENTRYPOINT (default command to execute at runtime)
|
|
387
|
387
|
|
|
388
|
388
|
--entrypoint="": Overwrite the default entrypoint set by the image
|
|
389
|
389
|
|
|
...
|
...
|
@@ -406,7 +406,7 @@ or two examples of how to pass more parameters to that ENTRYPOINT:
|
|
406
|
406
|
$ sudo docker run -i -t --entrypoint /bin/bash example/redis -c ls -l
|
|
407
|
407
|
$ sudo docker run -i -t --entrypoint /usr/bin/redis-cli example/redis --help
|
|
408
|
408
|
|
|
409
|
|
-## EXPOSE (Incoming Ports)
|
|
|
409
|
+## EXPOSE (incoming ports)
|
|
410
|
410
|
|
|
411
|
411
|
The Dockerfile doesn't give much control over networking, only providing
|
|
412
|
412
|
the `EXPOSE` instruction to give a hint to the operator about what
|
|
...
|
...
|
@@ -446,7 +446,7 @@ then the client container can access the exposed port via a private
|
|
446
|
446
|
networking interface. Docker will set some environment variables in the
|
|
447
|
447
|
client container to help indicate which interface and port to use.
|
|
448
|
448
|
|
|
449
|
|
-## ENV (Environment Variables)
|
|
|
449
|
+## ENV (environment variables)
|
|
450
|
450
|
|
|
451
|
451
|
When a new container is created, Docker will set the following environment
|
|
452
|
452
|
variables automatically:
|
|
...
|
...
|
@@ -555,7 +555,7 @@ mechanism to communicate with a linked container by its alias:
|
|
555
|
555
|
If you restart the source container (`servicename` in this case), the recipient
|
|
556
|
556
|
container's `/etc/hosts` entry will be automatically updated.
|
|
557
|
557
|
|
|
558
|
|
-## VOLUME (Shared Filesystems)
|
|
|
558
|
+## VOLUME (shared filesystems)
|
|
559
|
559
|
|
|
560
|
560
|
-v=[]: Create a bind mount with: [host-dir]:[container-dir]:[rw|ro].
|
|
561
|
561
|
If "container-dir" is missing, then docker creates a new volume.
|