LXD Support in Webdock

Webdock now fully supports nested LXD containers. LXD is similar in functionality to Docker, and is a great alternative.

To create an LXD container in your Webdock server, simply initialize LXD and accept all the defaults (comes pre-installed on all our Ubuntu systems) and off you go. The setup process would look something like the following. Please note the security.nesting=true in the launch / init command parameters:

root@testnesting:~# lxc init ubuntu c2 -c security.nesting=true 
If this is your first time running LXD on this machine, you should also run: lxd init 
To start your first container, try: lxc launch ubuntu:16.04 

Creating c2 
The local image 'ubuntu' couldn't be found, trying 'ubuntu:' instead. 
Error: Failed container creation: No storage pool found. Please create a new storage pool. 
root@testnesting:~# lxd init 
Would you like to use LXD clustering? (yes/no) [default=no]:  
Do you want to configure a new storage pool? (yes/no) [default=yes]:  
Name of the new storage pool [default=default]:  
Would you like to connect to a MAAS server? (yes/no) [default=no]:  
Would you like to create a new local network bridge? (yes/no) [default=yes]:  
What should the new bridge be called? [default=lxdbr0]:  
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:  
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:  

We detected that you are running inside an unprivileged container. 
This means that unless you manually configured your host otherwise, 
you will not have enough uids and gids to allocate to your containers. 

LXD can re-use your container's own allocation to avoid the problem. 
Doing so makes your nested containers slightly less safe as they could 
in theory attack their parent container and gain more privileges than 
they otherwise would.                                                                                                              
Would you like to have your containers share their parent's allocation? (yes/no) [default=yes]:                                    
Would you like LXD to be available over the network? (yes/no) [default=no]:                                                        
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]                                             
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:                                                     
root@testnesting:~# lxc launch ubuntu c2 -c security.nesting=true 
Creating c2 
The local image 'ubuntu' couldn't be found, trying 'ubuntu:' instead. 
Starting c2                                  
root@testnesting:~# lxc ls 
| NAME |  STATE  |        IPV4        |                     IPV6                      |    TYPE    | SNAPSHOTS | 
| c2   | RUNNING | (eth0) | fd42:4e3c:4243:492c:216:3eff:fee0:dffd (eth0) | PERSISTENT | 0         | 
root@testnesting:~# lxc exec c2 bash 
root@c2:~# ping google.com 
PING google.com ( 56(84) bytes of data. 
64 bytes from arn11s03-in-f14.1e100.net ( icmp_seq=1 ttl=52 time=29.9 ms

Docker support in Webdock

In theory you should be able to deploy docker in our Ubuntu base images. However, Docker support is limited if not broken in unprivileged LXD containers at the moment.

We have gotten docker almost working by jumping through a few hoops, and sometimes hello-world works. However, there still seems to be an issue we haven't quite gotten solved yet. The steps required to get Docker running in our VPS's are as follows:

1. Provision a Webdock Ubuntu Bionic base image

2. Follow the official instructions on how to install Docker-CE 

3. "Hack" the containerd service to prevent it from looking for the overlay fs driver

  • Run systemctl edit containerd.service. This automatically creates a draft override file, and opens it in your editor.
  • Edit the file to look like this;
  • Save the file
  • Now run:
    systemctl daemon-reload
    systemctl restart containerd.service

4. Configure Docker to use VFS as the filesystem driver

  • Edit /etc/docker/daemon.json. If it does not yet exist, create it. Assuming that the file was empty, add the following contents.
  "storage-driver": "vfs"

If you are using docker-compose, you may need to tell it where the Docker daemon lives:

export DOCKER_HOST=http+unix://var/run/docker.sock

Now this gets the Docker daemon running, but when you deploy your containers you may get an error message regarding insufficient disk space. We have not figured this one out yet, but we have an open ticket with Docker at Github and we are hoping we can find a workaround for this issue.