Docker Run

Docker Run

Certified

Run a Docker container with runtime controls

Starts a container using the Docker task runner or host daemon, with optional waits, resource limits, port/volume bindings, and registry credentials. Waits for exit by default; volume mounts are disabled unless enabled in kestra.tasks.scripts.docker.volume-enabled.

yaml
type: io.kestra.plugin.docker.Run

Run the alpine container with no command

yaml
id: docker_run
namespace: company.team

tasks:
  - id: run
    type: io.kestra.plugin.docker.Run
    containerImage: alpine:latest

Run the docker/opentelemetry with commands and config file

yaml
id: docker_run
namespace: company.team

tasks:
  - id: write
    type: io.kestra.plugin.core.storage.Write
    content: |
         extensions:
           health_check: {}

         receivers:
           otlp:
             protocols:
               grpc:
                 endpoint: 0.0.0.0:4317
               http:
                 endpoint: 0.0.0.0:4318

         exporters:
           debug: {}

         service:
           pipelines:
             logs:
               receivers: [otlp]
               exporters: [debug]
    extension: .yaml

  - id: run
    type: io.kestra.plugin.docker.Run
    containerImage: otel/opentelemetry-collector:latest
    inputFiles:
      otel.yaml: "{{ outputs.write.uri }}"
    commands:
      - --config
      - otel.yaml
    portBindings:
      - "4318:4318"
    wait: false

Run Docker with Ubuntu image, run shell commands to create a file, log the output in Kestra

yaml
id: docker_run_with_output_file
namespace: company.team

inputs:
  - id: greetings
    type: STRING
    defaults: HELLO WORLD !!

tasks:
  - id: docker_run_output_file
    type: io.kestra.plugin.docker.Run
    containerImage: ubuntu:22.04
    commands:
      - "/bin/sh"
      - "-c"
      - echo {{ inputs.greetings }} > file.txt
    outputFiles:
      - file.txt

  - id: log
    type: io.kestra.plugin.core.log.Log
    message: "{{ read(outputs.docker_run_output_file.outputFiles['file.txt']) }}"
Properties

Container image

Image reference; if credentials include a registry, it is prepended when missing.

SubTypestring
Default[]

Commands to run

Command/args executed inside the container; empty uses the image CMD.

Docker configuration file

Docker configuration file that can set access credentials to private container registries. Usually located in ~/.docker/config.json.

CPU limits

Set CPU quota/shares; otherwise the container can use all host CPU.

Definitions
cpusnumberstring

The maximum amount of CPU resources a container can use.

Make sure to set that to a numeric value e.g. cpus: "1.5" or cpus: "4" or For instance, if the host machine has two CPUs and you set cpus: "1.5", the container is guaranteed at most one and a half of the CPUs.

Credentials for a private container registry

Definitions
authstring

The registry authentication.

The auth field is a base64-encoded authentication string of username: password or a token.

identityTokenstring

The identity token.

passwordstring

The registry password.

registrystring

The registry URL.

If not defined, the registry will be extracted from the image name.

registryTokenstring

The registry token.

usernamestring

The registry username.

Device requests

List of device requests forwarded to device drivers (e.g., GPUs).

Definitions
capabilitiesarray
SubTypearray

A list of capabilities; an OR list of AND lists of capabilities.

countintegerstring
deviceIdsarray
SubTypestring
driverstring
optionsobject
SubTypestring

Driver-specific options, specified as key/value pairs.

These options are passed directly to the driver.

SubTypestring

Entrypoint

Override the image entrypoint; empty keeps the image default.

Environment variables

Key/value map rendered before launching the container.

SubTypestring

Extra host entries

List of host: ip mappings added to /etc/hosts.

The URI of your Docker host e.g. localhost

The files to create on the working. It can be a map or a JSON object.

Each file can be defined:

  • Inline with its content
  • As a URI, supported schemes are kestra for internal storage files, file for host local files, and nsfile for namespace files.

Memory limits

Hard/soft memory limits; default is unlimited memory.

Definitions
kernelMemorystring

The maximum amount of kernel memory the container can use.

The minimum allowed value is 4MB. Because kernel memory cannot be swapped out, a container which is starved of kernel memory may block host machine resources, which can have side effects on the host machine and on other containers. See the kernel-memory docs for more details.

memorystring

The maximum amount of memory resources the container can use.

Make sure to use the format number + unit (regardless of the case) without any spaces. The unit can be KB (kilobytes), MB (megabytes), GB (gigabytes), etc.

Given that it's case-insensitive, the following values are equivalent:

  • "512MB"
  • "512Mb"
  • "512mb"
  • "512000KB"
  • "0.5GB"

It is recommended that you allocate at least 6MB.

memoryReservationstring

Allows you to specify a soft limit smaller than memory which is activated when Docker detects contention or low memory on the host machine.

If you use memoryReservation, it must be set lower than memory for it to take precedence. Because it is a soft limit, it does not guarantee that the container doesn’t exceed the limit.

memorySwapstring

The total amount of memory and swap that can be used by a container.

If memory and memorySwap are set to the same value, this prevents containers from using any swap. This is because memorySwap includes both the physical memory and swap space, while memory is only the amount of physical memory that can be used.

memorySwappinessstring

A setting which controls the likelihood of the kernel to swap memory pages.

By default, the host kernel can swap out a percentage of anonymous pages used by a container. You can set memorySwappiness to a value between 0 and 100 to tune this percentage.

oomKillDisablebooleanstring

By default, if an out-of-memory (OOM) error occurs, the kernel kills processes in a container.

To change this behavior, use the oomKillDisable option. Only disable the OOM killer on containers where you have also set the memory option. If the memory flag is not set, the host can run out of memory, and the kernel may need to kill the host system’s processes to free the memory.

Inject namespace files.

Inject namespace files to this task. When enabled, it will, by default, load all namespace files into the working directory. However, you can use the include or exclude properties to limit which namespace files will be injected.

Definitions
enabledbooleanstring
Defaulttrue

Whether to enable namespace files to be loaded into the working directory. If explicitly set to true in a task, it will load all Namespace Files into the task's working directory. Note that this property is by default set to true so that you can specify only the include and exclude properties to filter the files to load without having to explicitly set enabled to true.

excludearray
SubTypestring

A list of filters to exclude matching glob patterns. This allows you to exclude a subset of the Namespace Files from being downloaded at runtime. You can combine this property together with include to only inject a subset of files that you need into the task's working directory.

folderPerNamespacebooleanstring
Defaultfalse

Whether to mount file into the root of the working directory, or create a folder per namespace

ifExistsstring
DefaultOVERWRITE
Possible Values
OVERWRITEFAILWARNIGNORE

Comportment of the task if a file already exist in the working directory.

includearray
SubTypestring

A list of filters to include only matching glob patterns. This allows you to only load a subset of the Namespace Files into the working directory.

namespacesarray
SubTypestring
Default["{{flow.namespace}}"]

A list of namespaces in which searching files. The files are loaded in the namespace order, and only the latest version of a file is kept. Meaning if a file is present in the first and second namespace, only the file present on the second namespace will be loaded.

Network mode

Docker network mode such as host, bridge, or none.

SubTypestring

The files from the local filesystem to send to Kestra's internal storage.

Must be a list of glob expressions relative to the current working directory, some examples: my-dir/**, my-dir/*/** or my-dir/my-file.txt.

Reference (ref) of the pluginDefaults to apply to this task.

SubTypestring

List of port bindings

Corresponds to the --publish (-p) option of the docker run CLI command using the format ip: dockerHostPort: containerPort/protocol. Possible examples:

  • 8080: 80/udp
  • 127.0.0.1: 8080: 80
  • 127.0.0.1: 8080: 80/udp

Privileged container

If true, runs the container with --privileged; use cautiously.

DefaultIF_NOT_PRESENT
Possible Values
IF_NOT_PRESENTALWAYSNEVER

Image pull policy

Defaults to IF_NOT_PRESENT; set to ALWAYS to refresh the image even when cached.

Shared memory size

Bytes for /dev/shm; defaults to 64MB when not set.

Container user

Optional user/UID to run the process as.

SubTypestring

List of volumes to mount

Must be a valid mount expression as a string, for example: /home/user:/app.

Volume mounts are disabled by default for security reasons; you must enable them on server configuration by setting kestra.tasks.scripts.docker.volume-enabled to true.

Defaulttrue

Wait for container exit

Defaults to true; set false to start and return immediately.

Default0

The exit code of the entire flow execution.

SubTypestring

The output files' URIs in Kestra's internal storage.

Definitions

The values extracted from executed commands using the Kestra outputs format.

More Plugins in this Category

Core Plugins and tasks
Core Plugins and tasks

Tasks that provide Kestra's built-in orchestration, I/O, and observability capabilities.

Core

122 tasks

398 blueprints

NetBox (EE)
NetBox
Enterprise

Enterprise NetBox tasks to create, update, and query devices, IP addresses, and sites over the NetBox API.

Infrastructure

7 tasks

4 blueprints