6

I'm setting up two docker containers - one as a server to hold data in memory, and the other as a client to access that data. In order to do so, I believe I need to use the --ipc flag to share memory between the containers. The Docker documentation explains the --ipc flag pretty well. What makes sense to me according to the documentation is running:

docker run -d --ipc=shareable data-server
docker run -d --ipc=container:data-server data-client

But all of the Stackoverflow questions I've read (1, 2, 3, 4) link both containers directly to the host:

docker run -d --ipc=host data-server
docker run -d --ipc=host data-client

Which is more appropriate for this use case? If ipc=host is better, when would you use ipc=shareable?

Jacob Stern
  • 3,758
  • 3
  • 32
  • 54

1 Answers1

4

From doc:

--ipc="MODE" : Set the IPC mode for the container

"shareable": Own private IPC namespace, with a possibility to share it with other containers.

"host": Use the host system’s IPC namespace.

The difference between shareable and host is whether the host can access the shared memory.

  • An IPC (POSIX/SysV IPC) namespace provides separation of named shared memory segments, semaphores and message queues. Because of this, there should be no difference in performance between two modes.
  • Shared memory is commonly used by databases and custom-built (typically C/OpenMPI, C++/using boost libraries) high performance applications for scientific computing and financial services industries.

Considering the security of the service, using host exposes the IPC namespace to attackers who have control of the host machine. With shareable, the IPC namespace is only accessible inside of the containers, which may contain any attacks. The host mode exists to allow cooperation between a container and its host.

It's often difficult to know all the details of the environment and requirements of the asker, so host tends to be the most commonly recommended because it is easiest to understand and configure.

pensono
  • 336
  • 6
  • 17
atline
  • 28,355
  • 16
  • 77
  • 113
  • 1
    So both are valid, but the first option is safer for the containers? – Jacob Stern Jul 05 '19 at 23:23
  • 1
    Yes, that's it. And if not only share among container, you also use host – atline Jul 05 '19 at 23:27
  • Gotcha. One more question: Is `shareable` optional? [This blog](https://dzone.com/articles/docker-in-action-the-shared-memory-namespace) and [this post](https://stackoverflow.com/questions/37701203/shared-memory-across-docker-containers) seem to leave it off. – Jacob Stern Jul 08 '19 at 18:58
  • I guess it means if you don't need something like share memory between containers Then you can leave it off, instead you can use socket or others. But if you care communication speed, and want to use share memory you had to on it. This is the option for you depend on your application scenario – atline Jul 09 '19 at 00:25