Loadingfriends288

Estimated reading time: 10 minutes

• At this stage we can safely start docker daemon: # systemctl start docker Confirm that docker runs within a new data directory: # ps aux grep -i docker grep -v grep root 2095 0.2 0.4 66? Ssl 18:14 0:00 /usr/bin/docker daemon -g /new/path/docker -H fd:// root 2100 0.0 0.1 34?
• Check that you have free space on /var as this is where Docker stores the image files by default (in /var/lib/docker). First clean stuff up by using docker ps -a to list all containers (including stopped ones) and docker rm to remove them; then use docker images to list all the images you have stored and docker rmi to remove them.
• Two Ubuntu 18.04 servers set up by following the Ubuntu 18.04 initial server setup guide, including a sudo non-root user and a firewall. One server will host your private Docker Registry and the other will be your client server. Docker and Docker-Compose installed on both servers by following the How to Install Docker-Compose on Ubuntu 18.04.

Search the world's information, including webpages, images, videos and more. Google has many special features to help you find exactly what you're looking for.

To get started with Docker Engine on Ubuntu, make sure youmeet the prerequisites, theninstall Docker.

Prerequisites

OS requirements

To install Docker Engine, you need the 64-bit version of one of these Ubuntuversions:

• Ubuntu Groovy 20.10
• Ubuntu Focal 20.04 (LTS)
• Ubuntu Bionic 18.04 (LTS)
• Ubuntu Xenial 16.04 (LTS)

Docker Engine is supported on x86_64 (or amd64), armhf, and arm64 architectures.

Uninstall old versions

Older versions of Docker were called docker, docker.io, or docker-engine.If these are installed, uninstall them:

It’s OK if apt-get reports that none of these packages are installed.

The contents of /var/lib/docker/, including images, containers, volumes, andnetworks, are preserved. If you do not need to save your existing data, and want tostart with a clean installation, refer to the uninstall Docker Enginesection at the bottom of this page.

Supported storage drivers

Docker Engine on Ubuntu supports overlay2, aufs and btrfs storage drivers.

Docker Engine uses the overlay2 storage driver by default. If you need to useaufs instead, you need to configure it manually.See use the AUFS storage driver

Installation methods

You can install Docker Engine in different ways, depending on your needs:

• Most usersset up Docker’s repositories and installfrom them, for ease of installation and upgrade tasks. This is therecommended approach.

• Some users download the DEB package andinstall it manually and manageupgrades completely manually. This is useful in situations such as installingDocker on air-gapped systems with no access to the internet.

• In testing and development environments, some users choose to use automatedconvenience scripts to install Docker.

Install using the repository

Before you install Docker Engine for the first time on a new host machine, you needto set up the Docker repository. Afterward, you can install and update Dockerfrom the repository.

Set up the repository

1. Update the apt package index and install packages to allow apt to use arepository over HTTPS:

2. Add Docker’s official GPG key:

3. Use the following command to set up the stable repository. To add thenightly or test repository, add the word nightly or test (or both)after the word stable in the commands below. Learn about nightly and test channels.

   Note: The lsb_release -cs sub-command below returns the name of yourUbuntu distribution, such as xenial. Sometimes, in a distributionlike Linux Mint, you might need to change $(lsb_release -cs)to your parent Ubuntu distribution. For example, if you are using Linux Mint Tessa, you could use bionic. Docker does not offer any guarantees on untestedand unsupported Ubuntu distributions.

Install Docker Engine

1. Update the apt package index, and install the latest version of DockerEngine and containerd, or go to the next step to install a specific version:

   Got multiple Docker repositories?

   If you have multiple Docker repositories enabled, installingor updating without specifying a version in the apt-get install orapt-get update command always installs the highest possible version,which may not be appropriate for your stability needs.

2. To install a specific version of Docker Engine, list the available versionsin the repo, then select and install:

   a. List the versions available in your repo:

   b. Install a specific version using the version string from the second column, for example, 5:18.09.1~3-0~ubuntu-xenial.

3. Verify that Docker Engine is installed correctly by running the hello-worldimage.

   This command downloads a test image and runs it in a container. When thecontainer runs, it prints an informational message and exits.

Docker Engine is installed and running. The docker group is created but no usersare added to it. You need to use sudo to run Docker commands.Continue to Linux postinstall to allow non-privilegedusers to run Docker commands and for other optional configuration steps.

Upgrade Docker Engine

To upgrade Docker Engine, first run sudo apt-get update, then follow theinstallation instructions, choosing the newversion you want to install.

Install from a package

If you cannot use Docker’s repository to install Docker Engine, you can download the.deb file for your release and install it manually. You need to downloada new file each time you want to upgrade Docker.

1. Go to https://download.docker.com/linux/ubuntu/dists/,choose your Ubuntu version, then browse to pool/stable/, choose amd64,armhf, or arm64, and download the .deb file for the Docker Engineversion you want to install.

   Note: To install a nightly or test (pre-release) package,change the word stable in the above URL to nightly or test.Learn about nightly and test channels.

2. Install Docker Engine, changing the path below to the path where you downloadedthe Docker package.

   The Docker daemon starts automatically.

3. Verify that Docker Engine is installed correctly by running the hello-worldimage.

   This command downloads a test image and runs it in a container. When thecontainer runs, it prints an informational message and exits.

Docker Engine is installed and running. The docker group is created but no usersare added to it. You need to use sudo to run Docker commands.Continue to Post-installation steps for Linux to allownon-privileged users to run Docker commands and for other optional configurationsteps.

Upgrade Docker Engine

Ubuntu Start Docker Service

To upgrade Docker Engine, download the newer package file and repeat theinstallation procedure, pointing to the new file.

Install using the convenience script

Docker provides convenience scripts at get.docker.comand test.docker.com for installing edge andtesting versions of Docker Engine - Community into development environments quickly andnon-interactively. The source code for the scripts is in thedocker-install repository.Using these scripts is not recommended for productionenvironments, and you should understand the potential risks before you usethem:

• The scripts require root or sudo privileges to run. Therefore,you should carefully examine and audit the scripts before running them.
• The scripts attempt to detect your Linux distribution and version andconfigure your package management system for you. In addition, the scripts donot allow you to customize any installation parameters. This may lead to anunsupported configuration, either from Docker’s point of view or from your ownorganization’s guidelines and standards.
• The scripts install all dependencies and recommendations of the packagemanager without asking for confirmation. This may install a large number ofpackages, depending on the current configuration of your host machine.
• The script does not provide options to specify which version of Docker to install,and installs the latest version that is released in the “edge” channel.
• Do not use the convenience script if Docker has already been installed on thehost machine using another mechanism.

This example uses the script at get.docker.com toinstall the latest release of Docker Engine - Community on Linux. To install the latesttesting version, use test.docker.com instead. Ineach of the commands below, replace each occurrence of get with test.

Warning:

Always examine scripts downloaded from the internet beforerunning them locally.

If you would like to use Docker as a non-root user, you should now consideradding your user to the “docker” group with something like:

Remember to log out and back in for this to take effect!

Warning:

Adding a user to the “docker” group grants them the ability to run containerswhich can be used to obtain root privileges on the Docker host. Refer toDocker Daemon Attack Surfacefor more information.

Docker Engine - Community is installed. It starts automatically on DEB-based distributions. OnRPM-based distributions, you need to start it manually using the appropriatesystemctl or service command. As the message indicates, non-root users can’trun Docker commands by default.

Ubuntu Start Docker Container On Boot

Note:

To install Docker without root privileges, seeRun the Docker daemon as a non-root user (Rootless mode).

Upgrade Docker after using the convenience script

If you installed Docker using the convenience script, you should upgrade Dockerusing your package manager directly. There is no advantage to re-running theconvenience script, and it can cause issues if it attempts to re-addrepositories which have already been added to the host machine.

Ubuntu Start Docker Daemon

Uninstall Docker Engine

1. Uninstall the Docker Engine, CLI, and Containerd packages:

2. Images, containers, volumes, or customized configuration files on your hostare not automatically removed. To delete all images, containers, andvolumes:

You must delete any edited configuration files manually.

Next steps

• Continue to Post-installation steps for Linux.
• Review the topics in Develop with Docker to learn how to build new applications using Docker.

You can configure automatic log upload for continuous reports in Cloud App Security using a Docker on an on-premises Ubuntu, Red Hat Enterprise Linux (RHEL), or CentOS server.

Prerequisites

• OS:

  • Ubuntu 14.04, 16.04, and 18.04
  • RHEL 7.2 or higher
  • CentOS 7.2 or higher

• Disk space: 250 GB

• CPU: 2

• RAM: 4 GB

• Set your firewall as described in Network requirements

Note

If you have an existing log collector and want to remove it before deploying it again, or if you simply want to remove it, run the following commands:

Log collector performance

The Log collector can successfully handle log capacity of up to 50 GB per hour. The main bottlenecks in the log collection process are:

• Network bandwidth - Your network bandwidth determines the log upload speed.

• I/O performance of the virtual machine - Determines the speed at which logs are written to the log collector's disk. The log collector has a built-in safety mechanism that monitors the rate at which logs arrive and compares it to the upload rate. In cases of congestion, the log collector starts to drop log files. If your setup typically exceeds 50 GB per hour, it's recommended that you split the traffic between multiple log collectors.

Set up and configuration

Step 1 – Web portal configuration: Define data sources and link them to a log collector

1. Go to the Automatic log upload settings page.

   1. In the Cloud App Security portal, click the settings icon followed by Log collectors.

2. For each firewall or proxy from which you want to upload logs, create a matching data source.

   1. Click Add data source.
      
   2. Name your proxy or firewall.
      
   3. Select the appliance from the Source list. If you select Custom log format to work with a network appliance that isn't listed, see Working with the custom log parser for configuration instructions.
   4. Compare your log with the sample of the expected log format. If your log file format doesn't match this sample, you should add your data source as Other.
   5. Set the Receiver type to either FTP, FTPS, Syslog – UDP, or Syslog – TCP, or Syslog – TLS.

   Note

   Integrating with secure transfer protocols (FTPS and Syslog – TLS) often requires additional settings or your firewall/proxy.

   f. Repeat this process for each firewall and proxy whose logs can be used to detect traffic on your network. It's recommended to set up a dedicated data source per network device to enable you to:

   • Monitor the status of each device separately, for investigation purposes.
   • Explore Shadow IT Discovery per device, if each device is used by a different user segment.

3. Go to the Log collectors tab at the top.

   1. Click Add log collector.
   2. Give the log collector a name.
   3. Enter the Host IP address of the machine you'll use to deploy the Docker. The host IP address can be replaced with the machine name, if there is a DNS server (or equivalent) that will resolve the host name.
   4. Select all Data sources that you want to connect to the collector, and click Update to save the configuration.

4. Further deployment information will appear. Copy the run command from the dialog. You can use the copy to clipboard icon.

5. Export the expected data source configuration. This configuration describes how you should set the log export in your appliances.

   Note

   • A single Log collector can handle multiple data sources.
   • Copy the contents of the screen because you will need the information when you configure the Log Collector to communicate with Cloud App Security. If you selected Syslog, this information will include information about which port the Syslog listener is listening on.
   • For users sending log data via FTP for the first time, we recommend changing the password for the FTP user. For more information, see Changing the FTP password.

Step 2 – On-premises deployment of your machine

The following steps describe the deployment in Ubuntu.

Note

The deployment steps for other supported platforms may be slightly different.

1. Open a terminal on your Ubuntu machine.

2. Change to root privileges using the command: sudo -i

3. To bypass a proxy in your network, run the following two commands:

4. If you accept the software license terms, uninstall old versions and install Docker CE by running the commands appropriate for your environment:

1. Remove old versions of Docker: yum erase docker docker-engine docker.io

2. Install Docker engine prerequisites: yum install -y yum-utils

3. Add Docker repository:

4. Install Docker engine: yum -y install docker-ce

5. Start Docker

6. Test Docker installation: docker run hello-world

1. Remove old versions of Docker: yum erase docker docker-engine docker.io

2. Install Docker engine prerequisites:

3. Add Docker repository:

4. Install dependencies:

5. Install Docker engine: sudo yum install docker-ce

6. Start Docker

7. Test Docker installation: docker run hello-world

1. Remove the container-tools module: yum module remove container-tools

2. Add the Docker CE repository: yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

3. Modify the yum repo file to use CentOS 8/RHEL 8 packages: sed -i s/7/8/g /etc/yum.repos.d/docker-ce.repo

4. Install Docker CE: yum install docker-ce

5. Start Docker

6. Test Docker installation: docker run hello-world

1. Remove old versions of Docker: apt-get remove docker docker-engine docker.io

2. If you are installing on Ubuntu 14.04, install the linux-image-extra package.

3. Install Docker engine prerequisites:

4. Verify that the apt-key fingerprint UID is docker@docker.com: apt-key fingerprint | grep uid

5. Install Docker engine:

6. Test Docker installation: docker run hello-world

5. Deploy the collector image on the hosting machine by importing the collector configuration. Import the configuration by copying the run command generated in the portal. If you need to configure a proxy, add the proxy IP address and port number. For example, if your proxy details are 192.168.10.1:8080, your updated run command is:

6. Verify that the collector is running properly with the following command: docker logs <collector_name>

You should see the message: Finished successfully!

Step 3 - On-premises configuration of your network appliances

Configure your network firewalls and proxies to periodically export logs to the dedicated Syslog port or the FTP directory according to the directions in the dialog. For example:

Step 4 - Verify the successful deployment in the Cloud App Security portal

Check the collector status in the Log collector table and make sure the status is Connected. If it's Created, it's possible the log collector connection and parsing haven't completed.

You can also go to the Governance log and verify that logs are being periodically uploaded to the portal.

Alternatively, you can check the log collector status from within the docker container using the following commands:

1. Log in to the container by using this command: docker exec -it <Container Name> bash
2. Verify the log collector status using this command: collector_status -p

If you have problems during deployment, see Troubleshooting Cloud Discovery.

Optional - Create custom continuous reports

Verify that the logs are being uploaded to Cloud App Security and that reports are generated. After verification, create custom reports. You can create custom discovery reports based on Azure Active Directory user groups. For example, if you want to see the cloud use of your marketing department, import the marketing group using the import user group feature. Then create a custom report for this group. You can also customize a report based on IP address tag or IP address ranges.

1. In the Cloud App Security portal, under the Settings cog, select Cloud Discovery settings, and then select Continuous reports.
2. Click the Create report button and fill in the fields.
3. Under the Filters you can filter the data by data source, by imported user group, or by IP address tags and ranges.

Next steps

If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.