This repository contains the source for the docker snap package. The package provides a distribution of Docker Engine along with the Nvidia toolkit for Ubuntu Core and other snap-compatible systems. The Docker Engine is built from an upstream release tag with some patches to fit the snap format and is available on armhf, arm64, amd64, i386, and ppc64el architectures. The rest of this page describes installation, usage, and development.
Note
Docker's official documentation does not discuss the docker snap package.
To install the latest stable release of Docker CE using snap:
sudo snap install dockerThis snap is confined, which means that it can access a limited set of resources on the system. Additional access is granted via snap interfaces.
Upon installation using the above command, the snap connects automatically to the following system interface slots:
If you are using Ubuntu Core 16, connect the docker:home plug as it's not auto-connected by default:
sudo snap connect docker:homeBy default, Docker is only accessible with root privileges (sudo). If you want to use docker as a regular user, you need to add your user to the docker group. This isn't possible on Ubuntu Core because it disallows the addition of users to system groups [1, 2].
Warning
If you add your user to the docker group, it will have similar power as the root user. For details on how this impacts security in your system, see Docker daemon attack surface.
If you would like to run docker as a normal user:
- Create and join the
dockergroup:
sudo addgroup --system docker
sudo adduser $USER docker
newgrp docker- Disable and re-enable the
dockersnap if you added the group while Docker Engine was running:
sudo snap disable docker
sudo snap enable dockerDocker should function normally, with the following caveats:
-
All files that
dockerneeds access to should live within your$HOMEfolder.- If you are using Ubuntu Core 16, you'll need to work within a subfolder of
$HOMEthat is readable by root; see #8.
- If you are using Ubuntu Core 16, you'll need to work within a subfolder of
-
Additional certificates used by the Docker daemon to authenticate with registries need to be located in
/var/snap/docker/common/etc/certs.dinstead of/etc/docker/certs.d. -
Specifying the option
--security-opt="no-new-privileges=true"with thedocker runcommand (or the equivalent in docker-compose) will result in a failure of the container to start. This is due to an an underlying external constraint on AppArmor; see LP#1908448 for details.
If the system is found to have an nvidia graphics card available, and the host has the required nvidia libraries installed, the nvidia container toolkit will be setup and configured to enable use of the local GPU from docker. This can be used to enable use of CUDA from a docker container, for instance.
To enable proper use of the GPU within docker, the nvidia runtime must be used. By default, the nvidia runtime will be configured to use CDI mode, and a the appropriate nvidia CDI config will be automatically created for the system. You just need to specify the nvidia runtime when running a container.
The required nvidia libraries are available in the nvidia-core22 snap.
This requires connection of the graphics-core22 content interface provided by the nvidia-core22 snap, which should be automatically connected once installed.
The required nvidia libraries are available in the nvidia container toolkit packages.
Instruction on how to install them can be found (here)
If you want to make some adjustments to the automatically generated runtime config, you can use the nvidia-support.runtime.config-override snap config to completely replace it.
snap set docker nvidia-support.runtime.config-override="$(cat cutom-nvidia-config.toml)"By default, the device-name-strategy for the CDI config will use index. Optionally, you can specify an alternative from the currently supported:
indexuuidtype-index
snap set docker nvidia-support.cdi.device-name-strategy=uuidSetting up the nvidia support should be automatic the hardware is present, but you may wish to specifically disable it so that setup is not even attempted. You can do so via the following snap config:
snap set docker nvidia-support.disabled=trueGeneric example usage would look something like:
docker run --rm --runtime nvidia --gpus all {cuda-container-image-name}or
docker run --rm --runtime nvidia --env NVIDIA_VISIBLE_DEVICES=all {cuda-container-image-name}If your container image already has appropriate environment variables set, may be able to just specify the nvidia runtime with no additional args required.
Please refer to this guide for mode detail regarding environment variables that can be used.
NOTE: library path and discovery is automatically handled, but binary paths are not, so if you wish to test using something like the nvidia-smi binary passed into the container from the host, you could either specify the full path or set the PATH environment variable.
e.g.
docker run --rm --runtime=nvidia --gpus all --env PATH="${PATH}:/var/lib/snapd/hostfs/usr/bin" ubuntu nvidia-smi
Developing the docker snap package is typically performed on a "classic" Ubuntu distribution (Ubuntu Server / Desktop).
Install the snap tooling:
sudo snap install snapcraft --classicCheckout and enter this repository:
git clone https://github.com/canonical/docker-snap
cd docker-snapBuild the snap:
snapcraft -vInstall the newly-created snap package:
sudo snap install --dangerous ./docker_[VER]_[ARCH].snapManually connect the relevant plugs and slots which are not auto-connected:
sudo snap connect docker:privileged :docker-support
sudo snap connect docker:support :docker-support
sudo snap connect docker:firewall-control :firewall-control
sudo snap connect docker:network-control :network-control
sudo snap connect docker:docker-cli docker:docker-daemon
sudo snap disable docker
sudo snap enable dockerThe snap has various tests in place: