Docker Privileged Proxy

This image is a wrapper / proxy intended to workaround the limitation of --cap-add in Docker Swarm Mode services. (Which doesn't exist yet, watch this GH issue if you're interested )

Many images need --privileged mode, or some form of it using parameters like --device, --ipc, --net, or --cap-add.

This image is a very simple debian image that binds the docker socket from the host, then fires up a container using docker run.

socat is used to proxy the privileged container's port using a swarm overlay network.

NOTE: This requires docker engine 1.13 for attachable networks, and is currently in testing. This could hypothetically be replaced with --link on older Docker versions, but I haven't cared to do this.

Building

docker build -t docker_priv_proxy .

Example Usage

The primary reason I needed this functionality was for DB2 testing/staging setups.
Here's a real live demo you can try out.

First, create an overlay network with --attachable so that the container created with docker run can be accessed from the proxy service

docker network create -d overlay --attachable --subnet 10.1.1.0/24 db2_net

Next, create the db2_proxy swarm service. The DOCKER_RUN variable can have any parameters that docker run would accept.

docker service create \
  --name db2_proxy \
  --network db2_net \
  --mount "type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock" \
  -e DOCKER_RUN="--network db2_net --cap-add=IPC_OWNER --ipc=host -e DB2INST1_PASSWORD=password -e LICENSE=accept ibmcom/db2express-c:latest db2start" \
  -e PORT=50000 \
  -p 50002:50000 \
  docker_priv_proxy

The db2_proxy service will start up and publish the external 50002 port into the proxy's port 50000. The proxy will create a new db2 container on db2_net and proxy port 50000 to it.