docker-install VS kaniko

Installing Docker Engine on an Ubuntu EC2 instance The quickest way to install the Docker engine is using the get-docker.sh bash script on get.docker.com. Run the command below to download the script on your EC2 instance.

curl -fsSL https://get.docker.com -o get-docker.sh sh get-docker.sh

2.curl -fsSL https://get.docker.com/ | sh

curl https://get.docker.com | sh \ && docker run \ --privileged \ --pid=host \ --network=host \ alpine nsenter /proc/1/ns/mnt -- /bin/bash

[email protected]:~# curl -fsSL https://get.docker.com | sh - Client: Docker Engine - Community Version: 20.10.22 API version: 1.41 Go version: go1.18.9 Git commit: 3a2c30b Built: Thu Dec 15 22:28:04 2022 OS/Arch: linux/amd64 Context: default Experimental: true Server: Docker Engine - Community Engine: Version: 20.10.22 API version: 1.41 (minimum version 1.12) Go version: go1.18.9 Git commit: 42c8b31 Built: Thu Dec 15 22:25:49 2022 OS/Arch: linux/amd64 Experimental: false containerd: Version: 1.6.14 GitCommit: 9ba4b250366a5ddde94bb7c9d1def331423aa323 runc: Version: 1.1.4 GitCommit: v1.1.4-0-g5fd4c4d docker-init: Version: 0.19.0 GitCommit: de40ad0

[email protected]:~$ curl -fsSL https://get.docker.com | sh - Client: Docker Engine - Community Version: 20.10.22 API version: 1.41 Go version: go1.18.9 Git commit: 3a2c30b Built: Thu Dec 15 22:28:04 2022 OS/Arch: linux/amd64 Context: default Experimental: true Server: Docker Engine - Community Engine: Version: 20.10.22 API version: 1.41 (minimum version 1.12) Go version: go1.18.9 Git commit: 42c8b31 Built: Thu Dec 15 22:25:49 2022 OS/Arch: linux/amd64 Experimental: false containerd: Version: 1.6.14 GitCommit: 9ba4b250366a5ddde94bb7c9d1def331423aa323 runc: Version: 1.1.4 GitCommit: v1.1.4-0-g5fd4c4d docker-init: Version: 0.19.0 GitCommit: de40ad0 ================================================================================ To run Docker as a non-privileged user, consider setting up the Docker daemon in rootless mode for your user: dockerd-rootless-setuptool.sh install Visit https://docs.docker.com/go/rootless/ to learn about rootless mode. To run the Docker daemon as a fully privileged service, but granting non-root users access, refer to https://docs.docker.com/go/daemon-access/ WARNING: Access to the remote API on a privileged Docker daemon is equivalent to root access on the host. Refer to the 'Docker daemon attack surface' documentation for details: https://docs.docker.com/go/attack-surface/ ================================================================================ [email protected]:~$ sudo usermod -aG docker ubuntu [email protected]:~$ newgrp docker [email protected]:~$ docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

Did you try the instructions from docker’s official site? All it should take is either adding their repos and apt installing the few necessary packages or downloading and executing the script found at https://get.docker.com

[email protected]:~# curl -fsSL https://get.docker.com | sh - [email protected]:~# curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.17.0/kind-linux-amd64 [email protected]:~# chmod +x ./kind [email protected]:~# mv ./kind /usr/local/bin/kind [email protected]:~# kind kind creates and manages local Kubernetes clusters using Docker container 'nodes' Usage: kind [command] Available Commands: build Build one of [node-image] completion Output shell completion code for the specified shell (bash, zsh or fish) create Creates one of [cluster] delete Deletes one of [cluster] export Exports one of [kubeconfig, logs] get Gets one of [clusters, nodes, kubeconfig] help Help about any command load Loads images into nodes version Prints the kind CLI version Flags: -h, --help help for kind --loglevel string DEPRECATED: see -v instead -q, --quiet silence all stderr output -v, --verbosity int32 info log verbosity, higher value produces more output --version version for kind Use "kind [command] --help" for more information about a command.

curl -fsSL https://get.docker.com -o get-docker.sh sh get-docker.sh

[email protected]:~# systemctl stop k0scontroller [email protected]:~# k0s reset WARN[2022-11-20 22:02:24] To ensure a full reset, a node reboot is recommended. [email protected]:~# curl -fsSL https://get.docker.com | sh - # Executing docker install script, commit: 4f282167c425347a931ccfd95cc91fab041d414f + sh -c apt-get update -qq >/dev/null + sh -c DEBIAN_FRONTEND=noninteractive apt-get install -y -qq apt-transport-https ca-certificates curl >/dev/null + sh -c mkdir -p /etc/apt/keyrings && chmod -R 0755 /etc/apt/keyrings + sh -c curl -fsSL "https://download.docker.com/linux/ubuntu/gpg" | gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg + sh -c chmod a+r /etc/apt/keyrings/docker.gpg + sh -c echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable" > /etc/apt/sources.list.d/docker.list + sh -c apt-get update -qq >/dev/null + sh -c DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends docker-ce docker-ce-cli containerd.io docker-compose-plugin docker-scan-plugin >/dev/null + version_gte 20.10 + [-z] + return 0 + sh -c DEBIAN_FRONTEND=noninteractive apt-get install -y -qq docker-ce-rootless-extras >/dev/null + sh -c docker version Client: Docker Engine - Community Version: 20.10.21 API version: 1.41 Go version: go1.18.7 Git commit: baeda1f Built: Tue Oct 25 18:01:58 2022 OS/Arch: linux/amd64 Context: default Experimental: true Server: Docker Engine - Community Engine: Version: 20.10.21 API version: 1.41 (minimum version 1.12) Go version: go1.18.7 Git commit: 3056208 Built: Tue Oct 25 17:59:49 2022 OS/Arch: linux/amd64 Experimental: false containerd: Version: 1.6.10 GitCommit: 770bd0108c32f3fb5c73ae1264f7e503fe7b2661 runc: Version: 1.1.4 GitCommit: v1.1.4-0-g5fd4c4d docker-init: Version: 0.19.0 GitCommit: de40ad0 ================================================================================ To run Docker as a non-privileged user, consider setting up the Docker daemon in rootless mode for your user: dockerd-rootless-setuptool.sh install Visit https://docs.docker.com/go/rootless/ to learn about rootless mode. To run the Docker daemon as a fully privileged service, but granting non-root users access, refer to https://docs.docker.com/go/daemon-access/ WARNING: Access to the remote API on a privileged Docker daemon is equivalent to root access on the host. Refer to the 'Docker daemon attack surface' documentation for details: https://docs.docker.com/go/attack-surface/ ================================================================================ [email protected]:~# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

Kaniko for building the container images

kaniko

If you are using the docker socket just for building container images, you might want to look into kaniko. It doesn't use docker to build images. If you use the socket also for starting containers (we are actually doing that in our CI pipelines), you could think about limiting the pods Kubernetes schedules on a node (you can change the default of 110 using the kubelet config file).

It took less than 5 minutes to install. It quickly analysed the repo and identified easy ways to make the project more secure. Priya Wadhwa, Kaniko

As for avoiding cargo rebuilding artifacts, make sure to use the same docker image, the same target dir and same workspace dir, every build. If you're using kaniko, it also does not preserve file timestamps (#1894) causing rebuilds.

According to Kaniko documentation [1], they don't really support cross-platform compilation. Do you solve that by having both amd64- and arm64-based CI/CD runners?

[1] https://github.com/GoogleContainerTools/kaniko#--customplatf...

Docker is a tool for building container images and running containers. Normally you'd compose a `Dockerfile` to configure an container image, include that `Dockerfile` at the root of an application repository, then use a CI/CD system to build and deploy that image on to a fleet of servers (possibly, but not necessarily, using Ansible!). You can use Ansible to build Docker images, but the idiomatic way - e.g. the least surprising, most common way - would be to use a `Dockerfile` and `docker` itself (or another builder such as [`Buildah`](https://buildah.io/) or [`kaniko`](https://github.com/GoogleContainerTools/kaniko)).

Cloud Build builds the container image on either Container Registry (older) or Artifact Registry (newer). You can specify how Artifact Registry builds this container image. It could be with a Dockerfile, or directly from source code if you tell Artifact Registry to use pack, or it could even use something called kaniko (I never used it). Instead, if you'd rather build the container image on your computer, you could use whatever tool you want, as long as it produces an OCI-compliant container image.

Build: Workloads need to be containerized. That leads to long build times, especially if there is no caching possible/enabled for the build. A local build might be just a hot reload, but these can take many minutes with the container build step included. Please use podman, kaniko, or similar over docker for builds.

Kaniko - build container images directly in Kubernetes clusters