rkt: run dockerd

[jonboulle]

As part of #13, it would be nice to be able to run dockerd from within a Rocket pod.

(thinking out loud), while dockerd is running under Rocket, we could mimic the Docker client on the host with something like alias docker="rkt enter $RKT_DOCKER_UUID docker run $@" or similar

Latest status from #13 (comment):

---

Since #626 is merged, running Dockerd inside Rocket works fine as long as the isolator "os/linux/capabilities-retain-set" contains CAP_NET_ADMIN. The test was reported on this issue. The dind aci was generated by docker2aci.

We don't have a solution to modify automatically the isolator in the aci. Flannel would also benefit from that, see this comment.

[iaguis]

If you don't have aufs support enabled (debian has it by default) docker will try to use the devicemapper Storage Driver. This will not work because it uses loop devices which are not inside the container.

I could make it work with the overlay Storage Driver.

[jonboulle]

I think it is fine if we have to be a little more restrictive about what storage backends can be used running it inside Rocket; in CoreOS itself we can always rely on overlayfs

[alban]

actool patch-manifest has been merged (appc/spec#258)

The script to build the docker aci has been merged (appc/build-repository#1).

The instructions how to use the docker aci can be found on:
https://github.com/appc/build-repository/blob/master/projects/docker.sh
(including how to select overlay rather than devicemapper)

So I think this issue can be closed.

[jonboulle]

awesome!
@alban I think the only other thing I would like to see before closing this out is some information on the alban/dind:dockerinrocket image - how about maybe adding that Dockerfile to the build-repository repo?

[alban]

I added more details on appc/build-repository#6

I'm unsure about adding the Dockerfile from the Docker-in-Docker in build-repository: if Docker-in-Docker gets updated upstream, it would be easier to get them if we keep the same repository structure rather than copying the files in build-repository.

[jonboulle]

That's fine, I missed that it was based on that. Thanks!