php curl docker.sock,解析 /var/run/docker.sock

dd0c814680ba

image.png

docker.sock 是docker client 和docker daemon 在localhost进行通信的socket文件。

今天我们直接call这个socket文件来创建容器,启动容器。(其实就是直接call docker daemon API而不是通过docker client的方式去操控docker daemon)。

什么是unix socket?

unix socket可以让一个程序通过类似处理一个文件的方式和另一个程序通信,这是一种进程间通信的方式(IPC)。

当你在host上安装并且启动好docker,docker daemon 会自动创建一个socket文件并且保存在/var/run/docker.sock目录下。docker daemon监听着socket中即将到来的链接请求(可以通过-H unix:///var/run/docker.sock设定docker daemon监听的socket文件,-H参数还可以设定监听tcp:port或者其它的unix socket),当一个链接请求到来时,它会使用标准IO来读写数据。

创建容器

# curl -XPOST --unix-socket /var/run/docker.sock -d '{"Image":"nginx"}' -H 'Content-Type: application/json' http://localhost/containers/create

{"Id":"a4bc1943984d7fccd902ac9a5f5966b72b438a2f4f5764f319e181b601dbc886","Warnings":null}

# curl -XPOST --unix-socket /var/run/docker.sock http://localhost/containers/a4bc1943984d7fccd902ac9a5f5966b72b438a2f4f5764f319e181b601dbc886/start

# docker container ls

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

a4bc1943984d nginx "nginx -g 'daemon of…" 2 minutes ago Up 22 seconds 80/tcp zealous_buck

docker API 还暴露出event接口来记录操作API的事件

curl --unix-socket /var/run/docker.sock http://localhost/events

当用docker client 进行操作时,会看到打印出来的event

docker run -it --rm nginx sh

# curl --unix-socket /var/run/docker.sock http://localhost/events

{"status":"create","id":"94e4de2eed35056c5434c84e544bc429b84cfbf4f99b458464eb87f3394eaead","from":"nginx","Type":"container","Action":"create","Actor":{"ID":"94e4de2eed35056c5434c84e544bc429b84cfbf4f99b458464eb87f3394eaead","Attributes":{"image":"nginx","maintainer":"NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e","name":"ecstatic_mendeleev"}},"scope":"local","time":1560835913,"timeNano":1560835913703025294}

{"status":"attach","id":"94e4de2eed35056c5434c84e544bc429b84cfbf4f99b458464eb87f3394eaead","from":"nginx","Type":"container","Action":"attach","Actor":{"ID":"94e4de2eed35056c5434c84e544bc429b84cfbf4f99b458464eb87f3394eaead","Attributes":{"image":"nginx","maintainer":"NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e","name":"ecstatic_mendeleev"}},"scope":"local","time":1560835913,"timeNano":1560835913704314497}

{"Type":"network","Action":"connect","Actor":{"ID":"b049de6ba0d38d1af9d93487b60ed861a08e65ecf3a644b0e6745fa903eb3d06","Attributes":{"container":"94e4de2eed35056c5434c84e544bc429b84cfbf4f99b458464eb87f3394eaead","name":"bridge","type":"bridge"}},"scope":"local","time":1560835913,"timeNano":1560835913730994076}

{"status":"start","id":"94e4de2eed35056c5434c84e544bc429b84cfbf4f99b458464eb87f3394eaead","from":"nginx","Type":"container","Action":"start","Actor":{"ID":"94e4de2eed35056c5434c84e544bc429b84cfbf4f99b458464eb87f3394eaead","Attributes":{"image":"nginx","maintainer":"NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e","name":"ecstatic_mendeleev"}},"scope":"local","time":1560835914,"timeNano":1560835914138532930}

{"status":"resize","id":"94e4de2eed35056c5434c84e544bc429b84cfbf4f99b458464eb87f3394eaead","from":"nginx","Type":"container","Action":"resize","Actor":{"ID":"94e4de2eed35056c5434c84e544bc429b84cfbf4f99b458464eb87f3394eaead","Attributes":{"height":"49","image":"nginx","maintainer":"NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e","name":"ecstatic_mendeleev","width":"136"}},"scope":"local","time":1560835914,"timeNano":1560835914140380103}

还可以通过将bind mounting方式使用docker.socket

# docker run -it -v /var/run/docker.sock:/var/run/docker.sock busybox sh

apk update

apk add curl

/ # curl --unix-socket /var/run/docker.sock http://localhost/events

# docker run -it --rm nginx sh

/ # curl --unix-socket /var/run/docker.sock http://localhost/events

{"status":"create","id":"af36698121cb5b0734d3aa746c3f9519f54bb9bb63ae23a16bf3188a9fd7c724","from":"nginx","Type":"container","Action":"create","Actor":{"ID":"af36698121cb5b0734d3aa746c3f9519f54bb9bb63ae23a16bf3188a9fd7c724","Attributes":{"image":"nginx","maintainer":"NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e","name":"gracious_hopper"}},"scope":"local","time":1560836531,"timeNano":1560836531969907371}

{"status":"attach","id":"af36698121cb5b0734d3aa746c3f9519f54bb9bb63ae23a16bf3188a9fd7c724","from":"nginx","Type":"container","Action":"attach","Actor":{"ID":"af36698121cb5b0734d3aa746c3f9519f54bb9bb63ae23a16bf3188a9fd7c724","Attributes":{"image":"nginx","maintainer":"NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e","name":"gracious_hopper"}},"scope":"local","time":1560836531,"timeNano":1560836531971179743}

{"Type":"network","Action":"connect","Actor":{"ID":"b049de6ba0d38d1af9d93487b60ed861a08e65ecf3a644b0e6745fa903eb3d06","Attributes":{"container":"af36698121cb5b0734d3aa746c3f9519f54bb9bb63ae23a16bf3188a9fd7c724","name":"bridge","type":"bridge"}},"scope":"local","time":1560836532,"timeNano":1560836532003253979}

{"status":"start","id":"af36698121cb5b0734d3aa746c3f9519f54bb9bb63ae23a16bf3188a9fd7c724","from":"nginx","Type":"container","Action":"start","Actor":{"ID":"af36698121cb5b0734d3aa746c3f9519f54bb9bb63ae23a16bf3188a9fd7c724","Attributes":{"image":"nginx","maintainer":"NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e","name":"gracious_hopper"}},"scope":"local","time":1560836532,"timeNano":1560836532459395027}

{"status":"resize","id":"af36698121cb5b0734d3aa746c3f9519f54bb9bb63ae23a16bf3188a9fd7c724","from":"nginx","Type":"container","Action":"resize","Actor":{"ID":"af36698121cb5b0734d3aa746c3f9519f54bb9bb63ae23a16bf3188a9fd7c724","Attributes":{"height":"47","image":"nginx","maintainer":"NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e","name":"gracious_hopper","width":"88"}},"scope":"local","time":1560836532,"timeNano":1560836532461732028}

通过bind mounting的方式可以在容器中控制docker daemon.

分析docker

以docker 18.09.6 为例,分析一下docker,在docker 安装后,有docker``dockerd``docker-init``docker-proxy``runc这个几个二进制文件。

docker是docker client,dockerd是docker daemon,docker daemon调用runc最终创建container。

以docker 18.09.6为例,在x86_64 redhat 7.5环境中,通过rpm包安装docker,需要安装以下几个包

docker-ce-18.09.6-3.el7.x86_64.rpm``docker-ce-cli-18.09.6-3.el7.x86_64.rpm``containerd.io-1.2.5-3.1.el7.x86_64.rpm

我们来看看这些包中都包含了哪些内容

docker-ce 包含了主要的docker 包

# rpm -qpl docker-ce-18.09.6-3.el7.x86_64.rpm

warning: docker-ce-18.09.6-3.el7.x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID 621e9f35: NOKEY

/usr/bin/docker-init

/usr/bin/docker-proxy

/usr/bin/dockerd-ce

/usr/lib/systemd/system/docker.service

/usr/lib/systemd/system/docker.socket

/var/lib/docker-engine/distribution_based_engine-ce.json

docker-ce-cli包含了docker client和一些帮助文档

# rpm -qpl docker-ce-cli-18.09.6-3.el7.x86_64.rpm

warning: docker-ce-cli-18.09.6-3.el7.x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID 621e9f35: NOKEY

/usr/bin/docker

/usr/share/bash-completion/completions/docker

/usr/share/doc/docker-ce-cli-18.09.6

/usr/share/doc/docker-ce-cli-18.09.6/LICENSE

/usr/share/doc/docker-ce-cli-18.09.6/MAINTAINERS

/usr/share/doc/docker-ce-cli-18.09.6/NOTICE

/usr/share/doc/docker-ce-cli-18.09.6/README.md

/usr/share/fish/vendor_completions.d/docker.fish

/usr/share/man/man1/docker-attach.1.gz

......

containerd中包含了containerd containerd-shim ctr runc

# rpm -qpl containerd.io-1.2.5-3.1.el7.x86_64.rpm

warning: containerd.io-1.2.5-3.1.el7.x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID 621e9f35: NOKEY

/etc/containerd

/etc/containerd/config.toml

/usr/bin/containerd

/usr/bin/containerd-shim

/usr/bin/ctr

/usr/lib/systemd/system/containerd.service

/usr/sbin/runc

/usr/share/doc/containerd.io-1.2.5

/usr/share/doc/containerd.io-1.2.5/README.md

/usr/share/licenses/containerd.io-1.2.5

/usr/share/licenses/containerd.io-1.2.5/LICENSE

/usr/share/man/man1/containerd-config.1

/usr/share/man/man1/containerd.1

/usr/share/man/man1/ctr.1

/usr/share/man/man5/containerd-config.toml.5

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值