docker2

https://github.com/docker/distribution

daocloud

数人云

时速云

http://jpetazzo.github.io/2014/06/23/docker-ssh-considered-evil/　　容器为什么不用ssh去连接

https://github.com/jpetazzo/nsenter　　同上

https://segmentfault.com/a/1190000002931564　　Docker 环境 Storage Pool 用完解决方案：resize-device-mapper

http://www.oschina.net/news/57894/daocloud

http://blog.csdn.net/qinyushuang/article/details/43342553　　Docker学习笔记（3）-- 如何使用Dockerfile构建镜像

http://geek.csdn.net/news/detail/35121　　　　　　docker镜像

http://www.csdn.net/article/2014-11-18/2822693　　镜像与容器分析

http://www.blogjava.net/yongboy/archive/2013/12/12/407498.html　　Docker学习笔记之一，搭建一个JAVA Tomcat运行环境

DOCKER_STORAGE_OPTIONS=-s devicemapper --storage-opt dm.datadev=/home/dock-data --storage-opt dm.metadatadev=/home/dock-meta

为了解决报错，要设置以上变量

结果却明白了字符设备与块设备的区别，以上创建的是一个普通文件，也就是一个字符设备，

[root@docker1 ~]# docker run busybox /bin/echo Hello Docker
Usage of loopback devices is strongly discouraged for production use. Either use `--storage-opt dm.thinpooldev` or use `--storage-optl dm.no_warn_on_loop_devices=true` to suppress this warning.

The warning message occurs because your Docker storage configuration is using a "loopback device" -- a virtual block device such as /dev/loop0 that is actualled backed by a file on your filesystem. This was never meant as anything more than a quick hack to get Docker up and running quickly as a proof of concept.

You don't want to suppress the warning; you want to fix your storage configuration such that the warning is no longer issued. The easiest way to do this is to assign some local disk space for use by Docker's devicemapper storage driver and use that.

If you're using LVM and have some free space available on your volume group, this is relatively easy. For example, to give docker 100G of space, first create a data and metadata volume:

# lvcreate -n docker-data -L 100G /dev/my-vg
# lvcreate -n docker-metadata -L1G /dev/my-vg

And then configure Docker to use this space by editing /etc/sysconfig/docker-storage to look like:

DOCKER_STORAGE_OPTIONS=-s devicemapper --storage-opt dm.datadev=/dev/my-vg/docker-data --storage-opt dm.metadatadev=/dev/my-vg/docker-metadata

If you're not using LVM or don't have free space available on your VG, you could expose some other block device (e.g., a spare disk or partition) to Docker in a similar fashion.

DOCKER_STORAGE_OPTIONS=-s devicemapper --storage-opt dm.datadev=/home/dock-data --storage-opt dm.metadatadev=/home/dock-meta

[root@kvm1 docker]# touch  dock-data
[root@kvm1 docker]# touch dock-meta
[root@kvm1 docker]# systemctl start docker
[root@kvm1 docker]# systemctl status docker -l
docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; disabled; vendor preset: disabled)
   Active: inactive (dead) since Thu 2016-06-16 21:09:37 CST; 7s ago
     Docs: http://docs.docker.com
  Process: 9190 ExecStart=/bin/sh -c /usr/bin/docker-current daemon $OPTIONS            $DOCKER_STORAGE_OPTIONS            $DOCKER_NETWORK_OPTIONS            $ADD_REGISTRY            $BLOCK_REGISTRY            $INSECURE_REGISTRY            2>&1 | /usr/bin/forward-journald -tag docker (code=exited, status=0/SUCCESS)
 Main PID: 9190 (code=exited, status=0/SUCCESS)

Jun 16 21:09:36 kvm1.zf.com systemd[1]: Starting Docker Application Container Engine...
Jun 16 21:09:36 kvm1.zf.com forward-journal[9194]: Forwarding stdin to journald using Priority Informational and tag docker
Jun 16 21:09:37 kvm1.zf.com forward-journal[9194]: time="2016-06-16T21:09:37.023360992+08:00" level=error msg="Error getblockdevicesize: inappropriate ioctl for device"
Jun 16 21:09:37 kvm1.zf.com forward-journal[9194]: time="2016-06-16T21:09:37.023710458+08:00" level=fatal msg="Error starting daemon: error initializing graphdriver: Can't get data size Can't get block size"
Jun 16 21:09:37 kvm1.zf.com systemd[1]: Started Docker Application Container Engine.

Jun 16 21:08:12 kvm1.zf.com forward-journal[9050]: Forwarding stdin to journald using Priority Informational and tag docker
Jun 16 21:08:12 kvm1.zf.com forward-journal[9050]: time="2016-06-16T21:08:12.586347689+08:00" level=fatal msg="Error starting daemon: error initializing graphdriver: open /home/docker/dock-data: is a directory"

构建镜像

构建镜像的两种方法：
    使用docker commit 命令
    使用docker build命令和Dockerfile文件
Dockerfile更抢到、灵活，推荐使用。
一般来说不是真的“创建”新镜像，而是基于一个已有的基础镜像，比如Ubuntu、Fedora等，构建新的镜像而已。从零构建一个全新的镜像可参考这篇文章
https://docs.docker.com/engine/userguide/eng-image/baseimages/　　从头构建镜像--create a base image

运行，修改，保存镜像，然后上传到私服上，就可以作为公共镜像来被下载使用了。
 1261  docker run -it centos bash
 1263  docker ps -l
 1264  docker commit 949 centos-man
 1265  docker images

镜像地址

echo “DOCKER_OPTS=\”\$DOCKER_OPTS –registry-mirror=http://your-id.m.daocloud.io -d\”” >> /etc/default/docker

sudo sed -i 's|other_args="|other_args="--registry-mirror=http://a984be05.m.daocloud.io |g' /etc/sysconfig/docker
sudo sed -i "s|OPTIONS='|OPTIONS='--registry-mirror=http://a984be05.m.daocloud.io |g" /etc/sysconfig/docker
sudo sed -i 'N;s|\[Service\]\n|\[Service\]\nEnvironmentFile=-/etc/sysconfig/docker\n|g' /usr/lib/systemd/system/docker.service
sudo sed -i 's|fd://|fd:// $other_args |g' /usr/lib/systemd/system/docker.service

sudo systemctl daemon-reload
sudo service docker restart

搭建私服

http://lishaofengstar.blog.163.com/blog/static/131972852201411585441354/
这篇博客讨论了如何部署一个带 SSL 加密、HTTP 验证并有防火墙防护的私有 Docker Registry 。Docker Registry是一个存储和分享 Docker 镜像的服务。本文中我们使用的操作系统是 Ubuntu，任何支持 Upstart 的系统都可以。我们用 Nginx 作为 Docker Registry 的前端代理服务器，同时也用 Nginx 完成 SSL 加密和基本的 HTTP 验证。我们用 Gunicorn 运行 Docker Registry 并用 Upstart 管理 Gunicorn。我们还用 Redis 实现一个 LRU(Least Recently Used，近期最少使用算法) 缓存机制来减少 Docker Registry 和硬盘之间的数据存取。

https://github.com/docker/distribution/blob/master/docs/deploying.md

$ docker pull samalba/docker-registry
$ docker run -d -p 5000:5000 samalba/docker-registry
# 我们先pull下来一个简单的镜像（或者自己做一个也可以）
$ docker pull busybox
$ docker tag busybox localhost:5000/busybox
$ docker push localhost:5000/busybox

https://segmentfault.com/a/1190000000801162
docker-registry既然也是软件应用，自然最简单的方法就是使用官方提供的已经部署好的镜像registry。官方文档中也给出了建议，直接运行sudo docker run -p 5000:5000 registry命
令。这样确实能启动一个registry服务器，但是所有上传的镜像其实都是由docker容器管理，放在了/var/lib/docker/....某
个目录下。而且一旦删除容器，镜像也会被删除。因此，我们需要想办法告诉docker容器镜像应该存放在哪里。registry镜像中启动后镜像默认位置
是/tmp/registry，因此直接映射这个位置即可，比如到本机的/opt/data/registry目录下。

[root@kvm2 mnt]# docker run -d -p 5000:5000 -v /root/my_registry:/tmp/registry registry

先做一个私服，顺便就启动了。通过下面的docker ps可以看到。
[root@kvm2 mnt]# docker run -d -p 5000:5000 --restart=always --name registry registry:2
Unable to find image 'registry:2' locally
Trying to pull repository docker.io/library/registry ... 2: Pulling from library/registry
17bd2058e0c6: Pull complete
3f0d3d140ce1: Pull complete
47339bdfc690: Pull complete
03a7f8ec3d4f: Pull complete
d2501a6dc689: Pull complete
9ca18bbd0cd5: Pull complete
dd0dda9b2298: Pull complete
79ec4549598b: Pull complete
5d322e774cf2: Pull complete
Digest: sha256:c5455f3918e5235e641bb6d8dc8ff0780df197d5df12c589bf0c283e25fc0650
Status: Downloaded newer image for docker.io/registry:2

cf3554af4427c2700fbc2ffecf02332cf4087dd07c8da53ebf0dd54db9d2323a
Usage of loopback devices is strongly discouraged for production use. Either use `--storage-opt dm.thinpooldev` or use `--storage-opt dm.no_warn_on_loop_devices=true` to suppress this warning.
[root@kvm2 mnt]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
cf3554af4427        registry:2          "/bin/registry serve "   10 seconds ago      Up 8 seconds        0.0.0.0:5000->5000/tcp   registry

查看镜像，多了个registry:2
[root@kvm2 mnt]# docker images
REPOSITORY           TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
centos-man           latest              44cc4eec11d1        About an hour ago   282.4 MB
docker.io/registry   2                   5d322e774cf2        7 days ago          171.5 MB
docker.io/httpd      latest              6bce6ad2c6a9        9 days ago          198.5 MB
docker.io/centos     latest              a65193109361        2 weeks ago         196.7 MB

将本地的centos-man打标为man
为需要push到私有registry的image打tag
[root@kvm2 mnt]# docker tag centos-man localhost:5000/man
[root@kvm2 mnt]# docker images
REPOSITORY           TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
localhost:5000/man   latest              44cc4eec11d1        About an hour ago   282.4 MB
centos-man           latest              44cc4eec11d1        About an hour ago   282.4 MB
docker.io/registry   2                   5d322e774cf2        7 days ago          171.5 MB
docker.io/httpd      latest              6bce6ad2c6a9        9 days ago          198.5 MB
docker.io/centos     latest              a65193109361        2 weeks ago         196.7 MB
然后将本地的man推送到私服里
[root@kvm2 mnt]# docker push localhost:5000/man
The push refers to a repository [localhost:5000/man] (len: 1)
44cc4eec11d1: Pushed
a65193109361: Pushed
df0fc3863fbc: Pushed
latest: digest: sha256:9b95cacf2aa3a4fb25ed897dd7233cd135708d527cde54d86119e221a7f8201f size: 4621

docker1上命令顺序

存储
制作本地其他分区存储或VG，而不使用loop设备
[root@localhost ~]# vi /usr/lib/docker-storage-setup/docker-storage-setup 
[root@localhost ~]# docker-storage-setup

镜像
sed -i "s|OPTIONS='|OPTIONS='--registry-mirror=http://a984be05.m.daocloud.io |g" /etc/sysconfig/docker
systemctl restart docker

私服
docker run -d -p 5000:5000 --restart=always --name registry registry:2
docker pull httpd 
   31  docker run -p 8076:80 -d -it httpd
   35  docker exec eb7 ls /usr/local/apache2/htdocs
   37  docker cp index.html eb7:/usr/local/apache2/htdocs
   38  docker commit eb7 httpd-gai
   39  docker images
   40  docker ps
   41  docker tag httpd-gai localhost:5000/gai
   42  docker ps
   43  docker images
   44  docker push localhost:5000/gai
docker2上命令顺序

制作本地其他分区存储或VG，而不使用loop设备

[root@localhost ~]# vi /usr/lib/docker-storage-setup/docker-storage-setup 
[root@localhost ~]# docker-storage-setup

以下是在另外一个机器上拉取pull刚才在上面主机上发布push的镜像
先修改下面这个文件，去掉注释，加入ip，因为使用的是https
[root@my graph]# vi /etc/sysconfig/docker
INSECURE_REGISTRY='--insecure-registry 192.168.1.22:5000'

然后再拉取,运行，修改文件，浏览器测试访问，
[root@my graph]# docker pull 192.168.1.22:5000/man
  698  docker run -d -p 7965:80 192.168.10.112:5000/gai 
  699  docker ps
  700  ip addr
  701  docker ps
  702  vi index.html
  703  docker cp index.html 8d0:/usr/local/apache2/htdocs

看json格式文件用cat json |python -mjson.tool

[root@kvm2 1544084fad81e27c28a8c12c08b2439451fd1e745e38c1dcecd862d240c4235e]# pwd
/var/lib/docker/graph/1544084fad81e27c28a8c12c08b2439451fd1e745e38c1dcecd862d240c4235e
[root@kvm2 1544084fad81e27c28a8c12c08b2439451fd1e745e38c1dcecd862d240c4235e]# cat json |python -mjson.tool
{
    "container_config": {
        "AttachStderr": false,
        "AttachStdin": false,
        "AttachStdout": false,
        "Cmd": [
            "/bin/sh -c #(nop) MAINTAINER The CentOS Project <cloud-ops@centos.org>"
        ],
        "Domainname": "",
        "Entrypoint": null,
        "Env": null,
        "Hostname": "",
        "Image": "",
        "Labels": null,
        "OnBuild": null,
        "OpenStdin": false,
        "StdinOnce": false,
        "Tty": false,
        "User": "",
        "Volumes": null,
        "WorkingDir": ""
    },
    "created": "2015-09-07T19:05:48.678585881Z",
    "layer_id": "sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4"
}
[root@kvm2 1544084fad81e27c28a8c12c08b2439451fd1e745e38c1dcecd862d240c4235e]# cat json
{"container_config":{"Hostname":"","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["/bin/sh -c #(nop) MAINTAINER The CentOS Project \u003ccloud-ops@centos.org\u003e"],"Image":"","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"created":"2015-09-07T19:05:48.678585881Z","layer_id":"sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4"}[root@kvm2 1544084fad81e27c28a8c12c08b2439451fd1e745e38c1dcecd862d240c4235e]#

[root@kvm2 graph]# docker images -tree
flag provided but not defined: -tree
See '/usr/bin/docker-current images --help'.

[root@kvm2 graph]# ll
total 0
drwx------ 2 root root 93 Jun 17 14:30 1544084fad81e27c28a8c12c08b2439451fd1e745e38c1dcecd862d240c4235e
drwx------ 2 root root 93 Jun 17 15:00 a3d54b467fad81f4b33c161c8a227c66cb45733ba5bbfdd971942083e6c666c7
drwx------ 2 root root 93 Jun 17 15:00 a65193109361c1c55a0baa79c2167ec417b977f284b3358f4d50b81e22f84ec5
drwx------ 2 root root 93 Jun 17 15:00 df0fc3863fbc60ba8576521b1ecb89133e66941ceef9b57716ccda2454c9e6fc
drwx------ 2 root root  6 Jun 17 15:00 _tmp

总共4层，一层依赖于一层
[root@kvm2 graph]# docker images -a
REPOSITORY          TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
docker.io/centos    latest              a65193109361        2 weeks ago         196.7 MB
<none>              <none>              a3d54b467fad        2 weeks ago         196.7 MB
<none>              <none>              df0fc3863fbc        2 weeks ago         196.7 MB
<none>              <none>              1544084fad81        9 months ago        0 B

最后，当从一个镜像启动容器时，Docker会在该镜像的最顶层加载一个读写文件系统。我们想在Docker中运行的程序就是在这个读写层中执行的。
从上面我们可以知道容器的writable 层是保存在以容器ID为名的长ID目录里的，而ID+init后缀目录是保存容器的初始信息的。
构建镜像中很重要的一环就是如何共享和发布镜像。可以将镜像推送到Docker Hub或者用户自己的私有Registry中。为了完成这项工作，需要在Docker Hub上创建一个账号

[root@kvm2 docker]# docker-storage-setup
ERROR: Docker has been previously configured for use with devicemapper graph driver. Not creating a new thin pool as existing docker metadata will fail to work with it. Manual cleanup is required before this will succeed.
INFO: Docker state can be reset by stopping docker and by removing /var/lib/docker directory. This will destroy existing docker images and containers and all the docker metadata.
[root@kvm2 docker]# docker images

[root@kvm2 lib]# systemctl stop docker
[root@kvm2 lib]# rm -rf /var/lib/docker/

[root@kvm2 lib]# docker-storage-setup
  Rounding up size to full physical extent 956.00 MiB
  Volume group "centos" has insufficient free space (16 extents): 239 required.
[root@kvm2 lib]# vgdisplayr
  --- Volume group ---
  VG Name               centos
  System ID
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  4
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                3
  Open LV               3
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               931.02 GiB
  PE Size               4.00 MiB
  Total PE              238341
  Alloc PE / Size       238325 / 930.96 GiB
  Free  PE / Size       16 / 64.00 MiB
  VG UUID               njw2Ue-6opd-mjxl-7wVW-reJE-wAMf-54yF4t

所以先要留出一些分区空间，才能使用上面的命令，因为docker-storage-setup这个命令要使用块设备。

[root@localhost ~]# lvremove -v /dev/docker/docker-data
    Using logical volume(s) on command line.
Do you really want to remove active logical volume docker-data? [y/n]: y
    Removing docker-docker--data (253:2)
    Archiving volume group "docker" metadata (seqno 2).
    Releasing logical volume "docker-data"
    Creating volume group backup "/etc/lvm/backup/docker" (seqno 3).
  Logical volume "docker-data" successfully removed

如果不修改/usr/lib/docker-storage-setup/docker-storage-setup这个文件的DEVS和VG行，就会出现下面的报错。
[root@localhost ~]# docker-storage-setup 
  Rounding up size to full physical extent 52.00 MiB
  Volume group "centos" has insufficient free space (11 extents): 13 required.

一定修改/usr/lib/docker-storage-setup/docker-storage-setup这个文件，修改/etc/sysconfig/docker-storage-setup这个文件会报各种问题

# cat <<EOF > /etc/sysconfig/docker-storage-setup
DEVS=/dev/vdb
VG=docker-vg
EOF

下面的是给定的VG容量不够的输出。
[root@localhost ~]# docker-storage-setup 
  Rounding up size to full physical extent 52.00 MiB
  Logical volume "docker-poolmeta" created.
INFO: DATA_SIZE=40%FREE is smaller than MIN_DATA_SIZE=2G. Will create data volume of size specified by MIN_DATA_SIZE.
  Logical volume "docker-pool" created.
  WARNING: Converting logical volume docker/docker-pool and docker/docker-poolmeta to pool's data and metadata volumes.
  THIS WILL DESTROY CONTENT OF LOGICAL VOLUME (filesystem etc.)
  Converted docker/docker-pool to thin pool.
  Logical volume "docker-pool" changed.

[root@localhost ~]# vi /usr/lib/docker-storage-setup/docker-storage-setup 
[root@localhost ~]# docker-storage-setup 
  Rounding up size to full physical extent 24.00 MiB
  Logical volume "docker-poolmeta" created.
  Logical volume "docker-pool" created.
  WARNING: Converting logical volume docker/docker-pool and docker/docker-poolmeta to pool's data and metadata volumes.
  THIS WILL DESTROY CONTENT OF LOGICAL VOLUME (filesystem etc.)
  Converted docker/docker-pool to thin pool.
  Logical volume "docker-pool" changed.

上面启动好后，fdisk -l 会发现下面的几个卷，而在/var/lib/docker/devicemapper/下面已没有devicemapper子目录，证明没有用/dev/loop0和/dev/loop1两个回环设备。
Disk /dev/mapper/docker-docker--pool_tmeta: 25 MB, 25165824 bytes, 49152 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk /dev/mapper/docker-docker--pool_tdata: 8577 MB, 8577351680 bytes, 16752640 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk /dev/mapper/docker-docker--pool: 8577 MB, 8577351680 bytes, 16752640 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 524288 bytes / 524288 bytes

Disk /dev/mapper/docker-253:0-34783213-a931702e612b6d6e2c6cb63d93f9ae19a5c309e6eb18443e32bf52f01ebabb21: 107.4 GB, 107374182400 bytes, 209715200 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 524288 bytes / 524288 bytes

[root@localhost lvm]# docker-storage-setup 
ERROR: Found LVM2_member signature on device /dev/vdb at offset 0x218. Wipe signatures using wipefs or use WIPE_SIGNATURES=true and retry.
[root@localhost lvm]# vi /etc/sysconfig/docker-storage-setup 
[root@localhost lvm]# docker-storage-setup 
INFO: Wipe Signatures is set to true. Any signatures on /dev/vdb will be wiped.
wipefs: error: /dev/vdb: probing initialization failed: Device or resource busy
ERROR: Failed to wipe signatures on device /dev/vdb

[root@localhost ~]# docker-storage-setup 
Checking that no-one is using this disk right now ...
OK

Disk /dev/vdb: 104025 cylinders, 16 heads, 63 sectors/track
sfdisk:  /dev/vdb: unrecognized partition table type

Old situation:
sfdisk: No partitions found

New situation:
Units: sectors of 512 bytes, counting from 0

   Device Boot    Start       End   #sectors  Id  System
/dev/vdb1          2048 104857599  104855552  8e  Linux LVM
/dev/vdb2             0         -          0   0  Empty
/dev/vdb3             0         -          0   0  Empty
/dev/vdb4             0         -          0   0  Empty
Warning: partition 1 does not start at a cylinder boundary
Warning: partition 1 does not end at a cylinder boundary
Warning: no primary partition is marked bootable (active)
This does not matter for LILO, but the DOS MBR will not boot this disk.
Successfully wrote the new partition table

Re-reading the partition table ...

If you created or changed a DOS partition, /dev/foo7, say, then use dd(1)
to zero the first 512 bytes:  dd if=/dev/zero of=/dev/foo7 bs=512 count=1
(See fdisk(8).)
  Physical volume "/dev/vdb1" successfully created
  Volume group "docker1" successfully created
ERROR: Old mode of passing data and metadata logical volumes to docker is not supported. Exiting.

aufs:
AUFS (AnotherUnionFS) 是一种Union FS，简单来说就是支持将不同目录挂载到同一个虚拟文件系统下的文件系统。Aufs driver是Docker最早支持的driver，但是aufs只是Linux内核的一个补丁集，而且不太可能会被加入到Linux内核中。但是由于aufs是唯一一个可以实现容器间共享可执行代码和运行库的storage driver，所以当你跑成千上百个拥有相同程序代码或者运行库的时候，aufs是个相当不错的选择。

device mapper：
Device mapper是Linux 2.6内核中提供的一种从逻辑设备到物理设备的映射框架机制，在该机制下，用户可以很方便的根据自己的需要制定实现存储资源的管理策略。
Device mapper driver会创建一个100G的简单文件包含你的镜像和容器。每一个容器被限制在10G大小的卷内， 可以调整。
你可以在启动Docker daemon时用参数-s 指定driver：docker -d -s devicemapper。

Btrfs:
Btufs driver 在Docker build时可以很高效。但是跟device mapper一样不支持设备间共享存储。

在没有aufs支持的Linux发行版本上（CentOS、openSUSE等），安装Docker可能就使用了device mapper driver。
查看你的Linux发行版有没有aufs支持：lsmod | grep aufs

最后，当从一个镜像启动容器时，Docker会在该镜像的最顶层加载一个读写文件系统。我们想在Docker中运行的程序就是在这个读写层中执行的。
从上面我们可以知道容器的writable 层是保存在以容器ID为名的长ID目录里的，而ID+init后缀目录是保存容器的初始信息的。
构建镜像中很重要的一环就是如何共享和发布镜像。可以将镜像推送到Docker Hub或者用户自己的私有Registry中。为了完成这项工作，需要在Docker Hub上创建一个账号

docker run -d -p 50001:22 ubuntu/ruby:v2 /usr/sbin/sshd -D
一般容器不开sshd

容器与主机互传文件两种方法：cp与-v

docker run -d -p 7965:80 192.168.10.112:5000/gai
将主机的目录挂在容器的/mnt下
#docker run -d -p 5000:5000 -v /root/my_registry:/tmp/registry registry
docker run -d -p 7965:80 -v /home/zf/:/mnt 192.168.10.112:5000/gai
./ent.sh 8d0

[root@my jj]# docker run -v /tmp/vol1 --name="vol2" -it 45b
[root@my jj]# docker ps -l
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                     PORTS               NAMES
3176547d7062        45b                 "bash"              12 seconds ago      Exited (0) 5 seconds ago                       vol2
[root@my jj]# docker start 317
317
[root@my jj]# docker ps
CONTAINER ID        IMAGE                       COMMAND              CREATED             STATUS              PORTS                  NAMES
3176547d7062        45b                         "bash"               28 seconds ago      Up 2 seconds                               vol2
c949de9826f5        192.168.1.22:5000/httpd-b   "httpd-foreground"   24 hours ago        Up 51 minutes       0.0.0.0:7975->80/tcp   jovial_engelbart
30b3bd502c74        192.168.1.22:5000/httpd-a   "httpd-foreground"   24 hours ago        Up 51 minutes       0.0.0.0:7965->80/tcp   ecstatic_kare
[root@my ~]# ./aa.sh 317
Last login: Tue Jun 21 07:45:04 UTC 2016
[root@3176547d7062 ~]# df -h
Filesystem                                                                                          Size  Used Avail Use% Mounted on
/dev/mapper/docker-253:0-67459471-3176547d70627f3a125f734ea145163eceaa367e45ad31534eef86be91d6ae60  100G  306M  100G   1% /
tmpfs                                                                                               493M     0  493M   0% /dev
tmpfs                                                                                               493M     0  493M   0% /sys/fs/cgroup
tmpfs                                                                                               493M     0  493M   0% /run/secrets
/dev/mapper/centos-root                                                                              48G  2.7G   45G   6% /tmp/vol1
shm                                                                                                  64M     0   64M   0% /dev/shm

与容器交互数据的不同方式

有-v方式本机目录与容器目录之间共享数据，查看对比如下

docker run -v /home/ff:/mnt/ -it 45b
[root@my ff]# cp /root/RanZhi.3.3.zbox_64.tar.gz ./
[root@my ff]# /root/aa.sh b7d
Last login: Tue Jun 21 08:00:31 UTC 2016
[root@b7d745dac2c4 ~]# cd /mnt/
[root@b7d745dac2c4 mnt]# ls
RanZhi.3.3.zbox_64.tar.gz  foef  passwd

[root@my ff]# cp /root/aa.sh ./
[root@my ff]# docker exec b7d ls /mnt
RanZhi.3.3.zbox_64.tar.gz
aa.sh
foef
passwd

有-v方式
docker run -v /tmp/vol1 --name="vol2" -it 45b
容器里面的路径是/tmp/vol1

[root@my ~]# docker inspect -f '{{.State.StartedAt}}' 317
2016-06-21T07:43:44.775004038Z

docker inspect -f '{{.Mounts}}' 317
获取volume在主机中的路径
touch /var/lib/docker/volumes/81557ef21a02e117585e41dba692a70eed5a9d7d96195679edc397e6dfecd835/_data/eif
所以只需要往_data这个目录里复制文件即可

数据卷共享，容器之间共享卷。
docker run -it --volumes-from 317 45b
这样会将上面容器317中的/tmp/vol1挂到新容器之中，因为新容器与317容器使用同一个卷，就是
/var/lib/docker/volumes/81557ef21a02e117585e41dba692a70eed5a9d7d96195679edc397e6dfecd835/_data

容器启动时没有-v选项，就用docker cp 来处理
[root@my ff]# docker cp /root/RanZhi.3.3.zbox_64.tar.gz c94:/usr/local/apache2/htdocs/
[root@my ff]# docker exec c94 ls /usr/local/apache2/htdocs
RanZhi.3.3.zbox_64.tar.gz
anaconda-ks.cfg
world.sql

交互脚本
主要利用nsenter.
util-linux包中含有nsenter.

[root@my ~]# ./aa.sh 30b
nsenter: failed to execute su: No such file or directory
如果出现上面的报错，只需要将脚本里的su改为/bin/su.原因是容器中的PATH 路径问题，使用/bin/su 即可。

#!/bin/sh

  if [ -e $(dirname "$0")/nsenter ]; then
    # with boot2docker, nsenter is not in the PATH but it is in the same folder
    NSENTER=$(dirname "$0")/nsenter
  else
    NSENTER=nsenter
  fi

  if [ -z "$1" ]; then
    echo "Usage: `basename "$0"` CONTAINER [COMMAND [ARG]...]"
    echo ""
    echo "Enters the Docker CONTAINER and executes the specified COMMAND."
    echo "If COMMAND is not specified, runs an interactive shell in CONTAINER."
  else
    PID=$(docker inspect --format "{{.State.Pid}}" "$1")
    if [ -z "$PID" ]; then
      exit 1
    fi
    shift

    OPTS="--target $PID --mount --uts --ipc --net --pid --"

    if [ -z "$1" ]; then
      # No command given.
      # Use su to clear all host environment variables except for TERM,
      # initialize the environment variables HOME, SHELL, USER, LOGNAME, PATH,
      # and start a login shell.
      "$NSENTER" $OPTS su - root
    else
      # Use env to clear all host environment variables.
      "$NSENTER" $OPTS env --ignore-environment -- "$@"
    fi
  fi

c/s本地与远程访问

vi /etc/sysconfig/docker
要使远程可以访问就加入-H 0.0.0.0:5555监听端口，否则就只能本地访问。
要本地与远程同时可以访问就加入-H 0.0.0.0:5555和-H unix:///var/run/docker.sock。
OPTIONS='-H 0.0.0.0:5555 --registry-mirror=http://a984be05.m.daocloud.io --registry-mirror=http://a984be05.m.daocloud.io --selinux-enabled'

docker -H 192.168.1.22:5555 images
docker -H 192.168.1.22:5555 ps

默认情况下，Docker守护进程会生成一个socket（/var/run/docker.sock）文件来进行本地进程通信，而不会监听任何端口，因此只能在本地使用docker客户端或者使用Docker API进行操作。
如果想在其他主机上操作Docker主机，就需要让Docker守护进程监听一个端口，这样才能实现远程通信。

修改Docker服务启动配置文件，添加一个未被占用的端口号，重启docker守护进程。

# vim /etc/sysconfig/docker
OPTIONS='-H 0.0.0.0:5555'
# systemctl restart docker

此时发现docker守护进程已经在监听5555端口，在另一台主机上可以通过该端口访问Docker进程了。

# docker -H IP:5555 images

但是我们却发现在本地操作docker却出现问题。

# docker images
FATA[0000] Cannot connect to the Docker daemon. Is 'docker -d' running on this host?

这是因为Docker进程只开启了远程访问，本地套接字访问未开启。我们修改/etc/sysconfig/docker，然后重启即可。

# vim /etc/sysconfig/docker
OPTIONS='-H unix:///var/run/docker.sock -H 0.0.0.0:5555'
# systemctl restart docker

现在本地和远程均可访问docker进程了。