## Docker Containerizer Mesos 0.20.0 新增了對使用Docker鏡像啟動任務的支持,同時支持了一部分Docker參數設置，未來計劃支持更多！ 使用者可以將Docker 鏡像作為一個任務 或 一個執行器來啟動. 下面的章節將結合對Docker的支持來描述 API的變化，同時說明如何設置Docker. ### 設置 為了讓agent使用Docker Containerizer，你必須在啟動agent的時候設置containerizers 參數值為docker. 如: `mesos-agent --containerizers=docker,mesos` 每一個具有Docker containerizer的agent 都需要安裝Docker 命令行客戶端(版本 >= 1.0.0) 如果你在agent允許iptables運行，請確保iptables允許所有的docker 橋接接口的網絡流量通過.添加如下規則： ``` iptables -A INPUT -s 172.17.0.0/16 -i docker0 -p tcp -j ACCEPT ``` ### 如何使用 Docker Containerizer? 0.20.0版本之前的TaskInfo，只支持2種方式運行任務：一種是通過設置CommandInfo,在bash命令行運行任務;或者設置ExecutorInfo啟動一個自定義的執行器來運行任務. 0.20.0開始在TaskInfo和ExecutorInfo增加了ContainerInfo字段，用來配置類似于Docker的Containerizer去運行任務和執行器. 為了啟動一個Docker鏡像作為任務運行，需要在TaskInfo 中設置command和container字段，因為Docker Containerizer會使用它們作為輔助命令去啟動docker 鏡像.ContainerInfo的類型設置為docker,在DockerInfo中說明要被啟動的docker鏡像. 為了啟動一個個Docker鏡像作為執行器運行，需要在TaskInfo中設置ExecutorInfo，它包含了一個type為docker的ContainerInfo用來啟動執行器.注意一旦Docker 鏡像作為mesos 執行器啟動，將向agent進行注冊. ### Docker Containerizer的作用是什么? Docker Containerizer將任務/執行器的啟動與停止請求，轉換為Docker命令行. 當任務啟動的時候，Docker Containerizer將做如下事情： 1. 將CommandInfo中涉及到的所有文件拉取到sandbox。 2. 從遠程倉庫拉取Docker 鏡像. 3. 使用docker 執行器運行docker 鏡像,將sandbox 目錄映射到docker 容器，并且設置 MESOS_SANDBOX環境變量的映射目錄.執行器將容器日志輸出到sandbox中的stdout/stderr文件. 4. 當容器退出或者銷毀的時候，停止或刪除docker容器. The Docker Containerizer launches all containers with the mesos- prefix plus the agent id (ie: mesos-agent1-abcdefghji), and also assumes all containers with the mesos- prefix is managed by the agent and is free to stop or kill the containers. When launching the docker image as an Executor, the only difference is that it skips launching a command executor but just reaps on the docker container executor pid. Note that we currently default to host networking when running a docker image, to easier support running a docker image as an Executor. The containerizer also supports optional force pulling of the image. It is set disabled as default, so the docker image will only be updated again if it’s not available on the host. To enable force pulling an image, force_pull_image has to be set as true. ### 私有Docker倉庫 To run an image from a private repository, one can include the uri pointing to a .dockercfg that contains login information. The .dockercfg file will be pulled into the sandbox the Docker Containerizer set the HOME environment variable pointing to the sandbox so docker cli will automatically pick up the config file. Starting from 0.29, we provide an alternative way to specify docker config file for pulling images from private registries. We allow operators to specify a shared docker config file using an agent flag. This docker config file will be used to pull images from private registries for all containers. See configuration documentation for detail. Operators can either use a local docker config file (need to manually configure .docker/config.json or .dockercfg on each agent), or specify the flag as a JSON-formatted string. For example: `--docker_config=file:///home/vagrant/.docker/config.json` or as a JSON object, ``` --docker_config="{ \ \"auths\": { \ \"https://index.docker.io/v1/\": { \ \"auth\": \"xXxXxXxXxXx=\", \ \"email\": \"username@example.com\" \ } \ } \ }" ``` ### CommandInfo to run Docker images A docker image currently supports having an entrypoint and/or a default command. To run a docker image with the default command (ie: docker run image), the CommandInfo’s value must not be set. If the value is set then it will override the default command. To run a docker image with an entrypoint defined, the CommandInfo’s shell option must be set to false. If shell option is set to true the Docker Containerizer will run the user’s command wrapped with /bin/sh -c which will also become parameters to the image entrypoint. ### Recover Docker containers on agent recovery The Docker containerizer supports recovering Docker containers when the agent restarts, which supports both when the agent is running in a Docker container or not. With the --docker_mesos_image flag enabled, the Docker containerizer assumes the containerizer is running in a container itself and modifies the mechanism it recovers and launches docker containers accordingly.