Documentation
¶
Overview ¶
Package dind runs private Docker daemons: one privileged docker:dind container per owner, reached as dind on the owner's own network, with the owner's work tree at the same path (/work) as in the owner's container. A chat on a worker keeps one for its session (internal/console/pi); an agent task on a worker has one from its start to its exit (internal/worker; design/operations/workers.md, "Private Docker on the worker").
Every daemon has the same DNS and mirror policy (DaemonOptions, BuildkitConfig) and its owner's limits (LimitArgs).
Every container here carries its owner in a label, and nothing with another owner is stopped or removed. A stop or removal is confirmed by asking Docker again; one it cannot confirm is an error.
Index ¶
- Constants
- func Builder(ctx context.Context, run Run, name, clientDir, config string) error
- func BuildkitConfig(mirror string) string
- func DaemonOptions(mirror string) []string
- func LimitArgs(cpus float64, memoryBytes, pids int64) []string
- func Missing(out []byte) bool
- func Ready(ctx context.Context, run Run, name string) error
- func Remove(ctx context.Context, run Run, name, ownerLabel, owner string) error
- func Start(image string, daemonFlags ...string) []string
- func State(ctx context.Context, run Run, name, ownerLabel, owner string) (exists, running bool, err error)
- func Stop(ctx context.Context, run Run, name, ownerLabel, owner string) error
- func TrustBuilder(ctx context.Context, run Run, name, clientDir string) error
- type Daemon
- type Run
Constants ¶
const BuilderContainer = "buildx_buildkit_apptown0"
BuilderContainer is the container the buildx builder apptown runs in, inside the private daemon (driver docker-container, its one node).
Variables ¶
This section is empty.
Functions ¶
func Builder ¶
Builder makes the buildx builder apptown, the default, in the client state at clientDir (a path in the daemon's container, shared with the owner's container), with the buildkit configuration at config. network=host puts buildkit in the daemon's own network namespace, where its DNS answers; builds load by default, so `docker build -t app .; docker run app` works. One already there is kept.
func BuildkitConfig ¶
BuildkitConfig is the builder's configuration under the same policy.
func DaemonOptions ¶
DaemonOptions are a private daemon's DNS and mirror flags, the same for steps, tasks and chats: this machine's resolvers and search domains, and the mirror ("" none).
func LimitArgs ¶
LimitArgs are a container's CPU, memory and PID limits. Memory includes swap: the limit is the memory there is. A caller refuses a zero first: zero is never "unlimited".
func Missing ¶
Missing reports Docker's own answer that there is no such object: the one classifier of "gone" for every Docker command the apptown runs. Only an answer from the daemon or the CLI counts. Anything else, a daemon that could not be asked included, is not absence: "no such file or directory" from a missing socket also says "no such", and once let a cleanup that never reached Docker record its containers removed.
func Remove ¶
Remove removes an owner's container with its anonymous volumes (a daemon's images and containers), and confirms it is gone.
func Start ¶
Start is the end of a private daemon's docker run arguments: the image, started so that it first trusts the extra certificates this machine's containers are given (internal/trust), then runs the image's own entrypoint with the daemon's flags. It runs as root, so they join its system store, which dockerd reads for its pulls.
func State ¶
func State(ctx context.Context, run Run, name, ownerLabel, owner string) (exists, running bool, err error)
State reads whether an owner's container exists and runs. One with another owner is an error.
func Stop ¶
Stop stops an owner's container and confirms it has stopped. One that does not exist is stopped.
func TrustBuilder ¶
TrustBuilder gives the builder apptown, just created in the private daemon name, the extra certificates: buildkit pulls base images itself, with its own container's roots. It starts the builder, runs the script in its container (as root, into its system store) and restarts it, so buildkit reads them, before any build. Nothing when there is no script.
Types ¶
type Daemon ¶
type Daemon struct {
Name, Network, Image string
// OwnerLabel=Owner is on the container; nothing is changed that
// carries another owner.
OwnerLabel, Owner string
// Args are the owner's own docker run flags: its labels, mounts and
// limits.
Args []string
// Options are the daemon's own flags: DNS, search domains, the mirror.
Options []string
}
Daemon is one private daemon's container.
Source Files