Docker学习指引-CSDN博客

本文链接：https://blog.csdn.net/qq_39519014/article/details/120694173

Docker概述

发布一个项目，能不能带上环境安装打包

# 发布一个安卓app
java --> apk --> 发布(应用商店) --> 张三使用apk --> 安装即可用
# 同理，发布一个jar包，利用docker
java --> jar(环境) -->打包项目带上环境(镜像) --> (Docker仓库: 类比商店) --> 下载我们发布的镜像 --> 直接运行即可

隔离：Docker核心思想，打包装箱，每个箱子是互相隔离的
虚拟机：在window中装一个VMware，通过这个软件，我们可以虚拟化出来一台或者多台电脑，硬件也虚拟出来，比较笨重，属于虚拟化技术
Docker容器技术也是一种虚拟化技术

VM: Linux centos原生镜像(相当与一台电脑)，互相隔离，需要开启多个虚拟机，大小几个G
Docker: 隔离，镜像(最核心的环境 4M)，十分小巧，运行镜像就可以了，几个M

Docker是基于Golang开发的

文档地址：https://docs.docker.com/

仓库地址：https://hub.docker.com/

虚拟机技术

资源占用十分多
冗余步骤多
启动很慢
虚拟化一些硬件，运行一个完整的操作系统，然后在这个系统上安装和运行软件

容器化技术

容器化技术不是模拟一个完整的操作系统
容器内的应用直接运行在宿主机的内核中，容器是没有自己的内核的，也没有虚拟我们的硬件，所以轻便了
每个容器内是相互隔离的，每个容器内都有一个属于自己的文件系统，互不影响

基本组成

镜像

image好比一个模版，可以通过这个模版来创建容器服务
tomcat镜像 --> run --> tomcat 容器
通过这个镜像可以创建多个容器，最终服务运行或者项目运行就是在容器中

容器

container：Docker容器技术，独立运行一个或者一个组应用，通过镜像来创建
启动、停止、删除、基本命令
目前就可以把这个容器理解为一个简易的Linux系统

仓库

仓库是存放镜像的地方
仓库分为共有仓库和私有仓库
Docker Hub默认是国外的

开始

Docker安装

官方安装文档

https://docs.docker.com/engine/install/centos/
测试hello-world

jiangsiyong: ~ $ docker run hello-world

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
93288797bd35: Pull complete 
Digest: sha256:393b81f0ea5a98a7335d7ad44be96fe76ca8eb2eaa76950eb8c989ebf2b78ec0
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

查看下载的镜像

jiangsiyong: ~ $ docker images
REPOSITORY    TAG       IMAGE ID       CREATED        SIZE
hello-world   latest    18e5af790473   37 hours ago   9.14kB
centos        latest    300e315adb2f   9 months ago   209MB

docker run hello-world流程
1. 开始，Docker会在本机寻找镜像
2. 判断本机是否有这个镜像
3. 如果本机有这个镜像，就直接使用这个镜像运行
4. 否则，去Docker Hub下载
5. 判断Docker Hub是否有这个镜像
6. 如果有，下载这个镜像到本地，转向流程3
7. 否则，返回找不到镜像的错误

通信模型

Docker是一个Client-Server结构的系统，Docker的守护进程运行在本机上，客户端通过Socker来访问Docker

Docker Server接收到Client发来的指令，就会执行这个指令

Docker为什么比VM快

Docker有着比虚拟机更少的抽象层
Docker利用的是宿主机的内核，VM需要的是Guest OS
Docker不需要像虚拟机一样重新加载一个操作系统的内核，避免引导

Docker常用命令

帮助命令

docker version #显示docker的版本信息
docker info #显示docker更加详细的系统信息，包括镜像和容器的数量
docker 命令 --help #帮助命令

官方命令文档：https://docs.docker.com/reference/

镜像命令

查看所有本地主机的镜像

docker images [OPTIONS] [REPOSITORY[:TAG]]

jiangsiyong: ~ $ docker images
REPOSITORY    TAG       IMAGE ID       CREATED        SIZE
hello-world   latest    18e5af790473   38 hours ago   9.14kB
centos        latest    300e315adb2f   9 months ago   209MB

#解释
REPOSITORY 镜像的仓库源
TAG 镜像的标签
IMAGE ID 镜像的ID
CREATED 镜像的创建时间
SIZE 镜像的大小

#可选项
--all, -a		列出所有的镜像
--quiet, -q		只显示镜像的id

搜索镜像

docker search [OPTIONS] TERM

jiangsiyong: ~ $ docker search mysql
NAME                              DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
mysql                             MySQL is a widely used, open-source relation…   11470     [OK]       
mariadb                           MariaDB Server is a high performing open sou…   4354      [OK]       
mysql/mysql-server                Optimized MySQL Server Docker images. Create…   848                  [OK]

#可选项
--filter=STARS=3000 搜出星级在3000以上的

拉取下载镜像

docker pull [OPTIONS] NAME[:TAG|@DIGEST]

jiangsiyong: ~ $ docker pull redis
Using default tag: latest #如果不写，默认是最新的
latest: Pulling from library/redis
d10c227306ce: Pull complete #分层下载，docker image的核心，联合文件系统
71f6c833430f: Pull complete 
f6169272c13d: Pull complete 
17db4d790ed8: Pull complete 
c5b59ebbf80e: Pull complete 
177c4d24fee3: Pull complete 
Digest: sha256:e595e79c05c7690f50ef0136acc9d932d65d8b2ce7915d26a68ca3fb41a7db61
Status: Downloaded newer image for redis:latest
docker.io/library/redis:latest #真实地址

删除镜像

docker rmi [OPTIONS] IMAGE [IMAGE...]

jiangsiyong: ~ $ docker rmi redis #删除指定的镜像
Untagged: redis:latest
Untagged: redis@sha256:e595e79c05c7690f50ef0136acc9d932d65d8b2ce7915d26a68ca3fb41a7db61
Deleted: sha256:33945ca6b5bfb35714f54f172737353a3e493c0866c238eb5e9034bdfe3ff798
Deleted: sha256:d11fdd6b15b07a0a1374773038f4f95881cde45357b8f028b63f147152f84821
Deleted: sha256:4ed432f18c5944c2c8eaa846424cdcbecf77ca65a49b9c27c2407c14c45dc24f
Deleted: sha256:fe4801e23a4ce9410c27576d7432e6e0d277593c71461f82cad1458f26fb8527
Deleted: sha256:a339fc4111fd6563276f4f8b994062480416c25f2beb5c01281942ad94b00184
Deleted: sha256:a2bbab4dc2e346ff93626bd68c14d2f182a9d719521a6987c0f8b3b64c9b9d43
Deleted: sha256:5f140fe6ea259f8caec3cb6a4f230fe761c8efa223579bf3c5f9af9e5883e986

容器命令

我们有了镜像，才可以创建容器

新建容器并启动

docker run [OPTIONS] IMAGE [COMMAND] [ARG...]

#参数说明
--name="Name" 容器名字 tomcat01 tomcat02用来区分容器
-d 后台方式运行
-it 使用交互方式运行，进入容器查看内容
-p 指定容器端口 -p 8080:8080
	-p ip:主机端口:容器端口
	-p 主机端口:容器端口(常用)
	-p 容器端口
-P 指定随机端口

#测试

#启动并进入容器
jiangsiyong: ~ $ docker run -it centos /bin/bash
[root@4d5a31acfaa7 /]# ls #进入容器内部
bin  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
[root@4d5a31acfaa7 /]# exit #从容器中退出主机
exit

列出当前正在运行的容器

docker ps [OPTIONS]

jiangsiyong: ~ $ docker ps -a
CONTAINER ID   IMAGE         COMMAND       CREATED         STATUS                          PORTS     NAMES
4d5a31acfaa7   centos        "/bin/bash"   3 minutes ago   Exited (0) About a minute ago             dreamy_leakey
578f57807749   hello-world   "/hello"      23 hours ago    Exited (0) 23 hours ago                   vibrant_cartwright

#参数
--all, -a		显示当前正在运行的容器+带出历史运行过的容器
-n=? 显示最近创建的容器
-q 只列出容器的编号

退出容器

exit #直接容器停止并退出
Ctrl + P + Q #容器不停止退出

删除容器

docker rm 容器id #删除指定的容器，不能删除正在运行的容器，如果要强制删除，要用rm -rf
docker rm -f $(docker ps -aq) #删除所有的容器
docker ps -a -q | xargs docker rm #删除所有的容器

启动和停止容器

docker start 容器id  #启动容器
docker restart 容器id #重启容器
docker stop 容器id #停止容器
docker kill 容器id #强制停止容器

常用其他命令

后台启动容器

#命令 docker run -d 镜像名
jiangsiyong: ~ $ docker run -d centos
#问题docker ps发现centos停止了
#常见问题：docker容器使用后台运行，就必须要有一个前台进程，docker发现没有应用，就会自动停止

查看容器的日志

jiangsiyong: ~ $ docker logs --help
Usage:  docker logs [OPTIONS] CONTAINER
Fetch the logs of a container
Options:
      --details        Show extra details provided to logs
  -f, --follow         Follow log output
      --since string   Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)
  -n, --tail string    Number of lines to show from the end of the logs (default "all")
  -t, --timestamps     Show timestamps
      --until string   Show logs before a timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)

#显示日志
-tf 显示日志，带上时间戳
--tail number 要显示的日志条数

显示容器内部的进程信息

docker top 容器id

jiangsiyong: ~ $ docker top d1c
UID                 PID                 PPID                C                   STIME               TTY                 TIME                CMD
root                2467                2441                0                   14:38               ?                   00:00:00            /usr/bin/qemu-x86_64 /bin/bash

查看容器的元数据

jiangsiyong: ~ $ docker inspect --help
Usage:  docker inspect [OPTIONS] NAME|ID [NAME|ID...]
Return low-level information on Docker objects
Options:
  -f, --format string   Format the output using the given Go template
  -s, --size            Display total file sizes if the type is container
      --type string     Return JSON for specified type


jiangsiyong: ~ $ docker inspect d1c
[
    {
        "Id": "d1c319b79b76e974fa4644c0cf154a0dd80bd68db012a6ba61cf8334de2fc0e4",
        "Created": "2021-09-26T14:38:10.65482422Z",
        "Path": "/bin/bash",
        "Args": [],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 2467,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2021-09-26T14:38:10.840967845Z",
            "FinishedAt": "0001-01-01T00:00:00Z"
        },
        "Image": "sha256:300e315adb2f96afe5f0b2780b87f28ae95231fe3bdd1e16b9ba606307728f55",
        "ResolvConfPath": "/var/lib/docker/containers/d1c319b79b76e974fa4644c0cf154a0dd80bd68db012a6ba61cf8334de2fc0e4/resolv.conf",
        "HostnamePath": "/var/lib/docker/containers/d1c319b79b76e974fa4644c0cf154a0dd80bd68db012a6ba61cf8334de2fc0e4/hostname",
        "HostsPath": "/var/lib/docker/containers/d1c319b79b76e974fa4644c0cf154a0dd80bd68db012a6ba61cf8334de2fc0e4/hosts",
        "LogPath": "/var/lib/docker/containers/d1c319b79b76e974fa4644c0cf154a0dd80bd68db012a6ba61cf8334de2fc0e4/d1c319b79b76e974fa4644c0cf154a0dd80bd68db012a6ba61cf8334de2fc0e4-json.log",
        "Name": "/thirsty_kowalevski",
        "RestartCount": 0,
        "Driver": "overlay2",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": null,
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "default",
            "PortBindings": {},
            "RestartPolicy": {
                "Name": "no",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": null,
            "CapDrop": null,
            "CgroupnsMode": "host",
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "private",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": [],
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DeviceCgroupRules": null,
            "DeviceRequests": null,
            "KernelMemory": 0,
            "KernelMemoryTCP": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": null,
            "OomKillDisable": false,
            "PidsLimit": null,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "MaskedPaths": [
                "/proc/asound",
                "/proc/acpi",
                "/proc/kcore",
                "/proc/keys",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug",
                "/proc/scsi",
                "/sys/firmware"
            ],
            "ReadonlyPaths": [
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ]
        },
        "GraphDriver": {
            "Data": {
                "LowerDir": "/var/lib/docker/overlay2/7facde6cefe6fb84fe71d61a08ab2b7d7bd16069c0e787e222d708ebd1dd9e02-init/diff:/var/lib/docker/overlay2/20d51d86652fa745c1f32efb2f77682f0a7ae3a0aa4f2d876ac8a85a2a269e98/diff",
                "MergedDir": "/var/lib/docker/overlay2/7facde6cefe6fb84fe71d61a08ab2b7d7bd16069c0e787e222d708ebd1dd9e02/merged",
                "UpperDir": "/var/lib/docker/overlay2/7facde6cefe6fb84fe71d61a08ab2b7d7bd16069c0e787e222d708ebd1dd9e02/diff",
                "WorkDir": "/var/lib/docker/overlay2/7facde6cefe6fb84fe71d61a08ab2b7d7bd16069c0e787e222d708ebd1dd9e02/work"
            },
            "Name": "overlay2"
        },
        "Mounts": [],
        "Config": {
            "Hostname": "d1c319b79b76",
            "Domainname": "",
            "User": "",
            "AttachStdin": true,
            "AttachStdout": true,
            "AttachStderr": true,
            "Tty": true,
            "OpenStdin": true,
            "StdinOnce": true,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
            ],
            "Cmd": [
                "/bin/bash"
            ],
            "Image": "centos",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {
                "org.label-schema.build-date": "20201204",
                "org.label-schema.license": "GPLv2",
                "org.label-schema.name": "CentOS Base Image",
                "org.label-schema.schema-version": "1.0",
                "org.label-schema.vendor": "CentOS"
            }
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "7d0b3806ffe95fa22f8c1a6950b60fc1eb35f684031d37cc9e1e87c84ddb5728",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {},
            "SandboxKey": "/var/run/docker/netns/7d0b3806ffe9",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "c17a0ad271ea7b704292a6dd26cc02991543a3ade37dd4fbd0f413ad90dd474e",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "172.17.0.2",
            "IPPrefixLen": 16,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:02",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "6a9b6e6db0fc67a93be97d23f7c086d6aa713a5b521a03e0f992553360109258",
                    "EndpointID": "c17a0ad271ea7b704292a6dd26cc02991543a3ade37dd4fbd0f413ad90dd474e",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.2",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:02",
                    "DriverOpts": null
                }
            }
        }
    }
]

进入当前正在运行的容器

#通常容器都是使用后台的方式运行的，需要进入容器修改一些配置
docker exec -it 容器id bashshell 进入容器后开启一个新的终端，可以在里面操作
docker attach 容器id 进入容器正在执行的终端，不会启动新的进程

从容器拷贝文件到主机上

docker cp 容器id:容器内的路径 目的的主机路径

常见部署

部署Nginx

#1 搜索镜像
#2 下载镜像
docker pull nginx
#3 运行容器 --name 给容器命名 -p 宿主机:容器内端口
docker run -d --name nginx -p 3344:80 nginx
#4 查看容器
docker ps
#5 本机自测
curl localhost:3344

#进入ngnix
jiangsiyong: ~ $ docker exec -it nginx /bin/bash
root@e2fc2bef14b4:/# ls
bin   dev		   docker-entrypoint.sh  home  media  opt   root  sbin	sys  usr
boot  docker-entrypoint.d  etc			 lib   mnt    proc  run   srv	tmp  var

部署Tomcat

#1 下载镜像
docker pull tomcat
#2 启动运行
docker run -d -p 3355:8080 --name tomcat tomcat
# 测试访问没有问题
# 进入tomcat
jiangsiyong: ~ $ docker exec -it tomcat /bin/bash
root@4ae869212724:/usr/local/tomcat# ls
BUILDING.txt	 LICENSE  README.md	 RUNNING.txt  conf  logs	    temp     webapps.dist
CONTRIBUTING.md  NOTICE   RELEASE-NOTES  bin	      lib   native-jni-lib  webapps  work
root@4ae869212724:/usr/local/tomcat# cp -r  webapps.dist/* webapps

部署ES + Kibana

# es 暴露的端口很多
# es 十分耗内存
# es的数据一般需要放到安全目录
# --net somenetwork 网络配置
# 下载启动
docker run -d --name elasticsearch -p 9200:9200 -p 9300:9300  -e "discovery.type=single-node" elasticsearch:7.14.1

# 启动了，很卡: es十分耗内存
docker stats #查看cpu的状态

# 增加内存限制
docker run -d --name elasticsearch -p 9200:9200 -p 9300:9300  -e "discovery.type=single-node" -e ES_JAVA_OPTS="-Xms64m -Xmx512m" elasticsearch:7.14.1

可视化工具portainer

Docker图形界面管理工具！提供一个后台面板供我们操作

docker run -d -p 8088:9000 -v /var/run/docker.sock:/var/run/docker.sock --restart=always --name prtainer portainer/portainer

访问测试：http://localhost:8088/

Docker镜像

从远程仓库下载
拷贝过来
通过DockerFile制作

UnionFS联合文件系统

下载的时候看到的一层层的就是这个
它是一种分层、轻量级并且高性能的文件系统，它支持对文件系统的修改作为一次提交来一层层的叠加，同时可以将不同目录挂载到同一个虚拟文件系统下，联合文件系统是Docker镜像的基础，镜像可以通过分层来进行继承，基于基础镜像，可以制作各种具体的应用的镜像
特性：一次同时加载多个文件系统，但从外面看来，只看到一个文件系统，联合加载会把各层文件系统叠加起来，这样最终的文件系统会包含所有底层的文件和目录

Docker镜像加速的原理

Docker镜像实际上是由一层层的文件系统组成，这种层级叫联合文件系统
bootfs主要包含bootloader和kernel，bootloader主要是引导加载kernel，Linux刚启动时候会加载bootfs文件系统，在Docker镜像最底层是bootfs。这一层与我们典型的Linux/Unix是一样的。包含了boot加速器和内核。当boot加载完成后整个内核就在内存中了，此时内存的使用权由bootfs转交给内核，此时系统会卸载bootfs
rootfs：在bootfs之上，包含了典型的Linux系统的/dev、/proc、/bin、/etc等标准目录和文件。rootfs就是各种不同的操作系统的发行版。
对于一个精简的OS、rootfs可以很小、只需要包含基本的命令、工具和程序库就行。因为底层直接用Host的kernel，自己只需要提供rootfs就可以了，由此可见对于不同的linux发行版，rootfs会有差异，因此不同的发行版可以共用bootfs

分层原理

我们可以下载一个镜像，注意观察下载的日志输出，可以看到是一层一层下载的
采用分层结构，最大的好处是资源共享，比如有多个镜像都是从相同的Base镜像构建来的，那么宿主机只需要在磁盘中保留一份Base镜像就可以了，同时内存也只需要加载一份Base镜像，这样就可以为所有的容器服务了，而且镜像的每一层都可以共享。

查看镜像的分层的方式可以通过docker image inspect命令

jiangsiyong: ~ $ docker image inspect nginx
[
    {
        "Id": "sha256:9fa3786cd6acd84e0c642aac376e374d55231e48546b1ec0611eb1d31f0a9f3d",
        "RepoTags": [
            "nginx:latest"
        ],
        "RepoDigests": [
            "nginx@sha256:853b221d3341add7aaadf5f81dd088ea943ab9c918766e295321294b035f3f3e"
        ],
        "Parent": "",
        "Comment": "",
        "Created": "2021-09-09T17:51:09.078592214Z",
        "Container": "e4a792602a7cb512b981296eccb2b50ae9e3ce77edc945db3bb8b0291c8655b3",
        "ContainerConfig": {
            "Hostname": "e4a792602a7c",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "80/tcp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "NGINX_VERSION=1.21.3",
                "NJS_VERSION=0.6.2",
                "PKG_RELEASE=1~buster"
            ],
            "Cmd": [
                "/bin/sh",
                "-c",
                "#(nop) ",
                "CMD [\"nginx\" \"-g\" \"daemon off;\"]"
            ],
            "Image": "sha256:d06c4989171f08174a38d621f11f1adaa0668f9894f518a215624e957889767b",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": [
                "/docker-entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {
                "maintainer": "NGINX Docker Maintainers <docker-maint@nginx.com>"
            },
            "StopSignal": "SIGQUIT"
        },
        "DockerVersion": "20.10.7",
        "Author": "",
        "Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "80/tcp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "NGINX_VERSION=1.21.3",
                "NJS_VERSION=0.6.2",
                "PKG_RELEASE=1~buster"
            ],
            "Cmd": [
                "nginx",
                "-g",
                "daemon off;"
            ],
            "Image": "sha256:d06c4989171f08174a38d621f11f1adaa0668f9894f518a215624e957889767b",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": [
                "/docker-entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {
                "maintainer": "NGINX Docker Maintainers <docker-maint@nginx.com>"
            },
            "StopSignal": "SIGQUIT"
        },
        "Architecture": "arm64",
        "Variant": "v8",
        "Os": "linux",
        "Size": 125996525,
        "VirtualSize": 125996525,
        "GraphDriver": {
            "Data": {
                "LowerDir": "/var/lib/docker/overlay2/1e6c6e8e97a4062494f53ffffa2ff7b4272bf0c3789f97b9be177a98ff94f907/diff:/var/lib/docker/overlay2/60771f42be72e06623f7587b36e791927f0dac7a09c72972ff9ac80248d9c802/diff:/var/lib/docker/overlay2/e08ef36312b415cbb803829b9baed945d7d4eca637bf97ec6c94fe9038693635/diff:/var/lib/docker/overlay2/b38e18d2dabe4004fcb630d8f1e1450a409ca5b3373f019f08b1c61b9982f9ab/diff:/var/lib/docker/overlay2/74867c601bb2e4cf4fa04d40c3f91adc74f6dbc6749ef454cfaf55b7187e35c0/diff",
                "MergedDir": "/var/lib/docker/overlay2/6d855dc4415773ce4a4269df4441f2110c40b89ea2f048b249d18caa3c0d6ef1/merged",
                "UpperDir": "/var/lib/docker/overlay2/6d855dc4415773ce4a4269df4441f2110c40b89ea2f048b249d18caa3c0d6ef1/diff",
                "WorkDir": "/var/lib/docker/overlay2/6d855dc4415773ce4a4269df4441f2110c40b89ea2f048b249d18caa3c0d6ef1/work"
            },
            "Name": "overlay2"
        },
        "RootFS": {
            "Type": "layers",
            "Layers": [
                "sha256:5f140fe6ea259f8caec3cb6a4f230fe761c8efa223579bf3c5f9af9e5883e986",
                "sha256:5ac2af1ad4fd920bb7e5cd04802bfda1b991c22a42d7bb1df773620553502d9a",
                "sha256:1fbe13821665fc8bd205e02dde22c5d72605c2170680c08401a6d3b8566c5dcb",
                "sha256:19d1177a9d832c9d7fb6f4285d74a5e35377fcc68242860abdf319293c4e2664",
                "sha256:a878019e90336fb68b6985982baf9f13b13d21f5230cbd1ce6c1d6b18f4ff6a3",
                "sha256:a97ebc9f68a9e9626354413ea31e221966d379567317a2bb59d0d15a89b230a4"
            ]
        },
        "Metadata": {
            "LastTagTime": "0001-01-01T00:00:00Z"
        }
    }
]

所有的镜像都起始于一个基础的镜像层，当进行修改或者添加新的内容的时候，就会在当前镜像层上面创建新的镜像层，比如给予Ubuntu Linux 16.04创建一个新的镜像，这就是新的镜像的第一层，如果在该镜像中添加Python包，就会在基础的镜像层之上创建第二个镜像层，如果继续添加一个安全补丁，就会创建第三个镜像层。
Docker镜像都是只读的，当容器启动时，一个新的可写层被加载到镜像的顶部，这就是我们通常所说的容器层，容器层之下的叫镜像层。

commit镜像

docker commit 提交容器成为一个新的副本

#命令和git类似
docker commit -m "提交的描述信息" -a "作者" 容器id 目标镜像名:[TAG]

容器数据卷

概念

Docker的理念是将应用和环境打包成一个镜像，如果数据在容器中，那么我们将容器删除，数据就会丢失。

需要容器之间可以有一个数据共享的技术。在Docker容器中产生的数据，可以同步到本地，这就是卷技术

就是目录的挂载，将我们容器中的目录，挂载到Linux上面

容器间也是可以数据共享的

使用数据卷

方式一：直接使用命令来挂载

docker run -it -v 宿主机的目录:容器目录 容器 bash

jiangsiyong: ~ $ docker run -it -v ~/Downloads/testDocker:/home/test centos
[root@46d5de98a240 /]# 
jiangsiyong: ~ $ docker inspect 46d5de98a240
…………
"Mounts": [
    {
        "Type": "bind",
        "Source": "/Users/jiangsiyong/Downloads/testDocker",
        "Destination": "/home/test",
        "Mode": "",
        "RW": true,
        "Propagation": "rprivate"
    }
]
…………

#假设将容器删除，挂载到本地的数据卷依旧没有消失

具名挂载和匿名挂载

#匿名挂载
-v 容器内路径
docker run -d -P --name ngnix01 -v /etc/nginx nginx

#查看所有卷volume的情况
docker volume ls
#发现
jiangsiyong: ~ $ docker volume ls
DRIVER    VOLUME NAME
local     19580df3d818a1df43a2862e6c43437eba4c53b9c75da048015a215df1ff4b37

#具名挂载
docker run -d -P --name ngnix01 -v juming-nginx:/etc/nginx nginx
#发现
jiangsiyong: ~ $ docker volume ls
DRIVER    VOLUME NAME
local     19580df3d818a1df43a2862e6c43437eba4c53b9c75da048015a215df1ff4b37
local     juming-nginx

#查看卷的路径
docker volume inspect 卷名
jiangsiyong: ~ $ docker volume inspect 19580df3d818a1df43
[
    {
        "CreatedAt": "2021-09-28T13:57:20Z",
        "Driver": "local",
        "Labels": null,
        "Mountpoint": "/var/lib/docker/volumes/19580df3d818a1df43a2862e6c43437eba4c53b9c75da048015a215df1ff4b37/_data",
        "Name": "19580df3d818a1df43a2862e6c43437eba4c53b9c75da048015a215df1ff4b37",
        "Options": null,
        "Scope": "local"
    }
]

#通过 -v 容器内路径:[ro:rw]来改变读写权限
#ro readonly 只读
#rw readwrite 可读可写
docker run -d -P --name ngnix01 -v juming-nginx:/etc/nginx:ro nginx
#一旦设置了容器权限，容器对我们挂载出来的内容就有限定了
#ro 只要看到ro，就说明这个路径只能通过宿主机来操作，容器内部是无法操作的

数据卷容器

#启动第一个容器
docker run -it --name docker01 centos
#第二个容器volumes-from docker01
docker run -it --name docker02 --volumes-from docker01 centos
#docker01容器创建的内容同步到docker02上
#启动docker03
docker run -it --name docker03 --volumes-from docker01 centos
#发现docker01、docker02和docker03之间的数据都是共享的

可以删除docker01，发现docker02和docker03的数据还是存在，是一种数据备份机制
多个mysql或者多个redis来实现数据共享
容器之间配置信息的传递，数据卷容器的生命周期一直持续到没有容器使用

Mac上进入容器目录

对于Mac操作系统，无法看到/var/lib/docker目录，因为Mac上安装的Docker是将Docker安装在虚拟机上的。

我们需要用以下方式进入

jiangsiyong: ~ $ docker run -it --rm --privileged --pid=host justincormack/nsenter1
Unable to find image 'justincormack/nsenter1:latest' locally
latest: Pulling from justincormack/nsenter1
726619a9fa8c: Pull complete 
Digest: sha256:e876f694a4cb6ff9e6861197ea3680fe2e3c5ab773a1e37ca1f13171f7f5798e
Status: Downloaded newer image for justincormack/nsenter1:latest
/ #

Dockerfile

Dockerfile是用来构建Docker的镜像构建文件，是命令脚本，通过这个脚本可以生成镜像，镜像是一层一层的，脚本一个一个的命令，每一个命令是一层镜像

创建一个Docker File文件：dockerfile1

FROM centos
VOLUME ["volume01","volume02"]
CMD echo "---end---"
CMD /bin/bash

构建一个镜像

docker build -f dockerfile1 -t hello/centos:1.0 .
执行

jiangsiyong: Docker $ docker build -f dockerfile1 -t hello/centos:1.0 .
[+] Building 1.3s (5/5) FINISHED                                                                                        
 => [internal] load build definition from dockerfile1                                                              0.0s
 => => transferring dockerfile: 121B                                                                               0.0s
 => [internal] load .dockerignore                                                                                  0.0s
 => => transferring context: 2B                                                                                    0.0s
 => [internal] load metadata for docker.io/library/centos:latest                                                   1.2s
 => [1/1] FROM docker.io/library/centos@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f432b177    0.0s
 => => resolve docker.io/library/centos@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f432b177    0.0s
 => exporting to image                                                                                             0.0s
 => => exporting layers                                                                                            0.0s
 => => writing image sha256:0f3f2a3f60442405fcd2a2cb17113bd0c796ad26e470db3ff1a9c4bd9edbb114                       0.0s
 => => naming to docker.io/hello/centos:1.0                                                                        0.0s

Use 'docker scan' to run Snyk tests against images to find vulnerabilities and learn how to fix them

基础

每个保留关键字都必须是大写字母
执行从上到下顺序执行
#表示注释
每个执行都会创建一个新的镜像层，并提交

指令

FROM					#基础镜像，一切从这里开始构建
MAINTAINER		#镜像是谁写的，姓名+邮箱
RUN						#镜像构建的时候需要运行的命令
ADD						#步骤：tomcat镜像，这个tomcat的压缩包！添加内容
WORKDIR				#镜像的工作目录
VOLUME				#挂载的目录
EXPOSE 				#指定暴露的端口配置

#ls -a --> docker run -l
CMD 					#指定这个容器启动的时候要运行的命令，只有最后一个会生效，可被替换
ENTRYPOINT 		#指定这个容器启动的时候要运行的命令，可以追加命令
ONBUILD 			#当构建一个被继承的DockerFile的，这个时候就会运行ONBUILD指令，触发指令
COPY 					#将文件拷贝到镜像中，类似于ADD
ENV 					#构建的时候设置环境变量

构建自己的镜像

Docker Hub中99%的镜像都是从scratch过来的，然后配置需要的软件和配置进行构建的

创建一个自己的centos

My docker

#编写dockerfile镜像文件
jiangsiyong: Docker $ vim mydockerfile-centos 
FROM centos
MAINTAINER helloworld<12345678@qq.com>

ENV MYPATH /usr/local
WORKDIR $MYPATH

RUN yum -y install vim
RUN yum -y install net-tools

EXPOSE 80

CMD echo $MYPATH
CMD echo "----end----"
CMD /bin/bash

#通过这个文件构建镜像
#通过docker build -f dockerfile 文件路径 -t 镜像名:[tag]
jiangsiyong: Docker $ docker build -f mydockerfile-centos -t mycentos:0.1 .
[+] Building 17.4s (8/8) FINISHED                                                                                       
 => [internal] load build definition from mydockerfile-centos                                                      0.0s
 => => transferring dockerfile: 262B                                                                               0.0s
 => [internal] load .dockerignore                                                                                  0.0s
 => => transferring context: 2B                                                                                    0.0s
 => [internal] load metadata for docker.io/library/centos:latest                                                   1.1s
 => CACHED [1/4] FROM docker.io/library/centos@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f43  0.0s
 => [2/4] WORKDIR /usr/local                                                                                       0.0s
 => [3/4] RUN yum -y install vim                                                                                  14.2s
 => [4/4] RUN yum -y install net-tools                                                                             1.9s
 => exporting to image                                                                                             0.2s 
 => => exporting layers                                                                                            0.2s 
 => => writing image sha256:8ce98b373ff5f4fa14fa7c90c99e52ffbe61b5b103de2a1286dc19f7d46a3141                       0.0s 
 => => naming to docker.io/library/mycentos:0.1                                                                    0.0s 
                                                                                                                        
Use 'docker scan' to run Snyk tests against images to find vulnerabilities and learn how to fix them

查看当前镜像的构建过程

jiangsiyong: Docker $ docker history 8ce98b373ff5
IMAGE          CREATED         CREATED BY                                      SIZE      COMMENT
8ce98b373ff5   5 minutes ago   CMD ["/bin/sh" "-c" "/bin/bash"]                0B        buildkit.dockerfile.v0
<missing>      5 minutes ago   CMD ["/bin/sh" "-c" "echo \"----end----\""]     0B        buildkit.dockerfile.v0
<missing>      5 minutes ago   CMD ["/bin/sh" "-c" "echo $MYPATH"]             0B        buildkit.dockerfile.v0
<missing>      5 minutes ago   EXPOSE map[80/tcp:{}]                           0B        buildkit.dockerfile.v0
<missing>      5 minutes ago   RUN /bin/sh -c yum -y install net-tools # bu…   15.1MB    buildkit.dockerfile.v0
<missing>      5 minutes ago   RUN /bin/sh -c yum -y install vim # buildkit    66.6MB    buildkit.dockerfile.v0
<missing>      5 minutes ago   WORKDIR /usr/local                              0B        buildkit.dockerfile.v0
<missing>      5 minutes ago   ENV MYPATH=/usr/local                           0B        buildkit.dockerfile.v0
<missing>      5 minutes ago   MAINTAINER helloworld<12345678@qq.com>          0B        buildkit.dockerfile.v0
<missing>      3 weeks ago     /bin/sh -c #(nop)  CMD ["/bin/bash"]            0B        
<missing>      3 weeks ago     /bin/sh -c #(nop)  LABEL org.label-schema.sc…   0B        
<missing>      3 weeks ago     /bin/sh -c #(nop) ADD file:420712a90b0934202…   272MB

CMD和ENTRYPOINT的区别

CMD

#编写dockerfile命令
jiangsiyong: Docker $ vim dockerfile-cmd-test
jiangsiyong: Docker $ cat dockerfile-cmd-test 
FROM centos
CMD ["ls","-a"]

#构建镜像
jiangsiyong: Docker $ docker build -f dockerfile-cmd-test -t cmdtest .
[+] Building 0.4s (5/5) FINISHED                                                                                        
 => [internal] load build definition from dockerfile-cmd-test                                                      0.0s
 => => transferring dockerfile: 79B                                                                                0.0s
 => [internal] load .dockerignore                                                                                  0.0s
 => => transferring context: 2B                                                                                    0.0s
 => [internal] load metadata for docker.io/library/centos:latest                                                   0.3s
 => CACHED [1/1] FROM docker.io/library/centos@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f43  0.0s
 => exporting to image                                                                                             0.0s
 => => exporting layers                                                                                            0.0s
 => => writing image sha256:800ae6f76bf9bd620270ac45363d160888daaa2e8d4fd17c155f573761ddca66                       0.0s
 => => naming to docker.io/library/cmdtest                                                                         0.0s

Use 'docker scan' to run Snyk tests against images to find vulnerabilities and learn how to fix them

#运行该镜像，发现ls -a生效
jiangsiyong: Docker $ docker run cmdtest
.
..
.dockerenv
bin
dev
etc
home
lib
lib64
lost+found
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
#想追加一个命令-l即ls -a -l
#cmd的情况下 -l会替换CMD ["ls","-a"]命令，而-l不是命令，所以报错
jiangsiyong: Docker $ docker run cmdtest -l
docker: Error response from daemon: OCI runtime create failed: container_linux.go:380: starting container process caused: exec: "-l": executable file not found in $PATH: unknown.
ERRO[0000] error waiting for container: context canceled

ENTRYPOINT

#编写dockerfile命令
jiangsiyong: Docker $ vim dockerfile-entrypoint-test 
jiangsiyong: Docker $ cat dockerfile-entrypoint-test  
FROM centos
ENTRYPOINT ["ls","-a"]

#构建镜像
jiangsiyong: Docker $ docker build -f dockerfile-entrypoint-test -t entrypoint-test .
[+] Building 0.4s (5/5) FINISHED                                                                                        
 => [internal] load build definition from dockerfile-entrypoint-test                                               0.0s
 => => transferring dockerfile: 93B                                                                                0.0s
 => [internal] load .dockerignore                                                                                  0.0s
 => => transferring context: 2B                                                                                    0.0s
 => [internal] load metadata for docker.io/library/centos:latest                                                   0.3s
 => CACHED [1/1] FROM docker.io/library/centos@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f43  0.0s
 => exporting to image                                                                                             0.0s
 => => exporting layers                                                                                            0.0s
 => => writing image sha256:9f1a36acb55321d87fe7400634a6d558f473f6905d4caf1c6734e627f2325abc                       0.0s
 => => naming to docker.io/library/entrypoint-test                                                                 0.0s

Use 'docker scan' to run Snyk tests against images to find vulnerabilities and learn how to fix them

#效果跟cmd命令一样
jiangsiyong: Docker $ docker run entrypoint-test
.
..
.dockerenv
bin
dev
etc
home
lib
lib64
lost+found
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var

#不是替换cmd命令，而是追加的方式
jiangsiyong: Docker $ docker run entrypoint-test -l
total 56
drwxr-xr-x   1 root root 4096 Oct  9 13:37 .
drwxr-xr-x   1 root root 4096 Oct  9 13:37 ..
-rwxr-xr-x   1 root root    0 Oct  9 13:37 .dockerenv
lrwxrwxrwx   1 root root    7 Nov  3  2020 bin -> usr/bin
drwxr-xr-x   5 root root  340 Oct  9 13:37 dev
drwxr-xr-x   1 root root 4096 Oct  9 13:37 etc
drwxr-xr-x   2 root root 4096 Nov  3  2020 home
lrwxrwxrwx   1 root root    7 Nov  3  2020 lib -> usr/lib
lrwxrwxrwx   1 root root    9 Nov  3  2020 lib64 -> usr/lib64
drwx------   2 root root 4096 Sep 15 14:25 lost+found
drwxr-xr-x   2 root root 4096 Nov  3  2020 media
drwxr-xr-x   2 root root 4096 Nov  3  2020 mnt
drwxr-xr-x   2 root root 4096 Nov  3  2020 opt
dr-xr-xr-x 185 root root    0 Oct  9 13:37 proc
dr-xr-x---   2 root root 4096 Sep 15 14:26 root
drwxr-xr-x  11 root root 4096 Sep 15 14:26 run
lrwxrwxrwx   1 root root    8 Nov  3  2020 sbin -> usr/sbin
drwxr-xr-x   2 root root 4096 Nov  3  2020 srv
dr-xr-xr-x  13 root root    0 Oct  9 13:37 sys
drwxrwxrwt   7 root root 4096 Sep 15 14:26 tmp
drwxr-xr-x  12 root root 4096 Sep 15 14:25 usr
drwxr-xr-x  20 root root 4096 Sep 15 14:25 var

构建Tomcat镜像

准备镜像文件tomcat压缩包，jdk压缩包
编写dockerfile文件

jiangsiyong: Docker $ vim dockerfile-tomcat
jiangsiyong: Docker $ 
jiangsiyong: Docker $ 
jiangsiyong: Docker $ cat dockerfile-tomcat 
FROM centos
MAINTAINER hello<12345678@qq.com>

COPY readme.txt /usr/local/readme.txt

ADD jdk-8u11-linux-x64.tar.gz /usr/local/
ADD apache-tomcat-9.0.22.tar.gz /usr/local/

RUN yum -y -install vim

ENV MYPATH /usr/local
WORK $MYPATH

ENV JAVA_HOME /usr/local/jdk1.8.0_11
ENV CLASSPATH $JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tolls.jar
ENV CATALINA_HOME /usr/local/apache-tomcat-9.0.22
ENV CATALINA_BASH /usr/local/apache-tomcat-9.0.22
ENV PATH $PATH:$JAVA_HOME/bin:$CATALINA_HOME/lib:$CATALINA_HOME/bin

EXPOSE 8080

CMD /usr/local/apache-tomcat-9.0.22/bin/startup.sh && tail -F /usr/local/apache-tomcat-9.0.22/bin/logs/catalina.out
jiangsiyong: Docker $