Enabling Remote API in Docker on Mac OS X (boot2do

Question

I can't seem to figure out how to enable the remote API when using boot2docker. I am trying to use dockerode as follows:

Docker = require('dockerode')
docker = new Docker(socketPath: "/var/run/docker.sock")

container = docker.getContainer('<my_container_id>')

container.inspect (err, data) ->
  debug data

Data is null, despite there being a container with the id ''. I suspect this is because there is no /var/run/docker.sock on the OS X host, and that I would need to use something like:

var docker2 = new Docker({host: 'http://192.168.1.10', port: 3000});

... but can't figure out how to configure boot2docker or docker in the VirtualBox VM to enable access via http or tcp.

Answer 1

Docker, as configured by Boot2Docker, supports remote access on port 2375 from the host OSX machine by default; this is what is set up when it tells you to do export DOCKER_HOST=tcp://192.168.59.103:2375

If you want to access the port from another machine you need to configure VirtualBox networking to route traffic to that port. This could be done by port forwarding with this command:

VBoxManage modifyvm "boot2docker-vm" --natpf1 "guestssh,tcp,,2375,,2375"

Then the address to use in your new Docker code is the IP address of your Mac.

You can also configure this in the VirtualBox GUI under boot2docker-vm/settings/network/advanced/port forwarding.

See VirtualBox docs.

Note, as described here that this now allows anyone with IP access to your machine to control your Docker installation, which may be a security concern.

Answer 2

For everybody that runs into that issue, most of the time you want to disable TLS when using something like boot2docker - which is build for dev and testing only (donno why boot2docker made the decision to enable TLS by default) It'll prevent you from accessing the remote API using basicly like every REST tool you can think about because none of them supports TLS based authentication without quite a lot of configuration.

So if you just want to develop within boot2docker, run this in your boot2docker console:

cp /etc/init.d/docker ~/docker.bak
sudo sed -i 's/DOCKER_TLS:=auto/DOCKER_TLS:=no/1' /etc/init.d/docker
sudo /etc/init.d/docker stop
sudo /etc/init.d/docker start

It will disable TLS and restart the docker deamon. Once done, you should be able to open http://your-boot2docker-ip:2375/info and get some output. Note that this is as of boot2docker 1.41. The name of the env variable repalced by the sed command above may change in future. Maybe they'll even disable TLS by default in future releases.

Answer 3

In current version of boot2docker (1.3.1) you can do this by just mounting a volume to the container, eg:

$ docker run -it -v /var/run/docker.sock:/home/docker.sock myimage bash
[ root@51c0518f4d42:~ ]$ ls /home
docker.sock

Docker = require('dockerode')
docker = new Docker(socketPath: "/home/docker.sock")
// should work!

IMHO this is simpler and cleaner than messing around with VirtualBox port forwarding

This is actually that same as how most examples of using a Docker API client are set out, i.e. "just mount the docker socket into the container as a volume".

Perhaps like me you thought due to the way boot2docker works this wouldn't be possible. After all, it appears that recent versions are set up to share volumes from your OS X host rather than the boot2docker vm, which is what you'd want most of the time. But there is no /var/run/docker.sock path on your OS X host, so what is going on?

What actually happens is that the /Users dir is mounted from your host into the boot2docker vm. When you add a volume to a container under boot2docker it is still sharing whatever is at that path in the vm... it just happens that any paths under /Users in the vm are mounted from the host. But any paths outside /Users will be from the boot2docker vm itself and not your host.

i.e.

$ boot2docker ssh
docker@boot2docker:~$ ls /var/run
acpid.pid        acpid.socket     docker.pid       docker.sock      sshd.pid         udhcpc.eth0.pid  udhcpc.eth1.pid  utmp

There is our docker socket file, and since it's outside the /Users directory we can link that path into our containers as a volume.

(For some reason this doesn't work:

$ docker run -it -v /var/run/docker.sock

...the socket file comes out as a /var/run/docker.sock/ directory in our container - seems like a docker bug.)

We have to use the colon-separated form:

$ docker run -it -v /var/run/docker.sock:/home/docker.sock