云安全：docker 容器基本概念及其相关实践

一、docker介绍:

docker是一种容器，什么是容器：

A container is a standard unit of software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another. A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries and settings.

容器和虚拟机的区别：

Containers and virtual machines have similar resource isolation and allocation benefits, but function differently because containers virtualize the operating system instead of hardware. Containers are more portable and efficient.

Reference：https://www.docker.com/resources/what-container

镜像，容器，仓库是docker中经常出现的三个对象。

镜像：类似于.ios文件

容器：类似于已经安装在硬件上的操作系统

仓库：类似于集中存放.ios文件的地方，可以在本地，也可以在网上。

二、docker安装：

对于使用 systemd 的系统，请在 /etc/docker/daemon.json 中写入如下内容（如果文件不存在请新建该文件）：

{"registry-mirrors":["https://registry.docker-cn.com"]}

之后重新启动服务：

$ sudo systemctl daemon-reload
$ sudo systemctl restart docker

 

docker安装

[root@192 ~]# yum install -y docker
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirrors.aliyun.com
 * extras: mirrors.aliyun.com
 * updates: mirrors.aliyun.com
base                                                     | 3.6 kB     00:00
extras                                                   | 2.9 kB     00:00
updates                                                  | 2.9 kB     00:00
updates/7/x86_64/primary_d 31% [====-           ] 1.2 MB/s | 2.3 MB   00:04 

 

三、镜像使用

查询镜像

#docker search
[root@192 ~]# docker search centos
INDEX       NAME                                         DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
docker.io   docker.io/centos                             The official build of CentOS.                   5890      [OK]
docker.io   docker.io/ansible/centos7-ansible            Ansible on Centos7                              128                  [OK]
docker.io   docker.io/jdeathe/centos-ssh                 OpenSSH / Supervisor / EPEL/IUS/SCL Repos ...   114                  [OK]
docker.io   docker.io/consol/centos-xfce-vnc             Centos container with "headless" VNC sessi...   111                  [OK]

 获取镜像

#docker pull centos
Using default tag: latest
Trying to pull repository docker.io/library/centos ...
latest: Pulling from docker.io/library/centos
8a29a15cefae: Pull complete
Digest: sha256:fe8d824220415eed5477b63addf40fb06c3b049404242b31982106ac204f6700
Status: Downloaded newer image for docker.io/centos:latest
[root@192 ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
docker.io/centos    latest              470671670cac        2 months ago        237 MB

 创建容器

[root@192 ~]# docker run -t -i centos:latest /bin/bash
[root@07bc957293e7 /]# exit
exit

导出容器

[root@192 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
07bc957293e7        centos              "/bin/bash"         13 minutes ago      Up 4 minutes                            ecstatic_curie
[root@192 ~]# docker export ecstatic_curie -o centos.tar
[root@192 ~]# ll
total 239300
-rw-------. 1 root root      1405 Mar 17 15:38 anaconda-ks.cfg
-rw-------. 1 root root 245035008 Mar 20 14:50 centos.tar
-rwxr-xr-x. 1 root root       169 Mar 20 13:30 docker_in.sh

 将导出的容器导入为镜像

[root@192 ~]# docker import - centos:load < centos.tar
sha256:74393833eb5496ae02d5d363515fd94c1026dd7d041870cf2521d63db3229170
[root@192 ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos              load                74393833eb54        16 seconds ago      237 MB
docker.io/centos    latest              470671670cac        2 months ago        237 MB
[root@192 ~]#

 进入正在运行的docker

docker attach     退出容器终端，会导致容器的停止

Usage:  docker attach [OPTIONS] CONTAINER

Attach to a running container

[root@192 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                      PORTS               NAMES
07bc957293e7        centos              "/bin/bash"         4 minutes ago       Exited (0) 43 seconds ago                       ecstatic_curie
[root@192 ~]# docker start ecstatic_curie
ecstatic_curie
[root@192 ~]# docker attach ecstatic_curie
[root@07bc957293e7 /]# exit
exit
[root@192 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                     PORTS               NAMES
07bc957293e7        centos              "/bin/bash"         5 minutes ago       Exited (0) 9 seconds ago                       ecstatic_curie

docker exec        退出容器终端，不会导致容器的停止

Usage:  docker exec [OPTIONS] CONTAINER COMMAND [ARG...]

Run a command in a running container

[root@192 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                     PORTS               NAMES
07bc957293e7        centos              "/bin/bash"         5 minutes ago       Exited (0) 9 seconds ago                       ecstatic_curie
[root@192 ~]# docker start ecstatic_curie
ecstatic_curie
[root@192 ~]# docker exec -it ecstatic_curie /bin/bash
[root@07bc957293e7 /]# exit
exit
[root@192 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
07bc957293e7        centos              "/bin/bash"         9 minutes ago       Up 43 seconds                           ecstatic_curie

编写脚本，使容器在输入exit命令时，仍可以运行

[root@192 ~]# vim login.sh
#!/bin/bash

login(){
        docker exec -it $1 /bin/bash
}

login $1

授予运行权限

[root@192 ~]# chmod +x docker_in.sh

运行容器

[root@192 ~]# ./login.sh blissful_euler
[root@ed414d4603bf /]# exit
logout
[root@192 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED                               STATUS                     PORTS               NAMES
ed414d4603bf        centos              "/bin/bash"         54 minutes ago                        Up 2 minutes                                   blissful_euler
30fba2607523        centos:latest       "/bin/bash"         2 hours ago                           Exited (127) 2 hours ago                       pensive_lovelace

四、网络管理

随机端口映射

[root@192 ~]# docker run -d -P nginx
42c48cf7ffc6d1449cc20278a7ce5a2366e0703473214b368fe6cc7ed8f7a144
[root@192 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                   NAMES
42c48cf7ffc6        nginx               "nginx -g 'daemon ..."   8 seconds ago       Up 7 seconds        0.0.0.0:32768->80/tcp   keen_clarke

访问验证

指定端口映射

[root@192 ~]# docker run -d -p 192.168.75.131:11111:80 --name test nginx
2514bd29d8868108d990f0046110f83bd0b7d2cadfc43b54c824d63f5c7bb850
[root@192 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                          NAMES
2514bd29d886        nginx               "nginx -g 'daemon ..."   5 seconds ago       Up 5 seconds        192.168.75.131:11111->80/tcp   test
42c48cf7ffc6        nginx               "nginx -g 'daemon ..."   14 minutes ago      Up 14 minutes       0.0.0.0:32768->80/tcp          keen_clarke
07bc957293e7        centos              "/bin/bash"              About an hour ago   Up About an hour                                   ecstatic_curie

访问验证

五、数据管理

自动生成挂载目录

[root@192 ~]# docker run -d --name=data-test -v /data nginx
[root@192 ~]# ./login.sh data-test
root@626f0474ea4c:/# cd /data/
root@626f0474ea4c:/data# ls
root@626f0474ea4c:/data# touch hello
root@626f0474ea4c:/data# ls
hello
root@626f0474ea4c:/data# exit
exit

[root@192 ~]# cd /var/lib/docker/volumes/
b0eed69ea8428a1cbe6868ccc7625903619d0a33df4d975e5ecfdd2f443d0922/ metadata.db
[root@192 ~]# cd /var/lib/docker/volumes/b0eed69ea8428a1cbe6868ccc7625903619d0a33df4d975e5ecfdd2f443d0922/_data/
[root@192 _data]# ls
hello

指定目录挂载卷

--volumes-from list                     Mount volumes from the specified container

[root@192 ~]# docker run -it --name data-test3 --volumes-from data-test2 centos /bin/bash
[root@7628ca6d4af5 /]# ls /data/
hello
[root@7628ca6d4af5 /]#

六、制作镜像

分层制作镜像，以适应不同的需求

系统镜像：基本的操作系统

运行环境镜像：安装有应用运行需要的环境

加载应用的镜像：将应用加载到运行环境镜像中

镜像的制作大致有两种方法，手工制作和Dockerfile自动制作

手动制作流程

由镜像创建容器-->进入容器配置环境并安装应用-->docker export导出-->docker import导入

由Dockerfile制作

制作系统镜像

[root@192 OS]# vim Dockerfile
#base image
FROM centos

#change yum
RUN rm -f /etc/yum.repos.d/*.repo
RUN curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-8.repo 
RUN yum clean all
RUN yum makecache
RUN yum -y install vim

有一点要注意的就是要看清楚自己FROM的centos镜像是哪个版本，我一开始就以为和我宿主机一样都是centos7，结果出错的时候才发现是8。 

[root@192 OS]# docker build -t test/centos:test ./
Sending build context to Docker daemon 2.048 kB
Step 1/6 : FROM centos
 ---> 470671670cac
Step 2/6 : RUN rm -f /etc/yum.repos.d/*.repo
 ---> Running in 869ae4c5e53e

 ---> 528828074a97
Removing intermediate container 869ae4c5e53e

.............

Complete!
 ---> 970976fcc1ad
Removing intermediate container d81031b28239
Successfully built 970976fcc1ad
[root@192 OS]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED              SIZE
test/centos         test                970976fcc1ad        About a minute ago   313 MB
docker.io/nginx     latest              6678c7c2e56c        2 weeks ago          127 MB
docker.io/centos    latest              470671670cac        2 months ago         237 MB

我后来对比了下yum换源前后的下载速度，发下差别并不大，不知道是我无线网的原因还是什么，官方yum源感觉并不比阿里云慢多少。

制作运行环境镜像

[root@192 OS]# cd ../runtime/
[root@192 runtime]# vim Dockerfile
#Dockerfile

FROM centos:base

RUN yum -y install nginx

[root@192 runtime]# docker build -t test/centos:nginx ./
Sending build context to Docker daemon 2.048 kB
Step 1/2 : FROM test/centos:test
 ---> 970976fcc1ad
Step 2/2 : RUN yum -y install nginx
 ---> Running in 277c2ba57075

Last metadata expiration check: 0:02:58 ago on Fri Mar 20 12:52:14 2020.
Dependencies resolved.
================================================================================
 Package                     Arch   Version                     Repo       Size
================================================================================
Installing:
 nginx                       x86_64 1:1.14.1-9.module_el8.0.0+184+e34fea82

..............................

Complete!
 ---> 72acef2a3771
Removing intermediate container 277c2ba57075
Successfully built 72acef2a3771
[root@192 runtime]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
test/centos         nginx               72acef2a3771        5 minutes ago       383 MB
test/centos         test                970976fcc1ad        8 minutes ago       313 MB
docker.io/nginx     latest              6678c7c2e56c        2 weeks ago         127 MB
docker.io/centos    latest              470671670cac        2 months ago        237 MB
[root@192 runtime]#

将应用迁移到运行环境镜像

[root@192 runtime]# cd ../application/
[root@192 application]# mkdir app
[root@192 application]# vim Dockerfile
[root@192 application]# cat Dockerfile
FROM test/centos:nginx

COPY ./app /myapp

[root@192 application]# docker build -t test/centos:app ./
Sending build context to Docker daemon  2.56 kB
Step 1/2 : FROM test/centos:nginx
 ---> 72acef2a3771
Step 2/2 : COPY ./app /myapp
 ---> da5f26ad6449
Removing intermediate container ec422e10c133
Successfully built da5f26ad6449



[root@192 ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
test/centos         app                 da5f26ad6449        9 minutes ago       383 MB
test/centos         nginx               72acef2a3771        19 minutes ago      383 MB
test/centos         test                970976fcc1ad        22 minutes ago      313 MB
docker.io/nginx     latest              6678c7c2e56c        2 weeks ago         127 MB
docker.io/centos    latest              470671670cac        2 months ago        237 MB
[root@192 ~]#