docker-install VS kaniko

root@vps1724252356:~# sudo snap install curl curl 8.1.2 from Wouter van Bommel (woutervb) installed root@vps1724252356:~# curl -fsSL https://get.docker.com -o get-docker.sh sh get-docker.sh sudo groupadd docker sudo usermod -aG docker $USER # Executing docker install script, commit: 0d6f72e671ba87f7aa4c6991646a1a5b9f9dae84 + sh -c apt-get update -qq >/dev/null + sh -c DEBIAN_FRONTEND=noninteractive apt-get install -y -qq ca-certificates curl >/dev/null + sh -c install -m 0755 -d /etc/apt/keyrings + sh -c curl -fsSL "https://download.docker.com/linux/ubuntu/gpg" -o /etc/apt/keyrings/docker.asc + sh -c chmod a+r /etc/apt/keyrings/docker.asc + sh -c echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu jammy stable" > /etc/apt/sources.list.d/docker.list + sh -c apt-get update -qq >/dev/null + sh -c DEBIAN_FRONTEND=noninteractive apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin docker-ce-rootless-extras docker-buildx-plugin >/dev/null + sh -c docker version Client: Docker Engine - Community Version: 27.1.2 API version: 1.46 Go version: go1.21.13 Git commit: d01f264 Built: Mon Aug 12 11:50:12 2024 OS/Arch: linux/amd64 Context: default Server: Docker Engine - Community Engine: Version: 27.1.2 API version: 1.46 (minimum version 1.24) Go version: go1.21.13 Git commit: f9522e5 Built: Mon Aug 12 11:50:12 2024 OS/Arch: linux/amd64 Experimental: false containerd: Version: 1.7.20 GitCommit: 8fc6bcff51318944179630522a095cc9dbf9f353 runc: Version: 1.1.13 GitCommit: v1.1.13-0-g58aa920 docker-init: Version: 0.19.0 GitCommit: de40ad0 ================================================================================ To run Docker as a non-privileged user, consider setting up the Docker daemon in rootless mode for your user: dockerd-rootless-setuptool.sh install Visit https://docs.docker.com/go/rootless/ to learn about rootless mode. To run the Docker daemon as a fully privileged service, but granting non-root users access, refer to https://docs.docker.com/go/daemon-access/ WARNING: Access to the remote API on a privileged Docker daemon is equivalent to root access on the host. Refer to the 'Docker daemon attack surface' documentation for details: https://docs.docker.com/go/attack-surface/ ================================================================================ groupadd: group 'docker' already exists root@vps1724252356:~# sudo apt install git -y Reading package lists... Done Building dependency tree... Done Reading state information... Done Suggested packages: git-daemon-run | git-daemon-sysvinit git-doc git-email git-gui gitk gitweb git-cvs git-mediawiki git-svn The following packages will be upgraded: git 1 upgraded, 0 newly installed, 0 to remove and 137 not upgraded. Need to get 3165 kB of archives. After this operation, 16.4 kB of additional disk space will be used. Get:1 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 git amd64 1:2.34.1-1ubuntu1.11 [3165 kB] Fetched 3165 kB in 1s (2408 kB/s) (Reading database ... 94596 files and directories currently installed.) Preparing to unpack .../git_1%3a2.34.1-1ubuntu1.11_amd64.deb ... Unpacking git (1:2.34.1-1ubuntu1.11) over (1:2.34.1-1ubuntu1.10) ... Setting up git (1:2.34.1-1ubuntu1.11) ... Scanning processes... Scanning linux images... Running kernel seems to be up-to-date. No services need to be restarted. No containers need to be restarted. No user sessions are running outdated binaries. No VM guests are running outdated hypervisor (qemu) binaries on this host. root@vps1724252356:~# curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" --no-use nvm install v20 nvm use v20 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 15037 100 15037 0 0 36871 0 --:--:-- --:--:-- --:--:-- 36945 => Downloading nvm from git to '/root/.nvm' => Cloning into '/root/.nvm'... remote: Enumerating objects: 376, done. remote: Counting objects: 100% (376/376), done. remote: Compressing objects: 100% (320/320), done. remote: Total 376 (delta 46), reused 176 (delta 29), pack-reused 0 (from 0) Receiving objects: 100% (376/376), 372.57 KiB | 2.13 MiB/s, done. Resolving deltas: 100% (46/46), done. * (HEAD detached at FETCH_HEAD) master => Compressing and cleaning up git repository => Appending nvm source string to /root/.bashrc => Appending bash_completion source string to /root/.bashrc => Close and reopen your terminal to start using nvm or run the following to use it now: export NVM_DIR="$HOME/.nvm" [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm [ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion" # This loads nvm bash_completion Downloading and installing node v20.16.0... Downloading https://nodejs.org/dist/v20.16.0/node-v20.16.0-linux-x64.tar.xz... ################################################################################################################################################################ 100.0% Computing checksum with sha256sum Checksums matched! Now using node v20.16.0 (npm v10.8.1) Creating default alias: default -> v20 (-> v20.16.0) Now using node v20.16.0 (npm v10.8.1) root@vps1724252356:~# npm install --global yarn added 1 package in 2s npm notice npm notice New patch version of npm available! 10.8.1 -> 10.8.2 npm notice Changelog: https://github.com/npm/cli/releases/tag/v10.8.2 npm notice To update run: npm install -g [email protected] npm notice root@vps1724252356:~# sudo apt install -y unzip Reading package lists... Done Building dependency tree... Done Reading state information... Done Suggested packages: zip The following NEW packages will be installed: unzip 0 upgraded, 1 newly installed, 0 to remove and 137 not upgraded. Need to get 175 kB of archives. After this operation, 386 kB of additional disk space will be used. Get:1 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 unzip amd64 6.0-26ubuntu3.2 [175 kB] Fetched 175 kB in 0s (485 kB/s) Selecting previously unselected package unzip. (Reading database ... 96234 files and directories currently installed.) Preparing to unpack .../unzip_6.0-26ubuntu3.2_amd64.deb ... Unpacking unzip (6.0-26ubuntu3.2) ... Setting up unzip (6.0-26ubuntu3.2) ... Processing triggers for man-db (2.10.2-1) ... Scanning processes... Scanning linux images... Running kernel seems to be up-to-date. No services need to be restarted. No containers need to be restarted. No user sessions are running outdated binaries. No VM guests are running outdated hypervisor (qemu) binaries on this host. root@vps1724252356:~# sudo reboot Connection to 194.226.49.162 closed by remote host. Connection to 194.226.49.162 closed.

#!/bin/bash set -e HOST_MEMORY="1g" HOST_CORES="0.20" STORAGE_SIZE="10g" CONTAINER_NAME="my-desktop-container" DOCKER_IMAGE="manishfoodtechs/xfcefulldesktop_ubuntu20.4" echo "Checking hardware compatibility..." # Check hardware compatibility if ! grep -E 'vmx|svm' /proc/cpuinfo >/dev/null; then echo "Error: CPU does not support hardware virtualization." exit 1 fi echo "Installing Docker..." # Install Docker if not already installed if ! command -v docker >/dev/null; then echo "Docker not found. Installing Docker..." curl -fsSL https://get.docker.com -o get-docker.sh sh get-docker.sh rm get-docker.sh fi echo "Assigning resources to Docker container..." # Assign resources to Docker container docker run -d -p 9097:3389 -e 3389 --shm-size $HOST_MEMORY --cpus $HOST_CORES --memory $HOST_MEMORY --name $CONTAINER_NAME $DOCKER_IMAGE tail -f /dev/null echo "Installing required packages inside Docker container..." # Install required packages inside Docker container docker exec -it $CONTAINER_NAME /bin/bash -c "apt-get update && apt-get install -y mesa-utils libgl1-mesa-dri mesa-utils-extra xrdp" echo "Creating swap file inside Docker container..." echo "Creating swap file outside Docker container..." # Create a swap file outside Docker container sudo fallocate -l $STORAGE_SIZE /swapfile sudo chmod 600 /swapfile sudo mkswap /swapfile sudo swapon /swapfile echo "Configuring LLVMpipe to use swap memory inside Docker container..." # Configure LLVMpipe to use swap memory inside Docker container docker exec -it $CONTAINER_NAME /bin/bash -c "echo 'export GALLIUM_DRIVER=\"llvmpipe\"' >> /etc/profile.d/llvmpipe.sh && echo 'export LIBGL_ALWAYS_SOFTWARE=1' >> /etc/profile.d/llvmpipe.sh && echo 'export LLVMPIPE_SWAPBUFFERS=1' >> /etc/profile.d/llvmpipe.sh" echo "Restarting xrdp service inside Docker container..." # Restart xrdp service inside Docker container docker exec -it $CONTAINER_NAME /etc/init.d/xrdp restart echo "Installation and configuration completed successfully."

Docker installed on your Raspberry Pi 4 ( Can be installed with curl -sSL https://get.docker.com | sh )

curl -sSL https://get.docker.com/ | sh

curl -fsSL https://get.docker.com -o get-docker.sh sudo sh get-docker.sh # check docker version docker -v

Now we can install Uptime Kuma using the Docker install instructions here. We're using docker instead of bare metal to keep things contained, and Docker images are less likely to be blocked, while NodeJS NPM packages are.

curl -fsSL https://get.docker.com -o get-docker.sh sudo sh get-docker.sh # Install docker compose sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose # Apply executable permissions to the binary sudo chmod +x /usr/local/bin/docker-compose # Run Project docker-compose up -d

root@ubuntu-16gb-hel1-1:~# curl -fsSL https://get.docker.com | sh - # Executing docker install script, commit: e5543d473431b782227f8908005543bb4389b8de + sh -c apt-get update -qq >/dev/null + sh -c DEBIAN_FRONTEND=noninteractive apt-get install -y -qq apt-transport-https ca-certificates curl >/dev/null + sh -c install -m 0755 -d /etc/apt/keyrings + sh -c curl -fsSL "https://download.docker.com/linux/ubuntu/gpg" | gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg + sh -c chmod a+r /etc/apt/keyrings/docker.gpg + sh -c echo "deb [arch=arm64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable" > /etc/apt/sources.list.d/docker.list + sh -c apt-get update -qq >/dev/null + sh -c DEBIAN_FRONTEND=noninteractive apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin docker-ce-rootless-extras docker-buildx-plugin >/dev/null + sh -c docker version Client: Docker Engine - Community Version: 26.0.0 API version: 1.45 Go version: go1.21.8 Git commit: 2ae903e Built: Wed Mar 20 15:18:14 2024 OS/Arch: linux/arm64 Context: default Server: Docker Engine - Community Engine: Version: 26.0.0 API version: 1.45 (minimum version 1.24) Go version: go1.21.8 Git commit: 8b79278 Built: Wed Mar 20 15:18:14 2024 OS/Arch: linux/arm64 Experimental: false containerd: Version: 1.6.28 GitCommit: ae07eda36dd25f8a1b98dfbf587313b99c0190bb runc: Version: 1.1.12 GitCommit: v1.1.12-0-g51d5e94 docker-init: Version: 0.19.0 GitCommit: de40ad0 ================================================================================ To run Docker as a non-privileged user, consider setting up the Docker daemon in rootless mode for your user: dockerd-rootless-setuptool.sh install Visit https://docs.docker.com/go/rootless/ to learn about rootless mode. To run the Docker daemon as a fully privileged service, but granting non-root users access, refer to https://docs.docker.com/go/daemon-access/ WARNING: Access to the remote API on a privileged Docker daemon is equivalent to root access on the host. Refer to the 'Docker daemon attack surface' documentation for details: https://docs.docker.com/go/attack-surface/ ================================================================================ root@ubuntu-16gb-hel1-1:~# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

curl | sh is a bad practice, but lack of "curl https://get.docker.com | sh" scenario is certainly bad for Podman adoption.

sudo apt-get purge docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin docker-ce-rootless-extras sudo rm -rf /var/lib/docker sudo rm -rf /var/lib/containerd Install Docker curl -fsSL https://get.docker.com -o get-docker.sh sudo sh ./get-docker.sh

If all you need to do is build container, you can use https://github.com/GoogleContainerTools/kaniko

Kaniko for building the container images

kaniko

You should maybe look into Kaniko or use some other build tool

If you are using the docker socket just for building container images, you might want to look into kaniko. It doesn't use docker to build images. If you use the socket also for starting containers (we are actually doing that in our CI pipelines), you could think about limiting the pods Kubernetes schedules on a node (you can change the default of 110 using the kubelet config file).

Check out Kaniko for building containers https://github.com/GoogleContainerTools/kaniko . Only issue is it doesnt support windows containers.

It took less than 5 minutes to install. It quickly analysed the repo and identified easy ways to make the project more secure. Priya Wadhwa, Kaniko

I'd suggest to take a look at the Kaniko project, combined with custom container images in Lambda functions.

kaniko is a tool that allows you to build container images inside Kubernetes without the need for the Docker daemon. Effectively, it allows you to build Docker images without docker build.

Kubernetes prefers to pull containers from registries. You may be able to work around it by specifying a local image in your Kube manifest. Both https://github.com/GoogleContainerTools/kaniko and/ or https://www.devspace.sh/ may help.