**
如何进入服务容器内部
**
##################################################################
使用exec命令进入
[root@foundation15 ~]# docker run -d --name vm1 nginx
41a0572cdd0e3b70e09ac9f74dcfc341c21ceef2c07dee714f0a24d94b1aa77f
[root@foundation15 ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
41a0572cdd0e nginx "nginx -g 'daemon ..." 4 seconds ago Up 3 seconds 80/tcp vm1
[root@foundation15 ~]# docker container exec -it vm1 bash
root@41a0572cdd0e:/#
##################################################################
##########################################################################
创建容器时直接打开交互界面shell
[root@foundation15 ~]# docker run -it --name vm2 nginx bash
root@d5f787395834:/# ls
bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var
##########################################################
**
使用supervisord同时打开多个服务
**
封装一个新的镜像
####################################################################
编写新的Dockerfile
FROM rhel7
EXPOSE 22 80
COPY yum.repo /etc/yum.repos.d/yum.repo
RUN rpmdb --rebuilddb&& yum install -y openssh-server supervisor openssh-clients httpd&& yum clean all root:westos | chpasswd
RUN echo root:westos | chpasswd
RUN ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -q -N ""
RUN ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -q -N ""
COPY supervisord.conf /etc/supervisord.conf
CMD ["/usr/bin/supervisord"]
ssh部分生产环境可以写在一起 但实验化环境为了清除了理解过程分开写
supervisord配置文件
[supervisord]
nodaemon=true
[program:sshd]
command=/usr/sbin/sshd -D
[program:httpd]
command=/usr/sbin/httpd
####################################################
######################################################
build创建新镜像即可
[root@foundation15 docker]# docker build -t rhel7:v3 .
Sending build context to Docker daemon 7.168 kB
Step 1/9 : FROM rhel7
---> 0a3eb3fde7fd
Step 2/9 : EXPOSE 22 80
---> Using cache
---> 1ec0317a22b7
Step 3/9 : COPY yum.repo /etc/yum.repos.d/yum.repo
---> Using cache
---> de3c79e1b8df
Step 4/9 : RUN rpmdb --rebuilddb&& yum install -y openssh-server supervisor openssh-clients httpd&& yum clean all root:westos | chpasswd
---> Using cache
---> 4b108c1cd6ab
Step 5/9 : RUN echo root:westos | chpasswd
---> Running in d549e2f4dc2d
---> 916e64011fea
Removing intermediate container d549e2f4dc2d
Step 6/9 : RUN ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -q -N ""
---> Running in 23d52c8a575c
---> cba68be457bc
Removing intermediate container 23d52c8a575c
Step 7/9 : RUN ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -q -N ""
---> Running in 200c813e6e7e
---> 6317ae0edd48
Removing intermediate container 200c813e6e7e
Step 8/9 : COPY supervisord.conf /etc/supervisord.conf
---> 2dd5c9ef0be1
Removing intermediate container 2666c11d86dd
Step 9/9 : CMD /usr/bin/supervisord
---> Running in 2a15083c3b60
---> 15846d8145b3
Removing intermediate container 2a15083c3b60
Successfully built 15846d8145b3
[root@foundation15 docker]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
rhel7 v3 15846d8145b3 13 seconds ago 202 MB
##################################################################
##################################################################
使用新镜像创建容器
[root@foundation15 docker]# docker run -d --name vm1 -v /tmp/docker/web/:/var/www/html rhel7:v3
5d6054ef42d8c01dfb9191b90ade1302fa85db3b12e6b775225623ed36bda53b
[root@foundation15 docker]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
5d6054ef42d8 rhel7:v3 "/usr/bin/supervisord" 2 seconds ago Up 2 seconds 22/tcp, 80/tcp vm1
##################################################################
##################################################################
测试
[root@foundation15 docker]# ssh 172.17.0.2
The authenticity of host '172.17.0.2 (172.17.0.2)' can't be established.
RSA key fingerprint is 38:a9:59:49:4b:2f:bc:32:25:81:72:ce:aa:67:b4:74.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.17.0.2' (RSA) to the list of known hosts.
root@172.17.0.2's password:
-bash-4.2# ip addr
-bash: ip: command not found
-bash-4.2# ^C
-bash-4.2# ^C
-bash-4.2# ^C
-bash-4.2# logout
Connection to 172.17.0.2 closed.
[root@foundation15 docker]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
5d6054ef42d8 rhel7:v3 "/usr/bin/supervisord" 50 seconds ago Up 50 seconds 22/tcp, 80/tcp vm1
[root@foundation15 docker]# curl 172.17.0.2
www.westos.org
##################################################################
**
doker中关于内存的使用
**
目前 Docker 支持内存资源限制选项
-m, --memory=""
Memory limit (format: <number>[<unit>]). Number is a positive integer. Unit can be one of b, k, m, or g. Minimum is 4M.
--memory-swap=""
Total memory limit (memory + swap, format: <number>[<unit>]). Number is a positive integer. Unit can be one of b, k, m, or g.
--memory-swappiness=""
Tune a container’s memory swappiness behavior. Accepts an integer between 0 and 100.
--shm-size=""
Size of /dev/shm. The format is <number><unit>. number must be greater than 0. Unit is optional and can be b (bytes), k (kilobytes), m (megabytes), or g(gigabytes). If you omit the unit, the system uses bytes. If you omit the size entirely, the system uses 64m.
根据实际需求设置,这里不作过多的介绍
--memory-reservation=""
Memory soft limit (format: <number>[<unit>]). Number is a positive integer. Unit can be one of b, k, m, or g.
--kernel-memory=""
Kernel memory limit (format: <number>[<unit>]). Number is a positive integer. Unit can be one of b, k, m, or g. Minimum is 4M.
kernel memory 没有特殊需求,则无需额外设置
--oom-kill-disable=false
Whether to disable OOM Killer for the container or not.
#####################################################################
使用stress来压力测试
[root@foundation15 ~]# docker run --rm -it --name vm1 -m 100M stress --vm 1 --vm-bytes 150M
stress: info: [1] dispatching hogs: 0 cpu, 0 io, 1 vm, 0 hdd
stress: dbug: [1] using backoff sleep of 3000us
stress: dbug: [1] --> hogvm worker 1 [7] forked
stress: dbug: [7] allocating 157286400 bytes ...
stress: dbug: [7] touching bytes in strides of 4096 bytes ...
stress: dbug: [7] freed 157286400 bytes
stress: dbug: [7] allocating 157286400 bytes ...
stress: dbug: [7] touching bytes in strides of 4096 bytes ...
stress: dbug: [7] freed 157286400 bytes
在物理机top查看使用情况
#######################################################################333
默认交换分区为物理内存的两倍 当压力测试大于两倍时 出现错误
[root@foundation15 ~]# docker run --rm -it --name vm1 -m 100M stress --vm 1 --vm-bytes 400M
stress: info: [1] dispatching hogs: 0 cpu, 0 io, 1 vm, 0 hdd
stress: dbug: [1] using backoff sleep of 3000us
stress: dbug: [1] --> hogvm worker 1 [7] forked
stress: dbug: [7] allocating 419430400 bytes ...
stress: dbug: [7] touching bytes in strides of 4096 bytes ...
stress: FAIL: [1] (416) <-- worker 7 got signal 9
stress: WARN: [1] (418) now reaping child worker processes
stress: FAIL: [1] (422) kill error: No such process
stress: FAIL: [1] (452) failed run completed in 2s
**
限制容器读写速度
**
##################################################################
[root@foundation15 ~]# docker run --rm -it --device-write-bps /dev/sda:10M ubuntu
root@6adf79762aa2:/# dd if=/dev/zero of=testfile bs=1M count=100 oflag=direct
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 9.9563 s, 10.5 MB/s
###############################################################
**
cgroup控制内存 cpu等参数
**
###################################################################
内存 cpu控制
[root@server0 mnt]# vim /etc/cgconfig.conf
group x1 {
memory {
memory.limit_in_bytes = 20480000;
memory.memsw.limit_in_bytes = 20480000;
}
}
group x2 {
cpu{
cpu.shares = 100;
}
}
在控制内存时 vim /etc/cgrules.conf
指定用户来限制内存使用
bobo:memapp1 memory x1/
bobo:memapp2 memory x2/
~
#################################################################
**
限制磁盘的读写速度
**
首先找到磁盘对应的id
[root@server0 ~]# ls -l /dev/vda
brw-rw---- 1 root disk 252, 0 Aug 21 14:25 /dev/vda
[root@server0 ~]# ls -l /dev/vda1
brw-rw---- 1 root disk 252, 1 Aug 21 14:25 /dev/vda1
如图 252:0 为vda 252:1为vda1的id
在写入配置文件即可
group x3 {
blkio {
blkio.throttle.read_bps_device = "252:0 1000000";
}
}
重启服务
cgexec -g blkio:x3 dd if=/dev/vda of=/dev/null &
iotop查看速度即可
**
搭建自己的本地仓库
**
#########################################################################
创建registry
[root@foundation15 ~]# docker run -d -p 5000:5000 -v /opt/registry:/var/lib/registry registry:2
Unable to find image 'registry:2' locally
2: Pulling from library/registry
4064ffdc82fe: Pull complete
c12c92d1c5a2: Pull complete
4fbc9b6835cc: Pull complete
765973b0f65f: Pull complete
3968771a7c3a: Pull complete
Digest: sha256:51bb55f23ef7e25ac9b8313b139a8dd45baa832943c8ad8f7da2ddad6355b3c8
Status: Downloaded newer image for registry:2
2436ae2d9ec2601ca0e49748506e3f2f6b0641cc111ddc34b281d64639ea3e65
#############################################################
##################################################################
将nginx作为测试镜像放入本地仓库中
docker push localhost:5000/nginx
The push refers to a repository [localhost:5000/nginx]
08d25fa0442e: Pushed
a8c4aeeaa045: Pushed
cdb3f9544e4c: Pushed
latest: digest: sha256:2de9d5fc6585b3f330ff5f2c323d2a4006a49a476729bbc0910b695771526e3f size: 948
在仓库中查看
[root@foundation15 registry]# ls
docker
#############################################################
#######################################################################
查看镜像文件
看到已经添加进去
[root@foundation15 registry]# docker images
REPOSITORY TAG IMAGE ID
localhost:5000/nginx latest c82521676580 3 weeks ago 109 MB
nginx latest c82521676580 3 weeks ago 109 MB
registry 2 b2b03e9146e1 6 weeks ago 33.3 MB
game2048 latest 19299002fdbe 20 months ago 55.5 MB
ubuntu latest 07c86167cdc4 2 years ago 188 MB
stress latest db646a8f4087 4 years ago 282 MB
rhel7 latest 0a3eb3fde7fd 4 years ago 140 MB
###################################################################3
为了便于区分 将原有的nginx删除
[root@foundation15 registry]# docker rmi nginx
Untagged: nginx:latest
Untagged: nginx@sha256:d85914d547a6c92faa39ce7058bd7529baacab7e0cd4255442b04577c4d1f424
在将新的loalninx改名
[root@foundation15 registry]# docker tag localhost:5000/nginx ninx
在删除localhostnginx
[root@foundation15 registry]# docker rmi localhost:5000/nginx
Untagged: localhost:5000/nginx:latest
Untagged: localhost:5000/nginx@sha256:2de9d5fc6585b3f330ff5f2c323d2a4006a49a476729bbc0910b695771526e3f
查看镜像 只有nginx了
[root@foundation15 registry]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
ninx latest c82521676580 3 weeks ago 109 MB
registry 2 b2b03e9146e1 6 weeks ago 33.3 MB
game2048 latest 19299002fdbe 20 months ago 55.5 MB
ubuntu latest 07c86167cdc4 2 years ago 188 MB
stress latest db646a8f4087 4 years ago 282 MB
rhel7 latest 0a3eb3fde7fd 4 years ago 140 MB
至此 基本的搭建完成
####################################################################
**
逻辑卷的挂载
**
####################################################################
在不指定本地目录时 使用dokcer自行指定的逻辑卷作为挂载点存储数据
和指定挂载点并没有太大区别
查看所有挂载过的逻辑卷 因为删除容器后没有同时删除逻辑卷挂载 所以u可以看到许多残留
[root@foundation15 ~]# docker volume ls
DRIVER VOLUME NAME
local 10b21ff1335efa3ed71077f41ef9b36a52918382c4009964b038569c6b5c1058
local 435f78e48a9515559435de3a779c95325c386668e74a5c18d3903a57cd2f8f5c
local b9a591dcba34c93c3564aa2d13611438d8e4f665b544df0811f8eb568b611729
local ce3ce97cdb37b3241bf6fabe6ecb916fcd53c553ea8ae931667010874385d704
local dbe20bc0669457137e7027e4ec24bb3e159e25613e087f6f8e0c8f4f19a7ff20
local fd42632d66a12a2f647ea3b1a843833eb00298feb4e4c66aa054f43369c5bf19
删除所有残留
[root@foundation15 ~]# docker volume rm `docker volume ls -q `
10b21ff1335efa3ed71077f41ef9b36a52918382c4009964b038569c6b5c1058
435f78e48a9515559435de3a779c95325c386668e74a5c18d3903a57cd2f8f5c
b9a591dcba34c93c3564aa2d13611438d8e4f665b544df0811f8eb568b611729
ce3ce97cdb37b3241bf6fabe6ecb916fcd53c553ea8ae931667010874385d704
dbe20bc0669457137e7027e4ec24bb3e159e25613e087f6f8e0c8f4f19a7ff20
fd42632d66a12a2f647ea3b1a843833eb00298feb4e4c66aa054f43369c5bf19
[root@foundation15 ~]# docker volume ls
DRIVER VOLUME NAME
################################################################
#################################################################
不指定挂载点测试
[root@foundation15 ~]# docker run -d --name vm1 -v /usr/share/nginx/html nginx
Unable to find image 'nginx:latest' locally
latest: Pulling from library/nginx
Digest: sha256:d85914d547a6c92faa39ce7058bd7529baacab7e0cd4255442b04577c4d1f424
Status: Downloaded newer image for nginx:latest
2417e33adf7e6c411f3b9a0ab6f56422ff302bd4ff9a9339ee9ce6d55618d22a
看到doker自定义的挂载位置依然在物理机
[root@foundation15 ~]# docker inspect vm1|grep vol
"Type": "volume",
"Source": "/var/lib/docker/volumes/18975c4e2e3bbd1cbcae8f376fd67e35e6b22a597ed8ff5b4ba7e6d28fbd3236/_data",
[root@foundation15 ~]# cd /var/lib/docker/volumes/18975c4e2e3bbd1cbcae8f376fd67e35e6b22a597ed8ff5b4ba7e6d28fbd3236/_data
[root@foundation15 _data]# ls
50x.html index.html
用镜像保存数据 使应用直接读取
Dockerfile
FROM rhel7
ADD html.tar /usr/share
VOLUME ["/usr/share/nginx/html"]
制作tar包用于add
tar zcvf html.tar nginx/
nginx目录中存放用于读取的数据
制作镜像
docker build -t rhel7:v5 .
create容器作为逻辑卷读取
docker create --name vol1 rhel7:v5 bash
创建新容器用逻辑卷读取数据
docker run -d --name vm3 --volumes-from vol1 nginx
curl测试即可
[root@foundation15 test]# curl 172.17.0.4
www.westos.org
www.westos.org
www.westos.org
www.westos.org
**
仓库https加密的解决
**
##################################################################3
https加密的解决
mkdir /etc/docker/certs
openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key -x509 -days 365 -out certs/domain.crt
再common那里选择自己的域名 westos.org
其他随便
运行私有仓库
docker run -d --restart=always --name registry -v `pwd`/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key -p 443:443 registry:2
WARNING: IPv4 forwarding is disabled. Networking will not work.
dda9f7f81a451c40cd7618238c40cd18b2e918571cafa44dcd7b1e8407bafd1d
######################################################################3
[root@foundation15 docker]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
dda9f7f81a45 registry:2 "/entrypoint.sh /e..." 8 seconds ago Up 6 seconds 0.0.0.0:443->443/tcp, 5000/tcp registry
#########################################################################3
将产生的证书发送给系统和doker
系统
[root@foundation15 certs]# cd /etc/pki/ca-trust/source/anchors/
[root@foundation15 anchors]# cp /etc/docker/certs/domain.crt .
[root@foundation15 anchors]# ls
domain.crt
#################################################################
doker证书
[root@foundation15 certs]# cp domain.crt ../certs.d/westos.org/ca.crt
###############################################################
重启下服务
推动镜像
[root@foundation15 westos.org]# docker tag game2048 westos.org/game2048
[root@foundation15 westos.org]# docker push westos.org/game2048
The push refers to a repository [westos.org/game2048]
latest: digest: sha256:31a46998f55ed03da6d62197f3a91b0a100c0abdd7380d88142ea44bce325001 size: 1364
查看镜像是否添加进去
[root@foundation15 westos.org]# docker images |grep game
game2048 latest 19299002fdbe 20 months ago 55.5 MB
westos.org/game2048 latest 19299002fdbe 20 months ago 55.5 MB
仓库搭建完成
######################################################################
虚拟机使用私有仓库
需要将钥匙发送给虚拟机
虚拟机没有目录直接将所有目录发送即可
[root@foundation15 westos.org]# scp -r /etc/docker/certs.d/ root@172.25.15.20:/etc/docker/
虚拟机添加解析 即可
172.25.15.250 westos.org
#########################################################################
测试拉取镜像
[root@server1 ~]# docker pull westos.org/game2048
Using default tag: latest
latest: Pulling from game2048
28c417e954d8: Pull complete
0fa119b15092: Pull complete
445374954ee8: Pull complete
732a5643c5cf: Pull complete
1c5c2056838a: Pull complete
Digest: sha256:31a46998f55ed03da6d62197f3a91b0a100c0abdd7380d88142ea44bce325001
Status: Downloaded newer image for westos.org/game2048:latest
创建认证
$ mkdir auth
$ docker run \
--entrypoint htpasswd \
registry:2 -Bbn test westos > auth/htpasswd
如果加密没有取消对应部分即可
docker run -d \
-p 5000:5000 \
--restart=always \
--name registry \
-v `pwd`/auth:/auth \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
-v `pwd`/certs:/certs \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
registry:2
docker login myregistrydomain.com:5000
添加第一部的认证用户 就可以下载或上传
**
compose的使用
**
创建compose目录 用于存放配置
测试使用apache与nginx来测试 将需要的网页文件存放在web中
haproxy的配置文件在对应目录下
[root@foundation15 compose]# ls
docker-compose.yml haproxy web
编写compose配置文件
apache:
image: rhel7:v1
expose:
- 80
volumes:
- ./web:/var/www/html
nginx:
image: nginx
expose:
- 80
haproxy:
image: haproxy
volumes:
- ./haproxy:/usr/local/etc/haproxy(创建容器是需要配置的文件从本地拷贝过去即可)
links:
- apache
- nginx
ports:
- "8080:80"(本机端口80被httpd占用 使用其他空闲端口即可)
expose:
- 80
在haprxoy目录下编写配置文件
global
log 127.0.0.1 local0
log 127.0.0.1 local1 notice
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
stats uri /status
frontend balancer
bind 0.0.0.0:80
default_backend web_backends
backend web_backends
balance roundrobin
server web1 nginx:80 check
server web2 apache:80 check
测试
[root@foundation15 haproxy]# curl 172.25.254.77:8080
第一次为nginx界面
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
[root@foundation15 haproxy]# curl 172.25.254.77:8080
第二次为apache中拷贝过去的网页
www.westos.org
测试成功 在compose端可以看到访问数据
[root@foundation15 haproxy]# docker-compose up
Creating compose_nginx_1 ... done
Creating compose_apache_1 ... done
Creating compose_haproxy_1 ... done
Attaching to compose_apache_1, compose_nginx_1, compose_haproxy_1
apache_1 | AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.3. Set the 'ServerName' directive globally to suppress this message
haproxy_1 | <7>haproxy-systemd-wrapper: executing /usr/local/sbin/haproxy -p /run/haproxy.pid -f /usr/local/etc/haproxy/haproxy.cfg -Ds
nginx_1 | 172.17.0.5 - - [22/Aug/2018:05:00:03 +0000] "GET / HTTP/1.1" 200 612 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" "-"
nginx_1 | 172.17.0.5 - - [22/Aug/2018:05:00:03 +0000] "GET / HTTP/1.1" 200 612 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" "-"
nginx_1 | 172.17.0.5 - - [22/Aug/2018:05:04:49 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.29.0" "-"
在浏览器中打开状态界面
关闭nginx测试
网页状态看到nginx关闭 网页只能浏览apache
在打开nginx
网页恢复