镜像编排
Dockerfile详解
指令 说明
FROM 指定基础镜像(唯一)
RUN 在容器内执行命令,可以写多条
ADD 把文件拷贝的容器内,如果文件是 tar.xx 格式,会自动解压
COPY 把文件拷贝的容器内,不会自动解压
ENV 设置启动容器的环境变量
WORKDIR 设置启动容器的默认工作目录(唯一)
CMD 容器默认的启动参数(唯一)
ENTRYPOINT 容器默认的启动命令(唯一)
USER 启动容器使用的用户(唯一)
EXPOSE 使用镜像创建的容器默认监听使用的端口号/协议
语法案例(1)
# 编写 Dockerfile
[root@docker ~]# mkdir myimg
[root@docker ~]# vim myimg/Dockerfile
FROM mylinux:latest
CMD ["/bin/ls", "-l"]
# 创建镜像
[root@docker ~]# docker build -t img1:latest myimg
......
Successfully tagged img1:latest
[root@docker ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
img1 latest 9278f72f8cb1 5 seconds ago 249MB
mylinux latest e3b3d26bf0da 21 hours ago 249MB
rockylinux 8.5 210996f98b85 13 months ago 205MB
# 查看镜像分层信息
[root@docker ~]# docker history img1:latest
IMAGE CREATED CREATED BY SIZE
9278f72f8cb1 11 seconds ago /bin/sh -c #(nop) CMD ["/bin/sh"] 0B
e3b3d26bf0da 21 hours ago /bin/bash 44.8MB
210996f98b85 13 months ago /bin/sh -c #(nop) CMD ["/bin/bash"] 0B
<missing> 13 months ago /bin/sh -c #(nop) ADD file:790b4c6a174560d47… 205MB
# 创建容器
[root@docker ~]# docker run -it --rm img1:latest
total 48
lrwxrwxrwx 1 root root 7 Oct 11 2021 bin -> usr/bin
drwxr-xr-x 5 root root 360 Feb 5 04:21 dev
drwxr-xr-x 1 root root 4096 Feb 5 04:21 etc
drwxr-xr-x 2 root root 4096 Oct 11 2021 home
......
# 传递参数命令,覆盖 CMD 执行
[root@docker ~]# docker run -it --rm img1:latest id
uid=0(root) gid=0(root) groups=0(root)
语法案例(2)
# ENTRYPOINT 与 CMD 执行方式为 ${ENTRYPOINT} ${CMD}
[root@docker ~]# vim myimg/Dockerfile
FROM mylinux:latest
ENTRYPOINT ["echo"]
CMD ["/bin/ls", "-l"]
# 创建镜像
[root@docker ~]# docker build -t img2:latest myimg
......
Successfully tagged img2:latest
# CMD 做为参数传递,在容器内执行了 echo '/bin/ls -l'
[root@docker ~]# docker run -it --rm img2:latest
/bin/ls -l
# CMD 被替换,在容器内执行了 echo id
[root@docker ~]# docker run -it --rm img2:latest id
id
- 脚本的执行结果是什么?
[root@docker ~]# vim img.sh
#!/bin/bash
typeset ENTRYPOINT=${ENTRYPOINT} CMD=${CMD}
${ENTRYPOINT} ${@:-${CMD}}
[root@docker-0002 ~]# chmod 0755 img.sh
[root@docker-0002 ~]# ./img.sh
[root@docker-0002 ~]# CMD='ls -l' ./img.sh
total 789224
-rwxr-xr-x 1 root root 83 Jul 4 09:46 img.sh
-rw-r--r-- 1 root root 600 Dec 30 2021 info.php
drwxr-xr-x 2 root root 4096 Jul 4 09:26 mying
-rw------- 1 root root 258137600 Jul 3 16:58 mylinux.tar
-rw------- 1 root root 338711552 Jul 3 17:34 myweb.tar
drwxr-xr-x 3 root root 4096 Feb 12 23:25 public
-rw------- 1 root root 211289600 Jul 3 11:01 rockylinux.tar
[root@docker-0002 ~]# ENTRYPOINT="echo" CMD='ls -l' ./img.sh
ls -l
[root@docker-0002 ~]# CMD='ls -l' ./img.sh cat /etc/redhat-release
Rocky Linux release 8.5 (Green Obsidian)
[root@docker-0002 ~]# ENTRYPOINT="echo" CMD='ls -l' ./img.sh cat /etc/redhat-release
cat /etc/redhat-release
语法案例(3)
# 制作测试文件
[root@docker ~]# tar -cf myimg/myfile.tar -C /etc hosts issue
# 编辑Dockerfile
[root@docker ~]# vim myimg/Dockerfile
FROM mylinux:latest
COPY myfile.tar /var/tmp/
ADD myfile.tar /tmp/
ENV mymsg="Hello World"
RUN id && touch /tmp/file1
USER nobody
RUN id && touch /tmp/file2
WORKDIR /tmp
CMD ["/bin/bash"]
# 创建镜像
[root@docker ~]# docker build -t img3:latest myimg
......
Successfully built eb8b669cbe7c
Successfully tagged img3:latest
# 运行测试
[root@docker ~]# docker run -it --rm img3:latest
# 环境变量可以直接调用
bash-4.4$ echo ${mymsg}
Hello World
# 使用 COPY 进来的文件还是 tar 包
bash-4.4$ tree /var/tmp
/var/tmp
`-- myfile.tar
# 使用 ADD 添加的文件已经被解压了
bash-4.4$ tree /tmp
/tmp
|-- hosts
`-- issue
# WORKDIR 把工作目录设置到 /tmp
bash-4.4$ pwd
/tmp
# USER 指令设置使用 nobody 用户运行容器
bash-4.4$ id
uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
# USER 指令前创建的文件是 root 权限,之后是 USER 用户权限
bash-4.4$ ls -l /tmp/file?
-rw-r--r-- 1 root root 0 Feb 5 05:25 /tmp/file1
-rw-r--r-- 1 nobody nobody 0 Feb 5 05:25 /tmp/file2
apache镜像
- 拷贝php测试文件到 /root/ 目录下
rsync -av public/info.php 192.168.1.32:/root/
-
准备配置文件
[root@docker ~]# mkdir httpd
# 设置测试页面
[root@docker ~]# echo 'Welcome to The Apache.' >httpd/index.html
[root@docker ~]# cp -a info.php httpd/
[root@docker ~]# tar czf httpd/myweb.tar.gz -C httpd index.html info.php
# 获取配置文件
[root@docker ~]# docker run -itd --name myweb mylinux:latest
[root@docker ~]# docker exec -it myweb dnf install -y httpd
[root@docker ~]# docker cp myweb:/etc/httpd/conf.modules.d/00-mpm.conf httpd/
[root@docker ~]# docker rm -f myweb
# 修改配置文件
[root@docker ~]# sed -ri -e 's,^Load.*,#&,' -e 's,^#(.*mod_mpm_prefork.so)$,\1,' httpd/00-mpm.conf
制作镜像
# 编写 dockerfile 文件
[root@docker ~]# vim httpd/Dockerfile
FROM mylinux:latest
RUN dnf install -y httpd php && dnf clean all
ADD myweb.tar.gz /var/www/html/
COPY 00-mpm.conf /etc/httpd/conf.modules.d/
ENV LANG=C
WORKDIR /var/www/html/
EXPOSE 80/tcp
CMD ["/usr/sbin/httpd", "-DFOREGROUND"]
[root@docker ~]# docker build -t httpd:latest httpd
......
Successfully tagged httpd:latest
验证镜像
# 查看镜像并创建容器
[root@docker ~]# docker images httpd:latest
REPOSITORY TAG IMAGE ID CREATED SIZE
httpd latest c1e854cde1f4 About a minute ago 299MB
[root@docker ~]# docker run -itd --name myweb httpd:latest
cc2b82ad0367172c344c7207def94c4c438027c60859e94883e440b53a860a93
# 查看容器地址并访问验证
[root@docker ~]# docker inspect myweb |grep -i IPAddress
[root@docker ~]# curl http://172.17.0.2/info.php
<pre>
Array
(
[REMOTE_ADDR] => 172.17.0.1
[REQUEST_METHOD] => GET
[HTTP_USER_AGENT] => curl/7.61.1
[REQUEST_URI] => /info.php
)
php_host: 2fbc8c132f7f
1229
[root@docker ~]# docker rm -f myweb
nginx镜像
- 拷贝 public/nginx-1.22.1.tar.gz 到 docker 主机
rsync -av public/nginx-1.22.1.tar.gz 192.168.1.32:./
-
编译软件包
-
# 安装编译工具和依赖软件包 [root@docker ~]# dnf install -y openssl-devel pcre-devel gcc make # 编译安装 [root@docker ~]# tar zxf nginx-1.22.1.tar.gz [root@docker ~]# cd nginx-1.22.1/ [root@docker nginx-1.22.1]# ./configure --prefix=/usr/local/nginx --with-pcre --with-http_ssl_module [root@docker nginx-1.22.1]# make && make install # 设置默认首页 [root@docker nginx-1.22.1]# echo 'Nginx is running !' >/usr/local/nginx/html/index.html
制作镜像
[root@docker ~]# mkdir nginx
# 将编译好的 nginx 打包,这里必须使用相对路径
[root@docker ~]# tar czf nginx/nginx.tar.gz -C /usr/local nginx
[root@docker ~]# vim nginx/Dockerfile
FROM mylinux:latest
RUN dnf install -y pcre openssl && dnf clean all
ADD nginx.tar.gz /usr/local/
ENV PATH=${PATH}:/usr/local/nginx/sbin
WORKDIR /usr/local/nginx/html
EXPOSE 80/tcp
CMD ["nginx", "-g", "daemon off;"]
[root@docker ~]# docker build -t nginx:latest nginx
Successfully tagged nginx:latest
验证镜像
# 查看镜像并创建容器
[root@docker ~]# docker images nginx:latest
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 645dd2d9a8ec 3 minutes ago 274MB
[root@docker ~]# docker run -itd --name myweb nginx:latest
e440b53a860a93cc2b82ad0367172c344c7207def94c4c438027c60859e94883
# 查看容器地址并访问验证
[root@docker ~]# docker inspect myweb |grep -i IPAddress
[root@docker ~]# curl http://172.17.0.2/
Nginx is running !
# 查看 nginx 服务的用户
[root@docker ~]# docker exec -it myweb ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 15:48 pts/0 00:00:00 nginx: master process nginx
nobody 7 1 0 15:48 pts/0 00:00:00 nginx: worker process
root 32 0 0 15:49 pts/1 00:00:00 ps -ef
[root@docker ~]# docker rm -f myweb
php-fpm镜像
准备配置文件
# 获取配置文件
[root@docker ~]# mkdir php
[root@docker ~]# docker run -itd --name myphp mylinux:latest
[root@docker ~]# docker exec -it myphp dnf install -y php-fpm
[root@docker ~]# docker cp myphp:/etc/php-fpm.d/www.conf php/
[root@docker ~]# docker rm -f myphp
# 修改配置文件
[root@docker ~]# sed -ri 's,^(listen = ).*,\1127.0.0.1:9000,' php/www.conf
制作镜像
# 编写 dockerfile 文件
[root@docker ~]# vim php/Dockerfile
FROM mylinux:latest
RUN dnf install -y php-fpm && dnf clean all && \
mkdir -p /run/php-fpm /usr/local/nginx/html && \
chown -R nobody.nobody /run/php-fpm /var/log/php-fpm /usr/local/nginx/html
COPY www.conf /etc/php-fpm.d/www.conf
USER nobody
WORKDIR /usr/local/nginx/html
EXPOSE 9000/tcp
CMD ["/usr/sbin/php-fpm", "--nodaemonize"]
[root@docker ~]# docker build -t php-fpm:latest php
Successfully tagged php-fpm:latest
验证镜像
# 查看镜像并创建容器
[root@docker ~]# docker images php-fpm:latest
REPOSITORY TAG IMAGE ID CREATED SIZE
php-fpm latest b2404bd119b0 48 seconds ago 275MB
[root@docker ~]# docker run -itd --name myphp php-fpm:latest
6eeff6af4a6469c298944b2bdd2ba69f32ebcbc6cb683a0a05af4eefbf90e8c1
# 验证服务
[root@docker ~]# docker exec -it myphp /bin/bash
# 验证用户
bash-4.4$ id
uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
# 我们无法直接调用 php 服务,可以通过查看进程验证服务
bash-4.4$ ps -ef
UID PID PPID C STIME TTY TIME CMD
nobody 1 0 0 16:13 pts/0 00:00:00 php-fpm: master process (/etc/php-fpm.conf)
nobody 7 1 0 16:13 pts/0 00:00:00 php-fpm: pool www
nobody 8 1 0 16:13 pts/0 00:00:00 php-fpm: pool www
nobody 9 1 0 16:13 pts/0 00:00:00 php-fpm: pool www
nobody 10 1 0 16:13 pts/0 00:00:00 php-fpm: pool www
nobody 11 1 0 16:13 pts/0 00:00:00 php-fpm: pool www
nobody 12 0 0 16:13 pts/1 00:00:00 /bin/bash
nobody 19 12 0 16:13 pts/1 00:00:00 ps -ef
bash-4.4$ exit
[root@docker ~]# docker rm -f myphp
docker私有仓库
主机清单
主机名 ip地址 最低配置
registry 192.168.1.35 2CPU,4G内存
registry安装部署
# 在 registry 上安装私有仓库
[root@registry ~]# dnf install -y docker-distribution
# 启动私有仓库,并设置开机自启动
[root@registry ~]# systemctl enable --now docker-distribution
客户端配置
- 所有node节点都需要配置
-
[root@docker ~]# vim /etc/hosts 192.168.1.35 registry # 修改配置文件 [root@docker ~]# vim /etc/docker/daemon.json { "registry-mirrors": ["http://registry:5000", "镜像加速器地址"], "insecure-registries":["registry:5000"] } # 重启服务生效 [root@docker ~]# docker rm -f $(docker ps -aq) [root@docker ~]# systemctl restart docker
上传镜像
-
# 给 nginx 镜像设置标签 library默认使用的目录,下载镜像可以直接下载,不写路径 [root@docker ~]# docker tag nginx:latest registry:5000/img/myimg:web # 上传 nginx 镜像 [root@docker ~]# docker push registry:5000/img/myimg:web The push refers to repository [registry:5000/img/myimg] c9d01852a13b: Pushed ...... web: digest: sha256:3e1fc9ad1ee46ee4619c95dc9d71034d919e53abfc size: 952 # 上传 php-fpm 镜像 [root@docker ~]# docker tag php-fpm:latest registry:5000/img/myimg:php-fpm [root@docker ~]# docker push registry:5000/img/myimg:php-fpm The push refers to repository [registry:5000/img/myimg] 619c95dc93e1: Pushed ...... php-fpm: digest: sha256:619c95dc93e1fc9ad1ee46ee4d71034d919e53abfc size: 875 # 上传 httpd 镜像 [root@docker ~]# docker tag httpd:latest registry:5000/library/httpd:latest [root@docker ~]# docker push registry:5000/library/httpd:latest The push refers to repository [registry:5000/library/httpd] 95dc9d71034d: Pushed ...... latest: digest: sha256:95dc9d71034d919e53abfc3e1fc9ad1ee46ee4619c size: 968 # 下载 httpd 镜像 [root@docker ~]# docker pull registry:5000/library/httpd:latest
验证测试
-
查看镜像名称: curl http://仓库IP:5000/v2/_catalog 查看镜像标签: curl http://仓库IP:5000/v2/镜像路径/tags/list 使用易读格式: python3 -m json.tool # 查看仓库中所有镜像的名称 [root@docker ~]# curl http://registry:5000/v2/_catalog {"repositories":["img/myimg", "library/httpd"]} # 查看某一镜像的所有标签 [root@docker ~]# curl http://registry:5000/v2/img/myimg/tags/list {"name":"img/myimg","tags":["web", "php-fpm"]} # 易读格式查看镜像名称 [root@docker ~]# curl -s http://registry:5000/v2/_catalog |python3 -m json.tool { "repositories": [ "img/myimg", "library/httpd" ] } # 易读格式查看镜像标签 [root@docker ~]# curl -s http://registry:5000/v2/img/myimg/tags/list |python3 -m json.tool { "name": "img/myimg", "tags": [ "php-fpm", "web" ] }
创建容器
-
# 删除所有容器 [root@docker ~]# docker rm -f $(docker ps -aq) ...... # 删除所有镜像 [root@docker ~]# docker rmi $(docker images -q) ...... # 使用仓库中的镜像运行容器 [root@docker ~]# docker run -itd --rm registry:5000/img/myimg:web 2b7cd6d88a7665dbea0a4b3d99478e9f302c0a5661d7676d6d3bd3cb6d181 # library 是默认路径,可以省略路径地址 [root@docker ~]# docker run -itd --rm httpd:latest 634766f788d665dbea0a4b39709e0a2cc8624fd99478e9f302c0a5661d767