Docker images are supposed to be immutable, yet when I import one of my images on another machine, it behaves differently.

To reproduce the bug, I will start from a debian-wheezy image built using debootstrap.

I build my image using a Dockerfile:

FROM debian-wheezy
RUN apt-get install -y fail2ban
RUN rm /var/run/fail2ban/fail2ban.sock

The last command avoids fail2ban from crashing at next start: for some reason, the socket file stays there after installing fail2ban, even if I stop the service manually in the Dockerfile. Fail2ban can not restart if the file is still there.

Launching the image and starting fail2ban will succeed. We can check the content of the /var/run/fail2ban repository:

$ docker build -t test/fail2ban .
$ docker run test/fail2ban ls /var/run/fail2ban

However, if I export the image and import it to another machine:

$ docker save test/fail2ban > /tmp/fail2ban.tar
$ scp /tmp/fail2ban.tar user@machine:/tmp
$ ssh user@machine "cat /tmp/fail2ban.tar | docker load"
$ ssh user@machine docker run test/fail2ban ls /var/run/fail2ban

This time the socket file is there, preventing me from starting the service.

Can somebody explain this behaviour and how to fix the problem?

Here are some more informations:

$ uname -a
Linux debian 3.2.0-4-amd64 #1 SMP Debian 3.2.65-1+deb7u2 x86_64 GNU/Linux
$ docker --version
Docker version 1.6.0, build 4749651
$ ssh user@machine uname -a
Linux debian 3.2.0-4-amd64 #1 SMP Debian 3.2.65-1 x86_64 GNU/Linux
$ ssh user@machine docker --version
Docker version 1.6.0, build 4749651
  • FROM debian-wheezy, RUN apt-get install -y fail2ban, RUN rm /var/run/fail2ban/fail2ban.sock does not even build in my tests: I cannot download debian-wheezy, just debian:wheezy and then I have to add an additional RUN apt-get update before I can apt-get install -y fail2ban. Is this really your Dockerfile in use? – Matthias Sep 2 '15 at 8:04
  • The Dockerfile is right, I'm using a local image I have locally. You can use whatever Debian flavour you want. I think the real issue here was that I ditn't really import it do another machine directly. Instead, I Imported the image in in a chroot, and then copied the chroot to a hard drive using rsync -ah... – pedroapero Sep 2 '15 at 8:40
  • Okay. Another question I have is: Why does the fail2ban.sock even exist just after installation? I thought those files would just be created when a programm/service starts. – Matthias Sep 2 '15 at 8:46
  • Did your rsync -ah include the contents of /var/run? This is generally a bad idea. – Matthias Sep 2 '15 at 9:53
  • I suppose fail2ban.sock is there because by default services are started right after installation. I suspect Docker does not stop services properly after installing packages from a Dockerfile. About the rsync, I stop every services before doing it. In includes the /var/run directory. Fail2ban is the first to cause me any trouble (and I've been playing like this with quite a lot of packages now). – pedroapero Sep 2 '15 at 10:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.