Docker

The Docker endpoint. Empty uses the environment, which the bundled Compose file relies on.

string · Default DOCKER_HOST, or the local socket

Thousandths of a core Pando may allocate.

int · Default The whole machine

Bytes Pando may allocate.

int · Default The whole machine

Bytes of disk Pando may allocate.

int · Default No limit

How many processes and threads each app container may run at once, so one app cannot exhaust the host's process table. A negative number removes the limit.

int · Default 1024

The IPv4 range each app's private network takes its addresses from. A /16 holds about 4,000 apps; a wider range such as 10.208.0.0/12 holds more. "off" uses Docker's own pool, which holds about 30 networks.

string · Default 10.213.0.0/16

The size of each app's private network, as a prefix length from 24 to 29. 28 holds 13 containers; an app with more workloads than fit gets a larger network.

int · Default 28

The image an app's egress gateway runs from when its egress rules restrict anything: any image with Pando's binary at /usr/local/bin/pando. Without one, and with Pando not running in a container, apps whose egress is restricted cannot be deployed.

string · Default The image Pando's own container runs

The runtime Docker starts apps with, by the name it is registered under in daemon.json. "runsc" (gVisor) or a Kata runtime makes this a sandboxed runtime, which host policy can require; the port and file-write checks when an app is added then cannot see inside the sandbox, so Pando asks for the port instead.

string · Default Docker's default, runc