56f77d5ade
containers may specify these cgroup values at runtime. This will allow processes to change their priority to real-time within the container when CONFIG_RT_GROUP_SCHED is enabled in the kernel. See #22380. Also added sanity checks for the new --cpu-rt-runtime and --cpu-rt-period flags to ensure that that the kernel supports these features and that runtime is not greater than period. Daemon will support a --cpu-rt-runtime flag to initialize the parent cgroup on startup, this prevents the administrator from alotting runtime to docker after each restart. There are additional checks that could be added but maybe too far? Check parent cgroups to ensure values are <= parent, inspecting rtprio ulimit and issuing a warning. Signed-off-by: Erik St. Martin <alakriti@gmail.com>
205 lines
13 KiB
Markdown
205 lines
13 KiB
Markdown
---
|
|
title: "create"
|
|
description: "The create command description and usage"
|
|
keywords: ["docker, create, container"]
|
|
---
|
|
|
|
<!-- This file is maintained within the docker/docker Github
|
|
repository at https://github.com/docker/docker/. Make all
|
|
pull requests against that repo. If you see this file in
|
|
another repository, consider it read-only there, as it will
|
|
periodically be overwritten by the definitive file. Pull
|
|
requests which include edits to this file in other repositories
|
|
will be rejected.
|
|
-->
|
|
|
|
# create
|
|
|
|
Creates a new container.
|
|
|
|
```markdown
|
|
Usage: docker create [OPTIONS] IMAGE [COMMAND] [ARG...]
|
|
|
|
Create a new container
|
|
|
|
Options:
|
|
--add-host value Add a custom host-to-IP mapping (host:ip) (default [])
|
|
-a, --attach value Attach to STDIN, STDOUT or STDERR (default [])
|
|
--blkio-weight value Block IO (relative weight), between 10 and 1000
|
|
--blkio-weight-device value Block IO weight (relative device weight) (default [])
|
|
--cap-add value Add Linux capabilities (default [])
|
|
--cap-drop value Drop Linux capabilities (default [])
|
|
--cgroup-parent string Optional parent cgroup for the container
|
|
--cidfile string Write the container ID to the file
|
|
--cpu-percent int CPU percent (Windows only)
|
|
--cpu-period int Limit CPU CFS (Completely Fair Scheduler) period
|
|
--cpu-quota int Limit CPU CFS (Completely Fair Scheduler) quota
|
|
-c, --cpu-shares int CPU shares (relative weight)
|
|
--cpu-rt-period int Limit the CPU real-time period in microseconds
|
|
--cpu-rt-runtime int Limit the CPU real-time runtime in microseconds
|
|
--cpuset-cpus string CPUs in which to allow execution (0-3, 0,1)
|
|
--cpuset-mems string MEMs in which to allow execution (0-3, 0,1)
|
|
--device value Add a host device to the container (default [])
|
|
--device-read-bps value Limit read rate (bytes per second) from a device (default [])
|
|
--device-read-iops value Limit read rate (IO per second) from a device (default [])
|
|
--device-write-bps value Limit write rate (bytes per second) to a device (default [])
|
|
--device-write-iops value Limit write rate (IO per second) to a device (default [])
|
|
--disable-content-trust Skip image verification (default true)
|
|
--dns value Set custom DNS servers (default [])
|
|
--dns-opt value Set DNS options (default [])
|
|
--dns-search value Set custom DNS search domains (default [])
|
|
--entrypoint string Overwrite the default ENTRYPOINT of the image
|
|
-e, --env value Set environment variables (default [])
|
|
--env-file value Read in a file of environment variables (default [])
|
|
--expose value Expose a port or a range of ports (default [])
|
|
--group-add value Add additional groups to join (default [])
|
|
--health-cmd string Command to run to check health
|
|
--health-interval duration Time between running the check
|
|
--health-retries int Consecutive failures needed to report unhealthy
|
|
--health-timeout duration Maximum time to allow one check to run
|
|
--help Print usage
|
|
-h, --hostname string Container host name
|
|
-i, --interactive Keep STDIN open even if not attached
|
|
--io-maxbandwidth string Maximum IO bandwidth limit for the system drive (Windows only)
|
|
--io-maxiops uint Maximum IOps limit for the system drive (Windows only)
|
|
--ip string Container IPv4 address (e.g. 172.30.100.104)
|
|
--ip6 string Container IPv6 address (e.g. 2001:db8::33)
|
|
--ipc string IPC namespace to use
|
|
--isolation string Container isolation technology
|
|
--kernel-memory string Kernel memory limit
|
|
-l, --label value Set meta data on a container (default [])
|
|
--label-file value Read in a line delimited file of labels (default [])
|
|
--link value Add link to another container (default [])
|
|
--link-local-ip value Container IPv4/IPv6 link-local addresses (default [])
|
|
--log-driver string Logging driver for the container
|
|
--log-opt value Log driver options (default [])
|
|
--mac-address string Container MAC address (e.g. 92:d0:c6:0a:29:33)
|
|
-m, --memory string Memory limit
|
|
--memory-reservation string Memory soft limit
|
|
--memory-swap string Swap limit equal to memory plus swap: '-1' to enable unlimited swap
|
|
--memory-swappiness int Tune container memory swappiness (0 to 100) (default -1)
|
|
--name string Assign a name to the container
|
|
--network-alias value Add network-scoped alias for the container (default [])
|
|
--network string Connect a container to a network (default "default")
|
|
'bridge': create a network stack on the default Docker bridge
|
|
'none': no networking
|
|
'container:<name|id>': reuse another container's network stack
|
|
'host': use the Docker host network stack
|
|
'<network-name>|<network-id>': connect to a user-defined network
|
|
--no-healthcheck Disable any container-specified HEALTHCHECK
|
|
--oom-kill-disable Disable OOM Killer
|
|
--oom-score-adj int Tune host's OOM preferences (-1000 to 1000)
|
|
--pid string PID namespace to use
|
|
--pids-limit int Tune container pids limit (set -1 for unlimited), kernel >= 4.3
|
|
--privileged Give extended privileges to this container
|
|
-p, --publish value Publish a container's port(s) to the host (default [])
|
|
-P, --publish-all Publish all exposed ports to random ports
|
|
--read-only Mount the container's root filesystem as read only
|
|
--restart string Restart policy to apply when a container exits (default "no")
|
|
Possible values are: no, on-failure[:max-retry], always, unless-stopped
|
|
--rm Automatically remove the container when it exits
|
|
--runtime string Runtime to use for this container
|
|
--security-opt value Security Options (default [])
|
|
--shm-size string Size of /dev/shm, default value is 64MB.
|
|
The format is `<number><unit>`. `number` must be greater than `0`.
|
|
Unit is optional and can be `b` (bytes), `k` (kilobytes), `m` (megabytes),
|
|
or `g` (gigabytes). If you omit the unit, the system uses bytes.
|
|
--stop-signal string Signal to stop a container, SIGTERM by default (default "SIGTERM")
|
|
--stop-timeout=10 Timeout (in seconds) to stop a container
|
|
--storage-opt value Storage driver options for the container (default [])
|
|
--sysctl value Sysctl options (default map[])
|
|
--tmpfs value Mount a tmpfs directory (default [])
|
|
-t, --tty Allocate a pseudo-TTY
|
|
--ulimit value Ulimit options (default [])
|
|
-u, --user string Username or UID (format: <name|uid>[:<group|gid>])
|
|
--userns string User namespace to use
|
|
'host': Use the Docker host user namespace
|
|
'': Use the Docker daemon user namespace specified by `--userns-remap` option.
|
|
--uts string UTS namespace to use
|
|
-v, --volume value Bind mount a volume (default []). The format
|
|
is `[host-src:]container-dest[:<options>]`.
|
|
The comma-delimited `options` are [rw|ro],
|
|
[z|Z], [[r]shared|[r]slave|[r]private], and
|
|
[nocopy]. The 'host-src' is an absolute path
|
|
or a name value.
|
|
--volume-driver string Optional volume driver for the container
|
|
--volumes-from value Mount volumes from the specified container(s) (default [])
|
|
-w, --workdir string Working directory inside the container
|
|
```
|
|
|
|
The `docker create` command creates a writeable container layer over the
|
|
specified image and prepares it for running the specified command. The
|
|
container ID is then printed to `STDOUT`. This is similar to `docker run -d`
|
|
except the container is never started. You can then use the
|
|
`docker start <container_id>` command to start the container at any point.
|
|
|
|
This is useful when you want to set up a container configuration ahead of time
|
|
so that it is ready to start when you need it. The initial status of the
|
|
new container is `created`.
|
|
|
|
Please see the [run command](run.md) section and the [Docker run reference](../run.md) for more details.
|
|
|
|
## Examples
|
|
|
|
$ docker create -t -i fedora bash
|
|
6d8af538ec541dd581ebc2a24153a28329acb5268abe5ef868c1f1a261221752
|
|
$ docker start -a -i 6d8af538ec5
|
|
bash-4.2#
|
|
|
|
As of v1.4.0 container volumes are initialized during the `docker create` phase
|
|
(i.e., `docker run` too). For example, this allows you to `create` the `data`
|
|
volume container, and then use it from another container:
|
|
|
|
$ docker create -v /data --name data ubuntu
|
|
240633dfbb98128fa77473d3d9018f6123b99c454b3251427ae190a7d951ad57
|
|
$ docker run --rm --volumes-from data ubuntu ls -la /data
|
|
total 8
|
|
drwxr-xr-x 2 root root 4096 Dec 5 04:10 .
|
|
drwxr-xr-x 48 root root 4096 Dec 5 04:11 ..
|
|
|
|
Similarly, `create` a host directory bind mounted volume container, which can
|
|
then be used from the subsequent container:
|
|
|
|
$ docker create -v /home/docker:/docker --name docker ubuntu
|
|
9aa88c08f319cd1e4515c3c46b0de7cc9aa75e878357b1e96f91e2c773029f03
|
|
$ docker run --rm --volumes-from docker ubuntu ls -la /docker
|
|
total 20
|
|
drwxr-sr-x 5 1000 staff 180 Dec 5 04:00 .
|
|
drwxr-xr-x 48 root root 4096 Dec 5 04:13 ..
|
|
-rw-rw-r-- 1 1000 staff 3833 Dec 5 04:01 .ash_history
|
|
-rw-r--r-- 1 1000 staff 446 Nov 28 11:51 .ashrc
|
|
-rw-r--r-- 1 1000 staff 25 Dec 5 04:00 .gitconfig
|
|
drwxr-sr-x 3 1000 staff 60 Dec 1 03:28 .local
|
|
-rw-r--r-- 1 1000 staff 920 Nov 28 11:51 .profile
|
|
drwx--S--- 2 1000 staff 460 Dec 5 00:51 .ssh
|
|
drwxr-xr-x 32 1000 staff 1140 Dec 5 04:01 docker
|
|
|
|
Set storage driver options per container.
|
|
|
|
$ docker create -it --storage-opt size=120G fedora /bin/bash
|
|
|
|
This (size) will allow to set the container rootfs size to 120G at creation time.
|
|
This option is only available for the `devicemapper`, `btrfs`, `overlay2`,
|
|
`windowsfilter` and `zfs` graph drivers.
|
|
For the `devicemapper`, `btrfs`, `windowsfilter` and `zfs` graph drivers,
|
|
user cannot pass a size less than the Default BaseFS Size.
|
|
For the `overlay2` storage driver, the size option is only available if the
|
|
backing fs is `xfs` and mounted with the `pquota` mount option.
|
|
Under these conditions, user can pass any size less then the backing fs size.
|
|
|
|
### Specify isolation technology for container (--isolation)
|
|
|
|
This option is useful in situations where you are running Docker containers on
|
|
Windows. The `--isolation=<value>` option sets a container's isolation
|
|
technology. On Linux, the only supported is the `default` option which uses
|
|
Linux namespaces. On Microsoft Windows, you can specify these values:
|
|
|
|
|
|
| Value | Description |
|
|
|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
| `default` | Use the value specified by the Docker daemon's `--exec-opt` . If the `daemon` does not specify an isolation technology, Microsoft Windows uses `process` as its default value if the
|
|
daemon is running on Windows server, or `hyperv` if running on Windows client. |
|
|
| `process` | Namespace isolation only. |
|
|
| `hyperv` | Hyper-V hypervisor partition-based isolation. |
|
|
|
|
Specifying the `--isolation` flag without a value is the same as setting `--isolation="default"`.
|