Browse code

Add example for device-cgroup-rule to man

Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>

Kenfe-Mickael Laventure authored on 2017/01/14 02:05:29
Showing 3 changed files
... ...
@@ -62,6 +62,18 @@ func loadLongDescription(cmd *cobra.Command, path string) error {
62 62
 			return err
63 63
 		}
64 64
 		cmd.Long = string(content)
65
+
66
+		fullpath = filepath.Join(path, cmd.Name()+"-example.md")
67
+		if _, err := os.Stat(fullpath); err != nil {
68
+			continue
69
+		}
70
+
71
+		content, err = ioutil.ReadFile(fullpath)
72
+		if err != nil {
73
+			return err
74
+		}
75
+		cmd.Example = string(content)
76
+
65 77
 	}
66 78
 	return nil
67 79
 }
68 80
new file mode 100644
... ...
@@ -0,0 +1,35 @@
0
+### Specify isolation technology for container (--isolation)
1
+
2
+This option is useful in situations where you are running Docker containers on
3
+Windows. The `--isolation=<value>` option sets a container's isolation
4
+technology. On Linux, the only supported is the `default` option which uses
5
+Linux namespaces. On Microsoft Windows, you can specify these values:
6
+
7
+* `default`: Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value.
8
+* `process`: Namespace isolation only.
9
+* `hyperv`: Hyper-V hypervisor partition-based isolation.
10
+
11
+Specifying the `--isolation` flag without a value is the same as setting `--isolation="default"`.
12
+
13
+### Dealing with dynamically created devices (--device-cgroup-rule)
14
+
15
+Devices available to a container are assigned at creation time. The
16
+assigned devices will both be added to the cgroup.allow file and
17
+created into the container once it is run. This poses a problem when
18
+a new device needs to be added to running container.
19
+
20
+One of the solution is to add a more permissive rule to a container
21
+allowing it access to a wider range of devices. For example, supposing
22
+our container needs access to a character device with major `42` and
23
+any number of minor number (added as new devices appear), the
24
+following rule would be added:
25
+
26
+```
27
+docker create --device-cgroup-rule='c 42:* rmw' -name my-container my-image
28
+```
29
+
30
+Then, a user could ask `udev` to execute a script that would `docker exec my-container mknod newDevX c 42 <minor>`
31
+the required device when it is added.
32
+
33
+NOTE: initially present devices still need to be explicitely added to
34
+the create/run command
... ...
@@ -6,7 +6,7 @@ any point.
6 6
 
7 7
 The initial status of the container created with **docker create** is 'created'.
8 8
 
9
-# OPTIONS 
9
+### OPTIONS 
10 10
 
11 11
 The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR`
12 12
 can be an absolute path or a `name` value. A `name` value must start with an
... ...
@@ -82,18 +82,3 @@ change propagation properties of source mount. Say `/` is source mount for
82 82
 
83 83
 To disable automatic copying of data from the container path to the volume, use
84 84
 the `nocopy` flag. The `nocopy` flag can be set on bind mounts and named volumes.
85
-
86
-# EXAMPLES
87
-
88
-## Specify isolation technology for container (--isolation)
89
-
90
-This option is useful in situations where you are running Docker containers on
91
-Windows. The `--isolation=<value>` option sets a container's isolation
92
-technology. On Linux, the only supported is the `default` option which uses
93
-Linux namespaces. On Microsoft Windows, you can specify these values:
94
-
95
-* `default`: Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value.
96
-* `process`: Namespace isolation only.
97
-* `hyperv`: Hyper-V hypervisor partition-based isolation.
98
-
99
-Specifying the `--isolation` flag without a value is the same as setting `--isolation="default"`.