Docker run 命令的使用方法详解

$ sudo docker run [OPTIONS] IMAGE[:TAG] [COMMAND] [ARG...]

-a=[]   　　　　 : Attach to `STDIN`, `STDOUT` and/or `STDERR`
-t=false  　　 : Allocate a pseudo-tty
--sig-proxy=true　: Proxify all received signal to the process (non-TTY mode only)
-i=false  　　 : Keep STDIN open even if not attached

$ sudo docker run -a stdin -a stdout -i -t ubuntu /bin/bash

echo test | docker run -i busybox cat

--ipc="" : Set the IPC mode for the container,
  'container:<name|id>': reuses another container's IPC namespace
  'host': use the host's IPC namespace inside the container

--dns=[]   : Set custom dns servers for the container
--net="bridge" : Set the Network mode for the container
       'bridge': creates a new network stack for the container on the docker bridge
       'none': no networking for this container
       'container:<name|id>': reuses another container network stack
       'host': use the host network stack inside the container
--add-host="" : Add a line to /etc/hosts (host:IP)
--mac-address="" : Sets the container's Ethernet device's MAC address

$ sudo docker run -d --name redis example/redis --bind 127.0.0.1
$ # use the redis container's network stack to access localhost
$ sudo docker run --rm -ti --net container:redis example/redis-cli -h 127.0.0.1

$ /docker run -ti --add-host db-static:86.75.30.9 ubuntu cat /etc/hosts
172.17.0.22  09d03f76bf2c
fe00::0   ip6-localnet
ff00::0   ip6-mcastprefix
ff02::1   ip6-allnodes
ff02::2   ip6-allrouters
127.0.0.1  localhost
::1    localhost ip6-localhost ip6-loopback
86.75.30.9  db-static

--rm=false: Automatically remove the container when it exits (incompatible with -d)

#docker run --security-opt label:level:s0:c100,c200 -i -t fedora bash

# docker run --security-opt label:level:TopSecret -i -t rhel7 bash

# docker run --security-opt label:disable -i -t fedora bash

# docker run --security-opt label:type:svirt_apache_t -i -t centos bash

-m="": Memory limit (format: <number><optional unit>, where unit = b, k, m or g)
-c=0 : CPU shares (relative weight)

Runtime privilege, Linux capabilities, and LXC configuration
--cap-add: Add Linux capabilities
--cap-drop: Drop Linux capabilities
--privileged=false: Give extended privileges to this container
--device=[]: Allows you to run devices inside the container without the --privileged flag.
--lxc-conf=[]: (lxc exec-driver only) Add custom lxc options --lxc-conf="lxc.cgroup.cpuset.cpus = 0,1"

$ sudo docker run --device=/dev/snd:/dev/snd ...

$ sudo docker run --device=/dev/sda:/dev/xvdc --rm -it ubuntu fdisk /dev/xvdc
Command (m for help): q
$ sudo docker run --device=/dev/sda:/dev/xvdc:r --rm -it ubuntu fdisk /dev/xvdc
You will not be able to write the partition table.
Command (m for help): q
$ sudo docker run --device=/dev/sda:/dev/xvdc:w --rm -it ubuntu fdisk /dev/xvdc
 crash....
$ sudo docker run --device=/dev/sda:/dev/xvdc:m --rm -it ubuntu fdisk /dev/xvdc
fdisk: unable to open /dev/xvdc: Operation not permitted

$ sudo docker run --cap-add=ALL --cap-drop=MKNOD ...

$ docker run -t -i --rm ubuntu:14.04 ip link add dummy0 type dummy
RTNETLINK answers: Operation not permitted
$ docker run -t -i --rm --cap-add=NET_ADMIN ubuntu:14.04 ip link add dummy0 type dummy

$ docker run --rm -it --cap-add SYS_ADMIN sshfs sshfs sven@10.10.10.20:/home/sven /mnt
fuse: failed to open /dev/fuse: Operation not permitted
$ docker run --rm -it --device /dev/fuse sshfs sshfs sven@10.10.10.20:/home/sven /mnt
fusermount: mount failed: Operation not permitted
$ docker run --rm -it --cap-add SYS_ADMIN --device /dev/fuse sshfs
# sshfs sven@10.10.10.20:/home/sven /mnt
The authenticity of host '10.10.10.20 (10.10.10.20)' can't be established.
ECDSA key fingerprint is 25:34:85:75:25:b0:17:46:05:19:04:93:b5:dd:5f:c6.
Are you sure you want to continue connecting (yes/no)? yes
sven@10.10.10.20's password:
root@30aa0cfaf1b5:/# ls -la /mnt/src/docker
total 1516
drwxrwxr-x 1 1000 1000 4096 Dec 4 06:08 .
drwxrwxr-x 1 1000 1000 4096 Dec 4 11:46 ..
-rw-rw-r-- 1 1000 1000  16 Oct 8 00:09 .dockerignore
-rwxrwxr-x 1 1000 1000 464 Oct 8 00:09 .drone.yml
drwxrwxr-x 1 1000 1000 4096 Dec 4 06:11 .git
-rw-rw-r-- 1 1000 1000 461 Dec 4 06:08 .gitignore

Overriding Dockerfile image defaults

CMD (Default Command or Options)
ENTRYPOINT (Default Command to Execute at Runtime)
EXPOSE (Incoming Ports)
ENV (Environment Variables)
VOLUME (Shared Filesystems)
USER
WORKDIR 　　
CMD (default command or options)
$ sudo docker run [OPTIONS] IMAGE[:TAG] [COMMAND] [ARG...]

ENTRYPOINT (default command to execute at runtime)
--entrypoint="": Overwrite the default entrypoint set by the image

$ sudo docker run -i -t --entrypoint /bin/bash example/redis
#or two examples of how to pass more parameters to that ENTRYPOINT:
$ sudo docker run -i -t --entrypoint /bin/bash example/redis -c ls -l
$ sudo docker run -i -t --entrypoint /usr/bin/redis-cli example/redis --help

--expose=[]: Expose a port or a range of ports from the container
  without publishing it to your host
-P=false : Publish all exposed ports to the host interfaces
-p=[]  : Publish a container᾿s port to the host (format:
   ip:hostPort:containerPort | ip::containerPort |
   hostPort:containerPort | containerPort)
   (use 'docker port' to see the actual mapping)
--link="" : Add link to another container (name:alias)

ENV (environment variables)
HOME Set based on the value of USER
HOSTNAME The hostname associated with the container
PATH Includes popular directories, such as :
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
TERM xterm if the container is allocated a psuedo-TTY

$ sudo docker run -e "deep=purple" --rm ubuntu /bin/bash -c export
declare -x HOME="/"
declare -x HOSTNAME="85bc26a0e200"
declare -x OLDPWD
declare -x PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
declare -x PWD="/"
declare -x SHLVL="1"
declare -x container="lxc"
declare -x deep="purple"

# Start the service container, named redis-name
$ sudo docker run -d --name redis-name dockerfiles/redis
4241164edf6f5aca5b0e9e4c9eccd899b0b8080c64c0cd26efe02166c73208f3

# The redis-name container exposed port 6379
$ sudo docker ps
CONTAINER ID  IMAGE      COMMAND    CREATED    STATUS    PORTS    NAMES
4241164edf6f  $ dockerfiles/redis:latest /redis-stable/src/re 5 seconds ago  Up 4 seconds  6379/tcp   redis-name

# Note that there are no public ports exposed since we didn᾿t use -p or -P
$ sudo docker port 4241164edf6f 6379
2014/01/25 00:55:38 Error: No public port '6379' published for 4241164edf6f

$ sudo docker run --rm --link redis-name:redis_alias --entrypoint /bin/bash dockerfiles/redis -c export
declare -x HOME="/"
declare -x HOSTNAME="acda7f7b1cdc"
declare -x OLDPWD
declare -x PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
declare -x PWD="/"
declare -x REDIS_ALIAS_NAME="/distracted_wright/redis"
declare -x REDIS_ALIAS_PORT="tcp://172.17.0.32:6379"
declare -x REDIS_ALIAS_PORT_6379_TCP="tcp://172.17.0.32:6379"
declare -x REDIS_ALIAS_PORT_6379_TCP_ADDR="172.17.0.32"
declare -x REDIS_ALIAS_PORT_6379_TCP_PORT="6379"
declare -x REDIS_ALIAS_PORT_6379_TCP_PROTO="tcp"
declare -x SHLVL="1"
declare -x container="lxc"
#And we can use that information to connect from another container as a client:
$ sudo docker run -i -t --rm --link redis-name:redis_alias --entrypoint /bin/bash dockerfiles/redis -c '/redis-stable/src/redis-cli -h $REDIS_ALIAS_PORT_6379_TCP_ADDR -p $REDIS_ALIAS_PORT_6379_TCP_PORT'
172.17.0.32:6379>

$ sudo docker run -d --name servicename busybox sleep 30
$ sudo docker run -i -t --link servicename:servicealias busybox ping -c 1 servicealias

VOLUME (shared filesystems)
-v=[]: Create a bind mount with: [host-dir]:[container-dir]:[rw|ro].
 If "container-dir" is missing, then docker creates a new volume.
--volumes-from="": Mount all volumes from the given container(s)