|
@@ -1,16 +1,13 @@
|
|
|
-<!--[metadata]>
|
|
|
-+++
|
|
|
-title = "dockerd"
|
|
|
-aliases = ["/engine/reference/commandline/daemon/"]
|
|
|
-description = "The daemon command description and usage"
|
|
|
-keywords = ["container, daemon, runtime"]
|
|
|
-[menu.main]
|
|
|
-parent = "smn_cli"
|
|
|
-weight = -1
|
|
|
-+++
|
|
|
-<![end-metadata]-->
|
|
|
-
|
|
|
-# daemon
|
|
|
+---
|
|
|
+redirect_from:
|
|
|
+- /reference/commandline/dockerd/
|
|
|
+- /reference/commandline/daemon/
|
|
|
+- /engine/reference/commandline/daemon/
|
|
|
+description: The daemon command description and usage
|
|
|
+keywords:
|
|
|
+- container, daemon, runtime
|
|
|
+title: dockerd
|
|
|
+---
|
|
|
|
|
|
```markdown
|
|
|
Usage: dockerd [OPTIONS]
|
|
@@ -236,7 +233,7 @@ snapshots. For each devicemapper graph location – typically
|
|
|
`/var/lib/docker/devicemapper` – a thin pool is created based on two block
|
|
|
devices, one for data and one for metadata. By default, these block devices
|
|
|
are created automatically by using loopback mounts of automatically created
|
|
|
-sparse files. Refer to [Storage driver options](#storage-driver-options) below
|
|
|
+sparse files. Refer to [Storage driver options](dockerd.md#storage-driver-options) below
|
|
|
for a way how to customize this setup.
|
|
|
[~jpetazzo/Resizing Docker containers with the Device Mapper plugin](http://jpetazzo.github.io/2014/01/29/docker-device-mapper-resize/)
|
|
|
article explains how to tune your existing setup without the use of options.
|
|
@@ -248,7 +245,7 @@ does not share executable memory between devices. Use
|
|
|
The `zfs` driver is probably not as fast as `btrfs` but has a longer track record
|
|
|
on stability. Thanks to `Single Copy ARC` shared blocks between clones will be
|
|
|
cached only once. Use `dockerd -s zfs`. To select a different zfs filesystem
|
|
|
-set `zfs.fsname` option as described in [Storage driver options](#storage-driver-options).
|
|
|
+set `zfs.fsname` option as described in [Storage driver options](dockerd.md#storage-driver-options).
|
|
|
|
|
|
The `overlay` is a very fast union filesystem. It is now merged in the main
|
|
|
Linux kernel as of [3.18.0](https://lkml.org/lkml/2014/10/26/137). `overlay`
|
|
@@ -280,7 +277,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
|
|
|
#### Devicemapper options
|
|
|
|
|
|
-* `dm.thinpooldev`
|
|
|
+* `dm.thinpooldev`
|
|
|
|
|
|
Specifies a custom block storage device to use for the thin pool.
|
|
|
|
|
@@ -307,7 +304,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.thinpooldev=/dev/mapper/thin-pool
|
|
|
```
|
|
|
|
|
|
-* `dm.basesize`
|
|
|
+* `dm.basesize`
|
|
|
|
|
|
Specifies the size to use when creating the base device, which limits the
|
|
|
size of images and containers. The default value is 10G. Note, thin devices
|
|
@@ -325,7 +322,6 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.basesize=50G
|
|
|
```
|
|
|
|
|
|
-
|
|
|
This will increase the base device size to 50G. The Docker daemon will throw an
|
|
|
error if existing base device size is larger than 50G. A user can use
|
|
|
this option to expand the base device size however shrinking is not permitted.
|
|
@@ -346,7 +342,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.basesize=20G
|
|
|
```
|
|
|
|
|
|
-* `dm.loopdatasize`
|
|
|
+* `dm.loopdatasize`
|
|
|
|
|
|
> **Note**:
|
|
|
> This option configures devicemapper loopback, which should not
|
|
@@ -363,7 +359,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.loopdatasize=200G
|
|
|
```
|
|
|
|
|
|
-* `dm.loopmetadatasize`
|
|
|
+* `dm.loopmetadatasize`
|
|
|
|
|
|
> **Note**:
|
|
|
> This option configures devicemapper loopback, which should not
|
|
@@ -380,7 +376,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.loopmetadatasize=4G
|
|
|
```
|
|
|
|
|
|
-* `dm.fs`
|
|
|
+* `dm.fs`
|
|
|
|
|
|
Specifies the filesystem type to use for the base device. The supported
|
|
|
options are "ext4" and "xfs". The default is "xfs"
|
|
@@ -391,7 +387,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.fs=ext4
|
|
|
```
|
|
|
|
|
|
-* `dm.mkfsarg`
|
|
|
+* `dm.mkfsarg`
|
|
|
|
|
|
Specifies extra mkfs arguments to be used when creating the base device.
|
|
|
|
|
@@ -401,7 +397,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt "dm.mkfsarg=-O ^has_journal"
|
|
|
```
|
|
|
|
|
|
-* `dm.mountopt`
|
|
|
+* `dm.mountopt`
|
|
|
|
|
|
Specifies extra mount options used when mounting the thin devices.
|
|
|
|
|
@@ -411,7 +407,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.mountopt=nodiscard
|
|
|
```
|
|
|
|
|
|
-* `dm.datadev`
|
|
|
+* `dm.datadev`
|
|
|
|
|
|
(Deprecated, use `dm.thinpooldev`)
|
|
|
|
|
@@ -429,7 +425,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
--storage-opt dm.metadatadev=/dev/sdc1
|
|
|
```
|
|
|
|
|
|
-* `dm.metadatadev`
|
|
|
+* `dm.metadatadev`
|
|
|
|
|
|
(Deprecated, use `dm.thinpooldev`)
|
|
|
|
|
@@ -453,7 +449,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
--storage-opt dm.metadatadev=/dev/sdc1
|
|
|
```
|
|
|
|
|
|
-* `dm.blocksize`
|
|
|
+* `dm.blocksize`
|
|
|
|
|
|
Specifies a custom blocksize to use for the thin pool. The default
|
|
|
blocksize is 64K.
|
|
@@ -464,7 +460,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.blocksize=512K
|
|
|
```
|
|
|
|
|
|
-* `dm.blkdiscard`
|
|
|
+* `dm.blkdiscard`
|
|
|
|
|
|
Enables or disables the use of blkdiscard when removing devicemapper
|
|
|
devices. This is enabled by default (only) if using loopback devices and is
|
|
@@ -480,7 +476,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.blkdiscard=false
|
|
|
```
|
|
|
|
|
|
-* `dm.override_udev_sync_check`
|
|
|
+* `dm.override_udev_sync_check`
|
|
|
|
|
|
Overrides the `udev` synchronization checks between `devicemapper` and `udev`.
|
|
|
`udev` is the device manager for the Linux kernel.
|
|
@@ -520,7 +516,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
> Otherwise, set this flag for migrating existing Docker daemons to
|
|
|
> a daemon with a supported environment.
|
|
|
|
|
|
-* `dm.use_deferred_removal`
|
|
|
+* `dm.use_deferred_removal`
|
|
|
|
|
|
Enables use of deferred device removal if `libdm` and the kernel driver
|
|
|
support the mechanism.
|
|
@@ -542,7 +538,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
$ sudo dockerd --storage-opt dm.use_deferred_removal=true
|
|
|
```
|
|
|
|
|
|
-* `dm.use_deferred_deletion`
|
|
|
+* `dm.use_deferred_deletion`
|
|
|
|
|
|
Enables use of deferred device deletion for thin pool devices. By default,
|
|
|
thin pool device deletion is synchronous. Before a container is deleted,
|
|
@@ -568,7 +564,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
when unintentional leaking of mount point happens across multiple mount
|
|
|
namespaces.
|
|
|
|
|
|
-* `dm.min_free_space`
|
|
|
+* `dm.min_free_space`
|
|
|
|
|
|
Specifies the min free space percent in a thin pool require for new device
|
|
|
creation to succeed. This check applies to both free data space as well
|
|
@@ -600,7 +596,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
|
|
|
#### ZFS options
|
|
|
|
|
|
-* `zfs.fsname`
|
|
|
+* `zfs.fsname`
|
|
|
|
|
|
Set zfs filesystem under which docker will create its own datasets.
|
|
|
By default docker will pick up the zfs filesystem where docker graph
|
|
@@ -614,9 +610,9 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
|
|
|
#### Btrfs options
|
|
|
|
|
|
-* `btrfs.min_space`
|
|
|
+* `btrfs.min_space`
|
|
|
|
|
|
- Specifies the mininum size to use when creating the subvolume which is used
|
|
|
+ Specifies the minimum size to use when creating the subvolume which is used
|
|
|
for containers. If user uses disk quota for btrfs when creating or running
|
|
|
a container with **--storage-opt size** option, docker should ensure the
|
|
|
**size** cannot be smaller than **btrfs.min_space**.
|
|
@@ -629,7 +625,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`.
|
|
|
|
|
|
#### Overlay2 options
|
|
|
|
|
|
-* `overlay2.override_kernel_check`
|
|
|
+* `overlay2.override_kernel_check`
|
|
|
|
|
|
Overrides the Linux kernel version check allowing overlay2. Support for
|
|
|
specifying multiple lower directories needed by overlay2 was added to the
|
|
@@ -657,19 +653,20 @@ Runtimes can be registered with the daemon either via the
|
|
|
configuration file or using the `--add-runtime` command line argument.
|
|
|
|
|
|
The following is an example adding 2 runtimes via the configuration:
|
|
|
+
|
|
|
```json
|
|
|
- "default-runtime": "runc",
|
|
|
- "runtimes": {
|
|
|
- "runc": {
|
|
|
- "path": "runc"
|
|
|
- },
|
|
|
- "custom": {
|
|
|
- "path": "/usr/local/bin/my-runc-replacement",
|
|
|
- "runtimeArgs": [
|
|
|
- "--debug"
|
|
|
- ]
|
|
|
- }
|
|
|
+"default-runtime": "runc",
|
|
|
+"runtimes": {
|
|
|
+ "runc": {
|
|
|
+ "path": "runc"
|
|
|
+ },
|
|
|
+ "custom": {
|
|
|
+ "path": "/usr/local/bin/my-runc-replacement",
|
|
|
+ "runtimeArgs": [
|
|
|
+ "--debug"
|
|
|
+ ]
|
|
|
}
|
|
|
+}
|
|
|
```
|
|
|
|
|
|
This is the same example via the command line:
|
|
@@ -829,35 +826,35 @@ $ sudo dockerd \
|
|
|
|
|
|
The currently supported cluster store options are:
|
|
|
|
|
|
-* `discovery.heartbeat`
|
|
|
+* `discovery.heartbeat`
|
|
|
|
|
|
Specifies the heartbeat timer in seconds which is used by the daemon as a
|
|
|
keepalive mechanism to make sure discovery module treats the node as alive
|
|
|
in the cluster. If not configured, the default value is 20 seconds.
|
|
|
|
|
|
-* `discovery.ttl`
|
|
|
+* `discovery.ttl`
|
|
|
|
|
|
Specifies the ttl (time-to-live) in seconds which is used by the discovery
|
|
|
module to timeout a node if a valid heartbeat is not received within the
|
|
|
configured ttl value. If not configured, the default value is 60 seconds.
|
|
|
|
|
|
-* `kv.cacertfile`
|
|
|
+* `kv.cacertfile`
|
|
|
|
|
|
Specifies the path to a local file with PEM encoded CA certificates to trust
|
|
|
|
|
|
-* `kv.certfile`
|
|
|
+* `kv.certfile`
|
|
|
|
|
|
Specifies the path to a local file with a PEM encoded certificate. This
|
|
|
certificate is used as the client cert for communication with the
|
|
|
Key/Value store.
|
|
|
|
|
|
-* `kv.keyfile`
|
|
|
+* `kv.keyfile`
|
|
|
|
|
|
Specifies the path to a local file with a PEM encoded private key. This
|
|
|
private key is used as the client key for communication with the
|
|
|
Key/Value store.
|
|
|
|
|
|
-* `kv.path`
|
|
|
+* `kv.path`
|
|
|
|
|
|
Specifies the path in the Key/Value store. If not configured, the default value is 'docker/nodes'.
|
|
|
|
|
@@ -994,7 +991,7 @@ following algorithm to create the mapping ranges:
|
|
|
If you enable user namespaces on the daemon, all containers are started
|
|
|
with user namespaces enabled. In some situations you might want to disable
|
|
|
this feature for a container, for example, to start a privileged container (see
|
|
|
-[user namespace known restrictions](#user-namespace-known-restrictions)).
|
|
|
+[user namespace known restrictions](dockerd.md#user-namespace-known-restrictions)).
|
|
|
To enable those advanced features for a specific container use `--userns=host`
|
|
|
in the `run/exec/create` command.
|
|
|
This option will completely disable user namespace mapping for the container's user.
|
|
@@ -1089,71 +1086,71 @@ This is a full example of the allowed configuration options on Linux:
|
|
|
|
|
|
```json
|
|
|
{
|
|
|
- "authorization-plugins": [],
|
|
|
- "dns": [],
|
|
|
- "dns-opts": [],
|
|
|
- "dns-search": [],
|
|
|
- "exec-opts": [],
|
|
|
- "exec-root": "",
|
|
|
- "storage-driver": "",
|
|
|
- "storage-opts": [],
|
|
|
- "labels": [],
|
|
|
- "live-restore": true,
|
|
|
- "log-driver": "",
|
|
|
- "log-opts": {},
|
|
|
- "mtu": 0,
|
|
|
- "pidfile": "",
|
|
|
- "graph": "",
|
|
|
- "cluster-store": "",
|
|
|
- "cluster-store-opts": {},
|
|
|
- "cluster-advertise": "",
|
|
|
- "max-concurrent-downloads": 3,
|
|
|
- "max-concurrent-uploads": 5,
|
|
|
- "debug": true,
|
|
|
- "hosts": [],
|
|
|
- "log-level": "",
|
|
|
- "tls": true,
|
|
|
- "tlsverify": true,
|
|
|
- "tlscacert": "",
|
|
|
- "tlscert": "",
|
|
|
- "tlskey": "",
|
|
|
- "swarm-default-advertise-addr": "",
|
|
|
- "api-cors-header": "",
|
|
|
- "selinux-enabled": false,
|
|
|
- "userns-remap": "",
|
|
|
- "group": "",
|
|
|
- "cgroup-parent": "",
|
|
|
- "default-ulimits": {},
|
|
|
- "ipv6": false,
|
|
|
- "iptables": false,
|
|
|
- "ip-forward": false,
|
|
|
- "ip-masq": false,
|
|
|
- "userland-proxy": false,
|
|
|
- "ip": "0.0.0.0",
|
|
|
- "bridge": "",
|
|
|
- "bip": "",
|
|
|
- "fixed-cidr": "",
|
|
|
- "fixed-cidr-v6": "",
|
|
|
- "default-gateway": "",
|
|
|
- "default-gateway-v6": "",
|
|
|
- "icc": false,
|
|
|
- "raw-logs": false,
|
|
|
- "registry-mirrors": [],
|
|
|
- "insecure-registries": [],
|
|
|
- "disable-legacy-registry": false,
|
|
|
- "default-runtime": "runc",
|
|
|
- "oom-score-adjust": -500,
|
|
|
- "runtimes": {
|
|
|
- "runc": {
|
|
|
- "path": "runc"
|
|
|
- },
|
|
|
- "custom": {
|
|
|
- "path": "/usr/local/bin/my-runc-replacement",
|
|
|
- "runtimeArgs": [
|
|
|
- "--debug"
|
|
|
- ]
|
|
|
- }
|
|
|
- }
|
|
|
+ "api-cors-header": "",
|
|
|
+ "authorization-plugins": [],
|
|
|
+ "bip": "",
|
|
|
+ "bridge": "",
|
|
|
+ "cgroup-parent": "",
|
|
|
+ "cluster-store": "",
|
|
|
+ "cluster-store-opts": {},
|
|
|
+ "cluster-advertise": "",
|
|
|
+ "debug": true,
|
|
|
+ "default-gateway": "",
|
|
|
+ "default-gateway-v6": "",
|
|
|
+ "default-runtime": "runc",
|
|
|
+ "default-ulimits": {},
|
|
|
+ "disable-legacy-registry": false,
|
|
|
+ "dns": [],
|
|
|
+ "dns-opts": [],
|
|
|
+ "dns-search": [],
|
|
|
+ "exec-opts": [],
|
|
|
+ "exec-root": "",
|
|
|
+ "fixed-cidr": "",
|
|
|
+ "fixed-cidr-v6": "",
|
|
|
+ "graph": "",
|
|
|
+ "group": "",
|
|
|
+ "hosts": [],
|
|
|
+ "icc": false,
|
|
|
+ "insecure-registries": [],
|
|
|
+ "ip": "0.0.0.0",
|
|
|
+ "iptables": false,
|
|
|
+ "ipv6": false,
|
|
|
+ "ip-forward": false,
|
|
|
+ "ip-masq": false,
|
|
|
+ "labels": [],
|
|
|
+ "live-restore": true,
|
|
|
+ "log-driver": "",
|
|
|
+ "log-level": "",
|
|
|
+ "log-opts": {},
|
|
|
+ "max-concurrent-downloads": 3,
|
|
|
+ "max-concurrent-uploads": 5,
|
|
|
+ "mtu": 0,
|
|
|
+ "oom-score-adjust": -500,
|
|
|
+ "pidfile": "",
|
|
|
+ "raw-logs": false,
|
|
|
+ "registry-mirrors": [],
|
|
|
+ "runtimes": {
|
|
|
+ "runc": {
|
|
|
+ "path": "runc"
|
|
|
+ },
|
|
|
+ "custom": {
|
|
|
+ "path": "/usr/local/bin/my-runc-replacement",
|
|
|
+ "runtimeArgs": [
|
|
|
+ "--debug"
|
|
|
+ ]
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "selinux-enabled": false,
|
|
|
+ "storage-driver": "",
|
|
|
+ "storage-opts": [],
|
|
|
+ "swarm-default-advertise-addr": "",
|
|
|
+ "tls": true,
|
|
|
+ "tlscacert": "",
|
|
|
+ "tlscert": "",
|
|
|
+ "tlskey": "",
|
|
|
+ "tlsverify": true,
|
|
|
+ "userland-proxy": false,
|
|
|
+ "userns-remap": ""
|
|
|
}
|
|
|
```
|
|
|
|
|
@@ -1168,36 +1165,36 @@ This is a full example of the allowed configuration options on Windows:
|
|
|
```json
|
|
|
{
|
|
|
"authorization-plugins": [],
|
|
|
+ "bridge": "",
|
|
|
+ "cluster-advertise": "",
|
|
|
+ "cluster-store": "",
|
|
|
+ "debug": true,
|
|
|
+ "default-ulimits": {},
|
|
|
+ "disable-legacy-registry": false,
|
|
|
"dns": [],
|
|
|
"dns-opts": [],
|
|
|
"dns-search": [],
|
|
|
"exec-opts": [],
|
|
|
- "storage-driver": "",
|
|
|
- "storage-opts": [],
|
|
|
+ "fixed-cidr": "",
|
|
|
+ "graph": "",
|
|
|
+ "group": "",
|
|
|
+ "hosts": [],
|
|
|
+ "insecure-registries": [],
|
|
|
"labels": [],
|
|
|
"live-restore": true,
|
|
|
"log-driver": "",
|
|
|
+ "log-level": "",
|
|
|
"mtu": 0,
|
|
|
"pidfile": "",
|
|
|
- "graph": "",
|
|
|
- "cluster-store": "",
|
|
|
- "cluster-advertise": "",
|
|
|
- "debug": true,
|
|
|
- "hosts": [],
|
|
|
- "log-level": "",
|
|
|
- "tlsverify": true,
|
|
|
+ "raw-logs": false,
|
|
|
+ "registry-mirrors": [],
|
|
|
+ "storage-driver": "",
|
|
|
+ "storage-opts": [],
|
|
|
+ "swarm-default-advertise-addr": "",
|
|
|
"tlscacert": "",
|
|
|
"tlscert": "",
|
|
|
"tlskey": "",
|
|
|
- "swarm-default-advertise-addr": "",
|
|
|
- "group": "",
|
|
|
- "default-ulimits": {},
|
|
|
- "bridge": "",
|
|
|
- "fixed-cidr": "",
|
|
|
- "raw-logs": false,
|
|
|
- "registry-mirrors": [],
|
|
|
- "insecure-registries": [],
|
|
|
- "disable-legacy-registry": false
|
|
|
+ "tlsverify": true
|
|
|
}
|
|
|
```
|
|
|
|
|
@@ -1244,7 +1241,7 @@ previously configured cluster configurations.
|
|
|
This section describes how to run multiple Docker daemons on a single host. To
|
|
|
run multiple daemons, you must configure each daemon so that it does not
|
|
|
conflict with other daemons on the same host. You can set these options either
|
|
|
-by providing them as flags, or by using a [daemon configuration file](#daemon-configuration-file).
|
|
|
+by providing them as flags, or by using a [daemon configuration file](dockerd.md#daemon-configuration-file).
|
|
|
|
|
|
The following daemon options must be configured for each daemon:
|
|
|
|