3 ms·

Similarly, I recently discovered it is possible to run Docker containers in LXC relatively easily using the provided "lxc" template. We use this to run a few pi

Similarly, I recently discovered it is possible to run Docker containers in LXC relatively easily using the provided "lxc" template. We use this to run a few pieces of software whose only supported method of distribution is Docker. But there's a number of things that don't quite work how we want it to out of the box, for example, our DNS isn't configured. It seems fly solves this with their custom init system, so I'm really excited to play around with that! Thank you for sharing!

Havoc 6y ago
Could you share a link for this docker containers as lxc? Thought that isn’t possible. Or is this only for ones following a specific pattern?
- Cu3PO42 6y ago
  I would be happy to, but I don't really have one. I can give you a really quick rundown of how to do it, though. 1. Install jq, umoci and skopeo on your host. 2. Run "lxc-create -n <name> -t oci -f <temp-config> -- -u docker://<link to container on registry> --no-cache" 3. Start the resulting container with "lxc-execute -d" rather than "lxc-start". The <temp-config> file should contain a uid and gid mapping for LXC. If you don't intend to run the containers rootless, you can omit it and "--no-cache" (the caching mechanism is broken for rootless containers). After container creation we patch the generated config file with our network configuration, etc. similarly to what we would do with a normal LXC container. This has worked with all containers we tried it with, but if it relies on interacting with the Docker domain directly via docker.sock it obviously won't. A colleague has had success adding the init system from a container (in that case tini) and changing the confict so the container can start with lxc-start, this was a much more manual process, though.
  - m463 6y ago
    This is really interesting. I wish I could upvote you more than once. I use proxmox with lxc, but there's nothing like the simplicity of a Dockerfile I think it would be nice to have say "dockerpull2lxc" or even better "dockerbuild2lxc".
    - Cu3PO42 6y ago
      Thank you! The votes on my post suggest there are a few people interested in this, so I might eventually write a small blog post on this. Running the resulting container in Proxmox was actually the reason why my colleague needed the container to start with lxc-start rather than lxc-execute. The process involves finding the init system in the container and setting up lxc.init.cmd rather than lxc.execute.cmd, which is set by lxc-create. We have not yet investigated whether it might be possible to automate this for the majority of cases, but this is something we might look at in the future.
      - Havoc 6y ago
        >so I might eventually write a small blog post on this. Be sure to post it on the reddit proxmox sub - it's sure to generate traffic
  - Havoc 6y ago
    Interesting. Entire proxmox community is constantly arguing over LXC > Docker > Container or VM > Docker > Container ...with it being accepted wisdom that container on lxc is impossible. Thought whether above steps can be integrated into proxmox is another question. Either way - thanks
    - Cu3PO42 6y ago
      They can with a few extra steps that are still somewhat manual. Specifically, changing the configuration such that using lxc-start rather than lxc-execute is possible. It may be possible to automate these in the future, it's something I'll eventually look at.
m463 6y ago
So by this do you mean running docker inside lxc, or do you mean something closer to what these folks have done -- unpacking the layers into lxc and using them directly?
- Cu3PO42 6y ago
  The latter. Unpacking the file system and directly creating an LXC container equivalent to the source Docker container.

Havoc 6y ago

Could you share a link for this docker containers as lxc? Thought that isn’t possible. Or is this only for ones following a specific pattern?

Cu3PO42 6y ago
I would be happy to, but I don't really have one. I can give you a really quick rundown of how to do it, though. 1. Install jq, umoci and skopeo on your host. 2. Run "lxc-create -n <name> -t oci -f <temp-config> -- -u docker://<link to container on registry> --no-cache" 3. Start the resulting container with "lxc-execute -d" rather than "lxc-start". The <temp-config> file should contain a uid and gid mapping for LXC. If you don't intend to run the containers rootless, you can omit it and "--no-cache" (the caching mechanism is broken for rootless containers). After container creation we patch the generated config file with our network configuration, etc. similarly to what we would do with a normal LXC container. This has worked with all containers we tried it with, but if it relies on interacting with the Docker domain directly via docker.sock it obviously won't. A colleague has had success adding the init system from a container (in that case tini) and changing the confict so the container can start with lxc-start, this was a much more manual process, though.
- m463 6y ago
  This is really interesting. I wish I could upvote you more than once. I use proxmox with lxc, but there's nothing like the simplicity of a Dockerfile I think it would be nice to have say "dockerpull2lxc" or even better "dockerbuild2lxc".
  - Cu3PO42 6y ago
    Thank you! The votes on my post suggest there are a few people interested in this, so I might eventually write a small blog post on this. Running the resulting container in Proxmox was actually the reason why my colleague needed the container to start with lxc-start rather than lxc-execute. The process involves finding the init system in the container and setting up lxc.init.cmd rather than lxc.execute.cmd, which is set by lxc-create. We have not yet investigated whether it might be possible to automate this for the majority of cases, but this is something we might look at in the future.
    - Havoc 6y ago
      >so I might eventually write a small blog post on this. Be sure to post it on the reddit proxmox sub - it's sure to generate traffic
- Havoc 6y ago
  Interesting. Entire proxmox community is constantly arguing over LXC > Docker > Container or VM > Docker > Container ...with it being accepted wisdom that container on lxc is impossible. Thought whether above steps can be integrated into proxmox is another question. Either way - thanks
  - Cu3PO42 6y ago
    They can with a few extra steps that are still somewhat manual. Specifically, changing the configuration such that using lxc-start rather than lxc-execute is possible. It may be possible to automate these in the future, it's something I'll eventually look at.

m463 6y ago

So by this do you mean running docker inside lxc, or do you mean something closer to what these folks have done -- unpacking the layers into lxc and using them directly?

Cu3PO42 6y ago
The latter. Unpacking the file system and directly creating an LXC container equivalent to the source Docker container.