第一章 Docker入门基础

sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates
sudo apt-key adv \
              --keyserver hkp://ha.pool.sks-keyservers.net:80 \
              --recv-keys 58118E89F3A912897C070ADBF76221572C52609D
#append this to /etc/apt/sources.list
cat >> /etc/apt/sources.list <<EOF
deb https://apt.dockerproject.org/repo ubuntu-xenial main
EOFsudo apt-get update
apt-cache policy docker-engine
apt-get upgrade -y
sudo apt-get install -y linux-image-extra-$(uname -r) linux-image-extra-virtual
sudo apt-get install -y docker-engine

apt-get update
# 默认将会安装最新版的docker1.13.1
apt-get install docker.io

vim /etc/docker/daemon.json
{
 "registry-mirrors": ["https://registry.docker-cn.com"]
}
# --registry-mirror=http://alaudademo13.m.alauda.cn
# "registry-mirrors": ["https://docker.mirrors.ustc.edu.cn"]

man docker subcommand
docker help subcommand
docker command --help

Commands:
 attach      # 进入一个正在运行的容器,不建议使用
 commit      # 把一个正在运行的容器打包成一个新的镜像
 cp          # 在容器与本地文件系统之间进行文件/文件夹拷贝
 create      # 创建一个新的容器
 diff        # 检查运行的容器与所使用镜像之间的变化
 exec        # 进入正在运行的容器
 export      # 把一个容器的文件系统归档成一个tar包
 inspect     # 显示一个/多个容器的详细信息
 kill        # 杀掉一个/多个正在运行的容器
 logs        # 查看容器中进程的运行日志
 ls          # 列出容器列表
 pause       # 暂停一个/多个容器中的所有进程
 port        # 显示容器与docker host的端口映射
 prune       # 移除所有所有停掉的容器
 rename      # 重命名容器
 restart     # 重启容器
 rm          # 删除一个或多个容器
 run         # 运行一个容器
 start       # 启动一个或多个容器
 stats       # 显示容器资源的使用信息
 stop        # 停止一个或多个容器
 top         # 显示容器中的进程
 unpause     # 恢复暂停的容器
 update      # 更新容器的配置(cpu,mem,重启的策略等)
 wait        # 阻塞运行直到容器停止，然后打印出它的退出代码

* 3、运行nginx-php

*　编辑nginx配置文件/usr/local/nginx/conf/nginx.conf
```Shell
user www www;  #modify
worker_processes auto;  #modify#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;
error_log /var/log/nginx_error.log crit;  #add#pid        logs/nginx.pid;
pid /var/run/nginx.pid;  #modify
worker_rlimit_nofile 51200;events {
   use epoll;
   worker_connections 51200;
   multi_accept on;
}http {
   include       mime.types;
   default_type  application/octet-stream;   #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
   #                  '$status $body_bytes_sent "$http_referer" '
   #                  '"$http_user_agent" "$http_x_forwarded_for"';   #access_log  logs/access.log  main;   client_max_body_size 100m;  #add
   sendfile        on;
   #tcp_nopush     on;   #keepalive_timeout  0;
   keepalive_timeout  120; #65;   #gzip  on;   server {
       listen       80;
       server_name  localhost;       #charset koi8-r;       #access_log  logs/host.access.log  main;       root   /usr/local/nginx/html;
       index  index.php index.html index.htm;       location / {
           try_files $uri $uri/ /index.php?$args;
       }       #error_page  404              /404.html;       # redirect server error pages to the static page /50x.html
       #
       error_page   500 502 503 504  /50x.html;
       location = /50x.html {
           root   html;
       }       location ~ \.php$ {
           root           /usr/local/nginx/html;
           fastcgi_pass   127.0.0.1:9000;
           fastcgi_index  index.php;
           fastcgi_param  SCRIPT_FILENAME  /$document_root$fastcgi_script_name;
           include        fastcgi_params;
       }
   }   #add
   ##########################vhost#####################################
   include vhost/*.conf;}daemon off;

#1
COPY ["src","dest"]
COPY src dest
#注意：src只能指定build context中的文件

#检查端口5000是否被占用
netstat -tunlp | grep 5000
# pull registry
mkdir -p /opt/myregistry
docker run -d -p 5000:5000 --name registry --restart=always -v /opt/myregistry:/var/lib/registry registry:2.4.1
curl http://172.17.0.1:5000/v2
# modify https to http
echo "{"insecure-registries:["172.17.0.1:5000"]"}" > /etc/docker/daemon.json
# 拉取busybox镜像做测试
docker pull busybox
# tag镜像
docker tag busybox 172.17.0.1:5000/busybox01
# 删除tag为latest的镜像
docker rmi busybox
# push镜像到本地仓库
docker push 172.17.0.1:5000/busybox01
# check
tree -l 4 /opt/myregistry
# 删除下载的busybox镜像
docker rmi 172.17.0.1:5000/busybox01
# 从本地镜像仓库下载
docker pull 172.17.0.1:5000/busybox01

wget https://github.com/vmware/harbor/releases/download/v1.2.2/harbor-offline-installer-v1.2.2.tgz -o /home/marion/docker
tar xf /home/marion/docker/harbor-offline-installer-v1.2.2.tgz
cd /home/marion/docker/harbor

vim /etc/hosts
## append this
10.0.0.128 www.proharbor.com
## 检查是否正常
ping www.proharbor.com

mkdir /home/marion/docker/harbor/newcert
cd /home/marion/docker/harbor/newcert
openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 365 -out ca.crt
openssl req -newkey rsa:4096 -nodes -sha256 -keyout proharbor.com.key -out proharbor.com.csr
openssl x509 -req -days 3650 -in proharbor.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out proharbor.com.crt
mkdir -pv /etc/docker/certs.d/www.proharbor.com
cp /home/marion/docker/harbor/newcert/ca.crt /etc/docker/certs.d/www.proharbor.com/
cp /home/marion/docker/harbor/newcert/proharbor.com.crt /usr/local/share/ca-certificates/www.proharbor.com.crt
update-ca-certificates

hostname = www.proharbor.com
ui_url_protocol = https
ssl_cert = /home/marion/docker/harbor/newcert/proharbor.com.crt
ssl_cert_key = /home/marion/docker/harbor/newcert/proharbor.com.key

# 创建本地仓库镜像的存储目录
cd /home/marion/docker/harbor
mkdir /home/marion/harborregistry/
vim docker-compose.yml
# ------以下是docker-compose.yml修改后的内容------
version: '2'
services:
 log:
   image: vmware/harbor-log:v1.2.2
   container_name: harbor-log
   restart: always
   volumes:
     - /var/log/harbor/:/var/log/docker/:z
   ports:
     - 127.0.0.1:1514:514
   networks:
     - harbor
 registry:
   image: registry:2.4.1
   container_name: registry
   restart: always
   volumes:
     - /home/marion/harborregistry:/storage:z
     - ./common/config/registry/:/etc/registry/:z
   networks:
     - harbor
   environment:
     - GODEBUG=netdns=cgo
   command:
     ["serve", "/etc/registry/config.yml"]
   depends_on:
     - log
   logging:
     driver: "syslog"
     options:  
       syslog-address: "tcp://127.0.0.1:1514"
       tag: "registry"
 mysql:
   image: vmware/harbor-db:v1.2.2
   container_name: harbor-db
   restart: always
   volumes:
     - /data/database:/var/lib/mysql:z
   networks:
     - harbor
   env_file:
     - ./common/config/db/env
   depends_on:
     - log
   logging:
     driver: "syslog"
     options:  
       syslog-address: "tcp://127.0.0.1:1514"
       tag: "mysql"
 adminserver:
   image: vmware/harbor-adminserver:v1.2.2
   container_name: harbor-adminserver
   env_file:
     - ./common/config/adminserver/env
   restart: always
   volumes:
     - /data/config/:/etc/adminserver/config/:z
     - /data/secretkey:/etc/adminserver/key:z
     - /data/:/data/:z
   networks:
     - harbor
   depends_on:
     - log
   logging:
     driver: "syslog"
     options:  
       syslog-address: "tcp://127.0.0.1:1514"
       tag: "adminserver"
 ui:
   image: vmware/harbor-ui:v1.2.2
   container_name: harbor-ui
   env_file:
     - ./common/config/ui/env
   restart: always
   volumes:
     - ./common/config/ui/app.conf:/etc/ui/app.conf:z
     - ./common/config/ui/private_key.pem:/etc/ui/private_key.pem:z
     - /data/secretkey:/etc/ui/key:z
     - /data/ca_download/:/etc/ui/ca/:z
     - /data/psc/:/etc/ui/token/:z
   networks:
     - harbor
   depends_on:
     - log
     - adminserver
     - registry
   logging:
     driver: "syslog"
     options:  
       syslog-address: "tcp://127.0.0.1:1514"
       tag: "ui"
 jobservice:
   image: vmware/harbor-jobservice:v1.2.2
   container_name: harbor-jobservice
   env_file:
     - ./common/config/jobservice/env
   restart: always
   volumes:
     - /data/job_logs:/var/log/jobs:z
     - ./common/config/jobservice/app.conf:/etc/jobservice/app.conf:z
     - /data/secretkey:/etc/jobservice/key:z
   networks:
     - harbor
   depends_on:
     - ui
     - adminserver
   logging:
     driver: "syslog"
     options:  
       syslog-address: "tcp://127.0.0.1:1514"
       tag: "jobservice"
 proxy:
   image: vmware/nginx-photon:1.11.13
   container_name: nginx
   restart: always
   volumes:
     - ./common/config/nginx:/etc/nginx:z
   networks:
     - harbor
   ports:
     - 80:80
     - 443:443
     - 4443:4443
   depends_on:
     - mysql
     - registry
     - ui
     - log
   logging:
     driver: "syslog"
     options:  
       syslog-address: "tcp://127.0.0.1:1514"
       tag: "proxy"
networks:
 harbor:
   external: false

version: 0.1
log:
 level: debug
 fields:
   service: registry
storage:
   cache:
       layerinfo: inmemory
   filesystem:
       rootdirectory: /storage
   maintenance:
       uploadpurging:
           enabled: false
   delete:
       enabled: true
http:
   addr: :5000
   secret: placeholder
   debug:
       addr: localhost:5001
auth:
 token:
   issuer: harbor-token-issuer
   realm: https://www.proharbor.com/service/token
   rootcertbundle: /etc/registry/root.crt
   service: harbor-registrynotifications:
 endpoints:
     - name: harbor
       disabled: false
       url: http://ui/service/notifications
       timeout: 3000ms
       threshold: 5
       backoff: 1s

cd /home/marion/docker/harbor/
sudo ./install.sh --with-notary --with-clair
#关闭harbor所有的容器(必须在含有docker-compose.yml文件的目录下执行)
docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml -f ./docker-compose.clair.yml down -v
#启动harbor相关的所有容器(必须在含有docker-compose.yml文件的目录下执行)
docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml -f ./docker-compose.clair.yml up -d

#日志路径各不相同，具体路径根据docker-compose.yml或者*/harbor/common/目录下的配置文件进行确定
cd /var/log/harbor
docker logs 容器功能名称

#push
root@dockermaster:/home/marion/docker/harbor# docker tag redis www.proharbor.com/harborssl/redis:dev
root@dockermaster:/home/marion/docker/harbor# docker push www.proharbor.com/harborssl/redis:dev
The push refers to a repository [www.proharbor.com/harborssl/redis]
d112bb627859: Pushed
265ab1ac61ec: Pushed
2341e66d779d: Pushed
9503917b6420: Pushed
aa84bbcc6553: Pushed
29d71372a492: Pushed
dev: digest: sha256:b707a0c39062f1769c8e16069015e1ba839add849deb441428fc0c1deee67c36 size: 1571
#pull
root@dockermaster:/home/marion/docker/harbor# docker pull www.proharbor.com/harborssl/redis:dev
dev: Pulling from harborssl/redis
Digest: sha256:b707a0c39062f1769c8e16069015e1ba839add849deb441428fc0c1deee67c36
Status: Downloaded newer image for www.proharbor.com/harborssl/redis:dev

➜  ~ docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
3ea8a3ad1a61        bridge              bridge              local
9043e76f315a        host                host                local
eba2113c67eb        none                null                local

➜  ~ docker network --helpUsage:    docker network COMMANDManage networksOptions:
     --help   Print usageCommands:
 connect     把一个容器连接到网络
 create       创建一个网络
 disconnect  从网络中中断容器的连接
 inspect     在一个或多个网络上显示详细信息
 ls          列出网络
 prune      移除所有未使用的网络
 rm          移除一个或多个网络

➜  ~ docker run -it --network=none busybox
/ # ifconfig
lo        Link encap:Local Loopback  
         inet addr:127.0.0.1  Mask:255.0.0.0
         UP LOOPBACK RUNNING  MTU:65536  Metric:1
         RX packets:0 errors:0 dropped:0 overruns:0 frame:0
         TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000
         RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)/ #

➜  ~ docker run -it --network=host busybox
/ # ifconfig
docker0   Link encap:Ethernet  HWaddr 02:42:D7:FD:FF:0D  
         inet addr:172.17.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
         inet6 addr: fe80::42:d7ff:fefd:ff0d/64 Scope:Link
         UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
         RX packets:0 errors:0 dropped:0 overruns:0 frame:0
         TX packets:119 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:0
         RX bytes:0 (0.0 B)  TX bytes:13785 (13.4 KiB)
...

apt-get install bridge-utils -y

➜  ~ docker run -it --network=bridge busybox
/ # ifconfig
eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:03  
         inet addr:172.17.0.3  Bcast:0.0.0.0  Mask:255.255.0.0
         UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
         RX packets:12 errors:0 dropped:0 overruns:0 frame:0
         TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:0
         RX bytes:1459 (1.4 KiB)  TX bytes:0 (0.0 B)lo        Link encap:Local Loopback  
         inet addr:127.0.0.1  Mask:255.0.0.0
         UP LOOPBACK RUNNING  MTU:65536  Metric:1
         RX packets:0 errors:0 dropped:0 overruns:0 frame:0
         TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000
         RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

docker network create --driver bridge bridge1
brctl show
docker network create --driver bridge --subnet 172.17.16.0/24 --dateway 172.17.16.1 bridge2
docker run -it --network=bridge2 busybox
----ifconfig
docker run -it --network=bridge2 --ip=172.17.16.3 busybox

docker run -it --network=bridge2 --ip=172.17.16.4 busybox
docker run -it --network=bridge2 --ip=172.17.16.5 busybox
ping -c 3 172.17.16.4(from 172.17.16.5)

docker run -it --network=bridge2 --name=busyboxone busybox
docker run -it --network=bridge2 --name=busyboxtwo busybox
ping -c 3 busyboxone(form busyboxtwo)

docker run -it --name web1 httpd
docker run -it --network=container:web1 httpd

ip r
iptables -t NAT -S
tcpdump -i docker0 -n icmp
tcpdump -i ens33 -n icmp

docker run -d -p 7001:80 -v /root/htdocs:/usr/local/apache2/htdocs httpd
docker run -d -p 7001:80 -v /root/htdocs:/usr/local/apache2/htdocs:ro httpd        #(ro)表示只读
# 类似于selinux这类标签系统,可以在volume挂载时使用z或Z指定该volume是否可以共享,默认为z即为共享,对于这种权限,容器内是无法修改的,只有在docker host上才可以修改权限

docker run -d -p 7001:80 -v /root/htdocs/index.html:/usr/local/apache2/htdocs/new_index.html httpd
# new_index.html在原容器中是没有的,因此此种格式不会类似于目录挂载完全覆盖数据,只是在原有数据的基础上添加一个新文件new_index.html

docker run -d -p 7002:80 -v /usr/local/apache2/htdocs --name web1 httpd    #只指定container path
docker inspect web1    #查找Source
docker volume ls
docker volume inspect VOLUME_NAME
# 注意-v 后面指定的是容器内的目录,也就是上文中说的container_path, 这种格式是把container_path中的文件复制到了docker host中docker volume中,其本质是把镜像层中的数据给共享出来了.

docker create --name vc_data -v /root/htdocs:/usr/local/apache2/htdocs -v /var/www/html busybox
docker run -d -p 7006:80 --name web1 --volume-from vc_data httpd

docker rm #删除容器
docker rm -v # 删除容器以及容器使用的volume
docker volume ls
docker volume rm
docker volume rm $(docker volume ls -q)

{
 "log-driver": "json-file",
 "log-opts": {
   "labels": "production_status",
   "env": "os,customer"
 }
}

docker info | grep 'Logging Driver'

docker inspect -f '{{.HostConfig.LogConfig.Type}}' CONTAINER_ID