Docker

Docker is a container virtualization environment which can establish development or runtime environments without modifying the environment of the base operating system. It has the ability to deploy instances of containers that provide a thin virtualization, using the host kernel, which makes it faster and lighter than full hardware visualization.

Kernel
Kernel version 3.10 or greater is required in order to run Docker.

If the kernel has not been configured properly before merging the package a list of missing kernel options will be printed by emerge. These kernel features must be enabled manually. Pressing the (forward slash) key while in the ncurses-based menuconfig to search the name of the configuration option.

For the most up-to-date values check the contents of the `CONFIG_CHECK in file.

A graphical representation would look something like this:

After exiting the kernel configuration, rebuild the kernel. If the kernel rebuild as also a kernel upgrade be sure to rebuild the bootloader's menu configuration, then reboot the system to the newly recompiled kernel binary.

Docker way of checking the kernel configuration:

Emerge
Install :

PaX kernel
Tools in the package are necessary for this operation. See Hardened/PaX Quickstart for an introduction.

For the hello-world example set this flag for containerd-shim and runc:

If an issue with denied chmods in chroots occurs, a more recent version of Docker (>=1.12) is needed. Use the Keyword for Docker and its dependencies listed subsequently when running  again.

OpenRC
After Docker has been successfully installed, add it to the system's default runlevel then tell OpenrC to start the daemon:

If you need to pass any additional options to the docker daemon edit file. See upstream documentation for the various options that can be passed to the DOCKER_OPTS variable.

systemd
To have Docker start on boot, enable it:

To start it now:

If you need to pass any additional options to the docker daemon create the file :

Guide to options that be placed into the json file

Permissions
Add relevant users to the docker group:

Testing
In order to test the installation, run the following command:

That will first download from the Docker Hub the image named hello-world (if it has not been downloaded locally yet), then it will run it inside new namespaces. It purpose is just to display some text through a container.

Building from a Dockerfile
Create a new Dockerfile in an empty directory with the following content:

Run:

Own images
There are two different ideas how a container should be built.
 * The minimal approach: According to the container philosophy a container should only contain what is needed to serve one process. In this case ideally the container consists of one static binary.
 * The VM approach: A container can be treated like a full system virtualization environment. In this case the container includes a whole operating system.

Build environment for the image
The image can be created out of a live system or - preferably - out of a special build environment
 * To create a build environment for the image, follow the Cross_build_environment guide. There is no need to emerge a full @system. The build essentials are enough.
 * The toolchain tuple could look like
 * The build essentials can be build like this

The minimal approach: Statically linked binaries
There are some caveats with this. The hints for statically linked binaries should be kept in mind for this.

To build an nginx-image:
 * Chroot into the build environment (e.g. )
 * Build the desired package statically linked
 * Extract the binary package to a tmp dir (e.g. )
 * Change the nginx configuration. At least add  and swap   for.
 * Add, ,  and a appropriate  directory. Make sure the   has "files" instead of "compat" and the  file has an "nginx" user entry.
 * Create the docker image out of the current directory
 * Spawn a container and start nginx

The VM-like approach

 * Create the image out of the full environment
 * Spawn a new gentoo container and start a shell:
 * This image can used as a base image. To build a nginx image for example run emerge nginx inside the container and push it back as new image afterwards:

Docker service fails to start (systemd)

 * Some users have issues on starting  because of device-mapper error. It can be solved by loading a different storage-driver. E.g. Loading “overlay” graph driver instead of “device-mapper” graph driver.
 * “overlay” graph driver requires "Overlay filesystem support" in kernel configuration:


 * Add following to, then re-emerge docker will solve this issue.


 * If you receive an error saying,, you may be missing the docker0 network bridge. Please see the following docker issue which provides a bash script solution to create the docker0 network bridge: https://github.com/docker/docker/issues/31546

Docker service runs but fails to start container (systemd)

 * if you are using systemd-232 or higher, and receive an error related to cgroups...


 * You will need to add the following line to your kernel boot parameters

External resources

 * https://docs.docker.com/engine/installation/linux/gentoolinux/ - Official Docker installation documentation.