Blog posts

Friends Don't Let Friends Run Docker on Loopback in Production

I’ve heard negative things about the Fedora|CentOS Docker storage configuration in the past, and while manning the Red Hat booth in San Francisco at DockerCon last week, I spoke to a number of people who’ve experienced these storage issues themselves.

Much of the trouble, I think, boils down to how Docker in Fedora and CentOS have shipped with a storage configuration that optimizes for a convenient getting started experience that can lead to inconvenience down the road.

I’ll cover how to reconfigure your Docker installation w/ better-performing storage, but first, a bit of background:

CentOS Atomic Host Released

We would like to announce the general availability of CentOS Atomic Host (May 2015), a lean operating system designed to run Docker containers, derived from Red Hat Enterprise Linux Atomic Host (7.1.2), and built from standard CentOS 7 RPMs.

CentOS Atomic Host is produced by the CentOS Atomic SIG, based on upstream work from Project Atomic.

Project Atomic Online Meetup Wednesday

Still wondering what this Atomic stuff is all about? Want a quick primer on Project Atomic?

Join us on Wednesday at 2 p.m. Eastern for a high level introduction to Project Atomic and its components. We’ll look at all the “pieces” of Atomic, from Atomic Host, to rpm-ostree, the Atomic command (/usr/bin/atomic), Nulecule, and Atomic App.

The event is hosted on BlueJeans, you can view the event using your Browser (a plugin is required for Firefox) or using the BlueJeans app on iOS or Android.

To join, visit https://a2m.bluejeans.com/a2m/live-event/ch34638 on Wednesday, 17 June at 2 p.m. Eastern.

This will be part of a regular series of online events about Project Atomic and its components. Keep your eyes on the Project Atomic blog for upcoming events!

Using Volumes with Docker can Cause Problems with SELinux

When using SELinux for controlling processes within a container, you need to make sure any content that gets volume mounted into the container is readable, and potentially writable, depending on the use case.

By default, Docker container processes run with the system_u:system_r:svirt_lxc_net_t:s0 label. The svirt_lxc_net_t type is allowed to read/execute most content under /usr, but it is not allowed to use most other types on the system.

See you at Southeast LinuxFest (SELF)

Heading to the SouthEast LinuxFest this weekend? If so, be sure to stop by the Red Hat booth to pick up some Project Atomic shirts and stickers!

If you’re looking about talks relevant to Atomic, you can catch my talk on Saturday All You Wanted to Know About Linux Containers at 2:45, or Containers and the Future of Open Source Software Delivery on Sunday at 11:30.

Michael Solberg will be speaking after lunch on Sunday (1:30) on Streamlining Agile Linux Development with Docker and RHEL Atomic.

Also interesting, though not directly related to Atomic, Tom Callaway and Ruth Suehle will be talking about Raspberry Pi on Saturday at 1:30, Tom Callaway will be covering How to Understand FOSS Licenses without a Lawyer at 5:15 on Saturday, and Brian Proffitt will deliver It’s Metaphors All the Way Down on Sunday at 2:45.

Running Cockpit as a service in Fedora 22 Atomic Host

With the release of Fedora 22 Atomic host, the Cockpit Project team changed the way cockpit was delivered. You can read more about the change on the Cockpit Project wiki page. The team is currently uploading the cockpit container to the Fedora repo on the Docker Hub, but Fedora Release Engineering is working on publishing layered images. We now have a super-privileged container (SPC) for the web service (cockpit-ws) with the bridge, shell, and docker components installed by default on the Atomic host.

cockpit-shell-0.55-1.fc22.noarch
cockpit-docker-0.55-1.fc22.x86_64
cockpit-bridge-0.55-1.fc22.x86_64

Project Atomic Comes to Japan

In case you missed the news on Twitter, we’re taking this show on the road! Specifically, we have a few opportunities to learn more about Project Atomic in Tokyo, Japan.

Next week, I’ll be attending LinuxCon Japan to speak about Project Atomic and the traditional package problems.

We’ll also be hosting a Meetup in Ebisu on 2 June at the Red Hat Tokyo office! If you’re local to Tokyo (or can get there easily) then you should definitely sign up and check out the Meetup!

Have a meetup, talk, or event where you’re discussing Project Atomic and want to spread the word? Shoot me an email to jzb at Red Hat or find me on Twitter.

Atomic App 0.1.1

We are pleased to announce Atomic App 0.1.1! Find it at github and docker hub.

Atomic App is the reference implementation of the Nulecule Specification for composite applications. It can be used to bootstrap container applications and to install/deploy and run them. One of the key design goals of the Nulecule spec is to be container and orchestration engine agnostic, so that any developer or operator could successfully build, test, install, run, and manage composite container applications regardless of tooling.

In that same vein, Atomic App is designed to be provider agnostic, whether you want to run your application in a Kubernetes, OpenShift, or plain container environment, like Docker. It’s this multi-provider support feature that we are emphasizing for this release: building a Nulecule application results in a portable container that can be run in a wide variety of environments, and Atomic App takes the Nulecule application container and allows the operator to easily run a composite application in their chosen environment with their chosen providers.

It is in the spirit of portability that we announce a major milestone for Atomic App: support for OpenShift v3 as a provider. And for developers of Nulecule applications, we have also added some new and exciting developer features.

Fedora 22 Released with Atomic Hosts

A quick note for folks who might have missed the announcement yesterday, Fedora 22 was officially released, along with Atomic images for OpenStack/KVM, Amazon EC2, and Vagrant.

The Vagrant images are suitable for VirtualBox and libvirt/KVM, so they’re usable on Linux (libvirt), or Mac OS X and Windows (VirtualBox) with the appropriate Vagrant providers. Josef Stříbný has written up a short tutorial on using Vagrant images on Fedora 22 on Fedora Magazine.

Of course, Fedora 22 also includes the Workstation and Server editions – and the Fedora 22 Docker image will be available via the Docker Hub very soon.

Questions or feedback on the Fedora 22 Atomic host release? Talk to us on the Fedora Cloud mailing list, or fire up your favorite IRC client and head to Freenode in the #fedora-cloud channel.

Building and running live Atomic from PXE with iSCSI

In this post I’ll show how to build live Atomic Host image that can be run on diskless machine using PXE boot. Once we have the images, I’ll show you how to run the live system and customize it with boot options and cloud-config for better use of resources, leading to the goal of storing Docker images on iSCSI devices.