Change:
set -e set -x <ins> # Build the binary. </ins> go build --ldflags '-extldflags "-static" -s' pause.go <ins> # Run goupx to shrink binary size. go get github.com/pwaller/goupx goupx pause </ins>

Discussion:
Kubernetes use kubernetes/pause image to create network container. The problem is that whatever signals the pause container received, it will exit with code 2. Instead, with a normal exit, it should exit with code 0; while it exit with port binding issue, it should exit with code -1.
The port-binding issues will occur before the pause image gets invoked, but the pause image itself should exit 0.
I filed to docker to capture port-binding issue there. Port-binding is not my concern since we validate the port to avoid the conflict anyway. The concern I am having is PreStart we plan to introduce between docker container creation and start ().
There seems to be another issue - quick testing shows that if there is a conflict with a port allocated OUTSIDE of docker (e.g. the kube-proxy), Docker will accept the container and run it, but the host port doesn't work at all, and there's no way to tell except trawling logs. , Dawn Chen wrote:
Is there anything we could do to help go through, to eliminate the need for the network container?
Good catch. But following your steps above, my quick testing shows that docker container is running, but doesn't work at all. Also daemon logs doesn't have any error information.

Will file another issue to docker: 1) # netstat -lnt Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:22 0.0.0.0: LISTEN tcp6 0 0 :::4194 ::: LISTEN tcp6 0 0 ::: ::: LISTEN tcp6 0 0 :::8080 ::: LISTEN tcp6 0 0 :::22 :::* LISTEN 2) # docker run -p :80 -d dockerimages/apache 6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11 3) # docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES dockerimages/apache:latest "apache2 -DFOREGROUN 6 seconds ago Up 5 seconds 0.0.0.0:-80/tcp jollynewton 4) # docker logs AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 10.244.3.11. Set the 'ServerName' directive globally to suppress this message AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 10.244.3.11. Set the 'ServerName' directive globally to suppress this message [Tue Sep 30 00:03:16. 2014] [core:warn] [pid 1:tid ] AH00098: pid file overwritten -- Unclean shutdown of previous Apache run? [Tue Sep 30 00:03:16. 2014] [mpmevent:notice] [pid 1:tid ] AH00489: Apache/2.4.7 (Ubuntu) configured -- resuming normal operations [Tue Sep 30 00:03:16. 2014] [core:notice] [pid 1:tid ] AH00094: Command line: 'apache2 -D FOREGROUND' 5) # cat | grep [] +job log(create, 6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11,

dockerimages/apache:latest) [] -job log(create, 6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11, dockerimages/apache:latest) = OK (0) [info] POST /v1.14/containers/6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11/start [] +job start(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) [] +job allocateinterface(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) [] -job allocateinterface(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) = OK (0) [] +job allocateport(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) [] -job allocateport(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) = OK (0) [] +job log(start, 6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11, dockerimages/apache:latest) [] -job log(start, 6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11,

dockerimages/apache:latest) = OK (0) [info] GET /containers/6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11/json [] +job containerinspect(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) [] -job start(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) = OK (0) [] -job containerinspect(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) = OK (0) [info] GET /containers/6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11/json [] +job containerinspect(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) [] -job containerinspect(6f7309782be63f95dbc3f87bded69637e3299cd255668f1f171dc5eef28f5a11) = OK (0) [info] GET /v1.14/containers//json [] +job containerinspect() [] -job containerinspect() = OK (0) [info] GET /containers//logs?stderr=1&stdout=1&tail=all [] +job containerinspect() [] -job containerinspect() = OK (0) [] +job logs() [] -job logs() = OK (0)
I agreed we should help docker/docker go through, so that network container should be gone forever which makes our system, especially kubelet much simple. But that doesn't help with docker/docker and a new issue found by following.
have you tried this on docker master because it should have been fixed by , just want to prevent duplicate issues
I just rebuild docker from HEAD, and tested it with above steps I posted.

The problem is fixed: 37a039245cd9faba6ae900cc463313eae77c9c9dce589616ec992a7e8eecb458 2014/09/30 16:29:20 Error response from daemon: Cannot start container 37a039245cd9faba6ae900cc463313eae77c9c9dce589616ec992a7e8eecb458: Bind for 0.0.0.0:8080 failed: port is already allocated But another issue I filed (docker/docker) is still exist. Thanks!
great, just wanted to make sure! and yes I can see if want to change the existing functionality for docker/docker