先来看下成果

Portainer搭建步骤

官方镜像：https://hub.docker.com/r/portainer/portainer

网上有很多相关的文章，这里不做累述，可参考

Docker(七)----搭建Portainer可视化界面

启动命令注意映射 volumn，这样重启可以保留数据：

docker run -d -p 9000:9000 --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v /opt/portainer/data:/data --name portainer portainer/portainer

如何设置管理Remote端的Docker容器

看重点：

The Docker API must be exposed over TCP. You can find more information about how to expose the Docker API over TCP

接下来的问题就是Docker如何暴露TCP端口？

搜索关键词 “Docker开启Remote API” Docker开启Remote API

vim /usr/lib/systemd/system/docker.service

[Unit]
Description=Docker Application Container Engine
Documentation=http://docs.docker.com
After=network.target
Wants=docker-storage-setup.service
Requires=docker-cleanup.timer

[Service]
Type=notify
NotifyAccess=main
EnvironmentFile=-/run/containers/registries.conf
EnvironmentFile=-/etc/sysconfig/docker
EnvironmentFile=-/etc/sysconfig/docker-storage
EnvironmentFile=-/etc/sysconfig/docker-network
Environment=GOTRACEBACK=crash
Environment=DOCKER_HTTP_HOST_COMPAT=1
Environment=PATH=/usr/libexec/docker:/usr/bin:/usr/sbin
ExecStart=/usr/bin/dockerd-current \
          -H tcp://0.0.0.0:2375 -H unix://var/run/docker.sock \
          --add-runtime docker-runc=/usr/libexec/docker/docker-runc-current \
          --default-runtime=docker-runc \
          --exec-opt native.cgroupdriver=systemd \
          --userland-proxy-path=/usr/libexec/docker/docker-proxy-current \
          --init-path=/usr/libexec/docker/docker-init-current \
          --seccomp-profile=/etc/docker/seccomp.json \
          $OPTIONS \
          $DOCKER_STORAGE_OPTIONS \
          $DOCKER_NETWORK_OPTIONS \
          $ADD_REGISTRY \
          $BLOCK_REGISTRY \
          $INSECURE_REGISTRY \
          $REGISTRIES
ExecReload=/bin/kill -s HUP $MAINPID
LimitNOFILE=1048576
LimitNPROC=1048576
LimitCORE=infinity
TimeoutStartSec=0
Restart=on-abnormal
KillMode=process

[Install]
WantedBy=multi-user.target

加入下面这行重启即可：

-H tcp://0.0.0.0:2375 -H unix://var/run/docker.sock \

sudo systemctl daemon-reload

sudo service docker restart

0.0.0.0 的问题

TODO List

直接暴露 docker remote api 的安全性如何保障？