1

I have found a lot of articles which speaks about communication between docker containers (docker network, docker link). But i don't Know if it exists a good practice to control a container from another one, like run and stop a container. If the only way is to use the rest api on the host, have you got a good article which explains that ? About the rest api i have found too much articles which explain that, most of them outdated.

To precise my intention, i have a jenkins container which builds and moves the built into an other folder for a second container which executes the built code. Basicaly, before the move i want to stop the container and after restart it.

Thanks for help.

Pred05
  • 492
  • 1
  • 3
  • 13
  • Yes it exists a god practice to control container from another one. Lets look at the [portainer](https://github.com/portainer/portainer) as example. It is app (or container) which controls and manage another containers. You can have a look to source code to find out how exactly it done. – Bukharov Sergey Feb 04 '17 at 21:55

1 Answers1

4

i don't Know if it exists a good practice to control a container from another one, like run and stop a container.

It's a "good enough" practice, and plenty of people do this. CoreOS's /usr/bin/toolbox is basically this, a few others like RancherOS do this as well.

If the only way is to use the rest api on the host have you got a good article which explains that ?

No, it is not. You can mount docker's socket into another docker container and then run docker commands on the host directly from inside the container. This practice is called "docker in docker", "dind", "nested containers" etc. There is a variation of this where people run full fledged versions of docker (docker engine/daemon + client) within an existing container, but that is not what you want to do here.

The gist of it is usually the same, the docker unix socket - /var/run/docker.sock is exposed/mounted within the "controlling container" i.e the container you want to use to control the docker daemon. You then install the docker command line client and use docker commands as normal; docker ps, docker start/stop/run should all work as expected.

It's not trivial to set it up [1], and there are associated security concerns [2][3], but there are plenty of people doing it.

Here are your references:

[1] https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/ , See the section under Solution, everything before that is what you should not be doing.

[2] https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container.html

[3] https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Docker.sock/

ffledgling
  • 11,502
  • 8
  • 47
  • 69
  • Ok thanks for this good explanation. It is a POC to learn docker by myself. So i will respect the security as your recomendation. Thanks for help. With this, i will use the jenkins docker plugin directly and not Shell. – Pred05 Feb 06 '17 at 06:10