Docker

docker run -d -it --name devtest --mount type=bind,source="$(pwd)"/aaa,target=/aaa nginx:latest

docker inspect devtest

  $ docker exec -it devtest /bin/sh

  > cd /app
  > ls
test1 test2

$ rm -rf /tmp/aaa

  $ docker exec -it devtest /bin/sh

  > cd /app
  > ls
(何も出ない)

$ cp -r /tmp/bbb /tmp/aaa

  $ docker exec -it devtest /bin/sh

  > cd /ap
  > ls
(何も出ない)

docker inspect devtest

docker run -d -p 80:80 --name webserver nginx

docker stop webserver

sudo make build # environment
sudo make binary # binary
sudo chown -R $USER:$USER . # なくてもいい

sudo service docker stop # 現状デーモン停止
sudo ./bundles/binary-daemon/dockerd

docker build . --progress plain --no-cache -t test

docker-compose logs -f

container:
  extra_hosts:
    - "host.docker.internal:host-gateway"

sudo gpasswd -a $(whoami) docker
id $(whoami) # dockerが追加されたのを確認する

docker build --target build -t ghcr.io/kijimad/roam-build:master --cache-from ghcr.io/kijimad/roam-build:master --build-arg BUILDKIT_INLINE_CACHE=1 .
docker push ghcr.io/kijimad/roam-build:master

COPY package.json $HOME/
COPY front/ $HOME/front/ # front にはビルド対象のjs, tsファイルが配置されている想定。サブモジュールを導入している場合、package.jsonは階層上に複数あるため、COPYしておく必要がある

RUN npm install

COPY babel.config.js $HOME/
COPY tsconfig.json $HOME/
COPY webpack.config.js $HOME/

RUN yarn run build

COPY --from=rails-yarn-build $HOME/public/webpack/ $HOME/public/webpack/

# 共通のimage名: app
# imageのワーキングディレクトリ: /app
version: '3.7'

services:
  mysql:
    image: mysql:latest
    ports:
      - '${MYSQL_PORT:-3306}:3306'
    environment:
      # DBクライアントでの接続時に必要なので明示する
      MYSQL_DATABASE: develop
      MYSQL_ROOT_PASSWORD: root
      MYSQL_USER: user
      MYSQL_PASSWORD: password
      MYSQL_ALLOW_EMPTY_PASSWORD: 'yes'
    volumes:
      - 'mysql-data:/var/lib/mysql'

  redis:
    image: redis:latest
    ports:
      - '${REDIS_PORT:-6379}:6379'

  memcached:
    image: memcached:latest
    ports:
      - '${MEMCACHED_PORT:-11212}:11211'

  rails:
    image: app
    environment:
      RAILS_ENV: development
      REDIS_URL: 'redis://redis:6379'
      MEMCACHED: 'memcached:11211'
      DATABASE_URL: 'mysql2://root@mysql:3306'
    depends_on:
      - mysql
      - redis
      - memcached
      - bundle
      - yarn
      - seed
    command: bash -c 'bundle exec rails s -b 0.0.0.0'
    volumes:
      - .:/app:delegated # delegatedで高速化
      - gem_data:/usr/local/bundle:delegated # package系は永続化して最初からinstallにならないようにする
      - node_modules:/app/node_modules:delegated
    ports:
      - '3000:3000'

  webpack:
    image: app
    environment:
      NODE_ENV: development
      WEBPACKER_DEV_SERVER_HOST: 0.0.0.0
    command: bash -c 'yarn watch'
    volumes:
      - .:/app:delegated
      - node_modules:/app/node_modules:delegated
    ports:
      - 8080:8080

  sidekiq:
    image: app
    command: bash -c 'bundle exec sidekiq -C config/sidekiq.yml'
    environment:
      REDIS_URL: 'redis://redis:6379'
      DATABASE_URL: 'mysql2://root@mysql:3306'
    volumes:
      - .:/app:delegated
      - gem_data:/usr/local/bundle:delegated
    links:
      - mysql
      - redis

  bundle:
    image: app
    environment:
      RAILS_ENV: development
    volumes:
      - .:/app:delegated
      - gem_data:/usr/local/bundle:delegated
    command: bash -c "bundle install --jobs 8" # マシンがいくつ並列処理できるかは`$ getconf _NPROCESSORS_ONLN` で調べられる

  yarn:
    image: app
    environment:
      NODE_ENV: development
    volumes:
      - .:/app:delegated
      - node_modules:/app/node_modules:delegated
    command: bash -c "yarn install"

  seed:
    image: app
    environment:
      DATABASE_URL: 'mysql2://root@mysql:3306'
    volumes:
      - .:/app:delegated
      - gem_data:/usr/local/bundle:delegated
    command: bash -c "rake db:seed_fu"

volumes:
  gem_data:
  node_modules:
  mysql_data:

#! /bin/bash

set -e

if [ -f tmp/pids/server.pid ]; then
  rm -f tmp/pids/server.pid
fi

cat << EOF

  ░░▄████████████▄▐█▄▄▄▄█▌░
  ░░████████████████▌▀▀██▀▀░░
  ░░████▄████████████▄▄█▌░░░░
  ░░▄▄▄▄▄██████████████▀ ░░░░

EOF

exec "$@"

sudo service docker restart

docker stop $(docker ps -q) # 全コンテナ停止
docker rm $(docker ps -q -a) # 全コンテナ削除
docker rmi $(docker images -q) # 全イメージ削除:

docker system prune

docker builder prune

ADD . /myapp

COPY docker-entrypoint.sh /usr/local/bin

ENTRYPOINT ["docker-entrypoint.sh"]

#!/bin/sh

set -e

if [ -f tmp/pids/server.pid ]; then
  rm tmp/pids/server.pid
fi

echo "Waiting for Postgres to start..."
while ! nc -z postgres 5432; do sleep 0.1; done
echo "Postgres is up"

echo "Waiting for Redis to start..."
while ! nc -z redis 6379; do sleep 0.1; done
echo "Redis is up - execuring command"

exec bundle exec "$@"

docker run --rm -v "$PWD/":/roam -w /roam ghcr.io/kijimad/roam:master sh deploy.sh

docker run --rm -it ghcr.io/kijimad/roam:master

export COMPOSE_DOCKER_CLI_BUILD=1
export DOCKER_BUILDKIT=1
docker build .

docker run --rm -v "$PWD":/roam -v /roam/node_modules ghcr.io/kijimad/roam_lint:master make textlint

$ dockle ghcr.io/kijimad/roam:4f3296b
FATAL   - DKL-DI-0001: Avoid sudo command
        * Avoid sudo in container : /bin/sh -c yum -y update &&     yum -y install         yum-utils
      gcc         gcc-c++         make         openssl-devel         openssh-server         readline
nuplot
WARN    - CIS-DI-0001: Create a user for the container
        * Last user should not be root
INFO    - CIS-DI-0005: Enable Content trust for Docker
        * export DOCKER_CONTENT_TRUST=1 before docker pull/build
INFO    - CIS-DI-0006: Add HEALTHCHECK instruction to the container image
        * not found HEALTHCHECK statement
INFO    - CIS-DI-0008: Confirm safety of setuid/setgid files
        * setgid file: g--x--x--x usr/libexec/openssh/ssh-keysign
        * setuid file: urwxr-xr-x usr/sbin/pam_timestamp_check
        * setuid file: urwxr-xr-x usr/bin/mount
        * setgid file: grwx--x--x usr/libexec/utempter/utempter
        * setuid file: urwxr-xr-x usr/bin/chage
        * setuid file: urwxr-xr-x usr/bin/su
        * setuid file: urwxr-x--- usr/libexec/dbus-1/dbus-daemon-launch-helper
        * setuid file: urwxr-xr-x usr/sbin/unix_chkpwd
        * setuid file: u--x--x--x usr/bin/sudo
        * setgid file: g--x--x--x usr/bin/ssh-agent
        * setuid file: urwxr-xr-x usr/bin/umount
        * setuid file: urwxr-xr-x usr/bin/gpasswd
        * setuid file: urwxr-xr-x usr/bin/newgrp
        * setgid file: grwxr-xr-x usr/bin/write
INFO    - DKL-LI-0003: Only put necessary files
        * Suspicious directory : roam/.git
        * Suspicious directory : usr/local/plugins/ruby-build/.git
        * Suspicious directory : usr/local/plugins/ruby-build/test/tmp
        * Suspicious directory : tmp
        * unnecessary file : roam/docker-compose.yml
        * unnecessary file : roam/Dockerfile

#!/bin/sh

LC=$(git rev-parse --short HEAD)
docker build -t ghcr.io/kijimad/webapp:${LC} .
docker push ghcr.io/kijimad/webapp:${LC}

sudo chown -R $USER:$USER .

volumes:
  - /etc/passwd:/etc/passwd:ro
  - /etc/group:/etc/group:ro

sudo docker run -u "$(id -u $USER):$(id -g $USER)" rails /bin/sh
sudo docker-compose run -u "$(id -u $USER):$(id -g $USER)" rails /bin/sh

sudo docker-compose -f docker-compose.yml -f docker-compose-app.override.yml run -u "$(id -u $USER):$(id -g $USER)" rails /bin/sh

docker-compose run {サービス名} {shellコマンド}

docker-compose exec {サービス名} {shellコマンド}

docker-compose build --no-cache

docker-compose up --build -d # コンテナ作成する
docker-compose down

CMD bundle exec rails server -b 0.0.0.0

docker run -p 8000:3000 -it bdd92ace66ec

docker ps -a # id確認
docker logs 1111... # idを入れる

docker images prone

docker stop $(docker ps -q)
docker rm $(docker ps -aq)
docker rmi $(docker images -q)

$ sudo unshare -u /bin/bash
# ユーザがrootになった
$ hostname newhost && hostname
-> newhost
# ホスト名を変更した
$ which emacs
-> /usr/bin/emacs # unshareしてない状態だとEmacsはguixディレクトリ化に入っているので、確かに環境が別になっている

docker compose cp doc:/usr/share/nginx/html ./

docker network ls

docker run -itd --rm --name test1 busybox
docker run -itd --rm --name test2 busybox

ip address show

bridge link

docker inspect bridge

docker run -itd --rm --network host --name test3 nginx

curl -I http://localhost
curl -I http://172.17.0.1

https://github.com/kd-collective/buildkit/blob/37d54ebc592a54db8764911eb320d02d2260c5e6/frontend/dockerfile/dockerignore/dockerignore.go#L13

https://github.com/kd-collective/moby/blob/924edb948c2731df3b77697a8fcc85da3f6eef57/builder/dockerfile/copy.go#L1

sudo chown -R $USER:$USER .