v7.1rc3 adds container support

I tried with very small container (arm32v7/busybox:stable-musl , tar size is about 1,4MB) on CRS305 and CRS309, but container never start (and nothing is write in logs despite logging=yes) :

[admin@CRS309-BU] /container> /container/print 
 0 file=arm32v7_busybox.tar name="3850934b-17c1-4403-8f04-65ead4703936" tag="arm32v7/busybox:stable-musl" os="linux" arch="arm" interface=veth1 mounts="" dns="" hostname="mybbox" logging=yes 
   status=stopped 
[admin@CRS309-BU] /container>
[admin@CRS309-BU] /container> /container/start number=0 ; /log/print follow-only

09:26:10 system,info,account user prometheus logged in from 192.168.0.182 via api 
09:26:11 system,info,account user prometheus logged out from 192.168.0.182 via api 
09:26:15 system,info,account user prometheus logged in from 192.168.0.182 via api 
09:26:16 system,info,account user prometheus logged out from 192.168.0.182 via api 
09:26:20 system,info,account user prometheus logged in from 192.168.0.182 via api 
09:26:21 system,info,account user prometheus logged out from 192.168.0.182 via api 
09:26:25 system,info,account user prometheus logged in from 192.168.0.182 via api 
09:26:25 system,info,account user prometheus logged out from 192.168.0.182 via api

I guess as CRS3xx have very tiny SPI Flash, Mikrotik didn’t test container on theses hardware. I tried with other docker images, but i always have the same result.

Could You please generate a supout.rif file and send it to support@mikrotik.com so we can look into this further?

I send it with also the tar image, thank you.

I’ve managed to get containers on MIPSBE working with 7.1rc4, however when the container is running, cpu usage is pinned at 100% despite all the processes inside the container sitting pretty much idle

Unfortunately nothing happens. I emailed support with supout.rif.

Boy my lightly used RB1100 “dude” works pretty well with the new container support.

But some way to access to “console” would be very handy. It’s not always easy to add SSH support to just any docker image, in particular some of the language runtimes like NodeJS, Julia or R - where you don’t need SSH once you’ve packaged an image with the code you want. Certainly using a stock Linux/OS to “test” on the platform can work…but then your still left unwinding what the more basic version for docker be of that work.

While the Dockerfile on the host can add the need code/entry point before generating the tar – sometimes it’s easier to try stuff out in the “running” docker image, then edit the Dockerfile to recreate your “diffs”. Now ideally, the containers console would be like any ROS port redirected like any other ROS serial thing, but some “/container/console”, similar to /system/serial-console command be very useful. I’d imagine it’s be especially useful on the “more escotic” platform since there isn’t some go-to stash of TILE base images, yet… and logging=yes will only get you so far at troubleshooting a greenfield like “docker-on-tile” – one way to make use of the unused cores on the TILE RBs.

One other thought, is the basic feature of MetaROUTER was running another ROS instance. I’m surprise that wasn’t an example – be awfully handy to run ROS v6 on a ROS v7, since you’d have the dude (which seems forgot in v7 feature-blitz) and could more easily allow testing any differences between v7 and v6…

Thanks for this awesome feature!

I’m running a domoticz container on a rb5009, works great.
It would be nice if you could add devices support, so I can connect USB or serial devices (like kwh meters).

The docker command line is:

docker run -d
-p 8080:8080
-p 8443:443
-v :/opt/domoticz/userdata
-e TZ=Europe/Amsterdam
–device=<device_id>
–name=
domoticz/domoticz

I mean the --device= part.
Maybe you can create a devices list, using the same approach as for the mounts and envs.

Noop
How to ssh to pihole :thinking:
To use command like
Pihole -u for update

“docker exec -it” / “docker container exec” ??? Or is there no docker program?
For GUI comfort I use the “portainer” container, but without “docker exec” that would probably not work on RouterOS.
(https://docs.portainer.io/v/ce-2.6/user/docker/containers/console#:~:text=Accesing%20to%20container%20console,and%20pick%20%2Fbin%2Fash.)

cfr : https://www.mankier.com/1/docker-exec

Hi,
How do I connect a container to 2 network interfaces?
I thought I’d have a go at avahi as a reflector.

Thanks

Kinda depends on how the LANs (or VLANs…) your trying do mDNS reflection on ingress the router/switch. The simplest case would be using two bridges (bridgeA and bridgeB) and two virtual ethernets, vethA and vethB, for Avanti container. Assuming your “LAN A” (e.g. “computers/WiFi”) is using ether1 and “LAN B” (e.g. “printers”) is using ether2. You’d then add ether1 & vethA as bridge ports on bridgeA, same for ether2+vethB going as ports on bridgeB (on /interface/bridge/ports).

VLAN Filtering likely be better long term, be one bridge, but that adds complexity here. You’d add both vethA and vethB as interface to the /container. Like more, basically one bridge/veth per [V]LAN you want Avanti to use.

Where I think the trouble lies isn’t bridging the L2 traffic – lots of way to do that in ROS. But finding a pre-compiled Dockerfile that exposes some UI to manage Avanti or has SSH enabled out-of-the box, AND is pre-compiled for the Mikrotik CPU your want to use, which need some “real” disk (USB, SSD, etc). Lots of Docker images for X86/AMD64, but only some number for ARM32 etc… You got a TILE, well, good luck but be interesting.

The current implementation doesn’t allow “console access” so once you get the image running on the Mikrotik, you have to essentially start/stop the container and use /container/set 0 cmd=“…” each time to modify the image. Normally you can just “compile” a Dockerfile, but unless you’re on the same CPU arch, that get tricky – most people don’t use an ARM32 as there desktop computer – docker supports “buildx” and scheme to deal with this BUT way more complex than L2 bridging on a Mikrotik part.

But, a poor-man function to proxy for a shell to the container looks like this, assuming you a container, it’s working, and logging=yes. Add something like this (as example of concept):


:global DockerDo do={/container/stop $1; :delay 10s; /container/set $1 cmd="$2"; /container/start $1; /log/print follow where topics~"container" and time>([/system/clock/get time]-10s)}

To use this, you can issue a ONE command $DockerDo [container number, “0”] [cmd to run in container] against the docker image, which will start/stop in-between your commands. Since the output it shown via /log/print follow, you’ll need to use Ctrl-C to then issue another command:

> $DockerDo 0 "uname -a"
                                            
12:55:51 container,info,debug Linux julia162 5.6.3 #15 SMP Mon Sep 20 07:31:39 UTC 2021 armv7l GNU/Linux 

> $DockerDo 0 "uname -a"

12:57:58 container,info,debug Linux julia162 5.6.3 #15 SMP Mon Sep 20 07:31:39 UTC 2021 armv7l GNU/Linux 

-- Ctrl-C to quit. Space prints separator. New entries will appear at bottom.

Although I’ve never been sold on the need for “reflecting” mDNS – kinda the point of subnetting is to limit broadcasting. If you just have some “well known printers” you want showing up on iPhone, using domain name in DHCP and some specfic DNS PTR/SRV records will do the same as mDNS broadcasts if that’s what your after, see RFC6763 - https://www.ietf.org/rfc/rfc6763.txt\

Now why Mikrotik has not added mDNS/avanti, just to stop the requests, is a different question. Guessing they are betting Docker is simpler answer, well see.

Thanks,
I have tried the manual DNS thing in the past, but Mikrotik DNS doesn’t support PTR records at present (maybe that will change), I did try on another DNS server, but never had much success.

Unfortunately I think I didn’t explain myself very well
There seems to be no (obvious) way to add more than 1 interface to a container in the /container add command.

Perhaps VLan filtering might be what I need to use, with the 2 interfaces coming in on 1 veth, a native, and a vlan

I haven’t tried this, but was thinking I could drop a netcat into the container’s bin directory, and set cmd to “nc -L 5000 -e /bin/sh”
(nil security, but you can firewall access to it)

Hello! Yet again I resurrected my RB4011. I updated it to 7.1 RC4. Then I used

/Container

to install a Docker image for iperf3, the beloved speedtest app. I picked this image from sk278 since it supports ARMv7 (32 bit ARM).

I leave here my steps for other newbies plus some doubts at the end.

First I created the virtual network interface and bridge for using with

/Container

. I sticked with the default network

172.17.0.0/24

from MT’s Container help. No environment variables or mountpoints were needed for this image.

Then I went to my computer and launched a console terminal app:

docker manifest inspect sk278/iperf3


2. Get the right hash for your architecture, in my case, MikroTik RB4011 is **ARMv7**:

```text
sha256:823a7cd38cfeea8fce736639cac8146c069246759463f262be832cff340e3bfa

(latest image version is this one)
3. Download the image:

docker pull sk278/iperf3:latest@sha256:823a7cd38cfeea8fce736639cac8146c069246759463f262be832cff340e3bfa
  1. Have the image compressed:
docker save sk278/iperf3 > iperf3.tar
  1. Upload it to the router filesystem using your preferred method (just drop it in “Files” section using Webfig).

Time to go to the router command prompt (via SSH, online terminal, serial cable…)

  1. Create the container in using the image file you just uploaded:
/container/add file=iperf3.tar interface=veth1 logging=yes

. (you can also add a

hostname

if you want)
2. ```text
/container/start [find file=iperf3.tar]


3. Check if

```text
status=running

with

/container/print detail

(it takes some time in bigger containers).

OK, now some questions arise in my head:

  • In my case, the container got itself the IP 172.16.0.2. Can anyone explain why? I mean, there is no environment variable for the IP as in PiHole`s image, nor any kind of negotiation that I’m aware of. Does this depend on the number of the container (0 gets first available IP, 1 gets second…)?
  • I tried to create a DHCP server for the containers, but I couldn’t since veth1 is a slave of a bridge. I tried creating the server for the bridge, but this made no effect since the Docker images are bound to
veth1

, not the bridge (see

/container/print

).

  • iperf3 speed looks to be limited to 100 Mbps, although all my network is 1 Gbps… I have no idea why is that, all physical interfaces look correct.
  • MikroTik support team, will you bring interactive terminal console to containers? Pretty please? We really need that.

Anyway, congratulations MikroTik for this breakthrough. These are exciting times for us, users. My Raspberry is going to have some rest.

I tried the official Debian image: https://hub.docker.com/_/debian?tab=description&page=1&ordering=last_updated

docker pull debian:stable@sha256:ae04ba555bd7342b5d49305425dcd9f233ea51321d16f1c04b26173a32918349

But once installed, it doesn’t start. Architecture is correct. I also tried to stop the other image, but no effect, Debian remains stopped forever:

/container/print



 0 file=iperf3.tar name="0d8ad45e-b1c0-4380-b720-906baf7db7fc" tag="" os="linux" arch="arm" 
   interface=veth1 mounts="" dns="" hostname="iperf3" logging=yes status=stopped 

 1 file=debian.tar name="7274b731-37e4-45b0-8c5c-4f336218333e" tag="" os="linux" arch="arm" 
   interface=veth1 mounts="" dns="" logging=yes status=stopped

I’ve tried numerous containers and I can’t get 1 to start also on ARM.

what container(s) did you try? im looking for some working mipsbe images as examples.

or how would one manage to create docker images for mipsbe?
there is no docker.io package for mips/mipsbe in debian.
for debian/bullseye there is a docker.io package for mips64el and mipsel but not mips/mipsbe because debian dropped mips/mipsbe support since bullseye.
on other linux distros i also could not find possibilities to run docker on mipsbe to be able to create images (or tar files from images)

how else is it possible to create docker images without running docker on mipsbe arch?
(i crosscompiled an application already but am not able to create docker images for mipsbe)

thanks for any hints!

EDIT: i crosscompiled mipsbe binary which works fine on other mipsbe devices running debian. then i created a container (with docker on openwrt/mipsel), saved it to a tar file and uploaded it to a rb960pgs running ros v7.1rc4:

[admin@MikroTik] > /container/add file=mipsolsrd.tar interface=veth1 hostname=olsrd logging=yes
[admin@MikroTik] > /container/print
0 file=mipsolsrd.tar name=“51b47d9f-9f81-4a26-9f57-1d59d715cbd3” tag=“vchrizz/mipsolsrd:latest” os=“linux” arch=“mipsle” interface=veth1
mounts=“” dns=“” hostname=“olsrd” logging=yes status=stopped
[admin@MikroTik] > /container/start number=0

[admin@MikroTik] > /container/print
0 file=mipsolsrd.tar name=“51b47d9f-9f81-4a26-9f57-1d59d715cbd3” tag=“vchrizz/mipsolsrd:latest” os=“linux” arch=“mipsle” interface=veth1
mounts=“” dns=“” hostname=“olsrd” logging=yes status=stopped

seems to look ok but it does not start, nothing is shown in logs on why it did not start (i already added topic “container” to system/logging)

how to debug the container what is wrong to fix that?

Have you managed to get any errors / logs? No reply yet from support dev team, But the main problem is lack of logs / errors. How are you supposed to debug this if no log appears. NB: container topic is added in logging and logging=yes is set. But no log appears.

No logs of any kind. It just stays stopped.

I find interesting the possibility of running a RouterOS container (stable ROS version) inside your own router (development ROS version). This way you could use “The Dude server” (stable versions only) as well as the newer funcionalities (WG, Docker, Zerotier…).

I can’t test it since my RB4011 is armv7 (32 bit only), but it would be nice to hear from any of you. Maybe MT support team finds it interesting to maintain their own ROS image (@normis?). Thank you.

PS: This implementation would require a second ROS software key.

Well, this is essentially how it all started on old MikroTik models that offered “MetaROUTER” where you could run either RouterOS or another image.
This fell out of attention as later architectures do not offer it, and the current Docker support is more or less a successor of that.