Summary: The example run commands in the Dockerhub readme don't work, but they can be fixed by adding or discussing the --privileged or --ulimit flags.
The Dockerhub readme suggests the following docker run commands:
docker run -d --name my-running-haproxy --sysctl net.ipv4.ip_unprivileged_port_start=0 my-haproxy
# Or:
docker run -d --name my-running-haproxy \
-v /path/to/etc/haproxy:/usr/local/etc/haproxy:ro --sysctl net.ipv4.ip_unprivileged_port_start=0 haproxy:2.3
When running either of these commands, HAProxy crashes with the following error message:
[ALERT] 040/170647 (8) : [haproxy.main()] Cannot raise FD limit to 8030, limit is 1024.
Running Docker in privileged mode lifts the 1024 limit on file descriptors. So that's one possible way to get past this error:
docker run -d --name my-running-haproxy --sysctl net.ipv4.ip_unprivileged_port_start=0 --privileged my-haproxy
# Or:
docker run -d --name my-running-haproxy \
-v /path/to/etc/haproxy:/usr/local/etc/haproxy:ro --sysctl net.ipv4.ip_unprivileged_port_start=0 --privileged haproxy:2.3
Perhaps the readme should be updated to either:
- discuss the
--privileged and --ulimit flags, their pros, their cons, and alternatives; or
- simply add
--privileged to the example docker run commands.
Option 1 is probably better so as not to encourage use of --privileged without knowledge of the consequences.
I tested this against haproxy:latest and haproxy:alpine, which as of today map to HAProxy 2.3.5.
Summary: The example run commands in the Dockerhub readme don't work, but they can be fixed by adding or discussing the
--privilegedor--ulimitflags.The Dockerhub readme suggests the following
docker runcommands:When running either of these commands, HAProxy crashes with the following error message:
Running Docker in privileged mode lifts the 1024 limit on file descriptors. So that's one possible way to get past this error:
Perhaps the readme should be updated to either:
--privilegedand--ulimitflags, their pros, their cons, and alternatives; or--privilegedto the exampledocker runcommands.Option 1 is probably better so as not to encourage use of
--privilegedwithout knowledge of the consequences.I tested this against
haproxy:latestandhaproxy:alpine, which as of today map to HAProxy 2.3.5.