Docker容器技术

Docker介绍

什么是容器

Linux容器是与系统其他部分隔离开的一系列进程，从另一个系统镜像运行，并由该镜像提供支持进程所需的全部文件。

容器镜像包含了应用的所有依赖项，因而在从开发到测试再到生产的整个过程中，它都具有可移植性和一致性。

来源：https://www.redhat.com/zh/topics/containers/whats-a-linux-container

容器就是虚拟化吗？

虚拟化使得许多操作系统可同时在单个系统上运行。

容器只能共享操作系统内核,将应用进程与系统其他部分,隔离开。

容器和虚拟化的区别

linux容器技术，容器虚拟化和kvm虚拟化的区别

kvm虚拟化：需要硬件的支持，需要模拟硬件，可以运行不同的操作系统，启动时间分钟级(开机启动流程)

容器虚拟化：不需要硬件的支持。不需要模拟硬件，共用宿主机的内核，启动时间秒级(没有开机启动流程)

容器总结：

（1）与宿主机使用同一个内核，性能损耗小；

（2）不需要指令级模拟；

（3）容器可以在CPU核心的本地运行指令，不需要任何专门的解释机制；

（4）避免了准虚拟化和系统调用替换中的复杂性；

（5）轻量级隔离，在隔离的同时还提供共享机制，以实现容器与宿主机的资源共享。

容器技术的发展过程

chroot技术，新建一个子系统

chroot，即 change root directory (更改 root 目录)。在 linux 系统中，系统默认的目录结构都是以 `/`，即是以根 (root) 开始的。而在使用 chroot 之后，系统的目录结构将以指定的位置作为 `/` 位置。

参考资料：https://www.ibm.com/developerworks/cn/linux/l-cn-chroot/

使用chroot监狱限制SSH用户访问指定目录和使用指定命令：https://linux.cn/article-8313-1.html

lxc部署

Linux Container容器是一种内核虚拟化技术，可以提供轻量级的虚拟化，以便隔离进程和资源。

安装lxc

需要使用epel源

#安装epel源

yum install epel-release -y

#编译epel源配置文件

vi  /etc/yum.repos.d/epel.repo
[epel]
name=Extra Packages for Enterprise Linux  - $basearch
baseurl=https://mirrors.tuna.tsinghua.edu.cn/epel/7/$basearch
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch
failovermethod=priority
enabled=
gpgcheck=
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7

[epel-debuginfo]
name=Extra Packages for Enterprise Linux  - $basearch - Debug
baseurl=https://mirrors.tuna.tsinghua.edu.cn/epel/7/$basearch/debug
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-debug-7&arch=$basearch
failovermethod=priority
enabled=
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
gpgcheck=

[epel-source]
name=Extra Packages for Enterprise Linux  - $basearch - Source
baseurl=https://mirrors.tuna.tsinghua.edu.cn/epel/7/SRPMS
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-source-7&arch=$basearch
failovermethod=priority
enabled=
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
gpgcheck=

##安装lxc

yum install lxc-* -y
yum install libcgroup* -y
yum install bridge-utils.x86_64 -y

交接网卡

[root@controller ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0
TYPE=Ethernet
BOOTPROTO=none
NAME=eth0
DEVICE=eth0
ONBOOT=yes
BRIDGE=br0

[root@controller ~]# cat /etc/sysconfig/network-scripts/ifcfg-br0
TYPE=Bridge
BOOTPROTO=static
NAME=br0
DEVICE=br0
ONBOOT=yes
IPADDR=10.0.0.11
NETMASK=255.255.255.0
GATEWAY=10.0.0.254
DNS1=223.5.5.5

修改lxc默认配置

vi /etc/lxc/default.conf
修改第2行为：lxc.network.link = br0

启动cgroup服务

systemctl enable cgconfig.service
systemctl start cgconfig.service

创建lxc容器

方法1:
lxc-create -t download -n centos7 -- --server mirrors.tuna.tsinghua.edu.cn/lxc-images -d centos -r  -a amd64
方法2：
lxc-create -t centos -n test

为容器指定ip和网关

vi /var/lib/lxc/centos7/config
lxc.network.name = eth0
lxc.network.ipv4 = 10.0.0.111/
lxc.network.ipv4.gateway = 10.0.0.254

启动容器

lxc-start -n centos7

lxc实操

#查看虚拟机

[root@docker opt]# lxc-ls
centos7  

修改子系统root密码

[root@docker opt]# chroot /var/lib/lxc/centos7/rootfs passwd
Changing password for user root.
New password:
BAD PASSWORD: The password is shorter than  characters
Retype new password:
passwd: all authentication tokens updated successfully.

启动子系统

[root@docker opt]# lxc-start -n centos7
systemd  running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN)
Detected virtualization lxc.
Detected architecture x86-.

Welcome to CentOS Linux  (Core)!

检测

[root@docker ~]# lxc-checkconfig
Kernel configuration not found at /proc/config.gz; searching...
Kernel configuration found at /boot/config-3.10.-.el7.x86_64
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
newuidmap is not installed
newgidmap is not installed
Network namespace: enabled
Multiple /dev/pts instances: enabled

--- Control groups ---
Cgroup: enabled
Cgroup clone_children flag: enabled
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: enabled
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled
Macvlan: enabled
Vlan: enabled
Bridges: enabled
Advanced netfilter: enabled
CONFIG_NF_NAT_IPV4: enabled
CONFIG_NF_NAT_IPV6: enabled
CONFIG_IP_NF_TARGET_MASQUERADE: enabled
CONFIG_IP6_NF_TARGET_MASQUERADE: enabled
CONFIG_NETFILTER_XT_TARGET_CHECKSUM: enabled

--- Checkpoint/Restore ---
checkpoint restore: enabled
CONFIG_FHANDLE: enabled
CONFIG_EVENTFD: enabled
CONFIG_EPOLL: enabled
CONFIG_UNIX_DIAG: enabled
CONFIG_INET_DIAG: enabled
CONFIG_PACKET_DIAG: enabled
CONFIG_NETLINK_DIAG: enabled
File capabilities: enabled

Note : Before booting a new kernel, you can check its configuration
usage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig

docker容器

Docker是通过内核虚拟化技术（namespaces及cgroups cpu、内存、磁盘io等）来提供容器的资源隔离与安全保障等。由于Docker通过操作系统层的虚拟化实现隔离，所以Docker容器在运行时，不需要类似虚拟机（VM）额外的操作系统开销，提高资源利用率。

docker的主要目标是"Build,Ship and Run any App,Angwhere",构建，运输，处处运行

构建：做一个docker镜像

运输：docker pull

运行：启动一个容器

每一个容器，他都有自己的文件系统rootfs.

kvm解决了硬件和操作系统之间的依赖

docker解决了软件和操作系统环境之间的依赖，能够让独立服务或应用程序在不同的环境中，得到相同的运行结果。

docker容器是一种轻量级、可移植、自包含的软件打包技术，使应用程序可以在几乎任何地方以相同的方式运行。开发人员在自己笔记本上创建并测试好的容器，无需任何修改就能够在生产系统的虚拟机、物理服务器或公有云主机上运行。

Docker的部署

wget -O /etc/yum.repos.d/docker-ce.repo https://mirrors.ustc.edu.cn/docker-ce/linux/centos/docker-ce.repo

sed -i 's#download.docker.com#mirrors.ustc.edu.cn/docker-ce#g' /etc/yum.repos.d/docker-ce.repo

yum install docker-ce -y

docker的主要组成部分

docker是传统的CS架构分为docker client和docker server,向mysql一样

命令：docker version

[root@controller ~]# docker version
Client:
 Version:    17.12.-ce
 API version:    1.35
 Go version:    go1.9.2
 Git commit:    c97c6d6
 Built:    Wed Dec  ::
 OS/Arch:    linux/amd64

Server:
 Engine:
  Version:    17.12.-ce
  API version:    1.35 (minimum version 1.12)
  Go version:    go1.9.2
  Git commit:    c97c6d6
  Built:    Wed Dec  ::
  OS/Arch:    linux/amd64
  Experimental:    false

设置docker远程执行

systemd详解：http://www.ruanyifeng.com/blog/2016/03/systemd-tutorial-part-two.html

在linux-node1设置

vim /usr/lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd -H unix:///var/run/docker.sock -H tcp://10.0.0.11:2375

systemctl daemon-reload
systemctl restart docker.service

ps -ef检查

在linux-node2设置

wget -O /etc/yum.repos.d/docker-ce.repo https://mirrors.ustc.edu.cn/docker-ce/linux/centos/docker-ce.repo

sed -i 's#download.docker.com#mirrors.ustc.edu.cn/docker-ce#g' /etc/yum.repos.d/docker-ce.repo

yum install docker-ce -y

docker -H 10.0.0.11 info 　　　　---  远程执行 info 展示docker的信息

docker主要组件有：镜像、容器、仓库

启动第一个容器

命令：docker run -d -p 80:80 nginx

实操：

[root@docker-node1 ~]# docker run -d -p : nginx
Unable to find image 'nginx:latest' locally
latest: Pulling from library/nginx
e7bb522d92ff: Pull complete
6edc05228666: Pull complete
cd866a17e81f: Pull complete
Digest: sha256:285b49d42c703fdf257d1e2422765c4ba9d3e37768d6ea83d7fe2043dad6e63d
Status: Downloaded newer image for nginx:latest
e1cb110a537622e4a5c885161bca69478adc5d218e6eb4e0307c7fe0c1350012
#run： 创建并运行一个容器，
#-d：放在后台
#-p：端口映射
#80:80：前面是宿主机的，后面是容器的
#nginx：镜像的名字

docker的镜像管理

搜索镜像

命令：docker search

实操：

[root@docker-node1 ~]# docker search centos
NAME（镜像名）     DESCRIPTION（说明）             STARS（送心数）  OFFICIAL（是否是官方的）    AUTOMATED（是否自动）
centos             The official build of CentOS.                  [OK]

获取镜像

命令：docker pull

实操：

[root@docker-node1 ~]# docker pull centos    --- 拉取一个镜像centos（不指定版本默认为最新版，只写名字默认在官方拉取）
Using default tag: latest
latest: Pulling from library/centos
af4b0a2388c6: Pull complete
Digest: sha256:2671f7a3eea36ce43609e9fe7435ade83094291055f1c96d9d1d1d7c0b986a5d
Status: Downloaded newer image for centos:latest
[root@docker-node1 ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos              latest              ff426288ea90         weeks ago         207MB
nginx               latest              3f8a4339aadd         weeks ago         108MB

拉取非官网的镜像：

[root@docker-node1 ~]# docker pull index.tenxcloud.com/tenxcloud/httpd:2.4
2.4: Pulling from tenxcloud/httpd
8b87079b7a06: Downloading  .53MB/.36MB
a3ed95caeb02: Download complete
0c30bf087cf7: Download complete
79f2be53847c: Downloading  .14MB/.7MB
7063c4b35837: Download complete
5c27df81ae71: Download complete

镜像加速

镜像加速器：阿里云加速器，daocloud加速器，中科大加速器，Docker 中国官方镜像加速：https://registry.docker-cn.com

镜像加速配置：

vi /etc/docker/daemon.json
{
  "registry-mirrors": ["https://registry.docker-cn.com"]
}    

第三方docker镜像仓库，使用方法

docker pull index.tenxcloud.com/tenxcloud/httpd:latest

镜像操作

查看镜像

docker images

删除镜像

docker rmi  例子：docker image rm centos:latest

实操：

[root@docker ~]# docker image rm centos:latest （名字：版本）
Untagged: centos:latest
Untagged: centos@sha256:2671f7a3eea36ce43609e9fe7435ade83094291055f1c96d9d1d1d7c0b986a5d
Deleted: sha256:ff426288ea903fcf8d91aca97460c613348f7a27195606b45f19ae91776ca23d
Deleted: sha256:e15afa4858b655f8a5da4c4a41e05b908229f6fab8543434db79207478511ff7
[root@docker ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
nginx               latest              3f8a4339aadd         weeks ago         108MB

导出镜像

docker save  例子：docker image save centos > docker-centos7.4.tar.gz

实操：

[root@docker ~]# docker image save centos > docker-centos7..tar.gz
[root@docker ~]# ls docker-centos7..tar.gz
docker-centos7..tar.gz

导入镜像

docker load  例子：docker image load -i docker-centos7.4.tar.gz

实操：

[root@docker ~]# docker image load -i docker-centos7..tar.gz
e15afa4858b6: Loading layer  .8MB/.8MB
Loaded image: centos:latest
[root@docker ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos              latest              ff426288ea90         weeks ago         207MB
nginx               latest              3f8a4339aadd         weeks ago         108MB

查看镜像详细信息

[root@docker ~]# docker image inspect centos
[
    {
        "Id": "sha256:ff426288ea903fcf8d91aca97460c613348f7a27195606b45f19ae91776ca23d",
        "RepoTags": [
            "centos:latest"
        ],
        "RepoDigests": [],
        "Parent": "",
        "Comment": "",
        "Created": "2018-01-08T19:58:27.63047329Z",
        "Container": "dd31c81a4b47b90a14cf6d1c7389465060e390f12a0b71189d181a0458d8443f",
        "ContainerConfig": {
            "Hostname": "dd31c81a4b47",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
            ],
            "Cmd": [
                "/bin/sh",
                "-c",
                "#(nop) ",
                "CMD [\"/bin/bash\"]"
            ],
            "ArgsEscaped": true,
            "Image": "sha256:5a28642a68c5af8083107fca9ffbc025179211209961eae9b1f40f928331fa90",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {
                "build-date": "",
                "license": "GPLv2",
                "name": "CentOS Base Image",
                "vendor": "CentOS"
            }
        },
        "DockerVersion": "17.06.2-ce",
        "Author": "",
        "Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
            ],
            "Cmd": [
                "/bin/bash"
            ],
            "ArgsEscaped": true,
            "Image": "sha256:5a28642a68c5af8083107fca9ffbc025179211209961eae9b1f40f928331fa90",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {
                "build-date": "",
                "license": "GPLv2",
                "name": "CentOS Base Image",
                "vendor": "CentOS"
            }
        },
        "Architecture": "amd64",
        "Os": "linux",
        "Size": ,
        "VirtualSize": ,
        "GraphDriver": {
            "Data": {
                "DeviceId": "",
                "DeviceName": "docker-8:2-667845-6de21ff18b07a4a121111b78d105af3ae3d1eccf0d5bcf3dff957e3640a79dac",
                "DeviceSize": ""
            },
            "Name": "devicemapper"
        },
        "RootFS": {
            "Type": "layers",
            "Layers": [
                "sha256:e15afa4858b655f8a5da4c4a41e05b908229f6fab8543434db79207478511ff7"
            ]
        },
        "Metadata": {
            "LastTagTime": "0001-01-01T00:00:00Z"
        }
    }
]

查看镜像详细信息

Docker的容器管理

启动一个容器

docker run -d -p : nginx

查看启动的容器（两种方法）：

[root@docker-node1 ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                NAMES
75516b38df19        nginx               "nginx -g 'daemon of…"    hours ago         Up  hours          0.0.0.0:->/tcp   inspiring_euler

[root@docker-node1 ~]# docker container ls
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                NAMES
75516b38df19        nginx               "nginx -g 'daemon of…"    hours ago         Up  hours          0.0.0.0:->/tcp   inspiring_euler

显示所有状态的容器

[root@docker-node1 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                   PORTS                NAMES
75516b38df19        nginx               "nginx -g 'daemon of…"    hours ago         Up  hours               0.0.0.0:->/tcp   inspiring_euler
e1cb110a5376        nginx               "nginx -g 'daemon of…"    hours ago         Exited ()  hours ago                        thirsty_brattain

只显示容器id

[root@docker-node1 ~]# docker ps -a -q
7cef098bebc7
75516b38df19

查看容器ip

docker container inspect id或name

[root@docker-node1 ~]# docker container inspect 75516b38df19
[
    {
        "Id": "75516b38df194d00fbb2d5ce51316f621f76a1037a0fdf1d578d14498a68d8a3",
        "Created": "2018-01-31T12:12:06.387035752Z",
        "Path": "nginx",
        "Args": [
            "-g",
            "daemon off;"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": ,
            "ExitCode": ,
            "Error": "",
            "StartedAt": "2018-01-31T12:12:06.710448922Z",
            "FinishedAt": "0001-01-01T00:00:00Z"
        },
        "Image": "sha256:3f8a4339aadda5897b744682f5f774dc69991a81af8d715d37a616bb4c99edf5",
        "ResolvConfPath": "/var/lib/docker/containers/75516b38df194d00fbb2d5ce51316f621f76a1037a0fdf1d578d14498a68d8a3/resolv.conf",
        "HostnamePath": "/var/lib/docker/containers/75516b38df194d00fbb2d5ce51316f621f76a1037a0fdf1d578d14498a68d8a3/hostname",
        "HostsPath": "/var/lib/docker/containers/75516b38df194d00fbb2d5ce51316f621f76a1037a0fdf1d578d14498a68d8a3/hosts",
        "LogPath": "/var/lib/docker/containers/75516b38df194d00fbb2d5ce51316f621f76a1037a0fdf1d578d14498a68d8a3/75516b38df194d00fbb2d5ce51316f621f76a1037a0fdf1d578d14498a68d8a3-json.log",
        "Name": "/inspiring_euler",
        "RestartCount": ,
        "Driver": "devicemapper",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": null,
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "default",
            "PortBindings": {
                "80/tcp": [
                    {
                        "HostIp": "",
                        "HostPort": ""
                    }
                ]
            },
            "RestartPolicy": {
                "Name": "no",
                "MaximumRetryCount":
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": null,
            "CapDrop": null,
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "shareable",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": ,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": ,
            "Runtime": "runc",
            "ConsoleSize": [
                ,

            ],
            "Isolation": "",
            "CpuShares": ,
            "Memory": ,
            "NanoCpus": ,
            "CgroupParent": "",
            "BlkioWeight": ,
            "BlkioWeightDevice": [],
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": ,
            "CpuQuota": ,
            "CpuRealtimePeriod": ,
            "CpuRealtimeRuntime": ,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DeviceCgroupRules": null,
            "DiskQuota": ,
            "KernelMemory": ,
            "MemoryReservation": ,
            "MemorySwap": ,
            "MemorySwappiness": null,
            "OomKillDisable": false,
            "PidsLimit": ,
            "Ulimits": null,
            "CpuCount": ,
            "CpuPercent": ,
            "IOMaximumIOps": ,
            "IOMaximumBandwidth":
        },
        "GraphDriver": {
            "Data": {
                "DeviceId": "",
                "DeviceName": "docker-8:2-667845-d7559a9d1629b837315264d5191776a3583b745cbb270be66f15126659ea266d",
                "DeviceSize": ""
            },
            "Name": "devicemapper"
        },
        "Mounts": [],
        "Config": {
            "Hostname": "75516b38df19",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "80/tcp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "NGINX_VERSION=1.13.8-1~stretch",
                "NJS_VERSION=1.13.8.0.1.15-1~stretch"
            ],
            "Cmd": [
                "nginx",
                "-g",
                "daemon off;"
            ],
            "ArgsEscaped": true,
            "Image": "nginx",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {
                "maintainer": "NGINX Docker Maintainers <docker-maint@nginx.com>"
            },
            "StopSignal": "SIGTERM"
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "33eb47f2321af718ee6a7564f8ae8c9841719051efebb2dfdb8a206d19e83004",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": ,
            "Ports": {
                "80/tcp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": ""
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/33eb47f2321a",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "a4a179b29fb9cda0c6332579460dddc5fbc6e7f29dd5608ae9f5742701d4202e",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": ,
            "IPAddress": "172.17.0.2",
            "IPPrefixLen": ,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:02",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "12e101b4dd9dd0078bab6ed9ce9aaf2d7cca2e00e4a66b5629f088732d6698d0",
                    "EndpointID": "a4a179b29fb9cda0c6332579460dddc5fbc6e7f29dd5608ae9f5742701d4202e",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.2",
                    "IPPrefixLen": ,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": ,
                    "MacAddress": "02:42:ac:11:00:02",
                    "DriverOpts": null
                }
            }
        }
    }
]

查看容器

停止容器

docker container stop id或name
docker container kill id或name

实操：

[root@docker-node1 ~]# docker container stop 75516b38df19
75516b38df19
[root@docker-node1 ~]# docker container ls
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
[root@docker-node1 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                      PORTS               NAMES
75516b38df19        nginx               "nginx -g 'daemon of…"    hours ago         Exited ()  seconds ago                       inspiring_euler
e1cb110a5376        nginx               "nginx -g 'daemon of…"    hours ago         Exited ()  hours ago                          thirsty_brattain

总结：docker容器内的第一个进程必须一直处于前台运行的状态，否则这个容器，就会处于退出状态！

删除已关闭的容器

[root@docker-node1 ~]# docker container rm e1cb110a5376
e1cb110a5376

批量删除：

docker rm -f `docker ps -a -q`    -- 强制删除全部，包括启动中的

[root@docker-node1 ~]# docker rm `docker ps -a -q`    #只删除关闭状态的
7cef098bebc7
75516b38df19

交互式进入容器，分配终端

docker run -it nginx:latest /bin/bash

-i -t：--interactive --tty（直接进入容器）

[root@docker-node1 ~]# docker run -it nginx:latest /bin/bash
root@7cef098bebc7:/# ls
bin   dev  home  lib64    mnt  proc  run     srv  tmp  var
boot  etc  lib     media    opt  root  sbin  sys  usr

进入容器的方法

[root@docker-node1 opt]# docker run -it --name erlianzhang centos:latest
[root@b07f6aad08cd /]#

进入到存活的容器中

[root@docker ~]# docker attach erlianzhang
[root@b07f6aad08cd /]# 

exec方式必须指定起始命令 --- 推荐使用exec

[root@docker ~]# docker exec -it erlianzhang /bin/bash
[root@abcadd1250cb /]# ps -ef
UID         PID   PPID  C STIME TTY          TIME CMD
root                   : pts/    :: /bin/bash
root                  : pts/    :: /bin/bash
root                 : pts/    :: ps -ef

注意：进入容器中第一个命令一定要让容器夯住，否则会变成退出状态

暂时退出容器：ctrl+p，ctrl+q

回到容器：docker attach id或name

docker容器的网络访问

指定映射

    -p hostPort:containerPort
    -p ip:hostPort:containerPort
    -p ip::containerPort
    -p hostPort:containerPort:udp
    -p : –p :

随机映射

docker run -P

实操

docker run -d -p 888:80 nginx:latest

docker run -d -p 10.0.0.11:80:80 nginx:latest

[root@docker-node1 opt]# docker run -d -p : nginx:latest
1b177e8c6357ed08ddabb745b902a4e577e8c25e154a4b891dfa900b108dd4bd
[root@docker-node1 opt]# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp               0.0.0.0:              0.0.0.0:*               LISTEN      /sshd
tcp               10.0.0.11:          0.0.0.0:*               LISTEN      /dockerd
tcp6              :::                   :::*                    LISTEN      /sshd
tcp6              :::                  :::*                    LISTEN      /docker-proxy  

docker的数据卷管理

数据卷(文件或目录)

    -v /data
    -v src:dst

数据卷容器

    --volumes-from

实操：挂载数据卷在容器宿主机

[root@docker-node1 opt]# docker run -d -p : -v /data:/usr/share/nginx/html nginx:latest
884b2c093c5c59897bd55b0dcec36c882abdc99134f8fffed4cb5decda17327d

创建数据卷

[root@docker-node1 data]# docker volume ls
DRIVER              VOLUME NAME
local               qingge

手动将容器保存为镜像（制作镜像）

命令：docker commit

特权容器

docker run --privileged  -ti -e "container=docker"  -v /sys/fs/cgroup:/sys/fs/cgroup  centos:latest  /usr/sbin/init

保存为镜像

[root@docker-node1 ~]# docker commit ebfdf46f9f12 centos6-ssh
sha256:b917ca49263af6d4435dc3c144c214af29c56dad7256e4de7978ffd9a7e24f39
[root@docker-node1 ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos6-ssh         latest              b917ca49263a         seconds ago       315MB
httpd               2.4                 2e202f453940         days ago          179MB
centos              latest              ff426288ea90         weeks ago         207MB
nginx               latest              3f8a4339aadd         weeks ago         108MB
centos              6.8                 6704d778b3ba         months ago        195MB

dockerfile自动构建docker镜像

dockerfile主要组成部分：

    基础镜像信息       FROM：centos:6.8
    制作镜像操作指令   RUN yum install openssh-server -y
    容器启动时执行指令 CMD ["/bin/bash"]

dockerfile常用指令：

    FROM        这个镜像的妈妈是谁？  （指定基础镜像）
    MAINTAINER  告诉别人，谁负责养它？（指定维护者信息，可以没有）
    RUN         你想让它干啥         （在命令前面加上RUN即可）
    ADD         给它点创业资金       （COPY文件，会自动解压）
    WORKDIR     我是cd,今天刚化了妆  （设置当前工作目录）
    VOLUME      给它一个存放行李的地方（设置卷，挂载主机目录）
    EXPOSE      它要打开的门是啥     （指定对外的端口）
    CMD         奔跑吧，兄弟！       （指定容器启动后的要干的事情）

dockerfile其他指令：

    COPY             复制文件
    ENV              环境变量
    ENTRYPOINT       容器启动后执行的命令

实例：

此处在CMD处执行的是一个脚本，脚本内容大致是开启ssh服务并让ssh服务夯住，参数是-D，开启httpd服务

[root@docker-node1 ~]# cat /opt/base/Dockerfile
FROM centos:6.8
RUN yum install wget unzip php* httpd openssh-server -y
RUN cd /var/www/html/ && wget http://static.kodcloud.com/update/download/kodexplorer4.25.zip && unzip kodexplorer4.25.zip
RUN echo 'root:123456'|chpasswd
RUN echo 'ServerName 127.0.0.1:80' >>/etc/httpd/conf/httpd.conf
RUN /etc/init.d/sshd start
RUN chmod -Rf  /var/www/html/
RUN sed 's#Options Indexes FollowSymLinks#Options FollowSymLinks#g' /etc/httpd/conf/httpd.conf -i
COPY init.sh /init.sh
EXPOSE /tcp
EXPOSE /tcp
CMD ["/bin/bash","/init.sh"]
[root@docker-node1 ~]# ll /opt/base/
total
-rw-r--r--  root root  Feb   : Dockerfile
-rw-r--r--  root root   Feb   : init.sh
[root@docker-node1 ~]# docker image build -t centos6-yun .

docker image build -t centos6-yun /opt/base/Dockerfile

docker image build -t 指定一个自动构建的镜像标签 Dockerfile文件路径

参考其他的dockerfile

官方dockerfile或者时速云镜像广场

容器间的互联

    docker run -d -p : nginx
    docker run -it --link quirky_brown:web01 qstack/centos-ssh /bin/bash
    ping web01

使用docker运行zabbix-server

docker run --name mysql-server -t \
      -e MYSQL_DATABASE="zabbix" \
      -e MYSQL_USER="zabbix" \
      -e MYSQL_PASSWORD="zabbix_pwd" \
      -e MYSQL_ROOT_PASSWORD="root_pwd" \
      -d mysql:5.7 \
      --character-set-server=utf8 --collation-server=utf8_bin

docker run --name zabbix-java-gateway -t \
      -d zabbix/zabbix-java-gateway:latest

docker run --name zabbix-server-mysql -t \
      -e DB_SERVER_HOST="mysql-server" \
      -e MYSQL_DATABASE="zabbix" \
      -e MYSQL_USER="zabbix" \
      -e MYSQL_PASSWORD="zabbix_pwd" \
      -e MYSQL_ROOT_PASSWORD="root_pwd" \
      -e ZBX_JAVAGATEWAY="zabbix-java-gateway" \
      --link mysql-server:mysql \
      --link zabbix-java-gateway:zabbix-java-gateway \
      -p : \
      -d zabbix/zabbix-server-mysql:latest

docker run --name zabbix-web-nginx-mysql -t \
      -e DB_SERVER_HOST="mysql-server" \
      -e MYSQL_DATABASE="zabbix" \
      -e MYSQL_USER="zabbix" \
      -e MYSQL_PASSWORD="zabbix_pwd" \
      -e MYSQL_ROOT_PASSWORD="root_pwd" \
      --link mysql-server:mysql \
      --link zabbix-server-mysql:zabbix-server \
      -p : \
      -d zabbix/zabbix-web-nginx-mysql:latest

docker私有仓库

普通的registry

启动registry容器

docker run -d -p : --restart=always --name registry -v /opt/myregistry:/var/lib/registry  registry

修改配置文件

/etc/docker/daemon.json

{
  "registry-mirrors": ["https://registry.docker-cn.com"],
  "insecure-registries": ["10.0.0.11:5000"]
}

"insecure-registries": ["10.0.0.11:5000"]   ---- 将https转换成http

重启docker服务

systemctl restart docker.service

为镜像打标签

docker tag centos6-yun:latest 10.0.0.11:/erlianzhang/centos6-yun:latest

push推送镜像

docker push 10.0.0.11:/erlianzhang/centos6-yun:latest

带basic认证的registry

mkdir /opt/registry-var/auth/ -p
htpasswd  -Bbn erlianzhang   >> /opt/registry-var/auth/htpasswd
docker run -d -p : -v /opt/registry-var/auth/:/auth/ -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry

实操

yum install httpd-tools.x86_64 -y

[root@docker-node1 ~]# mkdir /opt/registry-var/auth/ -p
ASSWD_PATH=/auth/htpasswd registry
[root@docker-node1 ~]# htpasswd  -Bbn erlianzhang  >> /opt/registry-var/auth/htpassw
[root@docker-node1 ~]# docker run -d -p : -v /opt/registry-var/auth/:/auth/ -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry
589820e671fa51114bf9ccf143375bce7351a80f7035e571f4e8524a1096edbb
[root@docker-node1 ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
589820e671fa        registry            "/entrypoint.sh /etc…"    seconds ago      Up  seconds       0.0.0.0:->/tcp   confident_visvesvaraya
[root@docker-node1 ~]# docker push 10.0.0.11:/erlianzhang/centos6-yun:latest   --- 不验证就不能上传
The push refers to repository [10.0.0.11:/erlianzhang/centos6-yun]
f8508dc392c8: Preparing
f85b7909a4bc: Preparing
8b2d1868cde8: Preparing
ad87982f4b1b: Preparing
ac521dbe8cd3: Preparing
3d169f2d5cff: Waiting
6bad9d62f12a: Waiting
f28db075daf0: Waiting
e00c9229b481: Waiting
no basic auth credentials
[root@docker-node1 ~]# docker login 10.0.0.11:    --- 验证一下
Username: erlianzhang
Password:
Login Succeeded
[root@docker-node1 ~]# docker push 10.0.0.11:/erlianzhang/centos6-yun:latest   --- 再次上传就可以了
The push refers to repository [10.0.0.11:/erlianzhang/centos6-yun]
f8508dc392c8: Pushed
f85b7909a4bc: Pushed
8b2d1868cde8: Pushed
ad87982f4b1b: Pushed
ac521dbe8cd3: Pushed
3d169f2d5cff: Pushed
6bad9d62f12a: Pushed
f28db075daf0: Pushed
e00c9229b481: Pushed
latest: digest: sha256:46e0409381ef7c5922bc5c37b5888015ab415c0e7248e463323db361318e93bf size: 

验证

[root@docker-node1 ~]# cat .docker/config.json
{
    "auths": {
        "10.0.0.11:5000": {
            "auth": "b2xkYm95OjEyMzQ1Ng=="
        }
    },
    "HttpHeaders": {
        "User-Agent": "Docker-Client/17.12.0-ce (linux)"
    }
}

docker-compose（单机版的容器编排工具）

docker-compose简介

一句话：docker-compose是用来做docker的多容器控制

docker-compose 是什么

docker-compose是一个用来把docker自动化的东西。

有了docker-compose你可以把所有繁复的docker操作全都一条命令，自动化的完成。

详细指令参考：https://www.jianshu.com/p/2217cfed29d7

安装python环境

yum install -y python2-pip

详细指令：http://www.jianshu.com/p/2217cfed29d7

配置pip加速

[root@docker-node1 ~]# mkdir .pip
[root@docker-node1 ~]# vim ~/.pip/pip.conf
[global]
index-url = http://mirrors.aliyun.com/pypi/simple/

[install]
trusted-host=mirrors.aliyun.com

pip install docker-compose

配置文件

该配置文件是部署wordpress博客网站的

cd my_wordpress/
vi docker-compose.yml

version: ''

services:
   db:
     image: mysql:5.7
     volumes:
       - /data/db_data:/var/lib/mysql
     restart: always
     environment:
       MYSQL_ROOT_PASSWORD: somewordpress
       MYSQL_DATABASE: wordpress
       MYSQL_USER: wordpress
       MYSQL_PASSWORD: wordpress

   wordpress:
     depends_on:
       - db
     image: wordpress:latest
     volumes:
       - /data/web_data:/var/www/html
     ports:
       - "8000:80"
     restart: always
     environment:
       WORDPRESS_DB_HOST: db:
       WORDPRESS_DB_USER: wordpress
       WORDPRESS_DB_PASSWORD: wordpress

启动服务

#启动
docker-compose up
#后台启动
docker-compose up -d

docker配合haproxy负载

灰度重启容器，防止因为更新业务全部关闭容器

安装haproxy

yum install haproxy -y

修改配置文件

vi /etc/haproxy/haproxy.cfg

global
    log         127.0.0.1 local2
    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn
    user        haproxy
    group       haproxy
    daemon
    stats socket /var/lib/haproxy/stats level admin
defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option http-server-close
    option forwardfor       except 127.0.0.0/
    option                  redispatch
    retries
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn
listen stats
    mode http
    bind 0.0.0.0:
    stats enable
    stats uri     /haproxy-status
    stats auth    admin:
frontend frontend_www_example_com
    bind 10.0.0.11:
    mode http
    option httplog
    log global
    default_backend backend_www_example_com
backend backend_www_example_com
    option forwardfor header X-REAL-IP
    option httpchk HEAD / HTTP/1.0
    balance roundrobin
    server web-node1  10.0.0.11: check inter  rise  fall
    server web-node2  10.0.0.11: check inter  rise  fall 

启动服务

systemctl start haproxy

安装socat

yum install socat.x86_64 -y
echo "disable server backend_www_example_com/web-node3"|socat stdio /var/lib/haproxy/stats
echo "enable server backend_www_example_com/web-node3"|socat stdio /var/lib/haproxy/stats

利用测试页测试

<html>
    <head>
        <title>PHP测试</title>
    </head>
    <body>
        <?php  echo '<p>Hello World </p>'; ?>
        <?php  echo "访问的服务器地址是:"."<fontcolor=red>".$_SERVER['SERVER_ADDR']."</font>"."<br>";
        echo"访问的服务器域名是:"."<fontcolor=red>".$_SERVER['SERVER_NAME']."</font>"."<br>";
        ?>
    </body>
</html>

Docker网络类型

类型	说明
None	不为容器配置任何网络功能，没有网络 --net=none
Container	与另一个运行中的容器共享Network Namespace，--net=container:containerID
Host	与主机共享Network Namespace，--net=host
Bridge	Docker设计的NAT网络模型（默认类型）

Bridge默认docker网络隔离基于网络命名空间，在物理机上创建docker容器时会为每一个docker容器分配网络命名空间，并且把容器IP桥接到物理机的虚拟网桥上。

不为容器配置网络功能

此模式下创建容器是不会为容器配置任何网络参数的，如：容器网卡、IP、通信路由等，全部需要自己去配置。

[root@docker01 ~]# docker run  -it --network none busybox:latest  /bin/sh
/ # ip a
: lo: <LOOPBACK,UP,LOWER_UP> mtu  qdisc noqueue
    link/loopback ::::: brd :::::
    inet 127.0.0.1/ scope host lo
       valid_lft forever preferred_lft forever

与其他容器共享网络配置(Container）

此模式和host模式很类似，只是此模式创建容器共享的是其他容器的IP和端口而不是物理机，此模式容器自身是不会配置网络和端口，创建此模式容器进去后，你会发现里边的IP是你所指定的那个容器IP并且端口也是共享的，而且其它还是互相隔离的，如进程等。

[root@docker01 ~]# docker run  -it --network container:mywordpress_db_1  busybox:latest  /bin/sh
/ # ip a
: lo: <LOOPBACK,UP,LOWER_UP> mtu  qdisc noqueue
    link/loopback ::::: brd :::::
    inet 127.0.0.1/ scope host lo
       valid_lft forever preferred_lft forever
: eth0@if106: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu  qdisc noqueue
    link/ether ::ac::: brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.3/ brd 172.18.255.255 scope global eth0
       valid_lft forever preferred_lft forever

使用宿主机网络

此模式创建的容器没有自己独立的网络命名空间，是和物理机共享一个Network Namespace，并且共享物理机的所有端口与IP，并且这个模式认为是不安全的。、

[root@docker01 ~]# docker run  -it --network host  busybox:latest  /bin/sh

查看网络列表

[root@docker01 ~]# docker network list
NETWORK ID          NAME                  DRIVER              SCOPE
b15e8a720d3b        bridge                bridge              local
345d65b4c2a0        host                  host                local
bc5e2a32bb55        mywordpress_default   bridge              local
ebf76eea91bb        none                  null                local

用PIPEWORK为docker容器配置独立IP

参考文档：http://blog.csdn.net/design321/article/details/48264825

官方网站：https://github.com/jpetazzo/pipework

宿主环境：centos7.2

1、安装pipework

wget https://github.com/jpetazzo/pipework/archive/master.zip
unzip master.zip
cp pipework-master/pipework  /usr/local/bin/
chmod +x /usr/local/bin/pipework

2、配置网桥连接

安装桥接工具

yum install bridge-utils.x86_64 -y

修改网卡配置，实现桥接

# 修改eth0配置，让br0实现桥接
[root@docker01 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0
TYPE=Ethernet
BOOTPROTO=static
NAME=eth0
DEVICE=eth0
ONBOOT=yes
BRIDGE=br0

[root@docker01 ~]# cat /etc/sysconfig/network-scripts/ifcfg-br0
TYPE=Bridge
BOOTPROTO=static
NAME=br0
DEVICE=br0
ONBOOT=yes
IPADDR=10.0.0.100
NETMASK=255.255.255.0
GATEWAY=10.0.0.254
DNS1=223.5.5.5
# 重启网络
[root@docker01 ~]# /etc/init.d/network restart

3、运行一个容器镜像测试：

pipework br0 $(docker run -d -it -p : --name  httpd_pw httpd) 10.0.0.220/@10.0.0.254

在其他主机上测试端口及连通性

[root@docker01 ~]# curl 10.0.0.220
<html><body><h1>It works!</h1></body></html>
[root@docker01 ~]# ping 10.0.0.220 -c
PING 10.0.0.220 (10.0.0.220) () bytes of data.
 bytes from 10.0.0.220: icmp_seq= ttl= time=0.043 ms

4、再运行一个容器，设置网路类型为none：

pipework br0 $(docker run -d -it --net=none --name test httpd:2.4) 10.0.0.221/@10.0.0.254

进行访问测试

[root@docker01 ~]# curl 10.0.0.221
<html><body><h1>It works!</h1></body></html>

5、重启容器后需要再次指定：

pipework br0 testduliip  172.16.146.113/@172.16.146.1
pipework br0 testduliip01  172.16.146.112/@172.16.146.1

Docker跨主机通信之macvlan

创建macvlan网络

docker network create --driver macvlan --subnet 10.1.0.0/ --gateway 10.1.0.254 -o parent=eth0 macvlan_1

设置eth0的网卡为混杂模式

ip link set eth0 promisc on

创建使用macvlan网络的容器

docker run -it --network macvlan_1 --ip=10.1.0.210 busybox:latest /bin/sh

基于macvlan网络，还存有overlay网络

Dcoker跨主机通信之overlay 参考文档：http://www.cnblogs.com/CloudMan6/p/7270551.html

Docker镜像的生命周期图

docker企业级镜像仓库harbor

介绍

Harbor 是一个企业级的 Docker Registry，可以实现 images 的私有存储和日志统计权限控制等功能，并支持创建多项目(Harbor 提出的概念)，基于官方 Registry V2 实现。 通过地址：https://github.com/vmware/harbor/releases 可以下载最新的版本。  官方提供了两种版本：在线版和离线版。

安装步骤

容器管理

[root@docker01 harbor]# pwd
/opt/harbor
[root@docker01 harbor]# docker-compose stop

第一步：安装docker和docker-compose

下载harbor-offline-installer-v1.3.0.tgz

cd /opt && https://storage.googleapis.com/harbor-releases/harbor-offline-installer-v1.3.0.tgz
tar xf harbor-offline-installer-v1.3.0.tgz

第二步：修改主机及web界面密码

修改harbor.cfg配置文件

[root@docker01 harbor]# vim harbor.cfg
    ···
    hostname = 10.0.0.100
    harbor_admin_password = 123456
    ···

第三步：执行install.sh

[root@docker01 harbor]# ./install.sh

第四步：web登陆测试

镜像推送到仓库的指定项目

[root@docker02 ~]# docker  tag centos:6.8  10.0.0.100/clsn/centos6.:1.0
[root@docker02 ~]#
[root@docker02 ~]# docker images
REPOSITORY                  TAG                 IMAGE ID            CREATED             SIZE
busybox                     latest              5b0d59026729         days ago          .15MB
10.0.0.100/clsn/centos6.   1.0                 6704d778b3ba         months ago        195MB
centos                      6.8                 6704d778b3ba         months ago        195MB
[root@docker02 ~]# docker login 10.0.0.100
Username: admin
Password:
Login Succeeded

推送镜像

[root@docker02 ~]# docker push 10.0.0.100/clsn/centos6.
The push refers to repository [10.0.0.100/clsn/centos6.]
e00c9229b481: Pushing  .53MB/.5MB

转载注明出处，写这篇很累！！！