|
|
@@ -23,26 +23,26 @@ docker-run - Run a command in a new container
|
|
|
[**--expose**[=*[]*]]
|
|
|
[**-h**|**--hostname**[=*HOSTNAME*]]
|
|
|
[**-i**|**--interactive**[=*false*]]
|
|
|
-[**--ipc**[=*[]*]]
|
|
|
-[**--security-opt**[=*[]*]]
|
|
|
+[**--ipc**[=*IPC*]]
|
|
|
[**--link**[=*[]*]]
|
|
|
[**--lxc-conf**[=*[]*]]
|
|
|
[**-m**|**--memory**[=*MEMORY*]]
|
|
|
+[**--mac-address**[=*MAC-ADDRESS*]]
|
|
|
[**--name**[=*NAME*]]
|
|
|
[**--net**[=*"bridge"*]]
|
|
|
-[**--mac-address**[=*MACADDRESS*]]
|
|
|
[**-P**|**--publish-all**[=*false*]]
|
|
|
[**-p**|**--publish**[=*[]*]]
|
|
|
[**--privileged**[=*false*]]
|
|
|
-[**--restart**[=*POLICY*]]
|
|
|
+[**--restart**[=*RESTART*]]
|
|
|
[**--rm**[=*false*]]
|
|
|
+[**--security-opt**[=*[]*]]
|
|
|
[**--sig-proxy**[=*true*]]
|
|
|
[**-t**|**--tty**[=*false*]]
|
|
|
[**-u**|**--user**[=*USER*]]
|
|
|
[**-v**|**--volume**[=*[]*]]
|
|
|
[**--volumes-from**[=*[]*]]
|
|
|
[**-w**|**--workdir**[=*WORKDIR*]]
|
|
|
- IMAGE [COMMAND] [ARG...]
|
|
|
+IMAGE [COMMAND] [ARG...]
|
|
|
|
|
|
# DESCRIPTION
|
|
|
|
|
|
@@ -59,21 +59,26 @@ all image dependencies, from the repository in the same way running **docker
|
|
|
pull** IMAGE, before it starts the container from that image.
|
|
|
|
|
|
# OPTIONS
|
|
|
+**-a**, **--attach**=[]
|
|
|
+ Attach to STDIN, STDOUT or STDERR.
|
|
|
|
|
|
-**-a**, **--attach**=*stdin*|*stdout*|*stderr*
|
|
|
- Attach to stdin, stdout or stderr. In foreground mode (the default when
|
|
|
-**-d** is not specified), **docker run** can start the process in the container
|
|
|
+ In foreground mode (the default when **-d**
|
|
|
+is not specified), **docker run** can start the process in the container
|
|
|
and attach the console to the process’s standard input, output, and standard
|
|
|
error. It can even pretend to be a TTY (this is what most commandline
|
|
|
executables expect) and pass along signals. The **-a** option can be set for
|
|
|
each of stdin, stdout, and stderr.
|
|
|
|
|
|
-**--add-host**=*hostname*:*ip*
|
|
|
+**--add-host**=[]
|
|
|
+ Add a custom host-to-IP mapping (host:ip)
|
|
|
+
|
|
|
Add a line to /etc/hosts. The format is hostname:ip. The **--add-host**
|
|
|
option can be set multiple times.
|
|
|
|
|
|
**-c**, **--cpu-shares**=0
|
|
|
- CPU shares in relative weight. You can increase the priority of a container
|
|
|
+ CPU shares (relative weight)
|
|
|
+
|
|
|
+ You can increase the priority of a container
|
|
|
with the -c option. By default, all containers run at the same priority and get
|
|
|
the same proportion of CPU cycles, but you can tell the kernel to give more
|
|
|
shares of CPU time to one or more containers when you start them via **docker
|
|
|
@@ -92,8 +97,9 @@ run**.
|
|
|
CPUs in which to allow execution (0-3, 0,1)
|
|
|
|
|
|
**-d**, **--detach**=*true*|*false*
|
|
|
- Detached mode. This runs the container in the background. It outputs the new
|
|
|
-container's ID and any error messages. At any time you can run **docker ps** in
|
|
|
+ Detached mode: run the container in the background and print the new container ID. The default is *false*.
|
|
|
+
|
|
|
+ At any time you can run **docker ps** in
|
|
|
the other shell to view a list of the running containers. You can reattach to a
|
|
|
detached container with **docker attach**. If you choose to run a container in
|
|
|
the detached mode, then you cannot use the **-rm** option.
|
|
|
@@ -107,19 +113,24 @@ stopping the process by pressing the keys CTRL-P CTRL-Q.
|
|
|
**--dns-search**=[]
|
|
|
Set custom DNS search domains (Use --dns-search=. if you don't wish to set the search domain)
|
|
|
|
|
|
-**--dns**=*IP-address*
|
|
|
- Set custom DNS servers. This option can be used to override the DNS
|
|
|
+**--dns**=[]
|
|
|
+ Set custom DNS servers
|
|
|
+
|
|
|
+ This option can be used to override the DNS
|
|
|
configuration passed to the container. Typically this is necessary when the
|
|
|
host DNS configuration is invalid for the container (e.g., 127.0.0.1). When this
|
|
|
is the case the **--dns** flags is necessary for every run.
|
|
|
|
|
|
-**-e**, **--env**=*environment*
|
|
|
- Set environment variables. This option allows you to specify arbitrary
|
|
|
+**-e**, **--env**=[]
|
|
|
+ Set environment variables
|
|
|
+
|
|
|
+ This option allows you to specify arbitrary
|
|
|
environment variables that are available for the process that will be launched
|
|
|
inside of the container.
|
|
|
|
|
|
+**--entrypoint**=""
|
|
|
+ Overwrite the default ENTRYPOINT of the image
|
|
|
|
|
|
-**--entrypoint**=*command*
|
|
|
This option allows you to overwrite the default entrypoint of the image that
|
|
|
is set in the Dockerfile. The ENTRYPOINT of an image is similar to a COMMAND
|
|
|
because it specifies what executable to run when the container starts, but it is
|
|
|
@@ -137,27 +148,25 @@ ENTRYPOINT.
|
|
|
**--expose**=[]
|
|
|
Expose a port or a range of ports (e.g. --expose=3300-3310) from the container without publishing it to your host
|
|
|
|
|
|
-**-h**, **--hostname**=*hostname*
|
|
|
+**-h**, **--hostname**=""
|
|
|
+ Container host name
|
|
|
+
|
|
|
Sets the container host name that is available inside the container.
|
|
|
|
|
|
**-i**, **--interactive**=*true*|*false*
|
|
|
+ Keep STDIN open even if not attached. The default is *false*.
|
|
|
+
|
|
|
When set to true, keep stdin open even if not attached. The default is false.
|
|
|
|
|
|
-**--ipc**=[]
|
|
|
- Set the IPC mode for the container
|
|
|
- **container**:<*name*|*id*>: reuses another container's IPC stack
|
|
|
- **host**: use the host's IPC stack inside the container.
|
|
|
- Note: the host mode gives the container full access to local IPC and is therefore considered insecure.
|
|
|
+**--ipc**=""
|
|
|
+ Default is to create a private IPC namespace (POSIX SysV IPC) for the container
|
|
|
+ 'container:<name|id>': reuses another container shared memory, semaphores and message queues
|
|
|
+ 'host': use the host shared memory,semaphores and message queues inside the container. Note: the host mode gives the container full access to local shared memory and is therefore considered insecure.
|
|
|
|
|
|
-**--security-opt**=*secdriver*:*name*:*value*
|
|
|
- "label:user:USER" : Set the label user for the container
|
|
|
- "label:role:ROLE" : Set the label role for the container
|
|
|
- "label:type:TYPE" : Set the label type for the container
|
|
|
- "label:level:LEVEL" : Set the label level for the container
|
|
|
- "label:disable" : Turn off label confinement for the container
|
|
|
+**--link**=[]
|
|
|
+ Add link to another container in the form of name:alias
|
|
|
|
|
|
-**--link**=*name*:*alias*
|
|
|
- Add link to another container. The format is name:alias. If the operator
|
|
|
+ If the operator
|
|
|
uses **--link** when starting the new client container, then the client
|
|
|
container can access the exposed port via a private networking interface. Docker
|
|
|
will set some environment variables in the client container to help indicate
|
|
|
@@ -166,7 +175,9 @@ which interface and port to use.
|
|
|
**--lxc-conf**=[]
|
|
|
(lxc exec-driver only) Add custom lxc options --lxc-conf="lxc.cgroup.cpuset.cpus = 0,1"
|
|
|
|
|
|
-**-m**, **--memory**=*memory-limit*
|
|
|
+**-m**, **--memory**=""
|
|
|
+ Memory limit (format: <number><optional unit>, where unit = b, k, m or g)
|
|
|
+
|
|
|
Allows you to constrain the memory available to a container. If the host
|
|
|
supports swap memory, then the -m memory setting can be larger than physical
|
|
|
RAM. If a limit of 0 is specified, the container's memory is not limited. The
|
|
|
@@ -174,15 +185,23 @@ actual limit may be rounded up to a multiple of the operating system's page
|
|
|
size, if it is not already. The memory limit should be formatted as follows:
|
|
|
`<number><optional unit>`, where unit = b, k, m or g.
|
|
|
|
|
|
-**--name**=*name*
|
|
|
- Assign a name to the container. The operator can identify a container in
|
|
|
-three ways:
|
|
|
+**--mac-address**=""
|
|
|
+ Container MAC address (e.g. 92:d0:c6:0a:29:33)
|
|
|
+
|
|
|
+ Remember that the MAC address in an Ethernet network must be unique.
|
|
|
+The IPv6 link-local address will be based on the device's MAC address
|
|
|
+according to RFC4862.
|
|
|
+
|
|
|
+**--name**=""
|
|
|
+ Assign a name to the container
|
|
|
+
|
|
|
+ The operator can identify a container in three ways:
|
|
|
|
|
|
UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”)
|
|
|
UUID short identifier (“f78375b1c487”)
|
|
|
Name (“jonah”)
|
|
|
|
|
|
-The UUID identifiers come from the Docker daemon, and if a name is not assigned
|
|
|
+ The UUID identifiers come from the Docker daemon, and if a name is not assigned
|
|
|
to the container with **--name** then the daemon will also generate a random
|
|
|
string name. The name is useful when defining links (see **--link**) (or any
|
|
|
other place you need to identify a container). This works for both background
|
|
|
@@ -190,21 +209,14 @@ and foreground Docker containers.
|
|
|
|
|
|
**--net**="bridge"
|
|
|
Set the Network mode for the container
|
|
|
- **bridge**: creates a new network stack for the container on the docker bridge
|
|
|
- **none**: no networking for this container
|
|
|
- **container**:<*name*|*id*>: reuses another container's network stack
|
|
|
- **host**: use the host network stack inside the container.
|
|
|
- Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
|
|
|
-
|
|
|
-**--mac-address**=*macaddress*
|
|
|
- Set the MAC address for the container's Ethernet device:
|
|
|
- --mac-address=12:34:56:78:9a:bc
|
|
|
-
|
|
|
-Remember that the MAC address in an Ethernet network must be unique.
|
|
|
-The IPv6 link-local address will be based on the device's MAC address
|
|
|
-according to RFC4862.
|
|
|
+ 'bridge': creates a new network stack for the container on the docker bridge
|
|
|
+ 'none': no networking for this container
|
|
|
+ 'container:<name|id>': reuses another container network stack
|
|
|
+ 'host': use the host network stack inside the container. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
|
|
|
|
|
|
**-P**, **--publish-all**=*true*|*false*
|
|
|
+ Publish all exposed ports to the host interfaces. The default is *false*.
|
|
|
+
|
|
|
When set to true publish all exposed ports to the host interfaces. The
|
|
|
default is false. If the operator uses -P (or -p) then Docker will make the
|
|
|
exposed port accessible on the host and the ports will be available to any
|
|
|
@@ -213,29 +225,44 @@ ports to a random port on the host between 49153 and 65535. To find the
|
|
|
mapping between the host ports and the exposed ports, use **docker port**.
|
|
|
|
|
|
**-p**, **--publish**=[]
|
|
|
- Publish a container's port to the host (format: ip:hostPort:containerPort |
|
|
|
-ip::containerPort | hostPort:containerPort | containerPort) (use **docker port** to see the
|
|
|
-actual mapping)
|
|
|
+ Publish a container's port to the host
|
|
|
+ format: ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort | containerPort
|
|
|
+ (use 'docker port' to see the actual mapping)
|
|
|
|
|
|
**--privileged**=*true*|*false*
|
|
|
- Give extended privileges to this container. By default, Docker containers are
|
|
|
+ Give extended privileges to this container. The default is *false*.
|
|
|
+
|
|
|
+ By default, Docker containers are
|
|
|
“unprivileged” (=false) and cannot, for example, run a Docker daemon inside the
|
|
|
Docker container. This is because by default a container is not allowed to
|
|
|
access any devices. A “privileged” container is given access to all devices.
|
|
|
|
|
|
-When the operator executes **docker run --privileged**, Docker will enable access
|
|
|
+ When the operator executes **docker run --privileged**, Docker will enable access
|
|
|
to all devices on the host as well as set some configuration in AppArmor to
|
|
|
allow the container nearly all the same access to the host as processes running
|
|
|
outside of a container on the host.
|
|
|
|
|
|
+**--restart**=""
|
|
|
+ Restart policy to apply when a container exits (no, on-failure[:max-retry], always)
|
|
|
|
|
|
**--rm**=*true*|*false*
|
|
|
Automatically remove the container when it exits (incompatible with -d). The default is *false*.
|
|
|
|
|
|
+**--security-opt**=[]
|
|
|
+ Security Options
|
|
|
+
|
|
|
+ "label:user:USER" : Set the label user for the container
|
|
|
+ "label:role:ROLE" : Set the label role for the container
|
|
|
+ "label:type:TYPE" : Set the label type for the container
|
|
|
+ "label:level:LEVEL" : Set the label level for the container
|
|
|
+ "label:disable" : Turn off label confinement for the container
|
|
|
+
|
|
|
**--sig-proxy**=*true*|*false*
|
|
|
Proxy received signals to the process (non-TTY mode only). SIGCHLD, SIGSTOP, and SIGKILL are not proxied. The default is *true*.
|
|
|
|
|
|
**-t**, **--tty**=*true*|*false*
|
|
|
+ Allocate a pseudo-TTY. The default is *false*.
|
|
|
+
|
|
|
When set to true Docker can allocate a pseudo-tty and attach to the standard
|
|
|
input of any container. This can be used, for example, to run a throwaway
|
|
|
interactive shell. The default is value is false.
|
|
|
@@ -243,52 +270,39 @@ interactive shell. The default is value is false.
|
|
|
**-u**, **--user**=""
|
|
|
Username or UID
|
|
|
|
|
|
+**-v**, **--volume**=[]
|
|
|
+ Bind mount a volume (e.g., from the host: -v /host:/container, from Docker: -v /container)
|
|
|
|
|
|
-**-v**, **--volume**=*volume*[:ro|:rw]
|
|
|
- Bind mount a volume to the container.
|
|
|
-
|
|
|
-The **-v** option can be used one or
|
|
|
+ The **-v** option can be used one or
|
|
|
more times to add one or more mounts to a container. These mounts can then be
|
|
|
used in other containers using the **--volumes-from** option.
|
|
|
|
|
|
-The volume may be optionally suffixed with :ro or :rw to mount the volumes in
|
|
|
+ The volume may be optionally suffixed with :ro or :rw to mount the volumes in
|
|
|
read-only or read-write mode, respectively. By default, the volumes are mounted
|
|
|
read-write. See examples.
|
|
|
|
|
|
-**--volumes-from**=*container-id*[:ro|:rw]
|
|
|
+**--volumes-from**=[]
|
|
|
+ Mount volumes from the specified container(s)
|
|
|
+
|
|
|
Will mount volumes from the specified container identified by container-id.
|
|
|
Once a volume is mounted in a one container it can be shared with other
|
|
|
containers using the **--volumes-from** option when running those other
|
|
|
containers. The volumes can be shared even if the original container with the
|
|
|
mount is not running.
|
|
|
|
|
|
-The container ID may be optionally suffixed with :ro or
|
|
|
+ The container ID may be optionally suffixed with :ro or
|
|
|
:rw to mount the volumes in read-only or read-write mode, respectively. By
|
|
|
default, the volumes are mounted in the same mode (read write or read only) as
|
|
|
the reference container.
|
|
|
|
|
|
+**-w**, **--workdir**=""
|
|
|
+ Working directory inside the container
|
|
|
|
|
|
-**-w**, **--workdir**=*directory*
|
|
|
- Working directory inside the container. The default working directory for
|
|
|
+ The default working directory for
|
|
|
running binaries within a container is the root directory (/). The developer can
|
|
|
set a different default with the Dockerfile WORKDIR instruction. The operator
|
|
|
can override the working directory by using the **-w** option.
|
|
|
|
|
|
-
|
|
|
-**IMAGE**
|
|
|
- The image name or ID. You can specify a version of an image you'd like to run
|
|
|
- the container with by adding image:tag to the command. For example,
|
|
|
- `docker run ubuntu:14.04`.
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
-**COMMAND**
|
|
|
- The command or program to run inside the image.
|
|
|
-
|
|
|
-
|
|
|
-**ARG**
|
|
|
- The arguments for the command to be run in the container.
|
|
|
-
|
|
|
# EXAMPLES
|
|
|
|
|
|
## Exposing log messages from the container to the host's log
|
Sven Dowideit