Docker Done Right

Yes, that is a bold statement. The Docker application containment architecture is all the rage right now and FreeBSD just may prove to be the ultimate Docker platform thanks to its 15+ years of containment experience and the unrivaled OpenZFS file system.

As one Twitter user put it, “#docker has now had more security issues within a year than
#freebsd #jails has had since 2000. Good job #techbros.”

Indeed, Docker has never been pitched as a security technology but rest assured, Docker on FreeBSD institutionally imprisons and secures Docker images using FreeBSD’s proven Jail infrastructure. FreeBSD Jails have been used in production since their inception to contain applications and full systems and are exactly what Docker needs. Docker itself has migrated away from Linux LXC containers in favor of the cross-platform libcontainer and of all the pluggable choices, FreeBSD’s Jail stands out as one of the best. FreeBSD also offers the bhyve and Xen hypervisors to provide you yet more options for containing your Linux-native and FreeBSD-native Docker deployments.

Then comes storage. Docker images are designed to be read-only and disposable until instructed otherwise. If only there were a file system that institutionalized lightning-fast snapshotting and cloning…

That file system exists! It’s called OpenZFS and FreeBSD has supported it since FreeBSD 7.0. This not only means you get the institutionalized snapshotting and cloning that suit Docker so well, but also the unrivaled data integrity protection that OpenZFS offers. If you care about your data, you care about OpenZFS.

Hands-on Docker

To try Docker on FreeBSD, you will need a recent snapshot such as 10.2 BETA or 11-CURRENT. Note that you should change “zroot” to match your system’s zpool.

 # pkg install docker-freebsd ca_root_nss
 # zfs create -o mountpoint=/usr/docker zroot/docker
 # service docker onestart
 Starting docker…

 # docker pull centos
 …

 # docker images
 REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE
 centos latest 7322fbe74aa5 4 weeks ago 172.2 MB

 # docker run -t -i centos /bin/bash
 [root@ /]# uname -a
 Linux 2.6.32 FreeBSD 11.0-CURRENT #5 r285594: Tue Jul 14 23:30:11 EDT 2015
 x86_64 x86_64 x86_64 GNU/Linux

Suddenly… CentOS!

Where the wheels really hit the pavement is with a peek under the hood at the Jail and ZFS output of our Docker Jail and OpenZFS dataset:

 # jls
   JID IP Address Hostname Path
     3 172.17.0.3 /usr/docker/zfs/graph/920bc5fbb45c

 # zfs list
 …
 zroot/docker
       119M 107G 6.02M /usr/docker
 zroot/docker/03a7a57df9197f242484375c4bc2149248ded5aaafc4feb8e472d6774d495530
       8K 107G 112M legacy
 zroot/docker/03a7a57df9197f242484375c4bc2149248ded5aaafc4feb8e472d6774d495530-
 init 128K 107G 112M legacy
 …

This output should be familiar to FreeBSD users and is becoming familiar to more and more GNU/Linux users every day.

For an expanded example of Docker on FreeBSD, consult the FreeBSD Wiki:

https://wiki.freebsd.org/Docker

FreeBSD is poised to be go-to Docker platform thanks to FreeBSD’s proven Jail and OpenZFS features and iXsystems has shipped over ten thousand systems with the best support for these features available anywhere. We can also build out your GNU/Linux-based Docker deployment and ship thousands of GNU/Linux systems every year. Give us a call to learn how we can take your Docker deployment to the next level and beyond.

Michael Dexter

18 Comments

  1. Kevin Hanson

    That looks great! I am confused, though… If docker is best on FreeBSD / FreeNAS, why not ship it by default? I don’t think it’s even on the roadmap for 10, as bhyve has been talked about. Can you clarify? I think bundling Docker with FreeNAS 10 would be awesome!

    Reply
    • jkh

      The Docker post was actually in reference to FreeBSD, but posted on the FreeNAS web site. FreeNAS would be a possible file store in this scenario, not a host.

      Reply
      • ne1

        FreeNAS is based on FreeBSD. I don’t see a reason why this would not be possible.

        Reply
      • ne1

        One could install Virtualbox in a FreeNAS-Jail to run FreeBSD for Docker?

        Reply
        • Michael Dexter

          Give it a try.

          Reply
  2. Mahdi Hedhli

    Sooo Docker FreeNAS plugin? Yes please!

    Reply
    • Michael Dexter

      We hear you!

      Reply
  3. Dave Cottlehuber

    AFAICT docker-freebsd is not available in pkg yet, this is worth mentioning if you need ports to install it.

    Reply
    • Michael Dexter

      It is in pkg: pkg install docker-freebsd on FreeBSD HEAD

      Reply
  4. Alex

    I’v tried docker on FreeBSD 10.2 amd64

    [root@bsd10 /]# docker run -t -i centos /bin/bash
    ELF binary type “0” not known.
    ELF binary type “0” not known.
    jail: exec /bin/bash: Exec format error
    jail: /bin/bash: failed

    However its possible to run FreeBSD under docker
    [root@bsd10 /]# docker run -t -i lexaguskov/freebsd /bin/csh
    #
    #
    # exit

    Reply
    • Michael Dexter

      Do make sure the linux compatibility kernel module is loaded.

      Reply
      • yggdrasil

        I have the exact same problem, even though linux.ko is loaded and a manually installed linux jail is running correctly!

        Reply
        • ScoDay

          I’ve found the CentOS docker to be a bit flaky – you could do a

          docker pull ubuntu
          docker run -i -t ubuntu /bin/bash

          Not sure that will get you to where you want to go – but I have decent docker experience and something is ‘not’ right with the CentOS:Latest currently.

          Reply
  5. Andrew

    Question regarding Docker (jails/containers in general) and launchd

    Will launchd support socket activation of docker containers and jails?
    ie If someone tries to establish a connection to a jail IP address will that prompt launchd to start the jail and pass the connection over. Or will the container need to be running already?

    Reply
  6. Siuram

    I am about to build a NAS setup with FreeNAS, and we plan to migrate some services to Docker.

    Is there a clean and nice way to use a ZFS pool in a FreeNAS host to run services in a compute machine? Docker storage containers? Another approach?

    Reply
    • Michael Dexter

      Here and now, you will want to use FreeBSD HEAD for Docker.

      Reply
  7. Eric

    If I switch my FreeNAS to the FreeNAS-10-Nightlies train, will I be able to follow the commands above to run docker? Or is there something fundamentally different with FreeNAS that would prohibit this?

    Reply
    • Michael Dexter

      FreeNAS 10 does not contain Docker support at this time. FreeBSD would be where you want to experiment with it.

      Reply

Submit a Comment

Your email address will not be published. Required fields are marked *