start:linux:debian:astuces
Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| start:linux:debian:astuces [2026/02/04 04:06] – créée admin | start:linux:debian:astuces [2026/02/04 04:35] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 4: | Ligne 4: | ||
| - | Sudo sur Debian : l’astuce secrète pour devenir admin en 2 minutes chrono | + | Sudo sur Debian : [[https:// |
| Par Jean / janvier 1, 2025 | Par Jean / janvier 1, 2025 | ||
| Ligne 100: | Ligne 100: | ||
| Finalement, l’installation et la configuration de sudo sur Debian sont des étapes essentielles pour tout administrateur système ou développeur soucieux de la sécurité. En suivant ce guide et en appliquant ces bonnes pratiques, tu seras en mesure de gérer efficacement les privilèges administrateur tout en maintenant un niveau de sécurité optimal. N’oublie pas que la sécurité est un processus continu, alors reste toujours informé des dernières recommandations en matière de gestion des privilèges sur Debian. | Finalement, l’installation et la configuration de sudo sur Debian sont des étapes essentielles pour tout administrateur système ou développeur soucieux de la sécurité. En suivant ce guide et en appliquant ces bonnes pratiques, tu seras en mesure de gérer efficacement les privilèges administrateur tout en maintenant un niveau de sécurité optimal. N’oublie pas que la sécurité est un processus continu, alors reste toujours informé des dernières recommandations en matière de gestion des privilèges sur Debian. | ||
| + | |||
| + | ====== Docker ====== | ||
| + | |||
| + | * Objet : Mise en place et utilisation de docker.io | ||
| + | * Niveau requis : {{tag> | ||
| + | * Commentaires : Docker.io est un outil permettant de créer facilement des conteneurs pour certaines applications. | ||
| + | * Débutant, à savoir : [[https:// | ||
| + | * Création par [[https:// | ||
| + | * Testé par <...> le <...> FIXME | ||
| + | * Commentaires sur le forum : [[https:// | ||
| + | |||
| + | ===== Introduction ===== | ||
| + | |||
| + | Les // | ||
| + | |||
| + | Avec LXC, on peut installer par exemple une Archlinux dans un dossier de sa debian, et puis la maintenir au quotidien, l' | ||
| + | À la différence d'une VM, le matériel n'est pas virtualisé, | ||
| + | |||
| + | Avec Docker, le principe est un peu différent, l' | ||
| + | Exemple: une vieille version de gnuradio qui ne compile plus sous une debian actuelle, qui nécessiterait d' | ||
| + | |||
| + | À noter que comme une image docker est figée, elle ne reçoit pas de mise à jour, en particulier de mise à jour de sécurité. Docker n'est donc en général pas une bonne solution pour des serveurs, à moins de mettre à jour régulièrement ses images dockers, ce qui nécessite qu' | ||
| + | |||
| + | ===== Installation ===== | ||
| + | |||
| + | <code root> | ||
| + | apt install docker.io | ||
| + | </ | ||
| + | |||
| + | ===== Utilisation ===== | ||
| + | |||
| + | ==== Permissions ==== | ||
| + | |||
| + | Pour utiliser docker, il faut soit être root, soit être membre du groupe '' | ||
| + | |||
| + | Le plus simple est de rajouter son utilisateur au groupe '' | ||
| + | <code root> | ||
| + | adduser votre_username docker | ||
| + | </ | ||
| + | |||
| + | À noter qu'il faut ensuite redémarrer, | ||
| + | |||
| + | ==== Construire un conteneur ==== | ||
| + | |||
| + | De nombreux conteneurs sont disponibles sur internet, mais il est souvent intéressant de construire ses propres conteneurs, souvent en se basant sur des conteneurs existants pour ne pas réinventer *toute* la roue. | ||
| + | |||
| + | On crée pour cela un fichier '' | ||
| + | |||
| + | * qui se base sur une image ubuntu 20.04, | ||
| + | * crée un utilisateur '' | ||
| + | * lance des commandes de création de dossier, d' | ||
| + | * copie un fichier '' | ||
| + | * indique que le docker doit être lancé en tant que '' | ||
| + | * indique que le dossier de travail ('' | ||
| + | * enfin, indique que la commande à lancer est '' | ||
| + | |||
| + | <code dockerfile> | ||
| + | FROM ubuntu: | ||
| + | |||
| + | ENV DEBIAN_FRONTEND=noninteractive | ||
| + | RUN apt-get update | ||
| + | |||
| + | RUN apt-get install -y sudo | ||
| + | RUN useradd --create-home --shell /bin/bash -G sudo gnuradio | ||
| + | RUN echo ' | ||
| + | |||
| + | RUN mkdir / | ||
| + | RUN apt-get install -y gir1.2-gtk-3.0 gnuradio gnuradio-dev cmake git libboost-all-dev libcppunit-dev liblog4cpp5-dev swig liborc-dev libgsl-dev vim xterm rtl-sdr gr-osmosdr | ||
| + | |||
| + | COPY --chown gnuradio: | ||
| + | |||
| + | USER gnuradio | ||
| + | WORKDIR / | ||
| + | |||
| + | CMD gnuradio-companion | ||
| + | </ | ||
| + | |||
| + | Une fois ce fichier créé, on construit l' | ||
| + | |||
| + | <code user> | ||
| + | |||
| + | Sauf erreur, l' | ||
| + | |||
| + | Pour en savoir plus: | ||
| + | <code user> | ||
| + | man docker-build | ||
| + | man docker-image | ||
| + | </ | ||
| + | |||
| + | ==== Lancer une image dans un conteneur ==== | ||
| + | |||
| + | On utilise '' | ||
| + | |||
| + | <code user> | ||
| + | docker run -it debian:slim bash | ||
| + | </ | ||
| + | |||
| + | Note: '' | ||
| + | |||
| + | Il est en général intéressant de partager un dossier ou un fichier entre le conteneur docker et l' | ||
| + | |||
| + | Voici la commande un peu complexe qui serait utilisée ici pour l' | ||
| + | |||
| + | * GnuRadio a besoin d' | ||
| + | * GnuRadio a besoin d' | ||
| + | * GnuRadio est une application graphique que je veux lancer en tant qu' | ||
| + | * Pour accéder aux périphériques audio et radio, je dois m' | ||
| + | * Enfin, je veux que mon dossier '' | ||
| + | |||
| + | Cela se traduit par: | ||
| + | <code user> | ||
| + | docker run \ | ||
| + | --privileged \ | ||
| + | --volume="/ | ||
| + | --volume=" | ||
| + | --volume=" | ||
| + | --volume="/ | ||
| + | --volume="/ | ||
| + | --group-add audio \ | ||
| + | --group-add plugdev \ | ||
| + | --env=" | ||
| + | -it \ | ||
| + | gnuradio3.8 | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | Pour en savoir plus: | ||
| + | <code user> | ||
| + | man docker-run | ||
| + | </ | ||
| + | |||
| + | ===== Résolution de problèmes ===== | ||
| + | |||
| + | ==== Droits insuffisants ==== | ||
| + | |||
| + | Les commandes docker retournent un message ressemblant à cela et suggérant une permission refusée : | ||
| + | < | ||
| + | Get " | ||
| + | dial unix / | ||
| + | connect: | ||
| + | permission denied</ | ||
| + | |||
| + | Le shell utilisé pour lancer la commande ne dispose pas des droits suffisants. S' | ||
| + | |||
| + | [[https:// | ||
| + | < | ||
| + | # Install Docker Engine on Debian | ||
| + | |||
| + | |||
| + | To get started with Docker Engine on Debian, make sure you | ||
| + | [meet the prerequisites](# | ||
| + | [installation steps](# | ||
| + | |||
| + | ## Prerequisites | ||
| + | |||
| + | ### Firewall limitations | ||
| + | |||
| + | > [!WARNING] | ||
| + | > | ||
| + | > Before you install Docker, make sure you consider the following | ||
| + | > security implications and firewall incompatibilities. | ||
| + | |||
| + | - If you use ufw or firewalld to manage firewall settings, be aware that | ||
| + | when you expose container ports using Docker, these ports bypass your | ||
| + | firewall rules. For more information, | ||
| + | [Docker and ufw](/ | ||
| + | - Docker is only compatible with `iptables-nft` and `iptables-legacy`. | ||
| + | Firewall rules created with `nft` are not supported on a system with Docker installed. | ||
| + | Make sure that any firewall rulesets you use are created with `iptables` or `ip6tables`, | ||
| + | and that you add them to the `DOCKER-USER` chain, | ||
| + | see [Packet filtering and firewalls](/ | ||
| + | |||
| + | ### OS requirements | ||
| + | |||
| + | To install Docker Engine, you need one of these Debian versions: | ||
| + | |||
| + | - Debian Trixie 13 (stable) | ||
| + | - Debian Bookworm 12 (oldstable) | ||
| + | - Debian Bullseye 11 (oldoldstable) | ||
| + | |||
| + | Docker Engine for Debian is compatible with x86_64 (or amd64), armhf (arm/v7), | ||
| + | arm64, and ppc64le (ppc64el) architectures. | ||
| + | |||
| + | ### Uninstall old versions | ||
| + | |||
| + | Before you can install Docker Engine, you need to uninstall any conflicting packages. | ||
| + | |||
| + | Your Linux distribution may provide unofficial Docker packages, which may conflict | ||
| + | with the official packages provided by Docker. You must uninstall these packages | ||
| + | before you install the official version of Docker Engine. | ||
| + | |||
| + | The unofficial packages to uninstall are: | ||
| + | |||
| + | - `docker.io` | ||
| + | - `docker-compose` | ||
| + | - `docker-doc` | ||
| + | - `podman-docker` | ||
| + | |||
| + | Moreover, Docker Engine depends on `containerd` and `runc`. Docker Engine | ||
| + | bundles these dependencies as one bundle: `containerd.io`. If you have | ||
| + | installed the `containerd` or `runc` previously, uninstall them to avoid | ||
| + | conflicts with the versions bundled with Docker Engine. | ||
| + | |||
| + | Run the following command to uninstall all conflicting packages: | ||
| + | |||
| + | ```console | ||
| + | $ sudo apt remove $(dpkg --get-selections docker.io docker-compose docker-doc podman-docker containerd runc | cut -f1) | ||
| + | ``` | ||
| + | |||
| + | `apt` might report that you have none of these packages installed. | ||
| + | |||
| + | Images, containers, volumes, and networks stored in `/ | ||
| + | automatically removed when you uninstall Docker. If you want to start with a | ||
| + | clean installation, | ||
| + | [uninstall Docker Engine](# | ||
| + | |||
| + | ## Installation methods | ||
| + | |||
| + | You can install Docker Engine in different ways, depending on your needs: | ||
| + | |||
| + | - Docker Engine comes bundled with | ||
| + | [Docker Desktop for Linux](/ | ||
| + | the easiest and quickest way to get started. | ||
| + | |||
| + | - Set up and install Docker Engine from | ||
| + | [Docker' | ||
| + | |||
| + | - [Install it manually](# | ||
| + | |||
| + | - Use a [convenience script](# | ||
| + | recommended for testing and development environments. | ||
| + | |||
| + | |||
| + | |||
| + | Apache License, Version 2.0. See [LICENSE](https:// | ||
| + | |||
| + | ### Install using the `apt` repository {# | ||
| + | |||
| + | Before you install Docker Engine for the first time on a new host machine, you | ||
| + | need to set up the Docker `apt` repository. Afterward, you can install and update | ||
| + | Docker from the repository. | ||
| + | |||
| + | 1. Set up Docker' | ||
| + | |||
| + | | ||
| + | # Add Docker' | ||
| + | sudo apt update | ||
| + | sudo apt install ca-certificates curl | ||
| + | sudo install -m 0755 -d / | ||
| + | sudo curl -fsSL https:// | ||
| + | sudo chmod a+r / | ||
| + | |||
| + | # Add the repository to Apt sources: | ||
| + | sudo tee / | ||
| + | | ||
| + | URIs: https:// | ||
| + | | ||
| + | | ||
| + | | ||
| + | EOF | ||
| + | |||
| + | sudo apt update | ||
| + | ``` | ||
| + | |||
| + | > [!NOTE] | ||
| + | > | ||
| + | > If you use a derivative distribution, | ||
| + | > you may need to substitute the part of this command that's expected to | ||
| + | > print the version codename: | ||
| + | > | ||
| + | > ```console | ||
| + | > $(. / | ||
| + | > ``` | ||
| + | > | ||
| + | > Replace this part with the codename of the corresponding Debian release, | ||
| + | > such as `bookworm`. | ||
| + | |||
| + | 2. Install the Docker packages. | ||
| + | |||
| + | Latest | ||
| + | |||
| + | |||
| + | |||
| + | To install the latest version, run: | ||
| + | |||
| + | | ||
| + | $ sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin | ||
| + | ``` | ||
| + | |||
| + | | ||
| + | |||
| + | |||
| + | |||
| + | To install a specific version of Docker Engine, start by listing the | ||
| + | | ||
| + | |||
| + | | ||
| + | $ apt list --all-versions docker-ce | ||
| + | |||
| + | | ||
| + | | ||
| + | ... | ||
| + | ``` | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | $ VERSION_STRING=5: | ||
| + | $ sudo apt install docker-ce=$VERSION_STRING docker-ce-cli=$VERSION_STRING containerd.io docker-buildx-plugin docker-compose-plugin | ||
| + | ``` | ||
| + | |||
| + | |||
| + | |||
| + | > [!NOTE] | ||
| + | > | ||
| + | > The Docker service starts automatically after installation. To verify that | ||
| + | > Docker is running, use: | ||
| + | > | ||
| + | > ```console | ||
| + | > $ sudo systemctl status docker | ||
| + | > ``` | ||
| + | > | ||
| + | > Some systems may have this behavior disabled and will require a manual start: | ||
| + | > | ||
| + | > ```console | ||
| + | > $ sudo systemctl start docker | ||
| + | > ``` | ||
| + | |||
| + | 3. Verify that the installation is successful by running the `hello-world` image: | ||
| + | |||
| + | | ||
| + | $ sudo docker run hello-world | ||
| + | ``` | ||
| + | |||
| + | This command downloads a test image and runs it in a container. When the | ||
| + | | ||
| + | |||
| + | You have now successfully installed and started Docker Engine. | ||
| + | |||
| + | |||
| + | |||
| + | > [!TIP] | ||
| + | > | ||
| + | > Receiving errors when trying to run without root? | ||
| + | > | ||
| + | > The `docker` user group exists but contains no users, which is why you’re required | ||
| + | > to use `sudo` to run Docker commands. Continue to [Linux postinstall](/ | ||
| + | > to allow non-privileged users to run Docker commands and for other optional configuration steps. | ||
| + | |||
| + | |||
| + | #### Upgrade Docker Engine | ||
| + | |||
| + | To upgrade Docker Engine, follow step 2 of the | ||
| + | [installation instructions](# | ||
| + | choosing the new version you want to install. | ||
| + | |||
| + | ### Install from a package | ||
| + | |||
| + | If you can't use Docker' | ||
| + | download the `deb` file for your release and install it manually. You need to | ||
| + | download a new file each time you want to upgrade Docker Engine. | ||
| + | |||
| + | <!-- markdownlint-disable-next-line --> | ||
| + | 1. Go to [`https:// | ||
| + | |||
| + | 2. Select your Debian version in the list. | ||
| + | |||
| + | 3. Go to `pool/ | ||
| + | | ||
| + | |||
| + | 4. Download the following `deb` files for the Docker Engine, CLI, containerd, | ||
| + | and Docker Compose packages: | ||
| + | |||
| + | - `containerd.io_< | ||
| + | - `docker-ce_< | ||
| + | - `docker-ce-cli_< | ||
| + | - `docker-buildx-plugin_< | ||
| + | - `docker-compose-plugin_< | ||
| + | |||
| + | 5. Install the `.deb` packages. Update the paths in the following example to | ||
| + | where you downloaded the Docker packages. | ||
| + | |||
| + | | ||
| + | $ sudo dpkg -i ./ | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | ``` | ||
| + | |||
| + | > [!NOTE] | ||
| + | > | ||
| + | > The Docker service starts automatically after installation. To verify that | ||
| + | > Docker is running, use: | ||
| + | > | ||
| + | > ```console | ||
| + | > $ sudo systemctl status docker | ||
| + | > ``` | ||
| + | > | ||
| + | > Some systems may have this behavior disabled and will require a manual start: | ||
| + | > | ||
| + | > ```console | ||
| + | > $ sudo systemctl start docker | ||
| + | > ``` | ||
| + | |||
| + | 6. Verify that the installation is successful by running the `hello-world` image: | ||
| + | |||
| + | | ||
| + | $ sudo docker run hello-world | ||
| + | ``` | ||
| + | |||
| + | This command downloads a test image and runs it in a container. When the | ||
| + | | ||
| + | |||
| + | You have now successfully installed and started Docker Engine. | ||
| + | |||
| + | |||
| + | |||
| + | > [!TIP] | ||
| + | > | ||
| + | > Receiving errors when trying to run without root? | ||
| + | > | ||
| + | > The `docker` user group exists but contains no users, which is why you’re required | ||
| + | > to use `sudo` to run Docker commands. Continue to [Linux postinstall](/ | ||
| + | > to allow non-privileged users to run Docker commands and for other optional configuration steps. | ||
| + | |||
| + | |||
| + | #### Upgrade Docker Engine | ||
| + | |||
| + | To upgrade Docker Engine, download the newer package files and repeat the | ||
| + | [installation procedure](https:// | ||
| + | |||
| + | |||
| + | |||
| + | ### Install using the convenience script | ||
| + | |||
| + | Docker provides a convenience script at | ||
| + | [https:// | ||
| + | development environments non-interactively. The convenience script isn't | ||
| + | recommended for production environments, | ||
| + | provisioning script tailored to your needs. Also refer to the | ||
| + | [install using the repository](# | ||
| + | about installation steps to install using the package repository. The source code | ||
| + | for the script is open source, and you can find it in the | ||
| + | [`docker-install` repository on GitHub](https:// | ||
| + | |||
| + | <!-- prettier-ignore --> | ||
| + | Always examine scripts downloaded from the internet before running them locally. | ||
| + | Before installing, make yourself familiar with potential risks and limitations | ||
| + | of the convenience script: | ||
| + | |||
| + | - The script requires `root` or `sudo` privileges to run. | ||
| + | - The script attempts to detect your Linux distribution and version and | ||
| + | configure your package management system for you. | ||
| + | - The script doesn' | ||
| + | - The script installs dependencies and recommendations without asking for | ||
| + | confirmation. This may install a large number of packages, depending on the | ||
| + | current configuration of your host machine. | ||
| + | - By default, the script installs the latest stable release of Docker, | ||
| + | containerd, and runc. When using this script to provision a machine, this may | ||
| + | result in unexpected major version upgrades of Docker. Always test upgrades in | ||
| + | a test environment before deploying to your production systems. | ||
| + | - The script isn't designed to upgrade an existing Docker installation. When | ||
| + | using the script to update an existing installation, | ||
| + | updated to the expected version, resulting in outdated versions. | ||
| + | |||
| + | > [!TIP] | ||
| + | > | ||
| + | > Preview script steps before running. You can run the script with the `--dry-run` option to learn what steps the | ||
| + | > script will run when invoked: | ||
| + | > | ||
| + | > ```console | ||
| + | > $ curl -fsSL https:// | ||
| + | > $ sudo sh ./ | ||
| + | > ``` | ||
| + | |||
| + | This example downloads the script from | ||
| + | [https:// | ||
| + | latest stable release of Docker on Linux: | ||
| + | |||
| + | ```console | ||
| + | $ curl -fsSL https:// | ||
| + | $ sudo sh get-docker.sh | ||
| + | Executing docker install script, commit: 7cae5f8b0decc17d6571f9f52eb840fbc13b2737 | ||
| + | <...> | ||
| + | ``` | ||
| + | |||
| + | You have now successfully installed and started Docker Engine. The `docker` | ||
| + | service starts automatically on Debian based distributions. On `RPM` based | ||
| + | distributions, | ||
| + | manually using the appropriate `systemctl` or `service` command. As the message | ||
| + | indicates, non-root users can't run Docker commands by default. | ||
| + | |||
| + | > **Use Docker as a non-privileged user, or install in rootless mode?** | ||
| + | > | ||
| + | > The installation script requires `root` or `sudo` privileges to install and | ||
| + | > use Docker. If you want to grant non-root users access to Docker, refer to the | ||
| + | > [post-installation steps for Linux](https:// | ||
| + | > You can also install Docker without `root` privileges, or configured to run in | ||
| + | > rootless mode. For instructions on running Docker in rootless mode, refer to | ||
| + | > [run the Docker daemon as a non-root user (rootless mode)](https:// | ||
| + | |||
| + | #### Install pre-releases | ||
| + | |||
| + | Docker also provides a convenience script at | ||
| + | [https:// | ||
| + | Docker on Linux. This script is equal to the script at `get.docker.com`, | ||
| + | configures your package manager to use the test channel of the Docker package | ||
| + | repository. The test channel includes both stable and pre-releases (beta | ||
| + | versions, release-candidates) of Docker. Use this script to get early access to | ||
| + | new releases, and to evaluate them in a testing environment before they' | ||
| + | released as stable. | ||
| + | |||
| + | To install the latest version of Docker on Linux from the test channel, run: | ||
| + | |||
| + | ```console | ||
| + | $ curl -fsSL https:// | ||
| + | $ sudo sh test-docker.sh | ||
| + | ``` | ||
| + | |||
| + | #### Upgrade Docker after using the convenience script | ||
| + | |||
| + | If you installed Docker using the convenience script, you should upgrade Docker | ||
| + | using your package manager directly. There' | ||
| + | convenience script. Re-running it can cause issues if it attempts to re-install | ||
| + | repositories which already exist on the host machine. | ||
| + | |||
| + | |||
| + | ## Uninstall Docker Engine | ||
| + | |||
| + | 1. Uninstall the Docker Engine, CLI, containerd, and Docker Compose packages: | ||
| + | |||
| + | | ||
| + | $ sudo apt purge docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin docker-ce-rootless-extras | ||
| + | ``` | ||
| + | |||
| + | 2. Images, containers, volumes, or custom configuration files on your host | ||
| + | | ||
| + | |||
| + | | ||
| + | $ sudo rm -rf / | ||
| + | $ sudo rm -rf / | ||
| + | ``` | ||
| + | |||
| + | 3. Remove source list and keyrings | ||
| + | |||
| + | | ||
| + | $ sudo rm / | ||
| + | $ sudo rm / | ||
| + | ``` | ||
| + | |||
| + | You have to delete any edited configuration files manually. | ||
| + | |||
| + | ## Next steps | ||
| + | |||
| + | - Continue to [Post-installation steps for Linux](https:// | ||
| + | |||
| + | |||
| + | |||
| + | </ | ||
/home/chanteri/www/fablab37110/data/attic/start/linux/debian/astuces.1770174384.txt.gz · Dernière modification : de admin
