Platform For AI:Sub-container management (DockerBoard)

Enable multi-container isolation

1. Log on to the PAI console, navigate to the DSW page, and click Create Instance.

2. In the instance configuration settings, find and enable the Enable Multi-Container Isolation (DinD) switch.

3. After you enable this option, the following settings appear:

   • Restrict roles that can access the main container: From the drop-down list, select the workspace roles to restrict. Users with a restricted role cannot directly open or operate the DSW main container and can only perform development work by logging in to a sub-container via SSH.

     For example, if you select Algorithm Development, users with this role cannot access the main container. However, they can still create and use their own sub-containers on the Sub-container Management tab of the instance details page.

     If you do not select any roles, all authorized users can access the main container as usual, which matches the existing behavior.

   • Maximum Number of Sub-containers: Set the maximum number of sub-containers that can be created for the instance. You can enter an integer from 1 to 16. The default value is 10.

   • Data Catalog Fencing Configuration: Specify the path of the data directory isolation configuration file within the main container. The default path is /etc/docker/dockerboard/mount_access.json. This file controls which data directories users can mount when they create sub-containers. You can click Configuration Template Download to download the template file. For configuration steps, see Configure data directory isolation.

4. Complete the remaining instance configurations and click Create Instance.

Configure data directory isolation

Data directory isolation controls which directories developers can mount when creating sub-containers, preventing access to storage data beyond their authorized scope.

Procedure

1. On the instance creation or editing page, click the Data Catalog Fencing Configuration link under Configuration Template Download to obtain the JSON template file.

2. Follow the template format to map each Alibaba Cloud sub-account UID to the directories within the DSW main container that the user is permitted to access.

3. Place the edited mount_access.json file in the location specified by the configuration path in the DSW main container. The default location is /etc/docker/dockerboard/mount_access.json.

Configuration file format

The configuration file is in JSON format and uses the Alibaba Cloud sub-account UID as the key. For each user, you can configure Allow (allowed mount directories) and Deny (denied mount directories). An example is as follows:

{
  "123124432xxx": {
    "Allow": [
      "/mnt/workspace",
      "/mnt/data1"
    ],
    "Deny": [
      "/mnt/data2"
    ]
  },
  "224321234xxx": {
    "Allow": [
      "*"
    ]
  }
}

The following table describes the fields.

Configuration application rules

• If the configuration file exists and is valid, the system checks whether the user has permission to mount the selected directories when creating a sub-container.

• If no record for the user is found in the configuration file, the user cannot mount any data directories when creating a sub-container. The page displays the message: "Your account does not have any available DSW paths. If you need to mount a path, contact the instance administrator to add a configuration for you."

• If the configuration file path is empty or the file does not exist, the system does not perform directory isolation checks, and all users can mount any directory from the main container.

Access the management page

1. Log on to the PAI console and go to the DSW page.

2. In the instance list, click the name of the target instance with DinD enabled to go to the instance details page.

3. On the instance details page, click the Sub-container Management tab.

Create a sub-container

On the Sub-container Management page, click Create Sub-container and complete the following parameters in the creation form.

Basic information

Environment information

Resource information

After you complete the configuration, click Confirm to create the sub-container. You can view the creation progress by clicking Child Container Creation Progress on the Sub-container Management page.

Manage sub-containers

In the sub-container list, the actions column provides the following operations:

You can manage only the sub-containers that you created.

• Start: Starts a sub-container that is in the stopped state.

• Stop: Stops a running sub-container. Processes inside the container are terminated, but the container configuration and mounted storage data are preserved.

• Restart: Restarts a running sub-container. This is equivalent to stopping and then starting it.

• Log: View the sub-container's running logs for troubleshooting.

• SSH Connection Information: View the SSH connection details for the sub-container, including the connection username and command.

• Delete: Deletes the sub-container. Data not persisted through a storage mount is permanently lost. Proceed with caution.

Sub-container list

After you go to the Sub-container Management page, a list of all sub-containers on the current instance is displayed, showing the following information:

All users with read permissions on the DSW instance can view the complete sub-container list, but can only manage (start, stop, or delete) the sub-containers they created.

Creation task list

Creating a sub-container can be time-consuming, especially when pulling large images. The system provides a way to track creation tasks.

In the upper-right corner of the Sub-container Management page, click Child Container Creation Progress to view the status and logs of all container creation tasks. You can manually stop tasks that are in the "Creating" state. Task records are automatically deleted after 3 days.

Connect via SSH

After a sub-container is created and running, you can connect to it remotely via SSH.

Procedure

1. In the sub-container list, find the target sub-container and click SSH Connection Information in the actions column. A dialog opens, showing the connection username and the full connection command.

2. Run the connection command in your local terminal to log in to the sub-container. The command format is as follows:

ssh <connection_username>@<instance_public_address> -p 22 -i <local_private_key_path>

The following table describes the parameters.

After a successful SSH login, you are connected directly to the sub-container's command-line environment. All sub-containers share port 22 of the DSW main container, but access is isolated through unique SSH keys and dedicated usernames.

Q: Why is the "Sub-container management" tab missing?

A: Please check the following:

1. The DSW instance was created with the Enable Multi-Container Isolation (DinD) feature enabled.

2. The DSW main container is currently in the Running state. The Sub-container Management tab is not displayed when the main container is not running.

Q: Why can't I mount a data directory?

A: This may be because the instance administrator has configured a data directory isolation policy and your Alibaba Cloud account has not been assigned any available directories in the configuration file. Contact the instance administrator to add a configuration for your account in the mount_access.json file.

Q: Why is my SSH connection failing?

A: Please check the following in order:

1. Ensure the sub-container is in the Running state.

2. Ensure the local private key you are using matches the public key you provided when creating the sub-container.

3. Ensure the SSH feature is enabled for the DSW instance.

4. Ensure your network allows access to the instance's public IP address on port 22.

Q: Why is sub-container creation slow?

A: The creation time primarily depends on image pull speed. Pulling a large image for the first time can take a while. You can check the progress and logs in the creation task list. Subsequent containers using the same image are created much faster because the image is cached locally.

Q: Can I manage another user's sub-containers?

A: By default, you can only manage sub-containers that you created, but you can view basic information for all sub-containers. To manage sub-containers created by others, an administrator must grant you the necessary permissions through a RAM policy.