dotcloud/docker — pull request #4833 by crosbymichael (2014-03-24 18:47:58+00:00)
Title: Add opts flag for fine grained control over drivers

Opening this now so we can get some discussion going and good docs. Basically this PR adds support for `-o` and `--opts` to pass generic configuration data to the drivers ( btrfs, libcontainer, lxc, devmapper). It is meant to deprecate `lxc-conf` and work across the board for all drivers.

The format for options to the drivers are in the following format:
`.=`

The name is used to route the key and values to the correct driver. The native driver should never see the lxc drivers options and vice versa.

Examples:
```bash

# pass lxc values to the lxc driver
docker run -ti --opts lxc.cgroups.cpuset.cpus=1,2 busybox sh
# pass options to libcontainer
docker run -ti -o native.cap.add=MKNOD busybox sh

```

Currently in the pr there is only support of the exec drivers but the parsing and framework is in place to add options to the other drivers.

So now onto the cools stuff that was added in this PR for libcontainer.

### fine grained cap control
`--privileged` is all or nothing but with `-o` and the native driver you can control what caps are dropped and which are not.

```bash

# run a container with only NET_ADMIN added so that we can take down an interface in the container
docker run -o native.cap.add=NET_ADMIN busybox ip link set down eth0
```

### namespace control
Maybe if you want all the linux namespaces to be applied to your container expect the network namespace so that you have access to the same network interfaces on your host then just drop NEWNET.

```bash
# we also need to set --networking=false so docker does not do anything with the adapters
docker run -o native.ns.drop=NEWNET --networking=false busybox ip a
```

Change the app armor profile for the container
```bash
docker run -o native.apparmor_profile=whatevv busybox sh
```

Make the entire container's root filesystem readonly expect for volumes mounted
```bash
docker run -v /data -o native.fs.readonly=true busybox touch /data/boom
```

Setup cgroups
```bash
docker run -o native.cgroups.memory=500m -o native.cgroups.cpuset.cpus=0-1 busybox sh
```

Also you can do super advanced stuff like joining a containers network namespace so that you can all share localhost
```bash
# start a redis server binding to localhost
docker run -d crosbymichael/redis --bind 127.0.0.1
b537724988ba9341569d871334d1ac5c69ab7b69762eb311f021379a624bc076

# join that containers network namespace so we can connect to the server without any veths
# remember to set --networking=false
docker run --rm -o native.net.join=b537724988ba9341569d871334d1ac5c69ab7b69762eb311f021379a624bc076 --networking=false crosbymichael/redis-benchmark -h 127.0.0.1 -q
```

options for the native driver in this pr
* native.cap.add
* native.cap.drop
* native.ns.add
* native.ns.drop
* native.net.join
* native.cgroups.cpu_shares
* native.cgroups.memory
* native.cgroups.memory_swap
* native.cgroups.cpuset.cpus
* native.apparmor_profile
* native.fs.readonly

What do you all think?