Docker Engine
Terraform Enterprise requires at least one of the following Docker Engine configurations, in order of preference:
- Docker Engine 20.10.x or 19.03.x with
runc
v1.0.0-rc93 or greater. - Docker Engine 20.10.x or 19.03.x with
libseccomp
2.4.4 or greater. - Docker Engine 20.10.x or 19.03.x with a modified
libseccomp
profile. - Docker Engine 1.13.1 from the Extra Packages for Enterprise Linux (EPEL) repository using a modified
libseccomp
profile.
On a first install of Terraform Enterprise (online install), Docker can be automatically installed with all necessary dependencies. Upgrades to Terraform Enterprise will not automatically upgrade Docker. Docker should be regularly updated to ensure stability and security.
Note: If you install Docker manually, Terraform Enterprise is not capable of verifying the Docker Engine configuration automatically.
Docker Engine With a Compatible runc
Version
Install a supported Docker Engine version.
Install the latest version of
containerd
for your operating system.On Debian/Ubuntu:
On RHEL/CentOS:
Confirm that the installed
containerd
version is 1.4.9, 1.5.5, or greater.Confirm that the installed
runc
version is v1.0.0-rc93 or greater:If your Docker Engine and
runc
versions meet the requirements from previous steps, your system is properly configured. Otherwise, proceed to option 2.
Docker Engine With a Compatible libseccomp
Version
Note: These instructions should only be used if your operating system does not meet the requirements detailed in Docker Engine With a Compatible runc
Version.
Install a supported Docker Engine version.
Install the latest version of
libseccomp
for your operating system.On Debian/Ubuntu:
On RHEL/CentOS:
Confirm that the installed
libseccomp
version is 2.4.4 or greater.If your Docker Engine and
libseccomp
versions meet the requirements from previous steps, your system is properly configured. Otherwise, proceed to option 3.
Docker Engine Using a Modified libseccomp
Profile
Note: These instructions should only be used if your operating system does not meet the requirements detailed in either Docker Engine With a Compatible runc
Version or Docker Engine With a Compatible libseccomp
Version.
Install a supported Docker Engine version.
Check if the file
/etc/docker/seccomp.json
exists. If it does, proceed to step 4.Download the default moby
libseccomp
profile and save it to the file/etc/docker/seccomp.json
.In the
/etc/docker/seccomp.json
file, change"defaultAction": "SCMP_ACT_ERRNO",
to"defaultAction": "SCMP_ACT_TRACE",
.Docker Engine 1.13.1 (RHEL only): After modifying the
/etc/docker/seccomp.json
file, proceed to step 8.Create a drop-in systemd unit file for the
docker
systemd service.Edit the drop-in
/etc/systemd/system/docker.service
systemd unit file and modify the line starting withExecStart=
to include the option--seccomp-profile=/etc/docker/seccomp.json
.For example, the following line:
Would become:
Reload the systemd daemon.
Restart Docker Engine.