Docker: using Monit to manage processes

I know that Docker has been built to run only one process per container (in fact it has no init process like a "normal" operating system), but I like to have an open port to connect to a container to inspect what's going on there.
There's another case for which I need more than one process: one of the web sites I manage is served by a node.js http server proxyed by Apache. To allow for more high availability I start two node processes serving the same site, so that my container needs to have at least two node.js processes running at the same time and listening to two different ports.

I found Monit handy to accomplish this task. The following example shows how to build an image that starts Monit which starts and monitors only the SSH daemon.

As I described in a previous article, I use a setup script to build a new image, so that the Dockerfile is as small as possible.

I'm not showing here the whole Dockerfile, but only the components needed to set up Monit and the SSH daemon. With the following lines the configuration files for Monit are copied into the container:

ADD ./monitrc /home/monitrc
ADD ./sshd.mon /home/sshd.mon

We'll look into these files later.

Then the setup.sh script is run in the container. This script installs Monit, moving its configuration from the /home directory to the final location, then installs SSHD configuring it.

# =====
# Monit
# =====

# install Monit
yum -y -q install http://pkgs.repoforge.org/monit/monit-5.5-1.el6.rf.x86_64.rpm

# move the Monit configuration from the /home directory where the Dockerfile has copied it to the final location
mv /home/monitrc /etc/monit.conf
chmod 600 /etc/monit.conf

# ====
# SSHD
# ====

# install OpenSSH
yum -y -q install openssh-server.x86_64

# this is the directory where the pid file will go
mkdir /var/run/sshd

# create the host keys: the "-A" option is available only starting from CentOS 7
/usr/bin/ssh-keygen -A

# change the root user password
echo 'root:password' | chpasswd

# enable ssh root user login
sed -i -e 's/#PermitRootLogin yes/PermitRootLogin yes/' /etc/ssh/sshd_config

# disable a module that is missing from Docker official CentOS image and prevents SSH to run
sed -i -e 's/\(session \+required \+pam_loginuid.so\)/#\1/' /etc/pam.d/sshd

# move Monit's SSH configuration to the final location
mv /home/sshd.mon /etc/monit.d/

The sshd.mon file describes the SSHD process to Monit telling it what to check and how to start/stop it.

check process sshd with pidfile /var/run/sshd.pid
      start program = "/usr/sbin/sshd"
      stop program = "/usr/bin/pkill sshd"

To add another service to Monit it's sufficient to create another file with ".mon" extension and to put it in the /etc/monit.d directory.

On the other hand the main Monit configuration should be put in /etc/monit.conf. The most important instruction is "set init": this tells Monit to act as the "init" process in a "normal" OS and prevents it from transforming itself into a daemon process.

# number of seconds between checks
set daemon 10

# run as a foreground process
set init

# start the administration interface on port 2812 with user "admin" and password "admin"
set httpd
    port 2812
    allow admin:admin

# include the configuration files for each process to manage 
include /etc/monit.d/*.mon

Running and testing

The command that starts the container is:

monit -l - -c /etc/monit.conf

where "-l -" tells Monit to write its log to the standard output so that "docker logs" can display it.

You run the container with the usual:

docker run -P --rm <IMAGE_NAME>

Then if you look at the running container whith "docker ps" you can see the external port associated with the usual SSH port (22). You should see something like this:

0.0.0.0:49195->22/tcp

To connect to the container you use:

ssh -p 49195 root@localhost

entering the password chosen in the setup script above.
You can also check the status of Monit and the processes it manages by pointing your browser to the host where the container is running and the port specified in monit.conf. The browser will ask you the user/password chosen in the same configuration file.