ability to run custom scripts before/after a container action has occurred

[jufis]

It would be good to have a configuration section to run custom scripts on the host running the docker daemon before and/or after a container action (stop/start/pause/restart) has occurred.

For example: I want to run a script before I try to stop a container. Portainer in that case will call my custom.sh script with an argument which is the container id. The custom script can figure out everything about this container using its container id and run custom functions on the host vm running the container. An example of a custom action could be to drain connections before stopping a container. Or sending an e-mail to the administrator etc etc.

[ncresswell]

Jufis, This is best handled within your container. See here for details on the different signals https://www.ctl.io/developers/blog/post/gracefully-stopping-docker-containers/. Not sure we would be adding this capability into Portainer in the near term.

[timelordx]

I actually have another use for the same request. I would like to set iptables inside a macvlan docker container as soon as such container starts or restarts. So, having an option to define in Portainer something like pre-start or post-start script that would be executed on the docker host system would be very useful.

For example, as soon as the macvlan container XYZ is started/restarted, I'd like to be able to run automatically on the docker host system something like the following (just an example):

nsenter -t $(docker inspect --format '{{ .State.Pid }}' XYZ) -n iptables -A INPUT -p tcp --dport 25 ! -s 192.168.10.150/32 -j REJECT

which would create iptables rule inside the container and block inbound SMTP from all but 192.168.10.150 (just an example). This way I don't have to give the container NET_ADMIN caps to set iptables from within the container.

I can easily run this manually as soon as I know the docker container has been started/restarted. But a built-in post-start/restart-script support in Portainer would be so much help. Right now, as an ugly workaround, I have to script it as a cron job on the docker host system, and run it pretty much every minute (with a set of controls and checks, of course). In the worst case scenario, there's a one minute delay between the container's start/restart and my cron job running. In some cases, that's too long to wait.

UPDATE: I've been thinking, after posting this request, that this would need to be done by the docker daemon. Because I'm not sure how Portainer would be able to run a script on a remote docker host. Or, maybe via Portainer agent? Anyways, just a thought.

[Caaruzo]

Hello, ill try the same. Using a script based on https://github.com/deitch/ctables/blob/master/ctables

Are iam able to run this on portainer, after the container got started?