694
回編集
「Debian活用/仮想マシン設定」の版間の差分
ナビゲーションに移動
検索に移動
→Docker
(→Docker) |
|||
| (同じ利用者による、間の27版が非表示) | |||
|
== 設定 ==
=== nftables ===
<nowiki>
$ sudo systemctl reload nftables
$ sudo systemctl restart lxc-net
$ sudo systemctl restart docker
$ sudo nft list ruleset
</nowiki>
=== libvirt ===
<nowiki>
$ sudo adduser
$ newgrp libvirt
$ sudo virsh net-start default
</nowiki>
/etc/nftables.conf
<nowiki>
table inet filter {
chain input {
iifname "virbr0" udp dport {53,67} accept
iifname "virbr0" tcp dport 53 accept
}
chain forward {
iifname "virbr0" accept
oifname "virbr0" ct state established,related accept
}
}
</nowiki>
=== bridge接続 ===
※ifupdownやconnmanなどが起動しているなら停止する。
<nowiki>
sudo apt install systemd-resolved
resolvectl status
</nowiki>
=== LXC(Unprivileged) ===
~/.config/lxc/lxc.conf
<nowiki>
lxc.lxcpath = /lxc
</nowiki>
* /etc/subuid
* /etc/subgid
<nowiki>
USER:100000:65536
</nowiki>
~/.config/lxc/default.conf
<nowiki>
lxc.include = /etc/lxc/default.conf
lxc.idmap = u 0 100000 65536
lxc.idmap = g 0 100000 65536
</nowiki>
<nowiki>
$ lxc-create -n debian -t download
</nowiki>
/lxc/debian/config
<nowiki>
lxc.apparmor.profile = lxc-container-default-with-nesting
</nowiki>
/etc/lxc/lxc-usernet
<nowiki>
USER veth lxcbr0 10
</nowiki>
/etc/nftables.conf
<nowiki>
table inet filter {
chain input {
iifname "lxcbr0" udp dport {53,67} accept
iifname "lxcbr0" tcp dport 53 accept
}
chain forward {
iifname "lxcbr0" accept
oifname "lxcbr0" ct state established,related accept
}
}
</nowiki>
<nowiki>
$ lxc-start -n debian
$ lxc-attach -n debian
$ lxc-stop -n debian
</nowiki>
==== 削除 ====
<nowiki>
$ lxc-stop -n debian
$ lxc-destroy -n debian
</nowiki>
==== bridge接続 ====
/etc/lxc/lxc-usernet
<nowiki>
USER veth br0 10
</nowiki>
/lxc/debian/config
<nowiki>
lxc.net.0.link = br0
</nowiki>
=== Docker ===
<nowiki>
sudo adduser USER docker
</nowiki>
/etc/docker/daemon.json
<nowiki>
{
"data-root": "/docker"
}
</nowiki>
※ver.29では、containerdが使われている
/etc/containerd/config.toml
<nowiki>
#root = "/var/lib/containerd"
</nowiki>
/etc/nftables.conf
<nowiki>
table inet filter {
chain input {
# Docker
iifname "docker0" udp dport {53,67} accept
iifname "docker0" tcp dport 53 accept
}
chain forward {
# Docker
iifname "docker0" accept
oifname "docker0" ct state established,related accept
}
}
</nowiki>
<nowiki>
$ docker pull debian:trixie
$ docker images
$ docker run --name debian-trixie -it debian:trixie bash
$ docker rm debian-trixie
</nowiki>
==== apache ====
Dockerfile
<nowiki>
FROM debian:trixie
RUN apt update && \
apt install -y apache2 && \
rm -rf /var/lib/apt/lists/*
EXPOSE 80
CMD ["/usr/sbin/apache2ctl", "-D", "FOREGROUND"]
</nowiki>
<nowiki>
$ docker build -t apache .
$ docker run -d \
--name web \
-p 8080:80 \
apache
</nowiki>
| |||