harbor软件包下载:https://github.com/search?q=harbor&type=repositories
拉取私有镜像仓库
1、上传镜像到私有仓库中
# 打标签
[root@docker01 ~]# docker tag centos:latest 192.168.2.100:5000/registry:v1
# 推送
[root@docker01 ~]# docker push 192.168.2.100:5000/registry:v1
The push refers to repository [192.168.2.100:5000/registry]
74ddd0ec08fa: Mounted from centos
v1: digest: sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc size: 529
[root@docker ~]# curl localhost:5000/v2/_catalog
{"repositories":["centos","registry"]}
从私有仓库中下载镜像到本地
# 安装docker
[root@docker ~]# cat << EOF | tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF
modprobe overlay
modprobe br_netfilter
[root@docker ~]# cat << EOF | tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF
[root@docker ~]# sysctl --system
[root@docker ~]# yum install -y yum-utils device-mapper-persistent-data lvm2
[root@docker ~]# yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
[root@docker ~]# yum install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y
# 配置/etc/docker/daemon.json ,指定私有仓库的位置
[root@docker ~]# vim /etc/docker/daemon{
"insecure-registries":[
"http://192.168.2.100:5000"
]
}
[root@docker2 ~]# systemctl restart docker
# 拉取私有仓库中的镜像
[root@docker2 ~]# docker pull 192.168.2.100:5000/registry:v1
v1: Pulling from registry
a1d0c7532777: Pull complete
Digest: sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc
Status: Downloaded newer image for 192.168.2.100:5000/registry:v1
192.168.2.100:5000/registry:v1
# 查看镜像列表
[root@docker2 ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
192.168.2.100:5000/registry v1 5d0da3dc9764 2 years ago 231MB
安装pip
为什么安装pip,因为要安装docker compose,它是docker的编排工具,ansible对多个主机编排,compose 对多个容器进行编排。
# 安装python-pip
[root@docker ~]# yum -y install python3-pip
# 查看所有的所有安装的包以及版本
[root@docker ~]# pip list
pip (8.1.2)
[root@2 ~]# python3 -m pip install --upgrade pip // 将pip工具升级到最新版本
[root@2 ~]# pip3 config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple
//设置pip3的全局配置
配置跨主机的容器网络连接
1)使用本机的ip地址和端口发布任务和通信
[root@docker ~]#systemctl start docker
[root@docker ~]# ip a s 3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default //mtu 1500表示一次接收不能超过1500
[root@docker ~]# docker run -d -p80:80 centos:nginx
[root@docker ~]# docker ps // 查看容器状态
[root@docker ~]# docker inspect 57 "IPAddress": "172.17.0.2", // 查看容器IP地址
[root@docker ~]# systemctl stop docker //停止容器服务
安装前是没有docker0的网卡的,bridge,默认nat,所有容器连接到桥就可以使⽤外⽹,使⽤nat让容器可以访问外⽹, 使⽤ ip a s指令查看桥,所有容器连接到此桥,ip地址都是 172.17.0.0/16⽹段,桥是启动docker服务后出现,在centos使⽤ bridge-utils安装,docker启动会生成新的虚拟网卡。
docker001:
bridge:这是默认的网络驱动程序,它创建一个虚拟网络桥接,容器连接到这个桥接,并且可以通过 IP 地址相互通信。
[root@docker001 ~]# yum -y install bridge-utils # 安装bridge-utils,用于创建和管理Linux网络桥接设备的工具
[root@docker001 ~]# yum provides *bin/brctl // 查看桥⽂件
[root@docker001 ~]# brctl show // 用于显示系统中已创建的网络桥接设备的信息
[root@docker ~]# docker ps -a // 查看容器状态
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
9d196b7190b3 registry:latest "/entrypoint.sh /etc…" 2 hours ago Exited (2) 3 minutes ago r2
[root@docker ~]# docker start r2 r2 // 开启r2容器
[root@docker ~]# docker network --help // 查看network的帮助信息
bridge name bridge id STP enabled interfaces
br-d026f3de4fec 8000.0242b81705e9 no
veth150cb70
veth1b80e45
veth451acfe
veth6d43b00
veth70c340d
veth7341776
veth87822ed
veth8b06afd
vethfc3f85d
docker0 8000.0242a3a8e91e no
[root@docker001 ~]# docker network --help
Usage: docker network COMMAND Manage networks
Commands:
connect Connect a container to a network
create Create a network
disconnect Disconnect a container from a network
inspect Display detailed information on one or more networks
ls List networks
prune Remove all unused networks
rm Remove one or more networks
Run 'docker network COMMAND --help' for more information on a command.
每⼀台dcoker host上的docker001所在网段完全⼀样,但是会造成跨主机的容器⽆法通信
host:
使用宿主机的网络堆栈,容器直接使用宿主机的网络接口,没有网络隔离。使用方便,直接使用宿主机的ip,若直接使用host,导致无法并行多个同类型的容器,与主机共享⽹络,可让容器连接外⽹ 所有容器与docker主机在同⼀个⽹络中,容器和外⽹相互访问。
[root@docker001 ~]# docker network ls
NETWORK ID NAME DRIVER SCOPE
01fa71620d73 bridge bridge local
d026f3de4fec harbor_harbor bridge local
f46543c13863 host host local
c220508b862f none null local
# 创建⼀个新的容器
[root@docker001 000]# docker run -d -p80 -v
/opt/:/usr/share/nginx/html/ centosnginx:v1 a4b6324a55e63a0966086a18519dd58fa26eaf91d0017d143d5 7f25312dfeb8
# 查看ip,默认在桥上
[root@docker001 000]# docker inspect a4b6|grep IPA
"SecondaryIPAddresses": null,
"IPAddress": "172.17.0.2",
"IPAMConfig": null,
"IPAddress": "172.17.0.2",
# 绑定其他的桥
[root@docker001 000]# docker run -d --network harbor_harbor centosnginx:v1 21a283fd5e684038d218892700e2b9689c0555bf2c59a554f00 554bd0daca55d
[root@docker001 000]# docker inspect 21a2|grep IPAdd "SecondaryIPAddresses": null, "IPAddress": "", "IPAddress": "172.19.0.11", # 使⽤--network对网桥的选择
# 绑定host主机⽹络
[root@docker001 001]# docker run -it --network host yum:v0 /bin/bash
[root@docker001 /]# yum -y install iprout
#内部查看ip是本地主机ip
# 外部查看ip 没有
[root@docker001 001]# docker inspect 306d|grep
IPAdd
"SecondaryIPAddresses": null,
"IPAddress": "",
"IPAddress": "",
主机名同真机,⽹络也同真机 优点:可以直接访问容器 缺点:端⼝占⽤,多容器同时运行⼀个服务,不建议,在测试环境中 使⽤。
none:
只保留lo网络,不能与外界链接,在高级应⽤中使⽤,lo网卡,⽆法链接外网。
# 创建两个容器,并查看它们的IP地址,发现它们是连续的
[root@docker ~]# docker run -it centos:latest /bin/bash
[root@5246f78f2d7d /]# [root@docker ~]#
[root@docker ~]# docker inspect 52
"IPAddress": "172.17.0.3",
[root@docker ~]# docker run -it centos:latest /bin/bash
[root@d0094ac22554 /]# [root@docker ~]#
[root@docker ~]# docker inspect d0
"IPAddress": "172.17.0.4",
# 创建一个network模式是host的容器
[root@docker ~]# docker run -it --network host centos:latest /bin/bash
[root@docker /]# [root@docker ~]#
# 查看容器的id号
[root@docker ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
64d033715cae centos:latest "/bin/bash" About a minute ago Up About a minute
# 查看容器的IP地址,发现并没有ip地址
[root@docker ~]# docker inspect 64
"IPAddress": "",
# 又创建一个network为host的容器
[root@docker ~]# docker run -it --network host centos:yum /bin/bash
# 容器直接覆盖源主机上
[root@docker /]# ls
bin etc lib lost+found mnt proc run srv tmp var
dev home lib64 media opt root sbin sys usr
# 下载安装iproute
[root@docker /]# yum -y install iproute
# 查看ip地址,发现IP地址为本机的地址,与源主机完全重合
[root@docker /]# ip a s
# 安装httpd
[root@docker /]# yum -y install httpd
# 首页输入数据
[root@docker /]# echo "hh" > /var/www/html/index.html
# 开启httpd服务,容器中不能使用systemctl
[root@docker /]# systemctl start httpd
报错
# 强制开启httpd服务
[root@docker /]# httpd -k start
成功
# 容器中访问
[root@docker /]#curl localhost
hh
# ctrl p q退出容器
# 关闭防火墙
[root@docker ~]# systemctl stop filewalld
浏览器访问测试
2)使用etcd数据库与flannel实现容器间的相互通信
====node1(主控)的配置======
搭建etcd数据库规定ip地址的范围,搭建flannel连通etcd数据库实现容器ip地址的规定范围分配,etcd是一个数据库,flannel负责ip的分配
[root@node1 ~]# yum -y install flannel etcd
[root@node1 ~]# vim /etc/etcd/etcd.conf //配置etcd的监听和通告客户端URL
# 指定了etcd服务在哪些地址和端口上监听来自客户端的连接请求
ETCD_LISTEN_CLIENT_URLS="http://0.0.0.0:2379,http://0.0.0.0:4001"# 指定etcd向其他节点和客户端通告的地址和端口
ETCD_ADVERTISE_CLIENT_URLS="http://10.0.0.11:2379,http://10.0.0.11:4001"
# 启动etcd服务
[root@node1 ~]# systemctl start etcd
# 查看端口是否启用
[root@node1 ~]# netstat -lntup | grep 4001
tcp6 0 0 :::4001 :::* LISTEN 1549/etcd[root@node1 ~]# netstat -lntup | grep 2379
tcp6 0 0 :::2379 :::* LISTEN 1549/etcd
# 设置etcd服务开机自启
[root@node1 ~]# systemctl enable etcd
Created symlink from /etc/systemd/system/multi-user.target.wants/etcd.service to /usr/lib/systemd/system/etcd.service.# 数据库测试,使用etcdctl工具进行键值对的设置和获取操作,将键为testdir/testkey0的值设置为1000
[root@node1 ~]# etcdctl set testdir/testkey0 1000 1000
# 获取键为testdir/testkey0的值
[root@node1 ~]# etcdctl get testdir/testkey0 1000
# 检查etcd集群的健康状态,通过指定-C http://10.0.0.11:4001参数,连接到IP地址为10.0.0.11的节点的4001端口进行检查
[root@node11 ~]# etcdctl -C http://10.0.0.11:4001 cluster-health
member 8e9e05c52164694d is healthy: got healthy result from http://10.0.0.11:2379
cluster is healthy
# 配置flanneld要访问的etcd数据库所在的位置
[root@node1 ~]# vim /etc/sysconfig/flanneld
FLANNEL_ETCD_ENDPOINTS="http://10.0.0.11:2379"
# 在etcd中创建一个特定路径的键值对,用于存储网络配置信息
[root@node1 ~]# etcdctl mk /atomic.io/network/config '{ "Network" : "172.20.0.0/16" }'
{ "Network" : "172.20.0.0/16" }
[root@node1 ~]# etcdctl get /atomic.io/network/config
{ "Network" : "172.20.0.0/16" }
# 启动flanneld
[root@node1 ~]# systemctl start flanneld
# 设置flanneld开机自启
[root@node1 ~]# systemctl enable flanneld
Created symlink from /etc/systemd/system/multi-user.target.wants/flanneld.service to /usr/lib/systemd/system/flanneld.service.
Created symlink from /etc/systemd/system/docker.service.wants/flanneld.service to /usr/lib/systemd/system/flanneld.service.
# 查看flanneld为本机分配的ip网段
[root@node1 ~]# ip a s
3: flannel0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1472 qdisc pfifo_fast state UNKNOWN group default qlen 500
link/none
inet 172.20.13.0/16 scope global flannel0
# 安装docker
[root@node1 ~]# sh docker.sh
# 开启容器
[root@node1 ~]# systemctl start docker
# 查看容器的所属网段
[root@node1 ~]# ip a s
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:88:a7:c7:69 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
[root@node1 ~]# cat /run/flannel/subnet.env
# 定义了Flannel网络的整体IP地址范围。在一个使用Flannel的容器网络环境中,所有容器的IP地址都将从这个范围内分配
FLANNEL_NETWORK=172.20.0.0/16
# 指定了当前节点在Flannel网络中的子网。这个子网将用于为当前节点上的容器分配IP地址
FLANNEL_SUBNET=172.20.13.1/24
# 设置了网络的最大传输单元(Maximum Transmission Unit)大小。MTU决定了一次可以在网络上传输的最大数据包大小。调整MTU可以优化网络性能,特别是在使用特定网络设备或协议时
FLANNEL_MTU=1472
# 当设置为false时,指示Flannel不进行IP伪装(IP Masquerading)。IP伪装通常用于在容器或虚拟机环境中,将内部网络的IP地址转换为外部可路由的 IP地址。在某些情况下,可能不需要进行IP伪装,或者有其他网络配置方式来处理网络通信
FLANNEL_IPMASQ=false
# 将flanneld分配的网段写入到daemon.json文件中
[root@node1 ~]# vim /etc/docker/daemon.json
{
"registry-mirrors" : [
"https://do.nark.eu.org",
"https://dc.j8.work",
"https://docker.m.daocloud.io",
"https://dockerproxy.com",
"https://docker.mirrors.ustc.edu.cn",
"https://docker.nju.edu.cn"
],
"host" : [
"tcp://0.0.0.0:2375",
"unix:///var/run/docker.sock"
],
"insecure-registries" : [
"http://10.0.0.100:5000"
],
"bip" : "172.20.13.1/24",
"mtu" : 1472
}
# 重启docker
[root@node1 ~]# systemctl restart docker
Job for docker.service failed because the control process exited with error code. See "systemctl status docker.service" and "journalctl -xe" for details.
[root@node1 ~]# vim /usr/lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd
# 更新配置文件
[root@node1 ~]# systemctl restart docker
[root@node1 ~]# systemctl daemon-reload
# 重启成功
[root@node1 ~]# systemctl restart docker
# flannel0的IP地址与docker0的IP地址属于一个网段
[root@node1 ~]# ip a s
# 拉取一个centos镜像
[root@node1 ~]# docker pull centos
[root@node1 ~]# systemctl stop firewalld
[root@node1 ~]# systemctl disable firewalld
[root@node1 ~]# setenforce 0
# 创建一个容器
[root@node1 ~]# docker run -it centos:latest /bin/bash
# 查看容器的ip地址,属于被flanneld分配网段的ip地址
[root@node1 ~]# docker inspect d89
"IPAddress": "172.20.13.2",
====node2(从控)的配置======
搭建flannel连通etcd数据库实现容器ip地址的规定范围分配,最后两个主机的容器进行相互通信
# 安装flannel
[root@node2 ~]#yum -y install flannel
# 修改flanneld配置文件,配置flannel要访问的etcd数据库所在的位置
[root@node2 ~]# vim /etc/sysconfig/flanneld
FLANNEL_ETCD_ENDPOINTS="http://10.0.0.11:2379"
# 启动服务
[root@node2 ~]# systemctl start flanneld
# 查看flanneld为本机所分配的网段信息
[root@node2 ~]# ip a s
5: flannel0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1472 qdisc pfifo_fast state UNKNOWN group default qlen 500
link/none
inet 172.20.82.0/16 scope global flannel0
# 安装配置docker
[root@node22 ~]# sh docker.sh
# 开启docker服务(守护进程)
[root@node22 ~]# systemctl start docker
# 查看docker的ip网段
[root@node22 ~]# ip a s
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:ce:a7:7c:ea brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
[root@node22 ~]# scp 10.0.0.11:/etc/docker/daemon.json /etc/docker/
# 查看flanneld的环境变量信息
[root@node2 ~]# cat /run/flannel/subnet.env
FLANNEL_NETWORK=172.20.0.0/16
FLANNEL_SUBNET=172.20.82.1/24
FLANNEL_MTU=1472
FLANNEL_IPMASQ=false
# 配置deamon文件
[root@node2 ~]# vim /etc/docker/daemon.json
{
"registry-mirrors" : [
"https://do.nark.eu.org",
"https://dc.j8.work",
"https://docker.m.daocloud.io",
"https://dockerproxy.com",
"https://docker.mirrors.ustc.edu.cn",
"https://docker.nju.edu.cn"
],
"host" : [
"tcp://0.0.0.0:2375",
"unix:///var/run/docker.sock"
],
"insecure-registries" : [
"http://10.0.0.100:5000"
],
# "bip"代表 Backend IP,Flannel为所在节点分配的子网的起始IP地址
"bip" : "172.20.82.1/24",
"mtu" : 1472
}
# 修改docker.sock
[root@node2~]# vim /usr/lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd
# 重载deamon文件
[root@node2 ~]# systemctl daemon-reload
# 重启docker服务
[root@node2 ~]# systemctl restart docker
# 查看docker的IP地址与flannel的IP地址,属于同一网段
[root@node2 ~]# ip a s
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1472 qdisc noqueue state DOWN group default
link/ether 02:42:ce:a7:7c:ea brd ff:ff:ff:ff:ff:ff
inet 172.20.82.1/24 brd 172.20.82.255 scope global docker0
5: flannel0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1472 qdisc pfifo_fast state UNKNOWN group default qlen 500
link/none
inet 172.20.82.0/16 scope global flannel0
# 拉取镜像
[root@node2 ~]# docker pull centos
# 创建容器
[root@node2 ~]# docker run -it centos:latest
# ping node1中的容器的ip地址
[root@2b47b26a7286 /]# ping 172.20.13.2