Edit This Page

Commands and Capabilities

• Containers and commands
  • How docker handles command and arguments
• Capabilities

Containers and commands

So far the Pods we’ve seen have all used the image field to indicate what process Kubernetes should run in a container. In this case, Kubernetes runs the image’s default command. If we want to run a particular command or override the image’s defaults, there are two additional fields that we can use:

1. Command: Controls the actual command run by the image
2. Args: Controls the arguments passed to the command

How docker handles command and arguments

Docker images have metadata associated with them that is used to store information about the image. The image author may use this to define defaults for the command and arguments to run a container when the user does not supply values. Docker calls the fields for commands and arguments Entrypoint and Cmd respectively. The full details for this feature are too complicated to describe here, mostly due to the fact that the docker API allows users to specify both of these fields as either a string array or a string and there are subtle differences in how those cases are handled. We encourage the curious to check out Docker’s documentation for this feature.

Kubernetes allows you to override both the image’s default command (docker Entrypoint) and args (docker Cmd) with the Command and Args fields of Container. The rules are:

1. If you do not supply a Command or Args for a container, the defaults defined by the image will be used
2. If you supply a Command but no Args for a container, only the supplied Command will be used; the image’s default arguments are ignored
3. If you supply only Args, the image’s default command will be used with the arguments you supply
4. If you supply a Command and Args, the image’s defaults will be ignored and the values you supply will be used

Here are examples for these rules in table format

Capabilities

By default, Docker containers are “unprivileged” and cannot, for example, run a Docker daemon inside a Docker container. We can have fine grain control over the capabilities using cap-add and cap-drop.More details here.

The relationship between Docker’s capabilities and Linux capabilities