Need testers for Portainer CE 2.1.1 - latest version

Reference: https://www.portainer.io/.

Portainer is an open source tool for managing containerized applications. It works with Kubernetes, Docker, Docker Swarm, Azure ACI in both data centres and at the edge.

Portainer removes the complexity associated with orchestrators so anyone can manage containers. It can be used to deploy and manage applications, observe the behavior of containers and provide the security and governance necessary to deploy containers widely.

Prerequisite

We disable the Portainer from Nethserver.

# config setprop portainer status disabled

# signal-event nethserver-docker-update


We open port 9000 which will be used by Portainer.

# config set fw_portainer service status enabled TCPPort 9000 access green,red

# signal-event firewall-adjust

We verify.

# cat /etc/shorewall/rules | egrep '9000'

ACCEPT  loc     $FW     tcp     9000
ACCEPT  net     $FW     tcp     9000

Certificate

■ ■ ■ When the script acme.sh is used to obtain the certificate

Certificate path/root/.acme.sh/toto.org
Public keytoto.org.cer
Private keytoto.org.key

The basic docker run command takes the following form:

docker run [OPTIONS] IMAGE[:TAG|@DIGEST] [COMMAND] [ARG...]

docker run → Command name
portainer/portainer-ce → Name of the container image
-dDetached
-p9000:9000
–nameportainer
–restartunless-stopped
-v/var/run/docker.sock:/var/run/docker.sock
-v/root/.acme.sh/toto.org:/certs
-vportainer_data:/data
–ssl → Tells Docker to use the specified SSL settings
–sslcert/certs/toto.org.cer
–sslkey/certs/toto.org.key

:ballot_box_with_check: docker run → Name of the docker command to use.

:ballot_box_with_check: portainer/portainer-ce → Name of the container image to use. If the image is not installed, Docker will download and install it.

:ballot_box_with_check: -d → Execution mode.
When starting a Docker container, you must first decide whether you want to run the container in background mode, i.e. detached, or in the default foreground mode.
To start a container in detached mode, you use the -d=true option or simply -d. By design, containers started in detached mode terminate when the root process used to run the container terminates, unless you also specify the --rm… option.

:ballot_box_with_check: -p → Specifies the port to use. Example: 9000:9000, the first is the port outside the container while the second is the one inside the container.

:ballot_box_with_check: --name → The operator can identify a container in three ways: long UUID, short UUID and its name.
The UUIDs come from the docker daemon. If you do not assign a container name with the --name option, the daemon generates a random string name for you. Setting a name can be a convenient way to add meaning to a container. If you specify a name, you can use it to reference the container in a Docker network. This works for both background and foreground Docker containers.

:ballot_box_with_check: --restart → By using the --restart parameter with docker run, you can specify a restart policy to specify how a container should or should not be restarted upon exit.
When a restart policy is active on a container, it will be displayed as either Up or Restarting in the docker ps command.
no → Do not automatically restart the container when it exits. This is the default value.
on-failure[:max-retries] → Restart only if the container exits with a non-zero exit status. Optionally, you can limit the number of restart attempts by the docker daemon.
always → Always restart the container regardless of the exit status. When you specify always, the docker daemon will try to restart the container indefinitely. The container will also always be started when the docker daemon starts, regardless of the current state of the container.
unless-stopped → Always restarts the container regardless of the exit state, including when the docker daemon starts, unless the container was put into a stopped state before the Docker daemon was stopped.

:ballot_box_with_check: -v → Volumes are the preferred mechanism for persistence of data generated and used by containers. Volumes are fully managed by Docker.
If you start a container with a volume that does not yet exist, Docker creates the volume for you.
If you start a container that creates a new volume and the container has files or directories in the directory to be “mounted” (as below /root/.acme.sh/toto.org), the contents of the directory are copied into the volume. The container then mounts the volume and uses it.
Ex: -v /root/.acme.sh/toto.org:/certs
-v → To specify a “volume”.
/root/.acme.sh/toto.org → Outside the container full path of the directory.
: → Separator (no space before or after).
/certs → Inside the container full path of the directory (i.e. the mount point).

:ballot_box_with_check: --ssl → Tells Docker to use the specified SSL settings.

:ballot_box_with_check: --sslcert → Specifies the full path to the certificate’s public key inside the container.

:ballot_box_with_check: --sslkey → Specifies the full path of the certificate’s private key inside the container.

Warning

Before installing Portainer CE, it is strongly recommended to restart Docker, otherwise you will get the docker error: Error response from daemon: driver failed programming external connectivity on endpoint portainer.

# systemctl restart docker

We verify.

# systemctl status docker | grep Active

Active: active (running) since ven. 2021-04-30 21:53:26 EDT; 11s ago

Installation

The command must be on one line, otherwise, each line must start with an alphabetical character or with a “/” and not with a “-”.

# docker run -d -p 9000:9000 --name portainer --restart unless-stopped -v /var/run/docker.sock:/var/run/docker.sock -v /root/.acme.sh/toto.org:/certs -v portainer_data:/data portainer/portainer-ce --ssl --sslcert /certs/toto.org.cer --sslkey /certs/toto.org.key

Unable to find image 'portainer/portainer-ce:latest' locally
latest: Pulling from  portainer/portainer-ce
94cfa856b2b1: Pull complete
49d59ee0881a: Pull complete
527b866940d5: Pull complete
Digest: sha256:5064d8414091c175c55ef6f8744da1210819388c2136273b4607a629b7d93358
Status: Downloaded newer image for portainer/portainer-ce:latest
834d207eff8005f7c6bc5539e464ed5bceaecb5e4264feae22ad7a485a0e4a7b

Docker did not find the portainer/portainer-ce:latest image, so it downloads and installs the required image.

portainer/portainer-ce → The name of the Portainer image.

834d207eff80 → The short UUID.

834d207eff8005f7c6bc5539e464ed5bceaecb5e4264feae22ad7a485a0e4a7b → The long UUID.

We display all the containers currently installed.

# docker ps -a

CONTAINER ID   IMAGE                    COMMAND                  CREATED          STATUS                   PORTS                                                 NAMES
834d207eff80   portainer/portainer-ce   "/portainer --ssl --…"   11 seconds ago   Up 5 seconds             8000/tcp, 0.0.0.0:9000->9000/tcp, :::9000->9000/tcp   portainer
1079944c9090   hello-world              "/hello"                 2 hours ago      Exited (0) 2 hours ago                                                         zealous_payne

Our new container, which has been given the name portainer, runs correctly (STATUS → Up 5 seconds).

Verification of Portainer’s operation

We go to the URL of our site specifying https and port 9000: https://toto.org:9000

The lock is closed indicating that our certificate is working properly. image

● We choose a name for the Portainer administrator and a password that we confirm.
● We uncheck Allow collection of anonymous statistics…
Create user.

Click on Manage the local Docker environmentConnect.

● The Portainer welcome screen appears.
● The version is 2.1.1 (Latest).
● Click inside the local frame.

● The dashboard appears and gives a summary of the present Docker components.

● In the menu, we click Containers to display all the containers.

Deleting a container

We delete the container zealous_pane (random name generated by Docker) which is the one of the hello-world image.

● Check the container zealous_paneRemove.

● Activate the button Automatically remove non-persistent volumesRemove. image

● The zealous_pane container has been removed.

App Template

● By clicking App Templates, several templates are displayed.
● By clicking a template, its page is displayed and we can deploy it in our Docker.



■ ■ ■ When the NethServer manager is used to obtain the certificate

If our server is directly connected to the Internet and we used the NethServer manager to obtain a Let’s Encrypt certificate, the same procedure can be used to apply this certificate to Portainer. The only differences are the path of the certificate keys and their names.

Path to the certificate /etc/letsencrypt|
Public keylive/toto.org/cert.pem|
Private keylive/toto.org/privkey.pem|

image It is absolutely necessary to use the path /etc/letsencrypt, because the files cert.pem and privkey.pem are links that point to the directory ../../archive/toto.org and Docker must be able to access the latter inside the portainer container. Indeed, if we use the path /etc/letsencrypt/live, Docker will only map this directory and its subdirectories into the portainer container and it will not see the ../../archive directory inside the container.

Warning

Before installing Portainer CE, it is strongly recommended to restart Docker, otherwise you will get the docker error: Error response from daemon: driver failed programming external connectivity on endpoint portainer.

# systemctl restart docker

We verify.

# systemctl status docker | grep Active

Active: active (running) since ven. 2021-04-30 21:53:26 EDT; 11s ago

Installation

The command must be on one line, otherwise, each line must start with an alphabetical character or with a “/” and not with a “-”.

# docker run -d -p 9000:9000 --name portainer --restart unless-stopped -v /var/run/docker.sock:/var/run/docker.sock -v /etc/letsencrypt:/certs -v portainer_data:/data portainer/portainer-ce --ssl --sslcert /certs/live/toto.org/cert.pem --sslkey /certs/live/toto.org/privkey.pem

Unable to find image 'portainer/portainer-ce:latest' locally
latest: Pulling from  portainer/portainer-ce
94cfa856b2b1: Pull complete
49d59ee0881a: Pull complete
527b866940d5: Pull complete
Digest: sha256:5064d8414091c175c55ef6f8744da1210819388c2136273b4607a629b7d93358
Status: Downloaded newer image for portainer/portainer-ce:latest
3043d906e23a3bc6adcdba19024a010acdabe478f63fec5cac6d728cd6b1962d

We verify.

# docker ps -a

CONTAINER ID   IMAGE                    COMMAND                  CREATED          STATUS          PORTS                                                 NAMES
3043d906e23a   portainer/portainer-ce   "/portainer --ssl --…"   18 seconds ago   Up 10 seconds   8000/tcp, 0.0.0.0:9000->9000/tcp, :::9000->9000/tcp   portainer
1079944c9090   hello-world              "/hello"                 30 minutes ago   Exited (0) 30 minutes ago                                             tender_haslett

Multi-lines command

● Example of the Portainer command spread over several lines.
● Each line must start with an alphabetical character or a “/” and not with a “-”.

# docker run -d -p 9000:9000 --name                           \
portainer --restart                                           \
unless-stopped -v                                             \
/var/run/docker.sock:/var/run/docker.sock -v                  \
/etc/letsencrypt:/certs -v                                    \
portainer_data:/data portainer/portainer-ce --ssl --sslcert   \
/certs/live/toto.org/cert.pem --sslkey                        \
/certs/live/toto.org/privkey.pem

All comments and suggestions appreciated,

Michel-André