Hi,
Some time ago I set up docker inside of a LXC container Running Docker inside of a LXD container - YouTube.
I’ve had issues with “hanging” when connecting to my LXC container with SSH, and I’ve noticed docker compose
takes almost 20 seconds to bring up a container. During that time it doesn’t appear to be doing anything.
My server boots off a Samsung SSD 970 PRO 512GB NVMe, which is formatted with a btrfs
filesystem. The load it has is rather small, it has 64GB of RAM, and AMD EPYC 7262 running Archlinux.
I started by configuring my system according to Server settings for a LXD production setup - LXD documentation.
How I set this up:
-
Initialize LXD
lxd init
-
Launch Archlinux container:
lxc launch images:archlinux docker-container
-
Join to VLAN 50
lxc config device add docker-container eth0 nic nictype=bridged parent=bridge0 hwaddr=00:xx:xx:xx:xx:xx vlan=50
-
Create btrfs subvolume
lxc storage create docker btrfs source=/var/lib/lxd/storage-pools/docker
-
Create new storage volume:
lxc storage volume create docker docker-container
-
Set the storage volume for
/var/lib/docker
lxc config device add docker-container docker disk pool=docker source=docker-container path=/var/lib/docker
My storage looks like:
❯ sudo lxc storage show default config: source: /var/lib/lxd/storage-pools/default volatile.initial_source: /var/lib/lxd/storage-pools/default description: "" name: default driver: btrfs used_by: - /1.0/instances/docker-container - /1.0/profiles/default status: Created locations: - none
❯ sudo lxc storage show docker config: source: /var/lib/lxd/storage-pools/docker volatile.initial_source: /var/lib/lxd/storage-pools/docker description: "" name: docker driver: btrfs used_by: - /1.0/storage-pools/docker/volumes/custom/docker-container status: Created locations: - none
-
Disable COW for some extra performance
chattr +C /var/lib/lxd/storage-pools/docker
-
Set security options for docker.
lxc config set docker-container security.nesting=true \ security.syscalls.intercept.mknod=true \ security.syscalls.intercept.setxattr=true
-
Add some bind mounts