Docker application manager

• 2.0.x

This component can be installed on core devices that run the following operating systems:

• Linux

• Windows

• Docker Engine 1.9.1 or later installed on the Greengrass core device. Version 20.10 is the latest version that is verified to work with the AWS IoT Greengrass Core software. You must install Docker directly on the core device before you deploy components that run Docker containers.

• The Docker daemon started and running on the core device before you deploy this component.

• Docker images stored in one of the following supported image sources:

  • Public and private image repositories in Amazon Elastic Container Registry (Amazon ECR)

  • Public Docker Hub repository

  • Public Docker Trusted Registry

• Docker images included as artifacts in your custom Docker container components. Use the following URI formats to specify your Docker images:

  • Private Amazon ECR image: docker:account-id.dkr.ecr.region.amazonaws.com/repository/image[:tag|@digest]

  • Public Amazon ECR image: docker:public.ecr.aws/repository/image[:tag|@digest]

  • Public Docker Hub image: docker:name[:tag|@digest]

  For more information, see Run a Docker container.

  Note

  If you don't specify the image tag or image digest in the artifact URI for an image, then the Docker application manager pulls the latest available version of that image when you deploy your custom Docker container component. To ensure that all of your core devices run the same version of an image, we recommend that you include the image tag or image digest in the artifact URI.

• The system user that runs a Docker container component must have root or administrator permissions, or you must configure Docker to run it as a non-root or non-admistrator user.

  • On Linux devices, you can add a user to the docker group to call docker commands without sudo.

  • On Windows devices, you can add a user to the docker-users group to call docker commands without adminstrator privileges.

  Linux or Unix

  To add ggc_user, or the non-root user that you use to run Docker container components, to the docker group, run the following command.

  sudo usermod -aG docker ggc_user

  For more information, see Manage Docker as a non-root user.

  Windows Command Prompt (CMD)

  To add ggc_user, or the user that you use to run Docker container components, to the docker-users group, run the following command as an administrator.

  net localgroup docker-users ggc_user /add

  Windows PowerShell

  To add ggc_user, or the user that you use to run Docker container components, to the docker-users group, run the following command as an administrator.

  Add-LocalGroupMember -Group docker-users -Member ggc_user

• If you configure the AWS IoT Greengrass Core software to use a network proxy, you must configure Docker to use the same proxy server.

• If your Docker images are stored in an Amazon ECR private registry, then you must include the token exchange service component as a dependency in the Docker container component. Also, the Greengrass device role must allow the ecr:GetAuthorizationToken, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer actions, as shown in the following example IAM policy.

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "ecr:GetAuthorizationToken",
          "ecr:BatchGetImage",
          "ecr:GetDownloadUrlForLayer"
        ],
        "Resource": [
          "*"
        ],
        "Effect": "Allow"
      }
    ]
  }

• The docker application manager component is supported to run in a VPC. To deploy this component in a VPC, the following is required.

  • The docker application manager component must have connectivity to download images. For example, if you use ECR, you must have connectivity to the following endpoints.

    • *.dkr.ecr.region.amazonaws.com (VPC endpoint com.amazonaws.region.ecr.dkr)

    • api.ecr.region.amazonaws.com (VPC endpoint com.amazonaws.region.ecr.api)

• Run a Docker container