Dokcer基础

查看Linux版本

uname -r

查看Linux详尽信息

cat /etc/*elease
CentOS Linux release 7.6.1810 (Core) 
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

CentOS Linux release 7.6.1810 (Core) 
CentOS Linux release 7.6.1810 (Core) 
View Code

容器的五大隔离

  • pid:进程隔离
  • net:网络隔离 (独有的ip地址,网关,子网掩码)
  • ipc:进程间交互隔离
  • mnt:文件系统隔离
  • uts:主机和域名隔离 (hostname,domainname)container 有自己的机器名

centos上安装docker

官方地址:https://docs.docker.com/install/linux/docker-ce/centos/

  1. 卸载旧版本
    sudo yum remove docker \
                      docker-client \
                      docker-client-latest \
                      docker-common \
                      docker-latest \
                      docker-latest-logrotate \
                      docker-logrotate \
                      docker-engine
  2. 安装包环境
    sudo yum install -y yum-utils \
      device-mapper-persistent-data \
      lvm2
  3. 设置仓储地址
    # 阿里云
    sudo yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
    # 官方
    sudo yum-config-manager \
        --add-repo \
        https://download.docker.com/linux/centos/docker-ce.repo
  4. 安装Docker-CE
    sudo yum install docker-ce docker-ce-cli # containerd.io
  5. 启动Docker,运行开机自启
    systemctl start docker
    systemctl enable docker

Docker安装位置

  • 查找Docker可执行程序地址 /usr/bin/docker 
    find / -name docker
    /run/docker
    /sys/fs/cgroup/pids/docker
    /sys/fs/cgroup/cpuset/docker
    /sys/fs/cgroup/freezer/docker
    /sys/fs/cgroup/devices/docker
    /sys/fs/cgroup/blkio/docker
    /sys/fs/cgroup/perf_event/docker
    /sys/fs/cgroup/memory/docker
    /sys/fs/cgroup/net_cls,net_prio/docker
    /sys/fs/cgroup/hugetlb/docker
    /sys/fs/cgroup/cpu,cpuacct/docker
    /sys/fs/cgroup/systemd/docker
    /etc/docker
    /var/lib/docker
    /var/lib/docker/overlay2/ec5a827479e221461a396c7d0695226ec60b642544f2f921e2da967426b1853c/diff/docker
    /var/lib/docker/overlay2/cf92e8387d988e9f87dc3656bb21d3a2fefff02e3505e1d282c0d105cb703ab1/merged/docker
    /var/lib/docker/overlay2/df3551b1764d57ad79604ace4c1b75ab1e47cdca2fb6d526940af8b400eee4aa/diff/etc/dpkg/dpkg.cfg.d/docker
    /usr/bin/docker
    /usr/share/bash-completion/completions/docker
    /docker
    View Code
  • 查找Docker服务端程序 /usr/bin/dockerd 

    find / -name dockerd
    /etc/alternatives/dockerd
    /var/lib/alternatives/dockerd
    /usr/bin/dockerd
    View Code
  • lib + data: /var/lib/docker

  • config: /etc/docker

  • 查找docker.service服务程序 /usr/lib/systemd/system/docker.service 
    find / -name docker.service
    [root@localhost ~]# cat /usr/lib/systemd/system/docker.service
    [Unit]
    Description=Docker Application Container Engine
    Documentation=https://docs.docker.com
    BindsTo=containerd.service
    After=network-online.target firewalld.service containerd.service
    Wants=network-online.target
    Requires=docker.socket
    
    [Service]
    Type=notify
    # the default is not to use systemd for cgroups because the delegate issues still
    # exists and systemd currently does not support the cgroup feature set required
    # for containers run by docker
    ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
    ExecReload=/bin/kill -s HUP $MAINPID
    TimeoutSec=0
    RestartSec=2
    Restart=always
    
    # Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
    # Both the old, and new location are accepted by systemd 229 and up, so using the old location
    # to make them work for either version of systemd.
    StartLimitBurst=3
    
    # Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
    # Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
    # this option work for either version of systemd.
    StartLimitInterval=60s
    
    # Having non-zero Limit*s causes performance problems due to accounting overhead
    # in the kernel. We recommend using cgroups to do container-local accounting.
    LimitNOFILE=infinity
    LimitNPROC=infinity
    LimitCORE=infinity
    
    # Comment TasksMax if your systemd version does not supports it.
    # Only systemd 226 and above support this option.
    TasksMax=infinity
    
    # set delegate yes so that systemd does not reset the cgroups of docker containers
    Delegate=yes
    
    # kill only the docker process, not all processes in the cgroup
    KillMode=process
    
    [Install]
    WantedBy=multi-user.target

解读dockerd配置文件

dockerd:https://docs.docker.com/engine/reference/commandline/dockerd/

硬盘挂载

  1. 使用 fdisk -l 命令查看主机上的硬盘
    fdisk -l
    [root@localhost ~]# fdisk -l
    
    Disk /dev/vda: 53.7 GB, 53687091200 bytes, 104857600 sectors
    Units = sectors of 1 * 512 = 512 bytes
    Sector size (logical/physical): 512 bytes / 512 bytes
    I/O size (minimum/optimal): 512 bytes / 512 bytes
    Disk label type: dos
    Disk identifier: 0x000b0ebb
    
       Device Boot      Start         End      Blocks   Id  System
    /dev/vda1   *        2048   104856254    52427103+  83  Linux
    
    Disk /dev/vdb: 536.9 GB, 536870912000 bytes, 1048576000 sectors
    Units = sectors of 1 * 512 = 512 bytes
    Sector size (logical/physical): 512 bytes / 512 bytes
    I/O size (minimum/optimal): 512 bytes / 512 bytes
    View Code
  2. 使用mkfs.ext4命令把硬盘格式化
    # mkfs.ext4    磁盘名称
    
    mkfs.ext4   /dev/vdb
  3. 使用mount命令挂载磁盘
    mount /dev/vdb /boot
  4. 输入指令: df -h 查看当前磁盘的情况
    df -h
    [root@localhost ~]# df -h
    Filesystem      Size  Used Avail Use% Mounted on
    /dev/vda1        50G  7.4G   40G  16% /
    devtmpfs        7.8G     0  7.8G   0% /dev
    tmpfs           7.8G     0  7.8G   0% /dev/shm
    tmpfs           7.8G  592K  7.8G   1% /run
    tmpfs           7.8G     0  7.8G   0% /sys/fs/cgroup
    overlay          50G  7.4G   40G  16% /var/lib/docker/overlay2/c76fb87ef4c263e24c7f6874121fb161ce9b22db572db66ff1992ca6daf5768b/merged
    shm              64M     0   64M   0% /var/lib/docker/containers/afe151311ee560e63904e3e9d3c1053b8bbb6fd5e3b2d4c74001091b132fe3bd/mounts/shm
    overlay          50G  7.4G   40G  16% /var/lib/docker/overlay2/5ca6ed8e1671cb590705f53f89af8f8f5b85a6cdfc8137b3e12e4fec6c76fcea/merged
    shm              64M  4.0K   64M   1% /var/lib/docker/containers/79427c180de09f78e33974278043736fca80b724db8b9bce42e44656d04823b3/mounts/shm
    tmpfs           1.6G     0  1.6G   0% /run/user/0
    /dev/vdb        493G   73M  467G   1% /boot
    View Code
  5. 用 blkid  获取磁盘的uuid和属性
    [root@localhost ~]# blkid
    /dev/vda1: UUID="105fa8ff-bacd-491f-a6d0-f99865afc3d6" TYPE="ext4" 
    /dev/vdb: UUID="97a17b64-d025-478c-8981-105214e99ff4" TYPE="ext4" 

     

  6. 设置开机自动mount

    vim /etc/fstab
    
    UUID=97a17b64-d025-478c-8981-105214e99ff4  /data  ext4  defaults  1  1

修改docker存储位置

  1. 创建或修改docker配置文件
    # 创建或修改docker配置文件
    vim /etc/docker/daemon.json
    
    {
     "data-root": "/data/docker"
    }
  2. 创建docker数据存储文件夹
    # 创建docker数据存储文件夹
    mkdir /data
    mkdir /data/docker
  3. 停止Docker

    # 停止Docker
    service docker stop
  4. 拷贝存储文件
    # 拷贝存储文件
    cp -r /var/lib/docker/* /data/docker/
  5. 删除源文件
    # 删除源文件(不建议先删除,后面没问题了再删除)
    # rm -rf /var/lib/docker/
  6. 验证docker数据存储位置是否改变

    # 验证docker数据存储位置是否改变
    docker info
    注意:最好在docker刚安装完就执行切换数据目录,不然等容器运行起来后里面的一些volume会还是使用的原来的

镜像加速器

sudo mkdir -p /etc/docker
vim /etc/docker/daemon.json

{
  "registry-mirrors": ["https://uwxsp1y1.mirror.aliyuncs.com"],
  "data-root": "/data/docker"
}

sudo systemctl daemon-reload
sudo systemctl restart docker

查看系统日志

# 修改配置信息
vim /etc/docker/daemon.json

{
  "registry-mirrors": ["https://uwxsp1y1.mirror.aliyuncs.com"],
  "data-root": "/data/docker",
  "debug":true
}


# journalctl 统一查看service所有的日志。
journalctl -u docker.service -f 

远程连接docker deamon

  1. 修改docker.service启动信息
    # 修改docker.service启动信息
    vim /usr/lib/systemd/system/docker.service
    # ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
    ExecStart=/usr/bin/dockerd --containerd=/run/containerd/containerd.sock
  2. 修改daemon.json

    #修改daemon.json
    vim /etc/docker/daemon.json
    
    {
      "registry-mirrors": ["https://uwxsp1y1.mirror.aliyuncs.com"],
      "data-root": "/data/docker",
      "debug":true,
      "hosts": ["192.168.103.240:6381","unix:///var/run/docker.sock"]
    }
  3. 重载、重启

    # 重载、重启
    sudo systemctl daemon-reload
    service docker restart
  4. 查看端口

    # 查看端口
    netstat -tlnp
    
    [root@localhost docker]# netstat -tlnp
    Active Internet connections (only servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
    tcp        0      0 192.168.103.240:6381    0.0.0.0:*               LISTEN      27825/dockerd       
    tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd           
    tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      3743/dnsmasq        
    tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      3122/sshd           
    tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      3109/cupsd          
    tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      3479/master         
    tcp        0      0 127.0.0.1:6010          0.0.0.0:*               LISTEN      14503/sshd: root@pt 
    tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd           
    tcp6       0      0 :::22                   :::*                    LISTEN      3122/sshd           
    tcp6       0      0 ::1:631                 :::*                    LISTEN      3109/cupsd          
    tcp6       0      0 ::1:25                  :::*                    LISTEN      3479/master         
    tcp6       0      0 ::1:6010                :::*                    LISTEN      14503/sshd: root@pt 
  5. 远程连接测试

    # 远程连接测试
    docker -H 192.168.103.240:6381 ps

容器基础

docker container 中常用操控命令

docker run --help
[root@localhost ~]# docker run --help

Usage:    docker run [OPTIONS] IMAGE [COMMAND] [ARG...]

Run a command in a new container

Options:
      --add-host list                  Add a custom host-to-IP mapping (host:ip)
  -a, --attach list                    Attach to STDIN, STDOUT or STDERR
      --blkio-weight uint16            Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)
      --blkio-weight-device list       Block IO weight (relative device weight) (default [])
      --cap-add list                   Add Linux capabilities
      --cap-drop list                  Drop Linux capabilities
      --cgroup-parent string           Optional parent cgroup for the container
      --cidfile string                 Write the container ID to the file
      --cpu-period int                 Limit CPU CFS (Completely Fair Scheduler) period
      --cpu-quota int                  Limit CPU CFS (Completely Fair Scheduler) quota
      --cpu-rt-period int              Limit CPU real-time period in microseconds
      --cpu-rt-runtime int             Limit CPU real-time runtime in microseconds
  -c, --cpu-shares int                 CPU shares (relative weight)
      --cpus decimal                   Number of CPUs
      --cpuset-cpus string             CPUs in which to allow execution (0-3, 0,1)
      --cpuset-mems string             MEMs in which to allow execution (0-3, 0,1)
  -d, --detach                         Run container in background and print container ID
      --detach-keys string             Override the key sequence for detaching a container
      --device list                    Add a host device to the container
      --device-cgroup-rule list        Add a rule to the cgroup allowed devices list
      --device-read-bps list           Limit read rate (bytes per second) from a device (default [])
      --device-read-iops list          Limit read rate (IO per second) from a device (default [])
      --device-write-bps list          Limit write rate (bytes per second) to a device (default [])
      --device-write-iops list         Limit write rate (IO per second) to a device (default [])
      --disable-content-trust          Skip image verification (default true)
      --dns list                       Set custom DNS servers
      --dns-option list                Set DNS options
      --dns-search list                Set custom DNS search domains
      --entrypoint string              Overwrite the default ENTRYPOINT of the image
  -e, --env list                       Set environment variables
      --env-file list                  Read in a file of environment variables
      --expose list                    Expose a port or a range of ports
      --group-add list                 Add additional groups to join
      --health-cmd string              Command to run to check health
      --health-interval duration       Time between running the check (ms|s|m|h) (default 0s)
      --health-retries int             Consecutive failures needed to report unhealthy
      --health-start-period duration   Start period for the container to initialize before starting health-retries countdown (ms|s|m|h) (default 0s)
      --health-timeout duration        Maximum time to allow one check to run (ms|s|m|h) (default 0s)
      --help                           Print usage
  -h, --hostname string                Container host name
      --init                           Run an init inside the container that forwards signals and reaps processes
  -i, --interactive                    Keep STDIN open even if not attached
      --ip string                      IPv4 address (e.g., 172.30.100.104)
      --ip6 string                     IPv6 address (e.g., 2001:db8::33)
      --ipc string                     IPC mode to use
      --isolation string               Container isolation technology
      --kernel-memory bytes            Kernel memory limit
  -l, --label list                     Set meta data on a container
      --label-file list                Read in a line delimited file of labels
      --link list                      Add link to another container
      --link-local-ip list             Container IPv4/IPv6 link-local addresses
      --log-driver string              Logging driver for the container
      --log-opt list                   Log driver options
      --mac-address string             Container MAC address (e.g., 92:d0:c6:0a:29:33)
  -m, --memory bytes                   Memory limit
      --memory-reservation bytes       Memory soft limit
      --memory-swap bytes              Swap limit equal to memory plus swap: '-1' to enable unlimited swap
      --memory-swappiness int          Tune container memory swappiness (0 to 100) (default -1)
      --mount mount                    Attach a filesystem mount to the container
      --name string                    Assign a name to the container
      --network string                 Connect a container to a network (default "default")
      --network-alias list             Add network-scoped alias for the container
      --no-healthcheck                 Disable any container-specified HEALTHCHECK
      --oom-kill-disable               Disable OOM Killer
      --oom-score-adj int              Tune host's OOM preferences (-1000 to 1000)
      --pid string                     PID namespace to use
      --pids-limit int                 Tune container pids limit (set -1 for unlimited)
      --privileged                     Give extended privileges to this container
  -p, --publish list                   Publish a container's port(s) to the host
  -P, --publish-all                    Publish all exposed ports to random ports
      --read-only                      Mount the container's root filesystem as read only
      --restart string                 Restart policy to apply when a container exits (default "no")
      --rm                             Automatically remove the container when it exits
      --runtime string                 Runtime to use for this container
      --security-opt list              Security Options
      --shm-size bytes                 Size of /dev/shm
      --sig-proxy                      Proxy received signals to the process (default true)
      --stop-signal string             Signal to stop a container (default "SIGTERM")
      --stop-timeout int               Timeout (in seconds) to stop a container
      --storage-opt list               Storage driver options for the container
      --sysctl map                     Sysctl options (default map[])
      --tmpfs list                     Mount a tmpfs directory
  -t, --tty                            Allocate a pseudo-TTY
      --ulimit ulimit                  Ulimit options (default [])
  -u, --user string                    Username or UID (format: <name|uid>[:<group|gid>])
      --userns string                  User namespace to use
      --uts string                     UTS namespace to use
  -v, --volume list                    Bind mount a volume
      --volume-driver string           Optional volume driver for the container
      --volumes-from list              Mount volumes from the specified container(s)
  -w, --workdir string                 Working directory inside the container
View Code
docker run,docker exec

run可以让容器从镜像中实例化出来,实例化过程中可以塞入很多参数

Usage: docker run [OPTIONS] IMAGE [COMMAND] [ARG...]

docker run -d --name some-redis redis 外界无法访问,因为是网络隔离,默认bridge模式。

  • -a stdin: 指定标准输入输出内容类型,可选 STDIN/STDOUT/STDERR 三项;

  • -d: 后台运行容器,并返回容器ID;

  • -i: 以交互模式运行容器,通常与 -t 同时使用;

  • -P: 随机端口映射,容器内部端口随机映射到主机的高端口

  • -p: 指定端口映射,格式为:主机(宿主)端口:容器端口

  • -t: 为容器重新分配一个伪输入终端,通常与 -i 同时使用;

  • --name="nginx-lb": 为容器指定一个名称;

  • --dns 8.8.8.8: 指定容器使用的DNS服务器,默认和宿主一致;

  • --dns-search example.com: 指定容器DNS搜索域名,默认和宿主一致;

  • -h "mars": 指定容器的hostname;

  • -e username="ritchie": 设置环境变量;

    # 设置东八区
    docker run -e TZ=Asia/Shanghai -d --name some-redis redis
  • --env-file=[]: 从指定文件读入环境变量;

  • --cpuset="0-2" or --cpuset="0,1,2": 绑定容器到指定CPU运行;

  • -m :设置容器使用内存最大值;

  • --net="bridge": 指定容器的网络连接类型,支持 bridge/host/none/container:<name|id> 四种类型;

  • --link=[]: 添加链接到另一个容器;

  • --expose=[]: 开放一个端口或一组端口;

  • --volume , -v: 绑定一个卷

    docker run -p 16379:6379 -d --name some-redis redis
  • --add-host: 添加自定义ip
    # 场景:consul做健康检查的时候,需要宿主机的ip地址
    docker run --add-host machineip:192.168.103.240 -d --name some-redis redis
    
    docker exec -it some-redis bash
    tail /etc/hosts
docker start,docker stop, docker kill
  • docker start :启动一个或多个已经被停止的容器

  • docker stop :停止一个运行中的容器

  • docker restart :重启容器

  • docker kill :杀掉一个运行中的容器。
batch delete 容器
docker rm -f 
docker rm -f `docker ps -a -q`
docker containers prune
# 极其强大的删除清理方式,慎重使用
# docker system prune

docker container 状态监控命令

查看容器日志
docker logs
[root@localhost ~]# docker logs some-redis
1:C 09 Jul 2019 03:07:03.406 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
1:C 09 Jul 2019 03:07:03.406 # Redis version=5.0.5, bits=64, commit=00000000, modified=0, pid=1, just started
1:C 09 Jul 2019 03:07:03.406 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf
1:M 09 Jul 2019 03:07:03.406 * Running mode=standalone, port=6379.
1:M 09 Jul 2019 03:07:03.406 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128.
1:M 09 Jul 2019 03:07:03.406 # Server initialized
1:M 09 Jul 2019 03:07:03.406 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
1:M 09 Jul 2019 03:07:03.406 # WARNING you have Transparent Huge Pages (THP) support enabled in your kernel. This will create latency and memory usage issues with Redis. To fix this issue run the command 'echo never > /sys/kernel/mm/transparent_hugepage/enabled' as root, and add it to your /etc/rc.local in order to retain the setting after a reboot. Redis must be restarted after THP is disabled.
1:M 09 Jul 2019 03:07:03.406 * Ready to accept connections
View Code
容器性能指标
docker stats
[root@localhost ~]# docker stats

CONTAINER ID        NAME                CPU %               MEM USAGE / LIMIT     MEM %               NET I/O             BLOCK I/O           PIDS
aaa8bec01038        some-redis          0.04%               8.375MiB / 1.795GiB   0.46%               656B / 0B           139kB / 0B          4
View Code
容器 -> 宿主机端口

查询port映射关系

知道容器的端口,不知道宿主机的端口。。。
不知道容器的端口,知道宿主机的端口。。。

docker port [container]
[root@localhost ~]# docker port some-redis-2
6379/tcp -> 0.0.0.0:16379
View Code
查看容器内运行的进程
docker top [container]
[root@localhost ~]# docker top some-redis-2
UID                 PID                 PPID                C                   STIME               TTY                 TIME                CMD
polkitd             18356               18338               0                   13:20               pts/0               00:00:00            redis-server *:6379
View Code
容器的详细信息
docker inspect [OPTIONS] NAME|ID [NAME|ID...]
[root@localhost ~]# docker inspect some-redis-2
[
    {
        "Id": "6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2",
        "Created": "2019-07-09T05:20:06.985445479Z",
        "Path": "docker-entrypoint.sh",
        "Args": [
            "redis-server"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 18356,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2019-07-09T05:20:07.255368955Z",
            "FinishedAt": "0001-01-01T00:00:00Z"
        },
        "Image": "sha256:bb0ab8a99fe694e832e56e15567c83dee4dcfdd321d0ad8ab9bd64d82d6a6bfb",
        "ResolvConfPath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/resolv.conf",
        "HostnamePath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/hostname",
        "HostsPath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/hosts",
        "LogPath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2-json.log",
        "Name": "/some-redis-2",
        "RestartCount": 0,
        "Driver": "overlay2",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": null,
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "default",
            "PortBindings": {
                "6379/tcp": [
                    {
                        "HostIp": "",
                        "HostPort": "16379"
                    }
                ]
            },
            "RestartPolicy": {
                "Name": "no",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": null,
            "CapDrop": null,
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "shareable",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": [],
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DeviceCgroupRules": null,
            "DiskQuota": 0,
            "KernelMemory": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": null,
            "OomKillDisable": false,
            "PidsLimit": 0,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "MaskedPaths": [
                "/proc/asound",
                "/proc/acpi",
                "/proc/kcore",
                "/proc/keys",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug",
                "/proc/scsi",
                "/sys/firmware"
            ],
            "ReadonlyPaths": [
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ]
        },
        "GraphDriver": {
            "Data": {
                "LowerDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7-init/diff:/data/docker/overlay2/d26d3067261173cfa34d57bbdc3371b164805203ff05a2d71ce868ddc5b5a2bc/diff:/data/docker/overlay2/6a35d92d8841364ee7443a84e18b42c22f60294a748f552ad4a0852507236c7f/diff:/data/docker/overlay2/5ed2ceb6771535d14cd64f375cc31462a82ff57503bbc3abace0589be3124955/diff:/data/docker/overlay2/9543ee1ade1f2d4341c00cadef3ec384eb3761c35d10726cc6ade4a3bfb99be2/diff:/data/docker/overlay2/86f47cf021b01ddec50356ae4c5387b910f65f75f97298de089336b4a413ce25/diff:/data/docker/overlay2/df3551b1764d57ad79604ace4c1b75ab1e47cdca2fb6d526940af8b400eee4aa/diff",
                "MergedDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7/merged",
                "UpperDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7/diff",
                "WorkDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7/work"
            },
            "Name": "overlay2"
        },
        "Mounts": [
            {
                "Type": "volume",
                "Name": "88f774ae0567f3e3f834a9f469c0db377be8948b82d05ee757e6eabe185903e6",
                "Source": "/data/docker/volumes/88f774ae0567f3e3f834a9f469c0db377be8948b82d05ee757e6eabe185903e6/_data",
                "Destination": "/data",
                "Driver": "local",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            }
        ],
        "Config": {
            "Hostname": "6248c674f067",
            "Domainname": "",
            "User": "",
            "AttachStdin": true,
            "AttachStdout": true,
            "AttachStderr": true,
            "ExposedPorts": {
                "6379/tcp": {}
            },
            "Tty": true,
            "OpenStdin": true,
            "StdinOnce": true,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "GOSU_VERSION=1.10",
                "REDIS_VERSION=5.0.5",
                "REDIS_DOWNLOAD_URL=http://download.redis.io/releases/redis-5.0.5.tar.gz",
                "REDIS_DOWNLOAD_SHA=2139009799d21d8ff94fc40b7f36ac46699b9e1254086299f8d3b223ca54a375"
            ],
            "Cmd": [
                "redis-server"
            ],
            "ArgsEscaped": true,
            "Image": "redis",
            "Volumes": {
                "/data": {}
            },
            "WorkingDir": "/data",
            "Entrypoint": [
                "docker-entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {}
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "31f5b2c1c0d59c3f8866fa2b02db2889e4d4d54076cbf88ae7d6057758b3f40a",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "6379/tcp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "16379"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/31f5b2c1c0d5",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "ab4f1a16403dfd415703868b52b33ea0b6d9d28b750e5ce80810d0f9b89f4af1",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "172.17.0.3",
            "IPPrefixLen": 16,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:03",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "80fba7499001738402fe35f0c1bb758ddd5f680abf75f4bd6a0456b3021ee5fe",
                    "EndpointID": "ab4f1a16403dfd415703868b52b33ea0b6d9d28b750e5ce80810d0f9b89f4af1",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.3",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:03",
                    "DriverOpts": null
                }
            }
        }
    }
]
View Code
容器的导入导出
  • docker export :将文件系统作为一个tar归档文件导出到STDOUT。
    docker export [OPTIONS] CONTAINER
    
    # OPTIONS说明:
    # -o :将输入内容写到文件。
    
    # PS:
    # docker export -o /app2/1.tar.gz some-redis
  • docker import : 从归档文件中创建镜像。

    docker import [OPTIONS] file|URL|- [REPOSITORY[:TAG]]
    
    # OPTIONS说明:
    # -c :应用docker 指令创建镜像;
    # -m :提交时的说明文字;
    
    # PS:
    # 还原镜像
    # docker import /app2/1.tar.gz newredis
    # 创建容器并运行redis-server启动命令
    # docker run -d --name new-some-redis-2 newredis redis-server

docker images命令详解

docker image
[root@localhost app2]# docker image

Usage:    docker image COMMAND

Manage images

Commands:
  build       Build an image from a Dockerfile
  history     Show the history of an image
  import      Import the contents from a tarball to create a filesystem image
  inspect     Display detailed information on one or more images
  load        Load an image from a tar archive or STDIN
  ls          List images
  prune       Remove unused images
  pull        Pull an image or a repository from a registry
  push        Push an image or a repository to a registry
  rm          Remove one or more images
  save        Save one or more images to a tar archive (streamed to STDOUT by default)
  tag         Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE

Run 'docker image COMMAND --help' for more information on a command.
View Code
镜像的获取,删除,查看
  • docker pull : 从镜像仓库中拉取或者更新指定镜像
    docker pull [OPTIONS] NAME[:TAG|@DIGEST]
    
    # OPTIONS说明:
    # -a :拉取所有 tagged 镜像
    # --disable-content-trust :忽略镜像的校验,默认开启
  • docker rmi : 删除本地一个或多少镜像。
    docker rmi [OPTIONS] IMAGE [IMAGE...]
    
    # OPTIONS说明:
    # -f :强制删除;
    # --no-prune :不移除该镜像的过程镜像,默认移除;
  • docker inspect : 获取容器/镜像的元数据。
    docker inspect [OPTIONS] NAME|ID [NAME|ID...]
    
    # OPTIONS说明:
    # -f :指定返回值的模板文件。
    # -s :显示总的文件大小。
    # --type :为指定类型返回JSON。
  • docker images : 列出本地镜像。
    docker images [OPTIONS] [REPOSITORY[:TAG]]
    
    # OPTIONS说明:
    # -a :列出本地所有的镜像(含中间映像层,默认情况下,过滤掉中间映像层);
    # --digests :显示镜像的摘要信息;
    # -f :显示满足条件的镜像;
    # --format :指定返回值的模板文件;
    # --no-trunc :显示完整的镜像信息;
    # -q :只显示镜像ID。
镜像的导入导出,迁移

docker export/import 对容器进行打包
docker save / load 对镜像进行打包

  • docker save : 将指定镜像保存成 tar 归档文件。
    docker save [OPTIONS] IMAGE [IMAGE...]
    
    # OPTIONS 说明:
    # -o :输出到的文件。
    
    # PS:
    # docker save -o /app2/1.tar.gz redis
  • docker load : 导入使用 docker save 命令导出的镜像。
    docker load [OPTIONS]
    
    # OPTIONS 说明:
    # -i :指定导出的文件。
    # -q :精简输出信息。
    
    # PS:
    # docker load -i /app2/1.tar.gz
docker tag

打标签的目的,方便我上传到自己的私有仓库

  • docker tag : 标记本地镜像,将其归入某一仓库。
    docker tag [OPTIONS] IMAGE[:TAG] [REGISTRYHOST/][USERNAME/]NAME[:TAG]
    
    # PS:
    # docker tag redis:latest 13057686866/redis_1
    # 登录
    # docker login
    # 推送到远程私有仓库
    # docker push 13057686866/redis_1

手工构建
  • docker build 命令用于使用 Dockerfile 创建镜像。
    docker build [OPTIONS] PATH | URL | -
    
    # OPTIONS说明:
    # --build-arg=[] :设置镜像创建时的变量;
    # --cpu-shares :设置 cpu 使用权重;
    # --cpu-period :限制 CPU CFS周期;
    # --cpu-quota :限制 CPU CFS配额;
    # --cpuset-cpus :指定使用的CPU id;
    # --cpuset-mems :指定使用的内存 id;
    # --disable-content-trust :忽略校验,默认开启;
    # -f :指定要使用的Dockerfile路径;
    # --force-rm :设置镜像过程中删除中间容器;
    # --isolation :使用容器隔离技术;
    # --label=[] :设置镜像使用的元数据;
    # -m :设置内存最大值;
    # --memory-swap :设置Swap的最大值为内存+swap,"-1"表示不限swap;
    # --no-cache :创建镜像的过程不使用缓存;
    # --pull :尝试去更新镜像的新版本;
    # --quiet, -q :安静模式,成功后只输出镜像 ID;
    # --rm :设置镜像成功后删除中间容器;
    # --shm-size :设置/dev/shm的大小,默认值是64M;
    # --ulimit :Ulimit配置。
    # --tag, -t: 镜像的名字及标签,通常 name:tag 或者 name 格式;可以在一次构建中为一个镜像设置多个标签。
    # --network: 默认 default。在构建期间设置RUN指令的网络模式

dockerfile

docker build自己动手构建镜像

官方文档:https://docs.docker.com/engine/reference/builder/

dockerfile参数
  • FROM

  • ENV

  • RUN

  • CMD

  • LABEL

  • EXPOSE

  • ADD

    不仅可以copy文件,还可以下载远程文件。。。
    如果是本地的zip包,还能自动解压。

  • COPY

  • ENTRYPOINT

  • VOLUME

  • USER

  • WORKDIR

  • ONBUILD

  • STOPSIGNAL

  • HEALTHCHECK

  1. 新建项目 WebApplication1 空项目即可
  2. 新建 Dockerfile 配置文件
    # 1-有了基础镜像
    FROM mcr.microsoft.com/dotnet/core/sdk:2.2
    
    # 2-把我的文件拷贝到这个操作系统中的/app文件夹中
    COPY . /app
    
    # 工作目录
    WORKDIR /app
    
    # 3-publish
    RUN cd /app && dotnet publish "WebApplication1.csproj" -c Release -o /work
    
    # 4-告诉外界我的app暴露的是80端口
    EXPOSE 80
    
    # else
    ENV TZ Asia/Shanghai
    ENV ASPNETCORE_ENVIRONMENT Production
    
    # 作者信息
    LABEL version="1.0"
    LABEL author="wyt"
    
    # 执行角色
    USER root
    
    # 设置工作目录
    WORKDIR /work
    
    # 4-启动
    CMD ["dotnet","WebApplication1.dll"]
  3. 将 WebApplication1 整个目录拷贝到远程服务器下

  4. 构建镜像

    cd /app/WebApplication1
    docker build -t 13057686866/webapp:v1 .
  5. 运行容器

    docker run -d -p 18000:80 --name webapp3 13057686866/webapp:v1
  6. 运行成功

    curl http://192.168.103.240:18000/
    Hello World!

Dockerfile优化策略

使用 .dockerignore 忽略文件

官方地址:https://docs.docker.com/engine/reference/builder/#dockerignore-file

**/.dockerignore
**/.env
**/.git
**/.gitignore
**/.vs
**/.vscode
**/*.*proj.user
**/azds.yaml
**/charts
**/bin
**/obj
**/Dockerfile
**/Dockerfile.develop
**/docker-compose.yml
**/docker-compose.*.yml
**/*.dbmdl
**/*.jfm
**/secrets.dev.yaml
**/values.dev.yaml
**/.toolstarget

我们完全可以使用VS来创建Dockerfile,会自动生成 .dockerignore 

使用多阶段构建

多阶段构建:一个From一个阶段

dockerfile中只有最后一个From是生效的,其他的from只是给最后一个from打辅助。。。

当最后一个from生成完毕的时候,其他的from都会自动销毁。。。

 FROM build AS publish  给当前的镜像取一个别名。。

FROM mcr.microsoft.com/dotnet/core/aspnet:2.2 AS base
WORKDIR /app
EXPOSE 80

FROM mcr.microsoft.com/dotnet/core/sdk:2.2 AS build
WORKDIR /src
COPY ["WebApplication1.csproj", ""]
RUN dotnet restore "WebApplication1.csproj"
COPY . .
WORKDIR "/src/"
RUN dotnet build "WebApplication1.csproj" -c Release -o /app

FROM build AS publish
RUN dotnet publish "WebApplication1.csproj" -c Release -o /app

FROM base AS final
WORKDIR /app
COPY --from=publish /app .
ENTRYPOINT ["dotnet", "WebApplication1.dll"] 
及时移除不必须的包
# 3-publish
RUN cd /app && dotnet publish "WebApplication1.csproj" -c Release -o /work && rm -rf /app
最小化层的个数   
  • 可参考官方dockerfile
  • ADD 和 COPY,ADD 会增加 layer的个数。
  • RUN尽可能合并

搭建自己的私有registry仓库

官网介绍:https://docs.docker.com/registry/deploying/

搭建自己内网仓库,可以加速
  1. 拉取本地仓库镜像
    docker pull registry:2
  2. 运行本地仓库容器

    # 运行本地仓库容器
    docker run -d -p 5000:5000 --restart=always --name registry registry:2
  3. 拉取alpine镜像
    # 拉取alpine镜像
    docker pull alpine
  4. 重命名标签,指向本地仓库
    # 重命名标签,指向本地仓库
    docker tag alpine 192.168.103.240:5000/alpine:s1
  5. 远程推送到本地仓库
    # 远程推送到本地仓库
    docker push 192.168.103.240:5000/alpine:s1

    故障:http: server gave HTTP response to HTTPS client(https client 不接受  http response)
    解决办法: https://docs.docker.com/registry/insecure/

    # 编辑该daemon.json文件,其默认位置 /etc/docker/daemon.json在Linux或 C:\ProgramData\docker\config\daemon.jsonWindows Server上。如果您使用Docker Desktop for Mac或Docker Desktop for Windows,请单击Docker图标,选择 Preferences,然后选择+ Daemon。
    # 如果该daemon.json文件不存在,请创建它。假设文件中没有其他设置,则应具有以下内容:
    
    {
      "insecure-registries" : ["192.168.103.240:5000"]
    }
    
    # 将不安全注册表的地址替换为示例中的地址。
    
    # 启用了不安全的注册表后,Docker将执行以下步骤:
    # 1-首先,尝试使用HTTPS。
    # 2-如果HTTPS可用但证书无效,请忽略有关证书的错误。
    # 3-如果HTTPS不可用,请回退到HTTP。
    
    # 重新启动Docker以使更改生效。
    service docker restart
  6. 验证镜像是否推送成功
    docker pull 192.168.103.240:5000/alpine:s1
  7. 拉取开源registry UI镜像
    官方地址:https://hub.docker.com/r/joxit/docker-registry-ui
    # 拉取registry-ui镜像
    docker pull joxit/docker-registry-ui
  8. 设置允许repositry跨域
    # 设置允许跨域https://docs.docker.com/registry/configuration/
    # 复制文件到本地
    docker cp registry:/etc/docker/registry/config.yml /app
    # 修改配置文件,添加跨域
    vim /etc/docker/registry/config.yml
    
    version: 0.1
    log:
      fields:
        service: registry
    storage:
      cache:
        blobdescriptor: inmemory
      filesystem:
        rootdirectory: /var/lib/registry
    http:
      addr: :5000
      headers:
        X-Content-Type-Options: [nosniff]
        Access-Control-Allow-Origin: ['*']
        Access-Control-Allow-Methods: ['*']
        Access-Control-Max-Age: [1728000]
    health:
      storagedriver:
        enabled: true
        interval: 10s
        threshold: 3
        
    # 重新启动registry容器
    docker rm registry -f
    docker run -d -p 5000:5000 --restart=always --name registry -v /app/config.yml:/etc/docker/registry/config.yml registry:2
  9. 运行registry-ui容器
    # 运行容器
    docker rm -f registry-ui
    docker run -d -p 8002:80 --name registry-ui joxit/docker-registry-ui
  10. 访问可视化容器
使用阿里云镜像存储服务

官方地址:https://cr.console.aliyun.com/cn-hangzhou/instances/repositories

接入操作:

  1. 登录阿里云Docker Registry

    sudo docker login --username=tb5228628_2012 registry.cn-hangzhou.aliyuncs.com

    用于登录的用户名为阿里云账号全名,密码为开通服务时设置的密码。

  2. 从Registry中拉取镜像

    sudo docker pull registry.cn-hangzhou.aliyuncs.com/wyt_registry/wyt_registry:[镜像版本号]
  3. 将镜像推送到Registry

    sudo docker tag [ImageId] registry.cn-hangzhou.aliyuncs.com/wyt_registry/wyt_registry:[镜像版本号]
    sudo docker push registry.cn-hangzhou.aliyuncs.com/wyt_registry/wyt_registry:[镜像版本号]

volume数据挂载

三种方式可以让 数据 脱离到 容器之外,减少容器层的size,也提升了性能(避免容器的读写层)。

volume 管理
# 创建数据卷
docker volume create redisdata
# 使用数据卷
docker run -d -v redisdata:/data --name some-redis redis

优点:

  • 不考虑宿主机文件结构,所以更加方便迁移,backup。
  • 可以使用 docker cli 命令统一管理
  • volumes支持多平台,不用考虑多平台下的文件夹路径问题。
  • 使用volumn plugin 可以方便和 aws, 等云平台远程存储。
bind 管理 (文件,文件夹)

将宿主机文件夹初始化送入容器中,后续进行双向绑定。

tmpfs 容器内目录挂载到宿主机内存中
# 不隐藏容器内/tmp内文件
docker run --rm -it webapp bash
# 隐藏容器内/tmp内文件
docker run --rm --tmpfs /tmp -it webapp bash

network网络

单机网络

默认情况下是 bridge,overlay,host, macvlan,none

docker host 的bridge 的 docker0 默认网桥

默认的 bridge 的大概原理

当docker启动的时候,会生成一个默认的docker0网桥。。。

当启动容器的时候,docker会生成一对 veth设备。。。。这个设备的一端连接到host的docker0网桥,一端连接到container中,重命名为eth0

veth一端收到了数据,会自动传给另一端。。。

docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 fe80::42:a4ff:fe79:a36f  prefixlen 64  scopeid 0x20<link>
        ether 02:42:a4:79:a3:6f  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 11  bytes 1439 (1.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


vethfc5e4ce: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::f802:99ff:fe73:34d7  prefixlen 64  scopeid 0x20<link>
        ether fa:02:99:73:34:d7  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 17  bytes 1947 (1.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


/ # ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever



[root@localhost ~]#  docker run -it alpine ash
/ # ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
8: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
/ # 
View Code
默认的bridge缺陷

无服务发现功能,同一个子网,无法通过 “服务名” 互通,只能通过 ip 地址。。。

自定义bridge网络

自带服务发现机制

# 创建桥接网络
docker network create my-net 
# 创建容器
docker run -it --network my-net --name some-redis alpine ash
docker run -it --network my-net --name some-redis2 alpine ash
# 在some-redis中ping容器some-redis2
ping some-redis2
容器网络发布

如果让宿主机之外的程序能能够访问host上的bridge内的container:-p 发布端口

# 运行容器进行端口转发
docker run -it --network my-net -p 80:80 --name some-redis-1 alpine ash
# 查看网络转发详情
iptables -t nat -L -n

Chain DOCKER (2 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:172.18.0.4:80

多机网络

overlay网络

可实现多机访问

  1. 使用docker swarm init 实现docker 集群网络
    # 192.168.103.240
    docker swarm init
    # 192.168.103.226
    docker swarm join --token SWMTKN-1-0g4cs8fcatshczn5koupqx7lulak20fbvu99uzjb5asaddblny-bio99e9kktn023k527y3tjgyv 192.168.103.240:2377
  2. 实现自定义的 可独立添加容器的 overlay网络
    docker network create --driver=overlay --attachable test-net

    TCP 2377 集群 manage 节点交流的
    TCP 的 7946 和 UDP 的 7946 nodes 之间交流的
    UDP 4789 是用于overlay network 流量传输的。

演示
  1. 192.168.103.226 redis启动
    docker run --network test-net --name some-redis -d redis
  2. 192.168.103.240 python
    mkdir /app
    vim /app/app.py
    vim /app/Dockerfile
    vim /app/requirements.txt

    app.pv

    from flask import Flask
    from redis import Redis, RedisError
    import os
    import socket
    
    # Connect to Redis
    redis = Redis(host="some-redis", db=0, socket_connect_timeout=2, socket_timeout=2)
    
    app = Flask(__name__)
    
    @app.route("/")
    def hello():
        try:
            visits = redis.incr("counter")
        except RedisError:
            visits = "<i>cannot connect to Redis, counter disabled</i>"
    
        html = "<b>Hostname:</b> {hostname}<br/>" \
               "<b>Visits:</b> {visits}"
        return html.format(hostname=socket.gethostname(), visits=visits)
    
    if __name__ == "__main__":
        app.run(host='0.0.0.0', port=80)
    View Code

    Dockerfile

    FROM python:2.7-slim
    
    WORKDIR /app
    
    COPY . .
    
    EXPOSE 80
    
    RUN pip install --trusted-host pypi.python.org -r requirements.txt
    
    VOLUME [ "/app" ]
    
    CMD [ "python", "app.py" ]
    View Code

    requirements.txt

    Flask
    Redis
    View Code
    # 构建镜像
    docker build -t pyweb:v1 .
    # 运行容器
    docker run -d --network test-net -p 80:80 -v /app:/app --name pyapp pyweb:v1

    访问结果

host 模式 

这种模式不和宿主机进行网络隔离,直接使用宿主机网络

最简单最粗暴的方式

overlay虽然复杂,但是强大, 不好控制。

docker-compose

什么是docker-compose?应用程序栈一键部署,(独立程序一键部署),docker-compose 可以管理你的整个应用程序栈的生命周期。

下载

官方地址:https://docs.docker.com/compose/install/

# 下载Docker Compose的当前稳定版本
sudo curl -L "https://github.com/docker/compose/releases/download/1.24.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
# https://github.com/docker/compose/releases/download/1.24.1/docker-compose-Linux-x86_64
# 建议迅雷下载后进行重命名,这样速度快
# 对二进制文件应用可执行权限
sudo chmod +x /usr/local/bin/docker-compose
# 测试安装
docker-compose --version

简单示例

  1. 新建项目 WebApplication1 空网站项目添加NLog、Redis包支持
    Install-Package NLog.Targets.ElasticSearch
    Install-Package StackExchange.Redis
  2. 修改 Program.cs 使用80端口
    public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
        WebHost.CreateDefaultBuilder(args)
            .UseUrls("http://*:80")
            .UseStartup<Startup>();
  3. 修改 Startup.cs 添加日志和redis
    public Logger logger = LogManager.GetCurrentClassLogger();
    public ConnectionMultiplexer redis = ConnectionMultiplexer.Connect("redis");
    
    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
    
        app.Run(async (context) =>
        {
            var count = await redis.GetDatabase(0).StringIncrementAsync("counter");
            var info= $"you have been seen {count} times !";
            logger.Info(info);
    
            await context.Response.WriteAsync(info);
        });
    }
  4. 添加 nlog.config 配置文件
    <?xml version="1.0" encoding="utf-8" ?>
    <nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          autoReload="true"
          internalLogLevel="Warn">
    
        <extensions>
            <add assembly="NLog.Targets.ElasticSearch"/>
        </extensions>
    
        <targets>
            <target name="ElasticSearch" xsi:type="BufferingWrapper" flushTimeout="5000" >
                <target xsi:type="ElasticSearch" uri="http://elasticsearch:9200" documentType="web.app"/>
            </target>
        </targets>
    
        <rules>
            <logger name="*" minlevel="Trace" writeTo="ElasticSearch" />
        </rules>
    </nlog>
  5. 添加 Dockerfile 文件

    FROM mcr.microsoft.com/dotnet/core/aspnet:2.2-stretch-slim AS base
    
    WORKDIR /data
    COPY . .
    
    EXPOSE 80
    
    ENTRYPOINT ["dotnet", "WebApplication1.dll"]
  6. 添加 docker-compose.yml 文件

    version: '3.0'
    
    services:
    
      webapp: 
        build: 
          context: .
          dockerfile: Dockerfile
        ports: 
          - 80:80
        depends_on: 
          - redis
        networks: 
          - netapp
    
      redis: 
        image: redis
        networks: 
          - netapp
    
      elasticsearch: 
        image: elasticsearch:5.6.14
        networks: 
          - netapp
    
      kibana: 
        image: kibana:5.6.14
        ports: 
          - 5601:5601
        networks: 
          - netapp
    
    networks: 
      netapp:
  7. 发布项目文件,并拷贝到远程服务器/app文件夹内

  8. 运行 docker-compose 

    cd /app
    docker-compose up --build
  9. 查看效果
    访问网站http://192.168.103.240/

    访问Kibana查看日志http://192.168.103.240:5601
docker-compose 常见命令
  •  操控命令
    docker-compose ps
    docker-compose images
    docker-compose kill webapp
    docker-compose build
    docker-compose run      -> docker exec
    docker-compose scale
    docker-compose up       -> docker run
    docker-compose down
  • 状态命令

    docker-compose logs
    docker-compose ps
    docker-compose top
    docker-compose port 
    docker-compose config

compose命令讲解

官方地址:https://docs.docker.com/compose/compose-file/

yml常用命令分析
version      3.7 
services
config    (swarm)
secret    (swarm)
volume     
networks  
appstack 补充

修改 WebApplication1 项目中的 docker-compose.yml 

version: '3.0'

services:

  webapp: 
    build: 
      context: .
      dockerfile: Dockerfile
    image: wyt/webapp
    container_name: webapplication
    restart: always
    ports: 
      - 80:80
    depends_on: 
      - redis
    networks: 
      - netapp

  redis: 
    image: redis
    networks: 
      - netapp

  elasticsearch: 
    image: elasticsearch:5.6.14
    networks: 
      - netapp
    volumes:
      - "esdata:/usr/share/elasticsearch/data"

  kibana: 
    image: kibana:5.6.14
    ports: 
      - 5601:5601
    networks: 
      - netapp

volumes:
  esdata:

networks: 
  netapp:
View Code

部分docker-compose脚本:https://download.csdn.net/download/qq_25153485/11324352

docker-compose 一些使用原则

使用多文件部署
  • 生产环境代码直接放在容器中,test环境实现代码挂载
    test:   docker-compose -f  docker-compose.yml  -f test.yml   up 
    prd:   docker-compose -f  docker-compose.yml  -f prd.yml   up 
  • 生产环境中绑定程序默认端口,测试机防冲突绑定其他端口。

  • 生产环境配置 restart: always , 可以容器就可以挂掉之后重启。
  • 添加日志聚合,对接es
按需编译,按需构建
# 只构建service名称为webapp的镜像,也会构建其依赖
docker-compose build webapp
# 只构建service名称为webapp的镜像,不构建其依赖
docker-compose up --no-deps --build -d webapp
变量插值
  1. 设置宿主机环境变量
    # 设置环境变量
    export ASPNETCORE_ENVIRONMENT=Production
    # 获取环境变量
    echo $ASPNETCORE_ENVIRONMENT
    # hostip 网卡ip 埋进去,方便获取
    # image的版本号
  2. 修改 docker-compose.yml 读取环境变量
    environment:
      ASPNETCORE_ENVIRONMENT: ${ASPNETCORE_ENVIRONMENT}

docker可视化portainer

安装教程参考:https://www.cnblogs.com/wyt007/p/11104253.html

yml文件

protainer:
  image: portainer/portainer
  ports:
    - 9000:9000
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock
  restart: always
  networks: 
    - netapp
使用python 和 C# 远程访问 docker
  1. 开放tcp端口,方便远程访问
    修改 docker.service ,修改掉ExecStart
    vim /usr/lib/systemd/system/docker.service
    
    # ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.soc
    ExecStart=/usr/bin/dockerd --containerd=/run/containerd/containerd.soc

    配置 daemon.json 

    vim /etc/docker/daemon.json
    
    "hosts": ["192.168.103.240:18080","unix:///var/run/docker.sock"]
  2. 刷新配置文件,重启docker
    systemctl daemon-reload
    systemctl restart docker
  3. 查看docker进程是否监听

    netstat -ano | grep 18080
    
    tcp        0      0 192.168.103.240:18080   0.0.0.0:*               LISTEN      off (0.00/0/0)
python访问docker

官方地址:https://docs.docker.com/develop/sdk/examples/

c#访问docker

社区地址:https://github.com/microsoft/Docker.DotNet

class Program
{
    static  async Task Main(string[] args)
    {
        DockerClient client = new DockerClientConfiguration(
                new Uri("http://192.168.103.240:18080"))
            .CreateClient();
        IList<ContainerListResponse> containers = await client.Containers.ListContainersAsync(
            new ContainersListParameters()
            {
                Limit = 10,
            });
        Console.WriteLine("Hello World!");
    }
}

cluster volumes

开源分布式文件系统:https://www.gluster.org/

  1. 部署前准备,修改 /etc/hosts 文件,增加如下信息
    2台机器
    vim /etc/hosts
    
    192.168.103.240 fs1
    192.168.103.226 fs2
  2. 安装GlusterFS   【两个node】
    yum install -y centos-release-gluster
    yum install -y glusterfs-server
    systemctl start glusterd
    systemctl enable glusterd
  3. 将fs2加入到集群中
    # 在fs1中执行
    # 将fs2加入集群节点中
    gluster peer probe fs2
    # 查看集群状态
    gluster peer status
    # 查看集群列表
    gluster pool list
    # 查看所有命令
    gluster help global
  4. 创建volume

    # 创建文件夹(两个都要创建)
    mkdir -p /data/glusterfs/glustervolume
    # 创建同步副本数据卷 replica集群 2复制分发 force强制(fs1)
    gluster volume create glusterfsvolumne replica 2 fs1:/data/glusterfs/glustervolume fs2:/data/glusterfs/glustervolume force
    # 启动卷使用
    gluster volume start glusterfsvolumne

    相当于两台机器都拥有了glusterfsvolumne

  5. 创建本地文件夹挂载 volume 即可
    # 分别创建
    mkdir /app
    # 【交叉挂载】
    # fs1
    mount -t glusterfs fs2:/glusterfsvolumne /app
    # fs2
    mount -t glusterfs fs1:/glusterfsvolumne /app
    [root@localhost app]# df -h
    文件系统                 容量  已用  可用 已用% 挂载点
    /dev/mapper/centos-root   17G   12G  5.8G   67% /
    devtmpfs                 903M     0  903M    0% /dev
    tmpfs                    920M     0  920M    0% /dev/shm
    tmpfs                    920M   90M  830M   10% /run
    tmpfs                    920M     0  920M    0% /sys/fs/cgroup
    /dev/sda1               1014M  232M  783M   23% /boot
    tmpfs                    184M   12K  184M    1% /run/user/42
    tmpfs                    184M     0  184M    0% /run/user/0
    overlay                   17G   12G  5.8G   67% /data/docker/overlay2/46ed811c8b335a3a59cae93a77133599390c4a6bf2767a690b01b8b2999eb1e3/merged
    shm                       64M     0   64M    0% /data/docker/containers/f7044f3d2b744f97f60a2fd004402300a8f4d1c1494f86dfd0852a89d4626efd/mounts/shm
    fs2:/glusterfsvolumne     17G   12G  5.7G   68% /app
    overlay                   17G   12G  5.8G   67% /data/docker/overlay2/b681972965562fe4f608f0724430906078130a65d3dbe9031cb9ab40ce29698f/merged
    shm                       64M     0   64M    0% /data/docker/containers/d43a7653a61a9a6d6ad89cb178b9567d99b5b0c6976ece90bd7b92f8cc2ebcaf/mounts/shm
    View Code
    [root@localhost app]# df -h
    文件系统                 容量  已用  可用 已用% 挂载点
    /dev/mapper/centos-root   17G  8.2G  8.9G   48% /
    devtmpfs                 903M     0  903M    0% /dev
    tmpfs                    920M     0  920M    0% /dev/shm
    tmpfs                    920M   90M  830M   10% /run
    tmpfs                    920M     0  920M    0% /sys/fs/cgroup
    /dev/sda1               1014M  232M  783M   23% /boot
    tmpfs                    184M  4.0K  184M    1% /run/user/42
    tmpfs                    184M   36K  184M    1% /run/user/0
    overlay                   17G  8.2G  8.9G   48% /data/docker/overlay2/20ae619da7d4578d9571a5ab9598478bce496423254833c110c67641e9f2d817/merged
    shm                       64M     0   64M    0% /data/docker/containers/fc31990633d41fd4bf21a8b0601db1cfb7cf9b2d5920bf1a13cf696e111d91e2/mounts/shm
    fs1:/glusterfsvolumne     17G   12G  5.7G   67% /app
    View Code

    在fs1新建文件

    在fs2中查看

  6. 容器部署
    # fs1 fs2
    # 数据是共享的
    docker run --name some-redis -p 6379:6379 -v /app/data:/data -d  redis

搭建自己的docker swarm集群

集群的搭建

  1. 准备三台服务器
    192.168.103.240 manager1
    192.168.103.226 node1
    192.168.103.227 node2
  2. 初始化swarm

    # 192.168.103.240 manager1
    docker swarm init
    [root@localhost ~]# docker swarm init
    Swarm initialized: current node (ryi7o7xcww2c9e4j1lotygfbu) is now a manager.
    
    To add a worker to this swarm, run the following command:
    
        docker swarm join --token SWMTKN-1-10bndgdxqph4nqmjn0g4oqse83tdgx9cbb50pcgmf0tn7yhlno-6mako3nf0a0504tiopu9jefxc 192.168.103.240:2377
    
    To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
    View Code
  3. 加入节点

    # 192.168.103.226 node1
    # 192.168.103.227 node2
    docker swarm join --token SWMTKN-1-10bndgdxqph4nqmjn0g4oqse83tdgx9cbb50pcgmf0tn7yhlno-6mako3nf0a0504tiopu9jefxc 192.168.103.240:2377
 关键词解释
  • managernode 

    用于管理这个集群。(manager + work )
    用于分发task 给 worknode 去执行。

  • worknode
    用于执行 manager 给过来的 task。
    给manager report task的执行情况 或者一些 统计信息。
  • service 服务
  • task 容器
  • overlay 网络

swarm操作的基本命令

  • docker swarm 
    docker swarm init
    docker swarm join
    docker swarm join-token
    docker swarm leave
  • docker node 
    docker node demote / promote 
    docker node ls / ps
  • docker service 

    docker service create
    docker service update
    docker service scale
    docker service ls
    docker service ps
    docker service rm
    # 在随机节点上创建一个副本
    docker service create --name redis redis:3.0.6
    # 创建每个节点都有的redis实例
    docker service create --mode global --name redis redis:3.0.6
    # 创建随机节点的5个随机的redis实例
    docker service create --name redis --replicas=5 redis:3.0.6
    # 创建端口映射3个节点的redis实例
    docker service create --name my_web --replicas 3 -p 6379:6379 redis:3.0.6
    # 更新服务,副本集提高成5个
    docker service update --replicas=5 redis
    # 更新服务,副本集提高成2个
    docker service scale redis=2
    # 删除副本集
    docker service rm redis

compose.yml自定义swarm集群

官方文档:https://docs.docker.com/compose/compose-file/#deploy

所有分布式部署都使用compose中的 deploy 进行节点部署

使用compose中的 deploy 进行节点部署
  1. 准备4台服务器
    192.168.103.240 manager1
    192.168.103.228 manager2
    192.168.103.226 node1
    192.168.103.227 node2
  2. 编写 docker-compose.yml 文件
    vim /app/docker-compose.yml
    
    version: '3.7'
    services:
      webapp:
        image: nginx
        ports:
          - 80:80
        deploy:
          replicas: 5
  3. 运行yml文件
    # 与docker-compose不同,这里是基于stack deploy的概念
    docker stack deploy -c ./docker-compose.yml nginx
  4. 查看stack

    # 查看所有栈
    docker stack ls
    # 查看名称为nginx的栈
    docker stack ps nginx

带状态的容器进行约束

placement:
  constraints:
    - xxxxxx
  1. 借助node的自带信息
    https://docs.docker.com/engine/reference/commandline/service_create/#specify-service-constraints---constraint
    node.id / node.hostname / node.role
    node.idNode IDnode.id==2ivku8v2gvtg4
    node.hostnameNode hostnamenode.hostname!=node-2
    node.roleNode rolenode.role==manager
    node.labelsuser defined node labelsnode.labels.security==high
    engine.labelsDocker Engine's labels
  2. 借助node的自定义标签信息  [更大的灵活性]
    node.labels / node.labels.country==china
让 5个task 分配在 node1节点上
  1. 编写 docker-compose.yml 文件|
    vim /app/docker-compose.yml
    
    version: '3.7'
    services:
      webapp:
        image: nginx
        ports:
          - 80:80
        deploy:
          replicas: 5
          placement:
            constraints:
              - node.id == icyia3s2mavepwebkyr0tqxly
  2. 运行yml文件
    # 先删除,发布,延迟5秒、查看详情
    docker stack rm nginx &&  docker stack deploy -c ./docker-compose.yml nginx && sleep 5 && docker stack ps nginx

     

让 5 个 task 在东部地区运行
  1. 给node打标签
    docker node update --label-add region=east --label-add country=china  0pbg8ynn3wfimr3q631t4b01s
    docker node update --label-add region=west --label-add country=china  icyia3s2mavepwebkyr0tqxly
    docker node update --label-add region=east --label-add country=usa  27vlmifw8bwyc19tpo0tbgt3e
  2. 编写 docker-compose.yml 文件
    vim /app/docker-compose.yml
    
    version: '3.7'
    services:
      webapp:
        image: nginx
        ports:
          - 80:80
        deploy:
          replicas: 5
          placement:
            constraints:
              - node.labels.region == east
  3. 运行yml文件

    # 先删除,发布,延迟5秒、查看详情
    docker stack rm nginx &&  docker stack deploy -c ./docker-compose.yml nginx && sleep 5 && docker stack ps nginx

     

让 5 个 task 在中国东部地区运行
deploy:
  replicas: 5
  placement:
    constraints:
      - node.labels.region == east
      - node.labels.country == china

均匀分布

目前只有 spread 这种策略,用于让task在指定的node标签上均衡的分布。

placement:
  preferences:
    - spread: node.labels.zone
让 8 个task 在 region 均匀分布
  1. 编写 docker-compose.yml 文件
    vim /app/docker-compose.yml
    
    version: '3.7'
    services:
      webapp:
        image: nginx
        ports:
          - 80:80
        deploy:
          replicas: 8
          placement:
            constraints:
              - node.id != ryi7o7xcww2c9e4j1lotygfbu
            preferences:
              - spread: node.labels.region
  2. 运行yml文件

    # 先删除,发布,延迟5秒、查看详情
    docker stack rm nginx &&  docker stack deploy -c ./docker-compose.yml nginx && sleep 5 && docker stack ps nginx

     

重启策略
deploy:
  restart_policy:
    condition: on-failure
    delay: 5s
    max_attempts: 3
    window: 120s

默认是any,(always) 单要知道和 on-failure, 前者如果我stop 容器,一样重启, 后者则不是

version: '3.7'
services:
  webapp:
    image: nginx
    ports:
      - 80:80
    deploy:
      replicas: 2
      restart_policy:
        condition: on-failure
        delay: 5s
      placement:
        constraints:
          - node.role == worker
其他属性

endpoint_mode vip -> keepalive 【路由器的一个协议】
labels:标签信息
mode:分发还是全局模式
resources:限制可用资源
update_config 【覆盖的一个策略】

把之前的单机版程序修改放到分布式环境中

修改 docker-compose.yml 文件

version: '3.0'

services:

  webapp:
    image: registry.cn-hangzhou.aliyuncs.com/wyt_registry/wyt_registry
    ports:
      - 80:80
    depends_on:
      - redis
    networks:
      - netapp
    deploy:
      replicas: 3
      placement:
        constraints:
          - node.id == ryi7o7xcww2c9e4j1lotygfbu

  redis:
    image: redis
    networks:
      - netapp
    deploy:
      placement:
        constraints:
          - node.role == worker

  elasticsearch:
    image: elasticsearch:5.6.14
    networks:
      - netapp
    deploy:
      placement:
        constraints:
          - node.role == worker

  kibana:
    image: kibana:5.6.14
    ports:
      - 5601:5601
    networks:
      - netapp
    deploy:
      placement:
        constraints:
          - node.role == worker
networks:
  netapp:

在私有仓库拉取的时候记得 带上这个参数,,否则会 no such image 这样的报错的。

docker stack deploy -c ./docker-compose.yml nginx --with-registry-auth

docker新特性

使用config实现全局挂载

  1. 创建config配置
    vim /app/nlog.config
    
    <?xml version="1.0" encoding="utf-8" ?>
    <nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          autoReload="true"
          internalLogLevel="Warn">
    
        <extensions>
            <add assembly="NLog.Targets.ElasticSearch"/>
        </extensions>
    
        <targets>
            <target name="ElasticSearch" xsi:type="BufferingWrapper" flushTimeout="5000" >
                <target xsi:type="ElasticSearch" uri="http://elasticsearch:9200" documentType="web.app"/>
            </target>
        </targets>
    
        <rules>
            <logger name="*" minlevel="Trace" writeTo="ElasticSearch" />
        </rules>
    </nlog>
    # 创建名称为nlog的配置
    docker config create nlog /app/nlog.config
  2. 查看config内容,默认是base64编码
    docker config inspect nlog
    
    [
        {
            "ID": "1zwa2o8f71i6zm6ie47ws987n",
            "Version": {
                "Index": 393
            },
            "CreatedAt": "2019-07-11T10:30:58.255006156Z",
            "UpdatedAt": "2019-07-11T10:30:58.255006156Z",
            "Spec": {
                "Name": "nlog",
                "Labels": {},
                "Data": "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiID8+CjxubG9nIHhtbG5zPSJodHRwOi8vd3d3Lm5sb2ctcHJvamVjdC5vcmcvc2NoZW1hcy9OTG9nLnhzZCIKICAgICAgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIKICAgICAgYXV0b1JlbG9hZD0idHJ1ZSIKICAgICAgaW50ZXJuYWxMb2dMZXZlbD0iV2FybiI+CgogICAgPGV4dGVuc2lvbnM+CiAgICAgICAgPGFkZCBhc3NlbWJseT0iTkxvZy5UYXJnZXRzLkVsYXN0aWNTZWFyY2giLz4KICAgIDwvZXh0ZW5zaW9ucz4KCiAgICA8dGFyZ2V0cz4KICAgICAgICA8dGFyZ2V0IG5hbWU9IkVsYXN0aWNTZWFyY2giIHhzaTp0eXBlPSJCdWZmZXJpbmdXcmFwcGVyIiBmbHVzaFRpbWVvdXQ9IjUwMDAiID4KICAgICAgICAgICAgPHRhcmdldCB4c2k6dHlwZT0iRWxhc3RpY1NlYXJjaCIgdXJpPSJodHRwOi8vZWxhc3RpY3NlYXJjaDo5MjAwIiBkb2N1bWVudFR5cGU9IndlYi5hcHAiLz4KICAgICAgICA8L3RhcmdldD4KICAgIDwvdGFyZ2V0cz4KCiAgICA8cnVsZXM+CiAgICAgICAgPGxvZ2dlciBuYW1lPSIqIiBtaW5sZXZlbD0iVHJhY2UiIHdyaXRlVG89IkVsYXN0aWNTZWFyY2giIC8+CiAgICA8L3J1bGVzPgo8L25sb2c+Cg=="
            }
        }
    ]
    
    
    #解密
    <?xml version="1.0" encoding="utf-8" ?>
    <nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          autoReload="true"
          internalLogLevel="Warn">
    
        <extensions>
            <add assembly="NLog.Targets.ElasticSearch"/>
        </extensions>
    
        <targets>
            <target name="ElasticSearch" xsi:type="BufferingWrapper" flushTimeout="5000" >
                <target xsi:type="ElasticSearch" uri="http://elasticsearch:9200" documentType="web.app"/>
            </target>
        </targets>
    
        <rules>
            <logger name="*" minlevel="Trace" writeTo="ElasticSearch" />
        </rules>
    </nlog>
  3. 给servcie作用域加上 config 文件, 根目录有一个 nlog 文件

    docker service create --name redis --replicas 3 --config nlog redis
    [root@localhost app]# docker ps
    CONTAINER ID        IMAGE               COMMAND                  CREATED              STATUS              PORTS               NAMES
    e5f7b18e8377        redis:latest        "docker-entrypoint.s…"   About a minute ago   Up About a minute   6379/tcp            redis.3.usqs8c5mucee16mokib7143aa
    [root@localhost app]# docker exec -it e5f7b18e8377 bash
    root@e5f7b18e8377:/data# cd /
    root@e5f7b18e8377:/# ls
    bin  boot  data  dev  etc  home  lib  lib64  media  mnt  nlog  opt  proc  root    run  sbin  srv    sys  tmp  usr  var
    root@e5f7b18e8377:/# cd nlog 
    bash: cd: nlog: Not a directory
    root@e5f7b18e8377:/# cat nlog 
    <?xml version="1.0" encoding="utf-8" ?>
    <nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          autoReload="true"
          internalLogLevel="Warn">
    
        <extensions>
            <add assembly="NLog.Targets.ElasticSearch"/>
        </extensions>
    
        <targets>
            <target name="ElasticSearch" xsi:type="BufferingWrapper" flushTimeout="5000" >
                <target xsi:type="ElasticSearch" uri="http://elasticsearch:9200" documentType="web.app"/>
            </target>
        </targets>
    
        <rules>
            <logger name="*" minlevel="Trace" writeTo="ElasticSearch" />
        </rules>
    </nlog>
    View Code
  4. 使用docker-compose实现

    vim /app/docker-compose.yml
    
    version: "3.7"
    services:
      redis:
        image: redis:latest
        deploy:
          replicas: 3
        configs:
          - nlog2
    configs:
      nlog2:
        file: ./nlog.config
  5. 运行

    docker stack deploy -c docker-compose.yml redis --with-registry-auth
  6. 挂载到指定目录(这里的意思是挂在到容器内的/root文件夹内)

    vim /app/docker-compose.yml
    
    version: "3.7"
    services:
      redis:
        image: redis:latest
        deploy:
          replicas: 1
        configs:
          - source: nlog2
            target: /root/nlog2
    configs:
      nlog2:
        file: ./nlog.config

serect挂载明文和密文

如果你有敏感的配置需要挂载在swarm的service中,可以考虑使用 serect

  1. 用户名和密码
  2. 生产的数据库连接串   

使用方式与config一致,挂在目录在:/run/secrets/<secret_name>

 

转载于:https://www.cnblogs.com/wyt007/p/11154156.html

Logo

权威|前沿|技术|干货|国内首个API全生命周期开发者社区

更多推荐