If I create a container using a tag/label
docker run --name some_container -d me/my_image
Update the image with
docker pull me/my_image
And restart the container with
docker restart some_container
Which version does the new container use?
In docker inspect .Image gives the id of the specific image, .Config.Image gives the label.
Setup
I am trying to make a setup that allows me to directly connect to docker containers from my LAN without binding individual ports to the docker hosts IP addresses.
I have turned on IP forwarding with sysctl -w net.ipv4.ip_forward=1.
Symptoms
I can connect with SSH and use SFTP to transfer really small files. However if I try to send a file that's bigger than around 30K the transfer just hangs. I need to kill sftp to stop it.
EDIT: The file size limit seems to vary. Now it is somewhere between 50-100KB. It can be changed further with different variations of -B, -l and -R of sftp
Small files reach 100% and stall, bigger ones read less. Speed slowly moves to zero and times reads - stalled -
sftp> put testfile35k
Uploading testfile35k to /home/user/testfile35k
testfile35k 100% 35KB 0.4KB/s 01:29
(killall -9 sftp)
sftp> put testfile
Uploading testfile to /home/user/testfile
testfile 20% 2080KB 0.0KB/s - stalled -
After 15 minutes I get Write failed: connection timed out and eventually Write failed: Broken pipe
If instead of trying to forward from eth0 to docker0 I use docker's port binding (-p) SFTP works fine.
Network settings:
SSH Server:
[root@b6c9d8f9d30d Python-3.4.3]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
112: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether 02:42:ac:11:00:0c brd ff:ff:ff:ff:ff:ff
inet 172.17.0.12/16 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::42:acff:fe11:c/64 scope link
valid_lft forever preferred_lft forever
Docker/"router":
[root@docker ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:21:68:9b brd ff:ff:ff:ff:ff:ff
inet 192.168.0.193/24 brd 192.168.0.255 scope global eth0
valid_lft forever preferred_lft forever
inet 192.168.0.121/24 brd 192.168.0.255 scope global secondary eth0
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fe21:689b/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether 56:84:7a:fe:97:99 brd ff:ff:ff:ff:ff:ff
inet 172.17.42.1/16 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::5484:7aff:fefe:9799/64 scope link
valid_lft forever preferred_lft forever
SSH Client:
[root@test ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:99:0b:64 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.201/24 brd 192.168.0.255 scope global eth1
inet6 fe80::5054:ff:fe99:b64/64 scope link
valid_lft forever preferred_lft forever
Docker host iptables: EDIT2: Flushed all iptables rules and NAT without any effect
[root@docker ~]# iptables-save
# Generated by iptables-save v1.4.21 on Sat Sep 12 15:09:53 2015
*nat
:PREROUTING ACCEPT [5:488]
:INPUT ACCEPT [2:284]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [3:204]
:DOCKER - [0:0]
COMMIT
# Completed on Sat Sep 12 15:09:53 2015
# Generated by iptables-save v1.4.21 on Sat Sep 12 15:09:53 2015
*filter
:INPUT ACCEPT [513:54486]
:FORWARD ACCEPT [280:161095]
:OUTPUT ACCEPT [325:35618]
:DOCKER - [0:0]
COMMIT
# Completed on Sat Sep 12 15:09:53 2015
I know that containers are not normally supposed to be running sshd. This is a remote python development host and the SSH is for running a remote interpreter.
We have a working exim setup at a site, where users can send and receive mails. We are trying to setup a server to send some warnings and errors using email to an address that is outside the local network.
The problem is:
The program that sends the mails sends them using the username it runs under and the local hostname of the server. This cause the mails to have a sender of format: [email protected]. Exim sends these mails to the ISP's SMTP server, which rejects the mails as they have an illegal or unverifiable sender (the internal address).
I'm thinking I should configure exim to rewrite the sender when:
I tried setting some kind of rewriting in the exim config, but did not manage to get it to work. I'd show what I have tried, but I ran out of time on the last visit to the site, and had to revert to the original version losing all the changes I tried.
On my server, I want to create a directory hidden from normal users, but that is accessible with a link without authentication.
Currently I have set it up like this:
h, as in hiddenh I have a .htaccess file with: IndexIgnore h.htaccess with IndexIgnore *However, that also hides the contents of h/abc/, which I don't want. I tried putting IndexIgnore . in h/abc/.htaccess, but it did not work. It is also stated in HTTPD Docs, which I learned later on:
Multiple IndexIgnore directives add to the list, rather than the replacing the list of ignored files. By default, the list contains . (the current directory).
Is there a way to specify the IndexIgnore to only act on items inside the current directory, and not be recursive?
Or is there some kind of other, better way to deal with this? I would prefer not to touch the "global" configuration files too much, altough that is possible.
I have set up apache to work as a reverse proxy to tomcat that is running jenkins-CI. I can access the site from outside fine, except when I log in to jenkins, it redirects to my lan-hostname, and it of course it fails outside my network. After that I can manually type the original address to the browser, and it it will work fine until I have to log in again.
I wonder if this is a problem in jenkins, or in my apache/tomcat proxy setup.
Jenkins also reports on the management page that my proxy setup is not right, but does not tell any more.
Apache VirtualHost configuration:
<VirtualHost *:80>
ServerName jenkins.outsideaddress
ServerAlias ci.outsideaddress jenkins.insideaddress ci.insideaddress
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
</VirtualHost>
Also the proxy, and proxy_http modules are loaded (according to apachectl -M)
I am installing tomcat on a linux server, and would want it to be available as a service. I have found two different ways to achieve this.
The first one is to copy the daemon.sh from $CATALINA_HOME/bin to /etc/init.d, and the other one I have seen is to create a simple init script that class $CATALINA_HOME/bin/startup.sh, etc. Startup.sh calls catalina.sh.
The contents of the daemon.sh and startup.sh look very similar (at least for the env variables, and stuff like that). Daemon.sh calls jsvc in the end. Catalina.sh calls java.
What is the (practical) difference between using the two of these when setting up tomcat as a service?
I have a django project, which I am moving from the dev-server to apache. I have managed to get it server with mod_wsgi, but it runs as apache. Mod_wsgi documentation says, that if apache is run as root, it is possible to run mod_wsgi process as a different user.
Q1: Is it possible to run mod_wsgi as different user without running apache as root?
Q2: If answer to the above is no, how do I make apache run as root. I am using the provided repository provided httpd package on a CentOS 6 machine.
I have a server with ESXi 5 and iSCSI attached network storage. The storage server has 4x1Tb SATA II disks in Raid-Z on freenas 8.0.4. Those two machines are connected to each other with Gigabit ethernet, isolated from everything else. There is no switch in between. The SAN box itself is a 1U supermicro server with a Intel Pentium D at 3 GHz and 2 Gigs of memory. The disks are connected to a integrated controller (Intel something?).
The raid-z volume is divided into three parts: two zvols, shared with iscsi, and one directly on top of zfs, shared with nfs and similar.
I ssh'd into the freeNAS box, and did some testing on the disks. I used ddto test the third part of the disks (straight on top of ZFS). I copied a 4GB (2x the amount of RAM) block from /dev/zero to the disk, and the speed was 80MB/s.
Other of the iSCSI shared zvols is a datastore for the ESXi. I did similar test with time dd .. there. Since the dd there did not give the speed, I divided the amount of data transfered by the time show by time. The result was around 30-40 MB/s. Thats about half of the speed from the freeNAS host!
Then I tested the IO on a VM running on the same ESXi host. The VM was a light CentOS 6.0 machine, which was not really doing anything else at that time. There were no other VMs running on the server at the time, and the other two "parts" of the disk array were not used. A similar dd test gave me result of about 15-20 MB/s. That is again about half of the result on a lower level!
Of course the is some overhead in raid-z -> zfs -> zvolume -> iSCSI -> VMFS -> VM, but I don't expect it to be that big. I belive there must be something wrong in my system.
I have heard about bad performance of freeNAS's iSCSI, is that it? I have not managed to get any other "big" SAN OS to run on the box (NexentaSTOR, openfiler).
Can you see any obvious problems with my setup?
I am trying to start a service that requires a env. variable to be set to certain path. I set this variable in "/etc/profile.d/". However when I start this service using the service command, it doesn't work.
man service:
service runs a System V init script in as predictable environment as possible,
removing most environment variables and with current working directory set to /.
So it seems that service is removing my variables. How should I set the variables up to keep them from being removed. Or is that something i should not do.
I could start the service manually using the init-scripts, or even hardcode the path into the script, but I'd like to know how to use it with the service command.
I have a server with ESXi 5 and iSCSI attached network storage(4x1Tb Raid-Z on freenas). Those two machines are connected to each other with Gigabit ethernet, and a procurve switch in between.
After a while, if I have many(4-5 or more) vms running, they start to get un-responsive (long delays before anything happens). We are trying to find the reason behind this.
Today we looked at esxtop, and found that DAVG of that iSCSI LUN stays at 70-80. I read that +30 is critical!
What could be causing those high response-times?