docker管理mysql风险,关于mysql:如果你还在用root管理docker容器你就out了

docker简介

Docker提供了轻量级的虚拟化，它简直没有任何额定开销，这十分的cool，相比于虚拟机，你能够在同一台机器上创立更多容器，而且启动docker容器只须要几秒钟，这是传统的虚拟机无法比拟的，这也是docker一经公布，就火爆互联网的起因，其利用场景十分宽泛。

docker运行用户

很多刚刚接触docker的敌人，根本都是用root进行治理docker容器，如下所示

【腾讯云】云产品限时秒杀，爆款1核2G云服务器，首年99元

[root@localhost ~]# docker ps -a

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

ff668e421d59 mysql:5.7.28 "docker-entrypoint.s…" 38 hours ago Exited (137) 10 hours ago mysql5.7.28_3307

423e39a1c866 mysql:5.7.28 "docker-entrypoint.s…" 38 hours ago Exited (137) 10 hours ago mysql5.7.28_3306

30482d5580fa mysql:5.7.28 "docker-entrypoint.s…" 7 months ago Exited (0) 46 hours ago mysql_dns_5.7.28

669d7e9b8d4c phensley/docker-dns "./dockerdns --domai…" 7 months ago Exited (2) 46 hours ago dns

b4f8d09ddf11 mysql:8.0.18 "docker-entrypoint.s…" 8 months ago Exited (0) 10 days ago mysql8.0.18

c8bc897479a9 mysql:5.7.28 "docker-entrypoint.s…" 8 months ago Exited (0) 45 hours ago mysql5.7.28

[root@localhost ~]#

[root@localhost ~]# docker start ff668e421d59

ff668e421d59

[root@localhost ~]#

[root@localhost ~]# docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

ff668e421d59 mysql:5.7.28 "docker-entrypoint.s…" 38 hours ago Up 8 seconds 33060/tcp, 0.0.0.0:3307->3306/tcp mysql5.7.28_3307

[root@localhost ~]#

用root治理容器，的确十分的不便，快捷，不过存在平安危险，因为root是操作系统的最高权限，docker容器运维人员用root权限，如果其账号失落或者泄露，或者docker运维人员用root删除系统文件，就会造成严重后果，所以必须要做权限隔离。

那能用非root用户治理docker容器吗，答案是能够的。

非root用户治理容器

创立治理docker容器用户

因为docker软件装置好之后，主动会创立好docker用户组，所以这里只须要创立好治理docer容器的用户就好。

[root@localhost ~]# useradd -g docker -d /home/appdocker appdocker

[root@localhost ~]#

[root@localhost ~]# id appdocker

uid=2002(appdocker) gid=995(docker) 95(docker)

验证容器治理用户appdocker

先来看看用mysql用户来执行治理docker命令

[mysql@localhost ~]$ docker version

Client: Docker Engine - Community

Version: 19.03.5

API version: 1.40

Go version: go1.12.12

Git commit: 633a0ea

Built: Wed Nov 13 07:25:41 2019

OS/Arch: linux/amd64

Experimental: false

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.40/version: dial unix /var/run/docker.sock: connect: permission denied

[mysql@localhost ~]$

[mysql@localhost ~]$ docker ps

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/json: dial unix /var/run/docker.sock: connect: permission denied

[mysql@localhost ~]$

能够看到用mysql用户执行docker version，docker ps都报错，无法访问/var/run/docker.sock

这个文件的。

来看看新创建的容器治理用户(appdocker)执行状况

查看容器版本

[appdocker@localhost ~]$ docker version

Client: Docker Engine - Community

Version: 19.03.5

API version: 1.40

Go version: go1.12.12

Git commit: 633a0ea

Built: Wed Nov 13 07:25:41 2019

OS/Arch: linux/amd64

Experimental: false

Server: Docker Engine - Community

Engine:

Version: 19.03.5

API version: 1.40 (minimum version 1.12)

Go version: go1.12.12

Git commit: 633a0ea

Built: Wed Nov 13 07:24:18 2019

OS/Arch: linux/amd64

Experimental: false

containerd:

Version: 1.2.10

GitCommit: b34a5c8af56e510852c35414db4c1f4fa6172339

runc:

Version: 1.0.0-rc8+dev

GitCommit: 3e425f80a8c931f88e6d94a8c831b9d5aa481657

docker-init:

Version: 0.18.0

GitCommit: fec3683

查看正在运行的容器

[appdocker@localhost ~]$ docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

ff668e421d59 mysql:5.7.28 "docker-entrypoint.s…" 38 hours ago Up 13 minutes 33060/tcp, 0.0.0.0:3307->3306/tcp mysql5.7.28_3307

[appdocker@localhost ~]$

启停容器

[appdocker@localhost ~]$ docker stop ff668e421d59

ff668e421d59

[appdocker@localhost ~]$

[appdocker@localhost ~]$ docker start ff668e421d59

ff668e421d59

[appdocker@localhost ~]$ docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

ff668e421d59 mysql:5.7.28 "docker-entrypoint.s…" 39 hours ago Up 3 seconds 33060/tcp, 0.0.0.0:3307->3306/tcp mysql5.7.28_3307

[appdocker@localhost ~]$

能够看到曾经新创建的用户appdocker能够完满的治理容器了。

如果想第一工夫获取最新的文章信息，请关注我的今日头条号：月牙讲数据库运维 或者微信公众号：落叶说Mysql数据库运维

本文由博客群发一文多发等经营工具平台 OpenWrite 公布