The 2016.11.0 release of Salt introduces the ability to execute Salt States and Salt remote execution commands directly inside of Docker containers.
This addition makes it possible to not only deploy fresh containers using Salt States. This also allows for running containers to be audited and modified using Salt, but without running a Salt Minion inside the container. Some of the applications include security audits of running containers as well as gathering operating data from containers.
This new feature is simple and straightforward, and can be used via a running Salt Minion, the Salt Call command, or via Salt SSH. For this tutorial we will use the salt-call command, but like all salt commands these calls are directly translatable to salt and salt-ssh.
Since setting up Docker is well covered in the Docker documentation we will make no such effort to describe it here. Please see the Docker Installation Documentation for installing and setting up Docker: https://docs.docker.com/engine/installation/
The Docker integration also requires that the docker-py library is installed. This can easily be done using pip or via your system package manager:
pip install docker-py
For this tutorial we will be using Salt Call, which is available in the salt-minion package, please follow the Salt Installation docs found here: https://repo.saltstack.com/
Next some Salt States are needed, for this example a very basic state which installs vim is used, but anything Salt States can do can be done here, please see the Salt States Introduction Tutorial to learn more about Salt States: https://docs.saltstack.com/en/stage/getstarted/config/
For this tutorial, simply create a small state file in /srv/salt/vim.sls:
The base image you choose will need to have python 2.6 or 2.7 installed. We are hoping to resolve this constraint in a future release.
If base is omitted the default image used is a minimal openSUSE image with Python support, maintained by SUSE
Next run the docker.sls_build command:
salt-call --local dockerng.sls_build test base=my_base_image mods=vim
Now we have a fresh image called test to work with and vim has been installed.
Salt can now run remote execution functions inside the container with another simple salt-call command:
salt-call --local dockerng.call test test.version salt-call --local dockerng.call test network.interfaces salt-call --local dockerng.call test disk.usage salt-call --local dockerng.call test pkg.list_pkgs salt-call --local dockerng.call test service.running httpd salt-call --local dockerng.call test cmd.run 'ls -l /etc'