# A Swagger 2.0 (a.k.a. OpenAPI) definition of the Engine API.

#

# This is used for generating API documentation and the types used by the

# client/server. See api/README.md for more information.

#

# Some style notes:

# - This file is used by ReDoc, which allows GitHub Flavored Markdown in

# descriptions.

# - There is no maximum line length, for ease of editing and pretty diffs.

# - operationIds are in the format "NounVerb", with a singular noun.

swagger: "2.0"

schemes:

- "http"

- "https"

produces:

- "application/json"

- "text/plain"

consumes:

- "application/json"

- "text/plain"

basePath: "/v1.43"

info:

title: "Docker Engine API"

version: "1.43"

x-logo:

url: "https://docs.docker.com/assets/images/logo-docker-main.png"

description: |

The Engine API is an HTTP API served by Docker Engine. It is the API the

Docker client uses to communicate with the Engine, so everything the Docker

client can do can be done with the API.

Most of the client's commands map directly to API endpoints (e.g. `docker ps`

is `GET /containers/json`). The notable exception is running containers,

which consists of several API calls.

# Errors

The API uses standard HTTP status codes to indicate the success or failure

of the API call. The body of the response will be JSON in the following

format:

```

{

"message": "page not found"

}

```

# Versioning

The API is usually changed in each release, so API calls are versioned to

ensure that clients don't break. To lock to a specific version of the API,

you prefix the URL with its version, for example, call `/v1.30/info` to use

the v1.30 version of the `/info` endpoint. If the API version specified in

the URL is not supported by the daemon, a HTTP `400 Bad Request` error message

is returned.

If you omit the version-prefix, the current version of the API (v1.43) is used.

For example, calling `/info` is the same as calling `/v1.43/info`. Using the

API without a version-prefix is deprecated and will be removed in a future release.

Engine releases in the near future should support this version of the API,

so your client will continue to work even if it is talking to a newer Engine.

The API uses an open schema model, which means server may add extra properties

to responses. Likewise, the server will ignore any extra query parameters and

request body properties. When you write clients, you need to ignore additional

properties in responses to ensure they do not break when talking to newer

daemons.

# Authentication

Authentication for registries is handled client side. The client has to send

authentication details to various endpoints that need to communicate with

registries, such as `POST /images/(name)/push`. These are sent as

`X-Registry-Auth` header as a [base64url encoded](https://tools.ietf.org/html/rfc4648#section-5)

(JSON) string with the following structure:

```

{

"username": "string",

"password": "string",

"email": "string",

"serveraddress": "string"

}

```

The `serveraddress` is a domain/IP without a protocol. Throughout this

structure, double quotes are required.

If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth),

you can just pass this instead of credentials:

```

{

"identitytoken": "9cbaf023786cd7..."

}

```

# The tags on paths define the menu sections in the ReDoc documentation, so

# the usage of tags must make sense for that:

# - They should be singular, not plural.

# - There should not be too many tags, or the menu becomes unwieldy. For

# example, it is preferable to add a path to the "System" tag instead of

# creating a tag with a single path in it.

# - The order of tags in this list defines the order in the menu.

tags:

# Primary objects

- name: "Container"

x-displayName: "Containers"

description: |

Create and manage containers.

- name: "Image"

x-displayName: "Images"

- name: "Network"

x-displayName: "Networks"

description: |

Networks are user-defined networks that containers can be attached to.

See the [networking documentation](https://docs.docker.com/network/)

for more information.

- name: "Volume"

x-displayName: "Volumes"

description: |

Create and manage persistent storage that can be attached to containers.

- name: "Exec"

x-displayName: "Exec"

description: |

Run new commands inside running containers. Refer to the

[command-line reference](https://docs.docker.com/engine/reference/commandline/exec/)

for more information.

To exec a command in a container, you first need to create an exec instance,

then start it. These two API endpoints are wrapped up in a single command-line

command, `docker exec`.

# Swarm things

- name: "Swarm"

x-displayName: "Swarm"

description: |

Engines can be clustered together in a swarm. Refer to the

[swarm mode documentation](https://docs.docker.com/engine/swarm/)

for more information.

- name: "Node"

x-displayName: "Nodes"

description: |

Nodes are instances of the Engine participating in a swarm. Swarm mode

must be enabled for these endpoints to work.

- name: "Service"

x-displayName: "Services"

description: |

Services are the definitions of tasks to run on a swarm. Swarm mode must

be enabled for these endpoints to work.

- name: "Task"

x-displayName: "Tasks"

description: |

A task is a container running on a swarm. It is the atomic scheduling unit

of swarm. Swarm mode must be enabled for these endpoints to work.

- name: "Secret"

x-displayName: "Secrets"

description: |

Secrets are sensitive data that can be used by services. Swarm mode must

be enabled for these endpoints to work.

- name: "Config"

x-displayName: "Configs"

description: |

Configs are application configurations that can be used by services. Swarm

mode must be enabled for these endpoints to work.

# System things

- name: "Plugin"

x-displayName: "Plugins"

- name: "System"

x-displayName: "System"

definitions:

Port:

type: "object"

description: "An open port on a container"

required: [PrivatePort, Type]

properties:

IP:

type: "string"

format: "ip-address"

description: "Host IP address that the container's port is mapped to"

PrivatePort:

type: "integer"

format: "uint16"

x-nullable: false

description: "Port on the container"

PublicPort:

type: "integer"

format: "uint16"

description: "Port exposed on the host"

Type:

type: "string"

x-nullable: false

enum: ["tcp", "udp", "sctp"]

example:

PrivatePort: 8080

PublicPort: 80

Type: "tcp"

MountPoint:

type: "object"

description: |

MountPoint represents a mount point configuration inside the container.

This is used for reporting the mountpoints in use by a container.

properties:

Type:

description: |

The mount type:

- `bind` a mount of a file or directory from the host into the container.

- `volume` a docker volume with the given `Name`.

- `tmpfs` a `tmpfs`.

- `npipe` a named pipe from the host into the container.

- `cluster` a Swarm cluster volume

type: "string"

enum:

- "bind"

- "volume"

- "tmpfs"

- "npipe"

- "cluster"

example: "volume"

Name:

description: |

Name is the name reference to the underlying data defined by `Source`

e.g., the volume name.

type: "string"

example: "myvolume"

Source:

description: |

Source location of the mount.

For volumes, this contains the storage location of the volume (within

`/var/lib/docker/volumes/`). For bind-mounts, and `npipe`, this contains

the source (host) part of the bind-mount. For `tmpfs` mount points, this

field is empty.

type: "string"

example: "/var/lib/docker/volumes/myvolume/_data"

Destination:

description: |

Destination is the path relative to the container root (`/`) where

the `Source` is mounted inside the container.

type: "string"

example: "/usr/share/nginx/html/"

Driver:

description: |

Driver is the volume driver used to create the volume (if it is a volume).

type: "string"

example: "local"

Mode:

description: |

Mode is a comma separated list of options supplied by the user when

creating the bind/volume mount.

The default is platform-specific (`"z"` on Linux, empty on Windows).

type: "string"

example: "z"

RW:

description: |

Whether the mount is mounted writable (read-write).

type: "boolean"

example: true

Propagation:

description: |

Propagation describes how mounts are propagated from the host into the

mount point, and vice-versa. Refer to the [Linux kernel documentation](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt)

for details. This field is not used on Windows.

type: "string"

example: ""

DeviceMapping:

type: "object"

description: "A device mapping between the host and container"

properties:

PathOnHost:

type: "string"

PathInContainer:

type: "string"

CgroupPermissions:

type: "string"

example:

PathOnHost: "/dev/deviceName"

PathInContainer: "/dev/deviceName"

CgroupPermissions: "mrw"

DeviceRequest:

type: "object"

description: "A request for devices to be sent to device drivers"

properties:

Driver:

type: "string"

example: "nvidia"

Count:

type: "integer"

example: -1

DeviceIDs:

type: "array"

items:

type: "string"

example:

- "0"

- "1"

- "GPU-fef8089b-4820-abfc-e83e-94318197576e"

Capabilities:

description: |

A list of capabilities; an OR list of AND lists of capabilities.

type: "array"

items:

type: "array"

items:

type: "string"

example:

# gpu AND nvidia AND compute

- ["gpu", "nvidia", "compute"]

Options:

description: |

Driver-specific options, specified as a key/value pairs. These options

are passed directly to the driver.

type: "object"

additionalProperties:

type: "string"

ThrottleDevice:

type: "object"

properties:

Path:

description: "Device path"

type: "string"

Rate:

description: "Rate"

type: "integer"

format: "int64"

minimum: 0

Mount:

type: "object"

properties:

Target:

description: "Container path."

type: "string"

Source:

description: "Mount source (e.g. a volume name, a host path)."

type: "string"

Type:

description: |

The mount type. Available types:

- `bind` Mounts a file or directory from the host into the container. Must exist prior to creating the container.

- `volume` Creates a volume with the given name and options (or uses a pre-existing volume with the same name and options). These are **not** removed when the container is removed.

- `tmpfs` Create a tmpfs with the given options. The mount source cannot be specified for tmpfs.

- `npipe` Mounts a named pipe from the host into the container. Must exist prior to creating the container.

- `cluster` a Swarm cluster volume

type: "string"

enum:

- "bind"

- "volume"

- "tmpfs"

- "npipe"

- "cluster"

ReadOnly:

description: "Whether the mount should be read-only."

type: "boolean"

Consistency:

description: "The consistency requirement for the mount: `default`, `consistent`, `cached`, or `delegated`."

type: "string"

BindOptions:

description: "Optional configuration for the `bind` type."

type: "object"

properties:

Propagation:

description: "A propagation mode with the value `[r]private`, `[r]shared`, or `[r]slave`."

type: "string"

enum:

- "private"

- "rprivate"

- "shared"

- "rshared"

- "slave"

- "rslave"

NonRecursive:

description: "Disable recursive bind mount."

type: "boolean"

default: false

CreateMountpoint:

description: "Create mount point on host if missing"

type: "boolean"

default: false

VolumeOptions:

description: "Optional configuration for the `volume` type."

type: "object"

properties:

NoCopy:

description: "Populate volume with data from the target."

type: "boolean"

default: false

Labels:

description: "User-defined key/value metadata."

type: "object"

additionalProperties:

type: "string"

DriverConfig:

description: "Map of driver specific options"

type: "object"

properties:

Name:

description: "Name of the driver to use to create the volume."

type: "string"

Options:

description: "key/value map of driver specific options."

type: "object"

additionalProperties:

type: "string"

TmpfsOptions:

description: "Optional configuration for the `tmpfs` type."

type: "object"

properties:

SizeBytes:

description: "The size for the tmpfs mount in bytes."

type: "integer"

format: "int64"

Mode:

description: "The permission mode for the tmpfs mount in an integer."

type: "integer"

RestartPolicy:

description: |

The behavior to apply when the container exits. The default is not to

restart.

An ever increasing delay (double the previous delay, starting at 100ms) is

added before each restart to prevent flooding the server.

type: "object"

properties:

Name:

type: "string"

description: |

- Empty string means not to restart

- `no` Do not automatically restart

- `always` Always restart

- `unless-stopped` Restart always except when the user has manually stopped the container

- `on-failure` Restart only when the container exit code is non-zero

enum:

- ""

- "no"

- "always"

- "unless-stopped"

- "on-failure"

MaximumRetryCount:

type: "integer"

description: |

If `on-failure` is used, the number of times to retry before giving up.

Resources:

description: "A container's resources (cgroups config, ulimits, etc)"

type: "object"

properties:

# Applicable to all platforms

CpuShares:

description: |

An integer value representing this container's relative CPU weight

versus other containers.

type: "integer"

Memory:

description: "Memory limit in bytes."

type: "integer"

format: "int64"

default: 0

# Applicable to UNIX platforms

CgroupParent:

description: |

Path to `cgroups` under which the container's `cgroup` is created. If

the path is not absolute, the path is considered to be relative to the

`cgroups` path of the init process. Cgroups are created if they do not

already exist.

type: "string"

BlkioWeight:

description: "Block IO weight (relative weight)."

type: "integer"

minimum: 0

maximum: 1000

BlkioWeightDevice:

description: |

Block IO weight (relative device weight) in the form:

```

[{"Path": "device_path", "Weight": weight}]

```

type: "array"

items:

type: "object"

properties:

Path:

type: "string"

Weight:

type: "integer"

minimum: 0

BlkioDeviceReadBps:

description: |

Limit read rate (bytes per second) from a device, in the form:

```

[{"Path": "device_path", "Rate": rate}]

```

type: "array"

items:

$ref: "#/definitions/ThrottleDevice"

BlkioDeviceWriteBps:

description: |

Limit write rate (bytes per second) to a device, in the form:

```

[{"Path": "device_path", "Rate": rate}]

```

type: "array"

items:

$ref: "#/definitions/ThrottleDevice"

BlkioDeviceReadIOps:

description: |

Limit read rate (IO per second) from a device, in the form:

```

[{"Path": "device_path", "Rate": rate}]

```

type: "array"

items:

$ref: "#/definitions/ThrottleDevice"

BlkioDeviceWriteIOps:

description: |

Limit write rate (IO per second) to a device, in the form:

```

[{"Path": "device_path", "Rate": rate}]

```

type: "array"

items:

$ref: "#/definitions/ThrottleDevice"

CpuPeriod:

description: "The length of a CPU period in microseconds."

type: "integer"

format: "int64"

CpuQuota:

description: |

Microseconds of CPU time that the container can get in a CPU period.

type: "integer"

format: "int64"

CpuRealtimePeriod:

description: |

The length of a CPU real-time period in microseconds. Set to 0 to

allocate no time allocated to real-time tasks.

type: "integer"

format: "int64"

CpuRealtimeRuntime:

description: |

The length of a CPU real-time runtime in microseconds. Set to 0 to

allocate no time allocated to real-time tasks.

type: "integer"

format: "int64"

CpusetCpus:

description: |

CPUs in which to allow execution (e.g., `0-3`, `0,1`).

type: "string"

example: "0-3"

CpusetMems:

description: |

Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only

effective on NUMA systems.

type: "string"

Devices:

description: "A list of devices to add to the container."

type: "array"

items:

$ref: "#/definitions/DeviceMapping"

DeviceCgroupRules:

description: "a list of cgroup rules to apply to the container"

type: "array"

items:

type: "string"

example: "c 13:* rwm"

DeviceRequests:

description: |

A list of requests for devices to be sent to device drivers.

type: "array"

items:

$ref: "#/definitions/DeviceRequest"

KernelMemoryTCP:

description: |

Hard limit for kernel TCP buffer memory (in bytes). Depending on the

OCI runtime in use, this option may be ignored. It is no longer supported

by the default (runc) runtime.

This field is omitted when empty.

type: "integer"

format: "int64"

MemoryReservation:

description: "Memory soft limit in bytes."

type: "integer"

format: "int64"

MemorySwap:

description: |

Total memory limit (memory + swap). Set as `-1` to enable unlimited

swap.

type: "integer"

format: "int64"

MemorySwappiness:

description: |

Tune a container's memory swappiness behavior. Accepts an integer

between 0 and 100.

type: "integer"

format: "int64"

minimum: 0

maximum: 100

NanoCpus:

description: "CPU quota in units of 10^-9 CPUs."

type: "integer"

format: "int64"

OomKillDisable:

description: "Disable OOM Killer for the container."

type: "boolean"

Init:

description: |

Run an init inside the container that forwards signals and reaps

processes. This field is omitted if empty, and the default (as

configured on the daemon) is used.

type: "boolean"

x-nullable: true

PidsLimit:

description: |

Tune a container's PIDs limit. Set `0` or `-1` for unlimited, or `null`

to not change.

type: "integer"

format: "int64"

x-nullable: true

Ulimits:

description: |

A list of resource limits to set in the container. For example:

```

{"Name": "nofile", "Soft": 1024, "Hard": 2048}

```

type: "array"

items:

type: "object"

properties:

Name:

description: "Name of ulimit"

type: "string"

Soft:

description: "Soft limit"

type: "integer"

Hard:

description: "Hard limit"

type: "integer"

# Applicable to Windows

CpuCount:

description: |

The number of usable CPUs (Windows only).

On Windows Server containers, the processor resource controls are

mutually exclusive. The order of precedence is `CPUCount` first, then

`CPUShares`, and `CPUPercent` last.

type: "integer"

format: "int64"

CpuPercent:

description: |

The usable percentage of the available CPUs (Windows only).

On Windows Server containers, the processor resource controls are

mutually exclusive. The order of precedence is `CPUCount` first, then

`CPUShares`, and `CPUPercent` last.

type: "integer"

format: "int64"

IOMaximumIOps:

description: "Maximum IOps for the container system drive (Windows only)"

type: "integer"

format: "int64"

IOMaximumBandwidth:

description: |

Maximum IO in bytes per second for the container system drive

(Windows only).

type: "integer"

format: "int64"

Limit:

description: |

An object describing a limit on resources which can be requested by a task.

type: "object"

properties:

NanoCPUs:

type: "integer"

format: "int64"

example: 4000000000

MemoryBytes:

type: "integer"

format: "int64"

example: 8272408576

Pids:

description: |

Limits the maximum number of PIDs in the container. Set `0` for unlimited.

type: "integer"

format: "int64"

default: 0

example: 100

ResourceObject:

description: |

An object describing the resources which can be advertised by a node and

requested by a task.

type: "object"

properties:

NanoCPUs:

type: "integer"

format: "int64"

example: 4000000000

MemoryBytes:

type: "integer"

format: "int64"

example: 8272408576

GenericResources:

$ref: "#/definitions/GenericResources"

GenericResources:

description: |

User-defined resources can be either Integer resources (e.g, `SSD=3`) or

String resources (e.g, `GPU=UUID1`).

type: "array"

items:

type: "object"

properties:

NamedResourceSpec:

type: "object"

properties:

Kind:

type: "string"

Value:

type: "string"

DiscreteResourceSpec:

type: "object"

properties:

Kind:

type: "string"

Value:

type: "integer"

format: "int64"

example:

- DiscreteResourceSpec:

Kind: "SSD"

Value: 3

- NamedResourceSpec:

Kind: "GPU"

Value: "UUID1"

- NamedResourceSpec:

Kind: "GPU"

Value: "UUID2"

HealthConfig:

description: "A test to perform to check that the container is healthy."

type: "object"

properties:

Test:

description: |

The test to perform. Possible values are:

- `[]` inherit healthcheck from image or parent image

- `["NONE"]` disable healthcheck

- `["CMD", args...]` exec arguments directly

- `["CMD-SHELL", command]` run command with system's default shell

type: "array"

items:

type: "string"

Interval:

description: |

The time to wait between checks in nanoseconds. It should be 0 or at

least 1000000 (1 ms). 0 means inherit.

type: "integer"

format: "int64"

Timeout:

description: |

The time to wait before considering the check to have hung. It should

be 0 or at least 1000000 (1 ms). 0 means inherit.

type: "integer"

format: "int64"

Retries:

description: |

The number of consecutive failures needed to consider a container as

unhealthy. 0 means inherit.

type: "integer"

StartPeriod:

description: |

Start period for the container to initialize before starting

health-retries countdown in nanoseconds. It should be 0 or at least

1000000 (1 ms). 0 means inherit.

type: "integer"

format: "int64"

Health:

description: |

Health stores information about the container's healthcheck results.

type: "object"

x-nullable: true

properties:

Status:

description: |

Status is one of `none`, `starting`, `healthy` or `unhealthy`

- "none" Indicates there is no healthcheck

- "starting" Starting indicates that the container is not yet ready

- "healthy" Healthy indicates that the container is running correctly

- "unhealthy" Unhealthy indicates that the container has a problem

type: "string"

enum:

- "none"

- "starting"

- "healthy"

- "unhealthy"

example: "healthy"

FailingStreak:

description: "FailingStreak is the number of consecutive failures"

type: "integer"

example: 0

Log:

type: "array"

description: |

Log contains the last few results (oldest first)

items:

$ref: "#/definitions/HealthcheckResult"

HealthcheckResult:

description: |

HealthcheckResult stores information about a single run of a healthcheck probe

type: "object"

x-nullable: true

properties:

Start:

description: |

Date and time at which this check started in

[RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format with nano-seconds.

type: "string"

format: "date-time"

example: "2020-01-04T10:44:24.496525531Z"

End:

description: |

Date and time at which this check ended in

[RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format with nano-seconds.

type: "string"

format: "dateTime"

example: "2020-01-04T10:45:21.364524523Z"

ExitCode:

description: |

ExitCode meanings:

- `0` healthy

- `1` unhealthy

- `2` reserved (considered unhealthy)

- other values: error running probe

type: "integer"

example: 0

Output:

description: "Output from last check"

type: "string"

HostConfig:

description: "Container configuration that depends on the host we are running on"

allOf:

- $ref: "#/definitions/Resources"

- type: "object"

properties:

# Applicable to all platforms

Binds:

type: "array"

description: |

A list of volume bindings for this container. Each volume binding

is a string in one of these forms:

- `host-src:container-dest[:options]` to bind-mount a host path

into the container. Both `host-src`, and `container-dest` must

be an _absolute_ path.

- `volume-name:container-dest[:options]` to bind-mount a volume

managed by a volume driver into the container. `container-dest`

must be an _absolute_ path.

`options` is an optional, comma-delimited list of:

- `nocopy` disables automatic copying of data from the container

path to the volume. The `nocopy` flag only applies to named volumes.

- `[ro|rw]` mounts a volume read-only or read-write, respectively.

If omitted or set to `rw`, volumes are mounted read-write.

- `[z|Z]` applies SELinux labels to allow or deny multiple containers

to read and write to the same volume.

- `z`: a _shared_ content label is applied to the content. This

label indicates that multiple containers can share the volume

content, for both reading and writing.

- `Z`: a _private unshared_ label is applied to the content.

This label indicates that only the current container can use

a private volume. Labeling systems such as SELinux require

proper labels to be placed on volume content that is mounted

into a container. Without a label, the security system can

prevent a container's processes from using the content. By

default, the labels set by the host operating system are not

modified.

- `[[r]shared|[r]slave|[r]private]` specifies mount

[propagation behavior](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt).

This only applies to bind-mounted volumes, not internal volumes

or named volumes. Mount propagation requires the source mount

point (the location where the source directory is mounted in the

host operating system) to have the correct propagation properties.

For shared volumes, the source mount point must be set to `shared`.

For slave volumes, the mount must be set to either `shared` or

`slave`.

items:

type: "string"

ContainerIDFile:

type: "string"

description: "Path to a file where the container ID is written"

LogConfig:

type: "object"

description: "The logging configuration for this container"

properties:

Type:

type: "string"

enum:

- "json-file"

- "syslog"

- "journald"

- "gelf"

- "fluentd"

- "awslogs"

- "splunk"

- "etwlogs"

- "none"

Config:

type: "object"

additionalProperties:

type: "string"

NetworkMode:

type: "string"

description: |

Network mode to use for this container. Supported standard values

are: `bridge`, `host`, `none`, and `container:<name|id>`. Any

other value is taken as a custom network's name to which this

container should connect to.

PortBindings:

$ref: "#/definitions/PortMap"

RestartPolicy:

$ref: "#/definitions/RestartPolicy"

AutoRemove:

type: "boolean"

description: |

Automatically remove the container when the container's process

exits. This has no effect if `RestartPolicy` is set.

VolumeDriver:

type: "string"

description: "Driver that this container uses to mount volumes."

VolumesFrom:

type: "array"

description: |

A list of volumes to inherit from another container, specified in

the form `<container name>[:<ro|rw>]`.

items:

type: "string"

Mounts:

description: |

Specification for mounts to be added to the container.

type: "array"

items:

$ref: "#/definitions/Mount"

ConsoleSize:

type: "array"

description: |

Initial console size, as an `[height, width]` array.

x-nullable: true

minItems: 2

maxItems: 2

items:

type: "integer"

minimum: 0

# Applicable to UNIX platforms

CapAdd:

type: "array"

description: |

A list of kernel capabilities to add to the container. Conflicts

with option 'Capabilities'.

items:

type: "string"

CapDrop:

type: "array"

description: |

A list of kernel capabilities to drop from the container. Conflicts

with option 'Capabilities'.

items:

type: "string"

CgroupnsMode:

type: "string"

enum:

- "private"

- "host"

description: |