1

I've recently started trying to learn how to use Chef to manage Docker containers. Currently, I'm trying to figure out how to bootstrap a Docker container using the knife-container gem, but I'm a little confused about the workflow for this scenario. Here is a high-level description of the steps that I've taken so far to do this:

  • First off, in order to learn how these technologies work together I have configured three Ubuntu 14.04 Virtualbox VMs, one for the Chef Server, one for a node to host my containers, and one workstation for development. The network configuration for these machines allows for connecting to the internet and to each other using a NAT Network interface and a Host-Only interface.
  • I have successfully bootstrapped the Chef node by itself using knife commands from my workstation VM, and can verify this using the Chef Management Console in a browser.

My confusion is about what to do next in order to bootstrap a container that I want to have running on the above mentioned Chef node. Currently, I'm attempting to do a docker installation and container setup from within a couple of recipes that run during the node bootstrap process that I start from my workstation. Here are the relevant commands from one of the recipes that runs on the node during the bootstrap:

dockerfile = data_bag_item('dockerfiles', 'ubuntu-dockerfile')["script"].join()

...

execute "knife container docker init test_app -f chef/ubuntu-14.04"

file "/var/chef/dockerfiles/test_app/Dockerfile" do
    content dockerfile
    action :create
end

...

execute "knife container build test_app -d /var/chef/dockerfiles"

execute "docker run -d -p 80:8000 -v /etc/chef /etc/chef/secure test_app python test_app/manage.py runserver 0.0.0.0:8000"

And here is what the Dockerfile looks like after the data bag string array has been joined:

FROM chef/ubuntu-14.04
RUN chef-init --bootstrap
RUN rm -rf /etc/chef/secure/*
RUN apt-get -qq update
RUN apt-get -qq install build-essential python-django
RUN apt-get clean
ENV DJANGO_PATH /usr/lib/python2.7/dist-packages/django/bin
RUN chmod u+x $DJANGO_PATH/django-admin.py
RUN $DJANGO_PATH/django-admin.py startproject test
RUN chmod u+x test/manage.py
EXPOSE 8000
ENTRYPOINT ["chef-init", "--onboot"]

The first problem is that even though the changes that I made to the Dockerfile in the recipe are successfully being written to the file at /var/chef/dockerfiles/test_app/Dockerfile, those changes are not being applied to the image when the new Docker image is built, which is evident from the error message that I receive stating that python isn't on the PATH. I have seen from the documentation for knife container that it's possible to supply a cookbook path and recipe run list for running on the containers themselves. I'm thinking that a recipe that performs the same tasks as my Dockerfile could be a better solution, but I'm unsure what the cookbook path should be since my cookbooks are synced with the Chef Server and not the container host.

Any insight or advice about what I'm missing here would be much appreciated.

1 Answers1

0

As far as I know, the typical workflow used with Chef container is generating a Dockerfile from your workstation, configuring the chef-server, the run-list... This will generate the files needed to build a Dockerimage (Dockerfile from a base image with Chef-client and the files needed to sync with your server), and then you can build that container. This is not pretended to install Docker to a node and run inside it a container, but Chef container is pretended to build docker images using the resources (chef cookbooks, and chef server). I recommend you to watch the talk Managing your container workflow with Chef from Chef container author Tom Duffield, to clarify what is the workflow with it. I think this is not pretended to manage the execution of the containers in chef nodes. For that you can check some Docker orchestration tools.

Community
  • 1
  • 1
Javier Cortejoso
  • 8,851
  • 3
  • 26
  • 27
  • Thanks for the info. I now have two questions: 1) In the video you linked to, the presenter only shows how to use knife container using local mode with the "-z" option. I'm more interested in how this would be done using a stand-alone chef server rather than using chef zero. Any ideas where I might find more information about that? 2) I now have a new setup to try using only a chef server and a node for hosting containers. The problem is that now when I run "knife container build ..." from the container host, I am getting an SSL validation failure. Any idea why that might occur? – vardaofthevalier Jan 20 '15 at 22:33
  • I have not used it, but from the documentation I understand that knife will connect against the chef-server you have configured in your default knife config (`~/.chef/knife.rb`). About the SSL maybe you are installing Chef Client 12 and it has SSL communication as default. Check this link to see how to solve this: http://jtimberman.housepub.org/blog/2014/12/11/chef-12-fix-untrusted-self-sign-certs/ – Javier Cortejoso Jan 21 '15 at 07:48
  • Hmm, I'm still having a problem even after running "knife ssl fetch" on the docker host. By running 'ls' from within the Dockerfile on /etc/chef/secure/trusted_certs, I can see that my trusted_certs directory is being copied to the container and contains the certificate generated by the chef server, but I'm still getting the same SSL validation error. I'm using the same knife.rb configuration that I used when I successfully bootstrapped a stand-alone Ubuntu VM (using knife bootstrap ...) so I'm not sure what is causing the problem. The error message isn't very specific about the cause. – vardaofthevalier Jan 23 '15 at 19:29
  • I figured out what the problem is. /etc/hosts in the container doesn't, by default, contain the hostname/ip of the chef server, so I was able to bootstrap a container interactively by using the "--add-host=..." flag with "docker run...". This means I had to completely remove the "chef-init --bootstrap" command from the Dockerfile, and instead run the command inside of an already built and running container. I'm still trying to figure out how to do this non-interactively, but it's not looking promising due to the fact that /etc/hosts can't seem to be modified on the fly during a build. – vardaofthevalier Jan 26 '15 at 20:01
  • You can use a dns server (if so search for dnsmasq or skydns+skydock). Also there is a tool (nim-mungehosts) I haven't tried but it seems it could help you: https://github.com/hiteshjasani/nim-mungehosts – Javier Cortejoso Jan 26 '15 at 20:16