summaryrefslogtreecommitdiffstats
path: root/docker
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2018-12-28 14:38:58 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2018-12-28 14:38:58 +0000
commitfa4ece01aed54c9a146af868be0d3db611ded229 (patch)
tree319cffc5f6c2abd7cce514383716153469fc6295 /docker
parentNew upstream version 1.11.0+dfsg (diff)
downloadnetdata-fa4ece01aed54c9a146af868be0d3db611ded229.tar.xz
netdata-fa4ece01aed54c9a146af868be0d3db611ded229.zip
New upstream version 1.11.1+dfsgupstream/1.11.1+dfsg
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r--docker/Dockerfile2
-rw-r--r--docker/README.md117
-rwxr-xr-xdocker/build.sh15
3 files changed, 121 insertions, 13 deletions
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 4362a273e..a852f3044 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -86,7 +86,7 @@ RUN \
addgroup -g ${NETDATA_GID} -S netdata && \
adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G netdata netdata && \
# Apply the permissions as described in
- # https://github.com/netdata/netdata/wiki/netdata-security#netdata-directories
+ # https://github.com/netdata/netdata/tree/master/doc/netdata-security.md#netdata-directories
chown -R root:netdata /etc/netdata && \
chown -R netdata:netdata /var/cache/netdata /var/lib/netdata /usr/share/netdata && \
chown -R root:netdata /usr/lib/netdata && \
diff --git a/docker/README.md b/docker/README.md
new file mode 100644
index 000000000..d624855fb
--- /dev/null
+++ b/docker/README.md
@@ -0,0 +1,117 @@
+# Install netdata with Docker
+
+> :warning: As of Sep 9th, 2018 we ship [new docker builds](https://github.com/netdata/netdata/pull/3995), running netdata in docker with an ENTRYPOINT directive, not a COMMAND directive. Please adapt your execution scripts accordingly.
+> More information about ENTRYPOINT vs COMMAND is presented by goinbigdata [here](http://goinbigdata.com/docker-run-vs-cmd-vs-entrypoint/) and by docker docs [here](https://docs.docker.com/engine/reference/builder/#understand-how-cmd-and-entrypoint-interact).
+>
+> Also, the `latest` is now based on alpine, so **`alpine` is not updated any more** and `armv7hf` is now replaced with `armhf` (to comply with https://github.com/multiarch naming), so **`armv7hf` is not updated** either.
+
+## Limitations
+
+Running netdata in a container for monitoring the whole host, can limit its capabilities. Some data is not accessible or not as detailed as when running netdata on the host.
+
+## Run netdata with docker command
+
+Quickly start netdata with the docker command line.
+Netdata is then available at http://host:19999
+
+This is good for an internal network or to quickly analyse a host.
+
+For a permanent installation on a public server, you should [[secure the netdata instance|netdata-security]]. See below for an example of how to install netdata with an SSL reverse proxy and basic authentication.
+
+```bash
+docker run -d --name=netdata \
+ -p 19999:19999 \
+ -v /proc:/host/proc:ro \
+ -v /sys:/host/sys:ro \
+ -v /var/run/docker.sock:/var/run/docker.sock:ro \
+ --cap-add SYS_PTRACE \
+ --security-opt apparmor=unconfined \
+ netdata/netdata
+```
+
+above can be converted to docker-compose file for ease of management:
+
+```yaml
+version: '3'
+services:
+ netdata:
+ image: netdata/netdata
+ hostname: example.com # set to fqdn of host
+ ports:
+ - 19999:19999
+ cap_add:
+ - SYS_PTRACE
+ security_opt:
+ - apparmor:unconfined
+ volumes:
+ - /proc:/host/proc:ro
+ - /sys:/host/sys:ro
+ - /var/run/docker.sock:/var/run/docker.sock:ro
+```
+
+### Docker container names resolution
+
+If you want to have your container names resolved by netdata it needs to have access to docker group. To achive that just add environment variable `PGID=999` to netdata container, where `999` is a docker group id from your host. This number can be found by running:
+```bash
+grep docker /etc/group | cut -d ':' -f 3
+```
+
+## Install Netdata using Docker Compose with SSL/TLS enabled http proxy
+
+You can use use the following docker-compose.yml and Caddyfile files to run netdata with docker.
+Replace the Domains and email address for Letsencrypt before starting.
+
+### Prerequisites
+* [Docker](https://docs.docker.com/install/#server)
+* [Docker Compose](https://docs.docker.com/compose/install/)
+* Domain configured in DNS pointing to host.
+
+### Caddyfile
+
+This file needs to be placed in /opt with nams Caddyfile. Here you customize your domain and you need to provide your email address to obtain Letsencrypt certificate.
+Certificate renewal will happen automatically and will be executed internally by caddy server.
+
+```
+netdata.example.org {
+ proxy / netdata:19999
+ tls admin@example.org
+}
+```
+
+### docker-compose.yml
+
+After setting Caddyfile run this with `docker-compose up -d` to have fully functioning netdata setup behind HTTP reverse proxy.
+
+```yaml
+version: '3'
+volumes:
+ caddy:
+
+services:
+ caddy:
+ image: abiosoft/caddy
+ ports:
+ - 80:80
+ - 443:443
+ volumes:
+ - /opt/Caddyfile:/etc/Caddyfile
+ - caddy:/root/.caddy
+ environment:
+ ACME_AGREE: 'true'
+ netdata:
+ restart: always
+ hostname: netdata.example.org
+ image: netdata/netdata
+ cap_add:
+ - SYS_PTRACE
+ security_opt:
+ - apparmor:unconfined
+ volumes:
+ - /proc:/host/proc:ro
+ - /sys:/host/sys:ro
+ - /var/run/docker.sock:/var/run/docker.sock:ro
+```
+
+### Restrict access with basic auth
+
+You can restrict access by following [official caddy guide](https://caddyserver.com/docs/basicauth) and adding lines to Caddyfile.
diff --git a/docker/build.sh b/docker/build.sh
index 908468d39..faaa2db79 100755
--- a/docker/build.sh
+++ b/docker/build.sh
@@ -30,7 +30,9 @@ fi
# Build images using multi-arch Dockerfile.
for ARCH in i386 armhf aarch64 amd64; do
- docker build --build-arg ARCH="${ARCH}-v3.8" --tag "${REPOSITORY}:${VERSION}-${ARCH}" --file docker/Dockerfile ./ &
+ docker build --build-arg ARCH="${ARCH}-v3.8" \
+ --tag "${REPOSITORY}:${VERSION}-${ARCH}" \
+ --file docker/Dockerfile ./ &
done
wait
@@ -70,14 +72,3 @@ docker --config /tmp/docker manifest push -p "${REPOSITORY}:${VERSION}"
# Show current manifest (debugging purpose only)
docker --config /tmp/docker manifest inspect "${REPOSITORY}:${VERSION}"
-# Push netdata images to firehol organization
-# TODO: Remove it after we decide to deprecate firehol/netdata docker repo
-if [ "$REPOSITORY" != "netdata" ]; then
- echo "$OLD_DOCKER_PASSWORD" | docker login -u "$OLD_DOCKER_USERNAME" --password-stdin
- for ARCH in amd64 i386 armhf aarch64; do
- docker tag "${REPOSITORY}:${VERSION}-${ARCH}" "firehol/netdata:${ARCH}"
- docker push "firehol/netdata:${ARCH}"
- done
- docker tag "${REPOSITORY}:${VERSION}-amd64" "firehol/netdata:${VERSION}"
- docker push "firehol/netdata:${VERSION}"
-fi