1CH-BUILD2DIR(1)                  Charliecloud                  CH-BUILD2DIR(1)
2
3
4

NAME

6       ch-build2dir - Build a Charliecloud image from Dockerfile and unpack it
7

SYNOPSIS

9          $ ch-build2dir -t TAG [ARGS ...] CONTEXT OUTDIR
10

DESCRIPTION

12       Build  a  Docker  image  named  TAG  described by a Dockerfile (default
13       ./Dockerfile) and unpack it into OUTDIR/TAG.  This  is  a  wrapper  for
14       ch-build, ch-docker2tar, and ch-tar2dir; see also those man pages.
15
16       Arguments:
17
18          ARGS   additional arguments passed to ch-build
19
20          CONTEXT
21                 Docker context directory
22
23          OUTDIR directory  in  which to place image directory (named TAG) and
24                 temporary tarball
25
26          -t TAG name (tag) of Docker image to build
27
28          --help print help and exit
29
30          --version
31                 print version and exit
32

EXAMPLES

34       To build using ./Dockerfile and create image directory /var/tmp/foo:
35
36          $ ch-build2dir -t foo . /var/tmp
37
38       Same as above, but build with a different Dockerfile:
39
40          $ ch-build2dir -t foo -f ./Dockerfile.foo . /var/tmp
41

REPORTING BUGS

43       If Charliecloud was obtained from your  Linux  distribution,  use  your
44       distribution’s bug reporting procedures.
45
46       Otherwise, report bugs to: <https://github.com/hpc/charliecloud/issues>
47

SEE ALSO

49       charliecloud(1)
50
51       Full documentation at: <https://hpc.github.io/charliecloud>
52

DOCKER TIPS

54       Docker  is  a  convenient  way  to  build  Charliecloud  images.  While
55       installing Docker is beyond the scope of this documentation, here are a
56       few tips.
57
58   Understand the security implications of Docker
59       Because  Docker  (a)  makes  installing  random  crap from the internet
60       really easy and (b) is easy to deploy insecurely, you should take care.
61       Some  of the implications are below. This list should not be considered
62       comprehensive nor a substitute for  appropriate  expertise;  adhere  to
63       your moral and institutional responsibilities.
64
65   docker equals root
66       Anyone  who can run the docker command or interact with the Docker dae‐
67       mon can trivially escalate to root.  This is considered a feature.
68
69       For this reason, don’t create the docker  group,  as  this  will  allow
70       passwordless, unlogged escalation for anyone in the group.
71
72   Images can contain bad stuff
73       Standard hygiene for “installing stuff from the internet” applies. Only
74       work with images you trust. The official Docker  Hub  repositories  can
75       help.
76
77   Containers run as root
78       By  default,  Docker  runs  container processes as root. In addition to
79       being poor hygiene, this  can  be  an  escalation  path,  e.g.  if  you
80       bind-mount host directories.
81
82   Docker alters your network configuration
83       To see what it did:
84
85          $ ifconfig    # note docker0 interface
86          $ brctl show  # note docker0 bridge
87          $ route -n
88
89   Docker installs services
90       If you don’t want the service starting automatically at boot, e.g.:
91
92          $ systemctl is-enabled docker
93          enabled
94          $ systemctl disable docker
95          $ systemctl is-enabled docker
96          disabled
97
98   Configuring for a proxy
99       By  default,  Docker does not work if you have a proxy, and it fails in
100       two different ways.
101
102       The first problem is that Docker itself must be told to  use  a  proxy.
103       This manifests as:
104
105          $ sudo docker run hello-world
106          Unable to find image 'hello-world:latest' locally
107          Pulling repository hello-world
108          Get https://index.docker.io/v1/repositories/library/hello-world/images: dial tcp 54.152.161.54:443: connection refused
109
110       If  you have a systemd system, the Docker documentation explains how to
111       configure  this.  If  you   don’t   have   a   systemd   system,   then
112       /etc/default/docker might be the place to go?
113
114       The  second  problem  is  that Docker containers need to know about the
115       proxy as well. This manifests as images failing to build  because  they
116       can’t download stuff from the internet.
117
118       The fix is to set the proxy variables in your environment, e.g.:
119
120          export HTTP_PROXY=http://proxy.example.com:8088
121          export http_proxy=$HTTP_PROXY
122          export HTTPS_PROXY=$HTTP_PROXY
123          export https_proxy=$HTTP_PROXY
124          export ALL_PROXY=$HTTP_PROXY
125          export all_proxy=$HTTP_PROXY
126          export NO_PROXY='localhost,127.0.0.1,.example.com'
127          export no_proxy=$NO_PROXY
128
129       You  also  need  to  teach  sudo  to  retain them. Add the following to
130       /etc/sudoers:
131
132          Defaults env_keep+="HTTP_PROXY http_proxy HTTPS_PROXY https_proxy ALL_PROXY all_proxy NO_PROXY no_proxy"
133
134       Because different programs use different subsets  of  these  variables,
135       and  to  avoid a situation where some things work and others don’t, the
136       Charliecloud test suite (see below) includes a test that fails if  some
137       but not all of the above variables are set.
138

AUTHOR

140       Reid Priedhorsky, Tim Randles, and others
141
143       2014–2018, Los Alamos National Security, LLC
144
145
146
147
148                  2019-08-22 00:00 Coordinated Universal Time  CH-BUILD2DIR(1)
Impressum