Search code examples
dockeripcshared-memory

Sharing Memory across Docker containers: '--ipc=host' vs. '--ipc=shareable'

I'm setting up two docker containers - one as a server to hold data in memory, and the other as a client to access that data. In order to do so, I believe I need to use the --ipc flag to share memory between the containers. The Docker documentation explains the --ipc flag pretty well. What makes sense to me according to the documentation is running:

docker run -d --ipc=shareable data-server
docker run -d --ipc=container:data-server data-client

But all of the Stackoverflow questions I've read (1, 2, 3, 4) link both containers directly to the host:

docker run -d --ipc=host data-server
docker run -d --ipc=host data-client

Which is more appropriate for this use case? If ipc=host is better, when would you use ipc=shareable?

Solution

  • From doc:

    --ipc="MODE" : Set the IPC mode for the container

    "shareable": Own private IPC namespace, with a possibility to share it with other containers.

    "host": Use the host system’s IPC namespace.

    The difference between shareable and host is whether the host can access the shared memory.

    • An IPC (POSIX/SysV IPC) namespace provides separation of named shared memory segments, semaphores and message queues. Because of this, there should be no difference in performance between two modes.
    • Shared memory is commonly used by databases and custom-built (typically C/OpenMPI, C++/using boost libraries) high performance applications for scientific computing and financial services industries.

    Considering the security of the service, using host exposes the IPC namespace to attackers who have control of the host machine. With shareable, the IPC namespace is only accessible inside of the containers, which may contain any attacks. The host mode exists to allow cooperation between a container and its host.

    It's often difficult to know all the details of the environment and requirements of the asker, so host tends to be the most commonly recommended because it is easiest to understand and configure.