Docker is a full development platform for creating containerized apps, and Docker for Mac is the most efficient way to start and run Docker on your MacBook. It runs on a LinuxKit VM and NOT on VirtualBox or VMware Fusion. It embeds a hypervisor (based on xhyve), a Linux distribution which runs on LinuxKit and filesystem & network sharing that is much more Mac native. It is a Mac native application, that you install in /Applications. At installation time, it creates symlinks in /usr/local/bin for docker & docker-compose and others, to the commands in the application bundle, in /Applications/Docker.app/Contents/Resources/bin.
One of the most amazing feature about Docker for Mac is “drag & Drop” the Mac application to /Applications to run Docker CLI and it just works flawlessly. The way the filesystem sharing maps OSX volumes seamlessly into Linux containers and remapping macOS UIDs into Linux is one of the most anticipated feature.
Few Notables Features of Docker for Mac:
- Docker for Mac runs in a LinuxKit VM.
- Docker for Mac uses HyperKit instead of Virtual Box. Hyperkit is a lightweight macOS virtualization solution built on top of Hypervisor.framework in macOS 10.10 Yosemite and higher.
- Docker for Mac does not use
docker-machineto provision its VM. The Docker Engine API is exposed on a socket available to the Mac host at/var/run/docker.sock. This is the default location Docker and Docker Compose clients use to connect to the Docker daemon, so you to usedockeranddocker-composeCLI commands on your Mac. - When you install Docker for Mac, machines created with Docker Machine are not affected.
- There is no docker0 bridge on macOS. Because of the way networking is implemented in Docker for Mac, you cannot see a
docker0interface on the host. This interface is actually within the virtual machine. - Docker for Mac has now Multi-Architectural support. It provides
binfmt_miscmulti architecture support, so you can run containers for different Linux architectures, such asarm,mips,ppc64le, and evens390x.
Top 5 Exclusive Features of Docker For Mac That You Can’t Afford to Ignore
Under this blog, I will deep dive into Docker for Mac architecture and show how to access service containers running on top of LinuxKit VM.
At the base of architecture, we have hypervisor called Hyperkit which is derived from xhyve. The xhyve hypervisor is a port of bhyve to OS X. It is built on top of Hypervisor.framework in OS X 10.10 Yosemite and higher, runs entirely in userspace, and has no other dependencies. HyperKit is basically a toolkit for embedding hypervisor capabilities in your application. It includes a complete hypervisor optimized for lightweight virtual machines and container deployment. It is designed to be interfaced with higher-level components such as the VPNKit and DataKit.
Just sitting next to HyperKit is Filesystem sharing solution. The osxfs is a new shared file system solution, exclusive to Docker for Mac. osxfs provides a close-to-native user experience for bind mounting macOS file system trees into Docker containers. To this end, osxfs features a number of unique capabilities as well as differences from a classical Linux file system.On macOS Sierra and lower, the default file system is HFS+. On macOS High Sierra, the default file system is APFS.With the recent release, NFS Volume sharing has been enabled both for Swarm & Kubernetes.
There is one more important component sitting next to Hyperkit, rightly called as VPNKit. VPNKit is a part of HyperKit attempts to work nicely with VPN software by intercepting the VM traffic at the Ethernet level, parsing and understanding protocols like NTP, DNS, UDP, TCP and doing the “right thing” with respect to the host’s VPN configuration. VPNKit operates by reconstructing Ethernet traffic from the VM and translating it into the relevant socket API calls on OSX. This allows the host application to generate traffic without requiring low-level Ethernet bridging support.
On top of these open source components, we have LinuxKit VM which runs containerd and service containers which includes Docker Engine to run service containers. LinuxKit VM is built based on YAML file. The docker-for-mac.yml contains an example use of the open source components of Docker for Mac. The example has support for controlling dockerd from the host via vsudd and port forwarding with VPNKit. It requires HyperKit, VPNKit and a Docker client on the host to run.
https://gist.github.com/ajeetraina/ac983ea54d407ab82ba1f4d542d9c1b2
Sitting next to Docker CE service containers, we have kubelet binaries running inside LinuxKit VM. If you are new to K8s, kubelet is an agent that runs on each node in the cluster. It makes sure that containers are running in a pod. It basically takes a set of PodSpecs that are provided through various mechanisms and ensures that the containers described in those PodSpecs are running and healthy. The kubelet doesn’t manage containers which were not created by Kubernetes.On top of Kubelet, we have kubernetes services running. We can either run Swarm Cluster or Kubernetes Cluster. We can use the same Compose YAML file to bring up both the clusters side by side.
Peeping into LinuxKit VM
Curious about VM and how Docker for Mac CE Edition actually look like?
Below are the list of commands which you can leverage to get into LinuxKit VM and see kubernetes services up and running. Here you go..
How to enter into LinuxKit VM?
Open MacOS terminal and run the below command to enter into LinuxKit VM:
$screen ~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/tty
Listing out the service containers:
Earlier the ctr tasks ls used to list the service containers running inside LinuxKit VM but in the recent release, namespace concept has been introduced, hence you might need to run the below command to list out the service containers:
$ ctr -n services.linuxkit tasks ls TASK PID STATUS acpid 854 RUNNING diagnose 898 RUNNING docker-ce 936 RUNNING host-timesync-daemon 984 RUNNING ntpd 1025 RUNNING trim-after-delete 1106 RUNNING vpnkit-forwarder 1157 RUNNING vsudd 1198 RUNNING
How to display containerd version?
Under Docker for Mac 18.05 RC1, containerd version 1.0.1 is available as shown below:
linuxkit-025000000001:~# ctr version
Client:
Version: v1.0.1
Revision: 9b55aab90508bd389d7654c4baf173a981477d55
Server:
Version: v1.0.1
Revision: 9b55aab90508bd389d7654c4baf173a981477d55
linuxkit-025000000001:~#
How shall I enter into docker-ce service container using containerd?
ctr -n services.linuxkit tasks exec -t --exec-id 936 docker-ce sh
/ # docker version
Client:
Version: 18.05.0-ce-rc1
API version: 1.37
Go version: go1.9.5
Git commit: 33f00ce
Built: Thu Apr 26 00:58:14 2018
OS/Arch: linux/amd64
Experimental: false
Orchestrator: swarm
Server:
Engine:
Version: 18.05.0-ce-rc1
API version: 1.37 (minimum version 1.12)
Go version: go1.10.1
Git commit: 33f00ce
Built: Thu Apr 26 01:06:49 2018
OS/Arch: linux/amd64
Experimental: true
/ #
How to verify Kubernetes Single Node Cluster?
/ # kubectl version
Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.6", GitCommit:"9f8ebd171479bec0ada837d7ee641dec2f8c6dd1", GitTreeState:"clean", BuildDate:"2018-03-23T09:38:59Z", GoVersion:"go1.9.4", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.6", GitCommit:"9f8ebd171479bec0ada837d7ee641dec2f8c6dd1", GitTreeState:"clean", BuildDate:"2018-03-21T15:13:31Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
/ # kubectl get nodes
NAME STATUS ROLES AGE VERSION
docker-for-desktop Ready master 26d v1.9.6
/ #
Interested to read further? Check out my curated list of blog posts –
Docker for Mac is built with LinuxKit. How to access the LinuxKit VM
Top 5 Exclusive Features of Docker for Mac That you can’t afford to ignore
5 Minutes to Bootstrap Kubernetes Cluster on GKE using Docker for Mac 18.03.0
Context Switching Made Easy under Kubernetes powered Docker for Mac 18.02.0
2-minutes to Kubernetes Cluster on Docker for Mac 18.01 using Swarm CLI
Docker For Mac 1.13.0 brings support for macOS Sierra, now runs ARM & AARCH64 based Docker containers
Docker for Mac 18.03.0 now comes with NFS Volume Sharing Support for Kubernetes
Did you find this blog helpful? Feel free to share your experience. Get in touch with me at twitter @ajeetsraina.
If you are looking out for contribution/discussion, join me at Docker Community Slack Channel.
