docker学习文档 (第二版)

原创
2017/12/12 10:05
阅读数 499

docker学习文档 (第二版)

峰回路转 (qq:275868299) 2017.11.27

#第一部分 安装docker ##1.1,docker安装前检查

安装要求

1,docker只能使用在64位系统上

2,docker运行在linux的kernel3.8以上

3,最好使用ubuntu16.04以上版本

本文档安装环境:

# cat /etc/redhat-release 
CentOS Linux release 7.3.1611 (Core) 

#uname -r
3.10.0-514.6.1.el7.x86_64
建议升级到4.10以上

##1.2,安装docker 安装

#yum install docker
#docker -v
Docker version 1.12.5, build 047e51b/1.12.5

启动

#systemctl start docker
# docker info
Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
Images: 0
Server Version: 1.12.5
Storage Driver: devicemapper
 Pool Name: docker-253:0-4297873-pool
 Pool Blocksize: 65.54 kB
 Base Device Size: 10.74 GB
 Backing Filesystem: xfs
 Data file: /dev/loop0
 Metadata file: /dev/loop1
 Data Space Used: 11.8 MB
 Data Space Total: 107.4 GB
 Data Space Available: 6.832 GB
 Metadata Space Used: 581.6 kB
 Metadata Space Total: 2.147 GB
 Metadata Space Available: 2.147 GB
 Thin Pool Minimum Free Space: 10.74 GB
 Udev Sync Supported: true
 Deferred Removal Enabled: false
 Deferred Deletion Enabled: false
 Deferred Deleted Device Count: 0
 Data loop file: /var/lib/docker/devicemapper/devicemapper/data
 WARNING: Usage of loopback devices is strongly discouraged for production use. Use `--    storage-opt dm.thinpooldev` to specify a custom block storage device.
 Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata
 Library Version: 1.02.135-RHEL7 (2016-11-16)
Logging Driver: journald
Cgroup Driver: systemd
Plugins:
 Volume: local
 Network: bridge null host overlay
Swarm: inactive
Runtimes: docker-runc runc
Default Runtime: docker-runc
Security Options: seccomp selinux
Kernel Version: 3.10.0-514.6.1.el7.x86_64
Operating System: CentOS Linux 7 (Core)
OSType: linux
Architecture: x86_64
Number of Docker Hooks: 2
CPUs: 2
Total Memory: 1.797 GiB
Name: localhost.localdomain
ID: 5P4J:HNJ4:AR7Z:Q7UC:3SYQ:M3KW:7RRM:DYR2:QJI2:JYPL:BOZM:ZZOD
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Insecure Registries:
 127.0.0.0/8
Registries: docker.io (secure)   

#第二部分 docker镜像 ##2.1,获取镜像

#docker pull NAME[:TAG]
默认是从docker官网上下载镜像。
其它下载的地方
https://dev.aliyun.com/search.html
https://c.163.com/hub#/m/home/
https://hub.daocloud.io/

设置默认镜像

# vim /etc/sysconfig/docker
ADD_REGISTRY='--add-registry docker.mirrors.ustc.edu.cn'

# /bin/systemctl restart  docker.service

##2.2,一些关于镜像的命令

查看镜像

#docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB

给镜像打tag

#docker tag docker.io/centos:latest docker.io/centos:7
# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
docker.io/centos    7                   98d35105a391        2 weeks ago         192.5 MB
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB

tag信息用于标记来自同一仓库的不同镜像,例如centos仓库有多个镜像,一般通过tag信息来区分发行版本。 以上这两个镜像的ID是完全一致的,说明是指向同一个镜像。 镜像自身是只读的,容器从镜像启动的时候,docker会在镜像的最上层创建一个可写层,镜像本身保持不变。

获取镜像的详细信息

# docker inspect 98d35105a391
[
    {
        "Id": "sha256:98d35105a391b7e429e2c51ea137670f7ec0d4341a42c985772a75cfa43ad85f",
        "RepoTags": [
            "docker.io/centos:7",
            "docker.io/centos:latest"
        ],
        "RepoDigests": [],
        "Parent": "",
        "Comment": "",
        "Created": "2017-03-15T21:49:52.758118314Z",
        "Container": "e8cc0aad77cfd7500966b5f434d8041508370a5ec5a44a71892aa9f0799c0204",
        "ContainerConfig": {
            "Hostname": "2cd7b0a690e2",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
            ],
            "Cmd": [
                "/bin/sh",
                "-c",
                "#(nop) ",
                "CMD [\"/bin/bash\"]"
            ],
            "Image":     "sha256:94765cfa3aaaf006425db71faa4b98466ee27e998d38e608b64d94b011aa5c11",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {
                "build-date": "20170315",
                "license": "GPLv2",
                "name": "CentOS Base Image",
                "vendor": "CentOS"
            }
        },
        "DockerVersion": "1.12.1",
        "Author": "https://github.com/CentOS/sig-cloud-instance-images",
        "Config": {
            "Hostname": "2cd7b0a690e2",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
            ],
            "Cmd": [
                "/bin/bash"
            ],
            "Image":     "sha256:94765cfa3aaaf006425db71faa4b98466ee27e998d38e608b64d94b011aa5c11",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {
                "build-date": "20170315",
                "license": "GPLv2",
                "name": "CentOS Base Image",
                "vendor": "CentOS"
            }
        },
        "Architecture": "amd64",
        "Os": "linux",
        "Size": 192493946,
        "VirtualSize": 192493946,
        "GraphDriver": {
            "Name": "devicemapper",
            "Data": {
                "DeviceId": "4",
                "DeviceName": "docker-253:0-4297873-477c7526e6d60930eea19b1913414260a00ed    16e26159959e88fb660b62b4820",
                "DeviceSize": "10737418240"
            }
        },
        "RootFS": {
            "Type": "layers",
            "Layers": [
                "sha256:9b198ff9ff5b314b0367bea097cfc320046b36ebfa6c9a1e2ba2a78665d58d87"
            ]
        }
    }
]  

搜索镜像

# docker search --filter=stars=10 centos              
INDEX       NAME                                      DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
docker.io   docker.io/centos                          The official build of CentOS.                   3221      [OK]       
docker.io   docker.io/jdeathe/centos-ssh              CentOS-6 6.8 x86_64 / CentOS-7 7.3.1611 x8...   63                   [OK]
docker.io   docker.io/jdeathe/centos-ssh-apache-php   CentOS-6 6.8 x86_64 - Apache / PHP-FPM / P...   25                   [OK]
docker.io   docker.io/consol/centos-xfce-vnc          Centos container with "headless" VNC sessi...   24                   [OK]
docker.io   docker.io/nimmis/java-centos              This is docker images of CentOS 7 with dif...   23                   [OK]
docker.io   docker.io/gluster/gluster-centos          Official GlusterFS Image [ CentOS-7 +  Glu...   18                   [OK]
docker.io   docker.io/million12/centos-supervisor     Base CentOS-7 with supervisord launcher, h...   14                   [OK]

删除镜像

[root[@localhost](https://my.oschina.net/u/570656) ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
docker.io/centos    7                   98d35105a391        2 weeks ago         192.5 MB
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB

[root[@localhost](https://my.oschina.net/u/570656) ~]# docker rmi docker.io/centos:7
Untagged: docker.io/centos:7

[root[@localhost](https://my.oschina.net/u/570656) ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB

docker rmi docker.io/centos:7只会删除该标签,镜像和建立在镜像的其他标签不会受影响

如果镜像上有容器存在,正确的删除方式

[root[@localhost](https://my.oschina.net/u/570656) ~]# docker run docker.io/centos:7 echo "hello,I am here" 
hello,I am here

[root[@localhost](https://my.oschina.net/u/570656) ~]# docker ps -a
CONTAINER ID        IMAGE                COMMAND                  CREATED             STATUS                      PORTS               NAMES
7a0e039f9a4f        docker.io/centos:7   "echo 'hello,I am her"   13 seconds ago      Exited (0) 12 seconds ago                       high_bose

[root@localhost ~]# docker rmi docker.io/centos:7
Untagged: docker.io/centos:7

[root@localhost ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB
执行了删除操作后,容器仍然存在。

[root@localhost ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED              STATUS                          PORTS               NAMES
7a0e039f9a4f        98d35105a391        "echo 'hello,I am her"   About a minute ago   Exited (0) About a minute ago                       high_bose

[root@localhost ~]# docker rm 7a0e039f9a4f
7a0e039f9a4f

[root@localhost ~]# docker ps -a          
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES

[root@localhost ~]# docker images         
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB    

正确的删除方式是,先删除容器,后删除镜像。

创建镜像

创建镜像的三种方式:基于以有镜像的容器创建,基于本地模板导入,基于dockerfile创建。

基于以有镜像的容器创建

[root@localhost ~]# docker run -ti centos:7 /bin/bash

[root@1a447290aa9b /]# touch test

[root@1a447290aa9b /]# exit
exit

[root@localhost ~]# docker commit -m "miaoshu" -a "duxuefeng" 1a447290aa9b centos_test
sha256:c16d722e10ba2872c0a686e884d2ed522ee88278cecce021d6931347eb28a28e

[root@localhost ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos_test         latest              c16d722e10ba        7 minutes ago       192.5 MB
docker.io/centos    7                   98d35105a391        2 weeks ago         192.5 MB
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB    

基于本地模板导入

模板下载地址:https://download.openvz.org/template/precreated/

[root@localhost ~]# ls
anaconda-ks.cfg  centos-6-x86_64-minimal.tar.gz  centos_7.tar

[root@localhost ~]# cat centos-6-x86_64-minimal.tar.gz | docker import - centos:6
sha256:9a031f7a0de5f9302d8dcded33742f12bc126b9540ed975852f666f6d3c7f8da

[root@localhost ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos              6                   9a031f7a0de5        8 seconds ago       553 MB
centos_test         latest              c16d722e10ba        32 minutes ago      192.5 MB
docker.io/centos    7                   98d35105a391        2 weeks ago         192.5 MB
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB 

存出导入镜像

[root@localhost ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos_test         latest              c16d722e10ba        18 minutes ago      192.5 MB
docker.io/centos    7                   98d35105a391        2 weeks ago         192.5 MB
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB

[root@localhost ~]# docker save -o centos_7.tar docker.io/centos:7  

[root@localhost ~]# docker rmi docker.io/centos:7   
Untagged: docker.io/centos:7

[root@localhost ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos_test         latest              c16d722e10ba        18 minutes ago      192.5 MB
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB

[root@localhost ~]# ls
anaconda-ks.cfg  centos_7.tar

[root@localhost ~]# docker load --input centos_7.tar  或者 docker load < centos_7.tar
Loaded image: docker.io/centos:7

[root@localhost ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos_test         latest              c16d722e10ba        19 minutes ago      192.5 MB
docker.io/centos    7                   98d35105a391        2 weeks ago         192.5 MB
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB  

#第三部分 容器

##3.1,新建启动容器

[root@localhost ~]# docker run centos:7 /bin/echo 'hello world'
hello world

当利用docker run创建并启动容器时,docker后台执行的操作:

  1. 检查本地是否存在指定的镜像,不存在就从公有仓库下载
  2. 利用镜像创建并启动一个容器
  3. 分配一个文件系统,并在只读的镜像层外面挂载一层可读写层
  4. 从宿主主机配置的网桥接口中桥接一个虚拟接口到容器中
  5. 从地址池配置一个IP地址给容器
  6. 执行用户指定的应用程序
  7. 执行完毕后容器被终止
  8. 进入容器的交互模式

例子:

[root@localhost ~]# docker run -t -i centos:7 /bin/bash
-t 让docker分配一个伪终端并绑定到容器的标准输入上
-i 让容器的标准输入保持打开状态

[root@6330918ea39a /]# ls
anaconda-post.log  dev  home  lib64       media  opt   root  sbin  sys  usr
bin                etc  lib   lost+found  mnt    proc  run   srv   tmp  var

守护态运行
[root@localhost ~]# docker run -d centos:7 /bin/bash -c "while true; do echo hello world; sleep 1; done"
cf03fed72e1883445ba4ffb075cb7608584b60fbe5ddb64d56cb86917c16227f

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
cf03fed72e18        centos:7            "/bin/bash -c 'while "   7 seconds ago       Up 6 seconds                            naughty_noyce

[root@localhost ~]# docker logs cf03fed72e18
hello world
hello world
hello world
...

##3.2,终止容器

交互模式容器终止

当容器中的应用终结时,容器也自动终止。例如在交互式模式下用户通过exit命令或ctril+d来退出终端时,所创建的容器立刻终止

守护态容器终止

可以通过docker stop来终止一个运行中的容器

[root@localhost ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                      PORTS               NAMES
cf03fed72e18        centos:7            "/bin/bash -c 'while "   16 minutes ago      Up 9 seconds                                    naughty_noyce
6330918ea39a        centos:7            "/bin/bash"              21 minutes ago      Exited (0) 17 minutes ago                       angry_noether
07a974ede13f        centos:7            "/bin/echo 'hello wor"   27 minutes ago      Exited (0) 27 minutes ago                       sleepy_hugle
可以看到cf03fed72e18的STATUS处于运行状态

[root@localhost ~]# docker ps -a -q          
cf03fed72e18
6330918ea39a
07a974ede13f

[root@localhost ~]# docker stop cf03fed72e18
cf03fed72e18
关闭cf03fed72e18容器

[root@localhost ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                       PORTS               NAMES
cf03fed72e18        centos:7            "/bin/bash -c 'while "   17 minutes ago      Exited (137) 4 seconds ago                       naughty_noyce
6330918ea39a        centos:7            "/bin/bash"              22 minutes ago      Exited (0) 18 minutes ago                        angry_noether
07a974ede13f        centos:7            "/bin/echo 'hello wor"   28 minutes ago      Exited (0) 28 minutes ago                        sleepy_hugle
可以看到cf03fed72e18的STATUS处于关闭状态	

[root@localhost ~]# docker start cf03fed72e18
cf03fed72e18
开启容器	

[root@localhost ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                      PORTS               NAMES
cf03fed72e18        centos:7            "/bin/bash -c 'while "   17 minutes ago      Up 3 seconds                                    naughty_noyce
6330918ea39a        centos:7            "/bin/bash"              23 minutes ago      Exited (0) 18 minutes ago                       angry_noether
07a974ede13f        centos:7            "/bin/echo 'hello wor"   28 minutes ago      Exited (0) 28 minutes ago                       sleepy_hugle      

##3.3,进入容器

exec方式进入

[root@localhost ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                      PORTS               NAMES
cf03fed72e18        centos:7            "/bin/bash -c 'while "   17 minutes ago      Up 3 seconds                                    naughty_noyce
6330918ea39a        centos:7            "/bin/bash"              23 minutes ago      Exited (0) 18 minutes ago                       angry_noether
07a974ede13f        centos:7            "/bin/echo 'hello wor"   28 minutes ago      Exited (0) 28 minutes ago                       sleepy_hugle

[root@localhost ~]# docker exec -ti cf03fed72e18 /bin/bash

[root@cf03fed72e18 /]# ls
anaconda-post.log  dev  home  lib64       media  opt   root  sbin  sys  usr
bin                etc  lib   lost+found  mnt    proc  run   srv   tmp  var

[root@cf03fed72e18 /]# exit
exit

[root@localhost ~]# docker exec -ti 6330918ea39a /bin/bash
Error response from daemon: Container 6330918ea39afd4a33b8b171f7b148260986826af97aa01efcd7b5a241353e22 is not running 
测试证明只有运行的容器可以进入

nsenter方式进入

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
cf03fed72e18        centos:7            "/bin/bash -c 'while "   42 hours ago        Up 42 hours                             naughty_noyce

[root@localhost ~]# docker inspect -f {{.State.Pid}} naughty_noyce
6072

[root@localhost ~]# docker inspect -f {{.State.Pid}} cf03fed72e18
6072

[root@localhost ~]# nsenter --target 6072 --mount --uts --ipc --net --pid

[root@cf03fed72e18 /]# exit
logout

##3.4,删除容器

[root@localhost ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                    PORTS               NAMES
17c26246299e        centos:7            "/bin/bash -c 'while "   31 seconds ago      Up 30 seconds                                 hopeful_sammet
cf03fed72e18        centos:7            "/bin/bash -c 'while "   43 hours ago        Up 42 hours                                   naughty_noyce
6330918ea39a        centos:7            "/bin/bash"              43 hours ago        Exited (0) 43 hours ago                       angry_noether
07a974ede13f        centos:7            "/bin/echo 'hello wor"   43 hours ago        Exited (0) 43 hours ago                       sleepy_hugle

[root@localhost ~]# docker rm 17c26246299e
Error response from daemon: You cannot remove a running container 17c26246299e5b080063bab3f3374f779173aaa0758668728b224e60b1b66b6b. Stop the container     before attempting removal or use -f
不能删除正在运行的容器,如果想删除加-f参数

[root@localhost ~]# docker rm -f 17c26246299e
17c26246299e
[root@localhost ~]# docker ps -a             
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                    PORTS               NAMES
cf03fed72e18        centos:7            "/bin/bash -c 'while "   43 hours ago        Up 42 hours                                   naughty_noyce
6330918ea39a        centos:7            "/bin/bash"              43 hours ago        Exited (0) 43 hours ago                       angry_noether
07a974ede13f        centos:7            "/bin/echo 'hello wor"   43 hours ago        Exited (0) 43 hours ago                       sleepy_hugle

[root@localhost ~]# docker rm 07a974ede13f
07a974ede13f
[root@localhost ~]# docker ps -a          
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                    PORTS               NAMES
cf03fed72e18        centos:7            "/bin/bash -c 'while "   43 hours ago        Up 42 hours                                   naughty_noyce
6330918ea39a        centos:7            "/bin/bash"              43 hours ago        Exited (0) 43 hours ago                       angry_noether

##3.5,导入导出容器

[root@localhost ~]# docker ps -a          
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                    PORTS               NAMES
cf03fed72e18        centos:7            "/bin/bash -c 'while "   43 hours ago        Up 42 hours                                   naughty_noyce
6330918ea39a        centos:7            "/bin/bash"              43 hours ago        Exited (0) 43 hours ago                       angry_noether

[root@localhost ~]# docker export cf03fed72e18 > test_for_run.tar
导出正在运行的容器

[root@localhost ~]# docker export 6330918ea39a > test_for_stop.tar            
导出停止运行的容器

[root@localhost ~]# ls
test_for_run.tar  test_for_stop.tar

[root@localhost ~]# cat test_for_stop.tar | docker import - test/centos:7
sha256:f5310b70a7b92d69bd5fd8c94c067ea42fe2a37be8ff7bf5cdeef85de3980f7e
导入容器成images

[root@localhost ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
test/centos         7                   f5310b70a7b9        3 seconds ago       192.5 MB
centos              6                   9a031f7a0de5        43 hours ago        553 MB
centos_test         latest              c16d722e10ba        44 hours ago        192.5 MB
docker.io/centos    7                   98d35105a391        2 weeks ago         192.5 MB
docker.io/centos    latest              98d35105a391        2 weeks ago         192.5 MB

#第四部分 仓库

##4.1,官方仓库

公共仓库:https://hub.docker.com

基本操作:见镜像一章

##4.2,私有仓库

创建私有仓库

测试仓库服务器:10.1.13.231

#docker run -d -p 5000:5000 -v /data/docker_registry:/var/lib/registry daocloud.io/library/registry
Registry服务默认会将上传的镜像保存在容器的/var/lib/registry,我们将主机的/data/docker_registry目录挂载到该目录,即可实现将镜像保存到主机的/data/docker_registry目录了。

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE                          COMMAND                  CREATED             STATUS              PORTS                    NAMES
69f96b24af09        daocloud.io/library/registry   "/entrypoint.sh /etc/"   8 minutes ago       Up 1 seconds        0.0.0.0:5000->5000/tcp   gloomy_hamilton
说明我们已经启动了registry服务,浏览器访问或命令行curl访问http://127.0.0.1:5000/v2,出现下面情况说明registry运行正常

# curl http://10.1.13.231:5000/v2/
{}

测试服务器:10.1.13.232

[root@localhost ~]# docker tag centos 10.1.13.231:5000/centos:6

[root@localhost ~]# docker images
REPOSITORY                TAG                 IMAGE ID            CREATED             SIZE
centos                    6                   9a031f7a0de5        2 days ago          553 MB
10.1.13.231:5000/centos   6                   98d35105a391        2 weeks ago         192.5 MB

[root@localhost ~]# docker push 10.1.13.231:5000/centos
The push refers to a repository [10.1.13.231:5000/centos]
Get https://10.1.13.231:5000/v1/_ping: http: server gave HTTP response to HTTPS client
报错:从错误信息来看,client与Registry交互,默认将采用https访问,但我们在install Registry时并未配置指定任何tls相关的key和crt文件,https访问定然失败
解决:修改Registry server上的Docker daemon的配置,参数增加–insecure-registry 10.1.13.231:5000

[root@localhost ~]# vim /etc/sysconfig/docker
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --insecure-registry 10.1.13.231:5000'
[root@localhost ~]# systemctl restart docker

[root@localhost ~]# docker push 10.1.13.224:5000/centos
The push refers to a repository [10.1.13.224:5000/centos]
b51149973e6a: Retrying in 1 second 
received unexpected HTTP status: 500 Internal Server Error
push返回500错误,需要关闭防火墙和selinux
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0

[root@localhost ~]# docker push 10.1.13.231:5000/centos:6
The push refers to a repository [10.1.13.231:5000/centos]
9b198ff9ff5b: Pushed 
6: digest: sha256:d7f3db1caf4ea76117abce89709ebfc66c9339e13866016b8b2e4eee3ab4bea0 size: 529

[root@localhost ~]# curl http://10.1.13.231:5000/v2/_catalog
{"repositories":["centos"]}

验证

在另外的一台机器做验证
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0
[root@localhost ~]# vim /etc/sysconfig/docker
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --insecure-registry 10.1.13.231:5000'	

[root@localhost ~]# docker pull 10.1.13.231:5000/centos:6
Trying to pull repository 10.1.13.231:5000/centos ... 
6: Pulling from 10.1.13.231:5000/centos
Digest: sha256:d7f3db1caf4ea76117abce89709ebfc66c9339e13866016b8b2e4eee3ab4bea0

[root@localhost ~]# docker images
REPOSITORY                     TAG                 IMAGE ID            CREATED             SIZE
10.1.13.231:5000/centos        6                   98d35105a391        2 weeks ago         192.5 MB

设置默认使用私有仓库

# vim /etc/sysconfig/docker
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --insecure-registry 10.1.13.231:5000'
ADD_REGISTRY='--add-registry 10.1.13.231:5000'

# docker pull centos:6     
Trying to pull repository 10.1.13.231:5000/centos ... 
6: Pulling from 10.1.13.231:5000/centos
4969bbd91a1e: Pull complete 
Digest: sha256:d7f3db1caf4ea76117abce89709ebfc66c9339e13866016b8b2e4eee3ab4bea0

# docker images
REPOSITORY                TAG                 IMAGE ID            CREATED             SIZE
10.1.13.231:5000/centos   6                   98d35105a391        2 weeks ago         192.5 MB    

#第五部分 数据管理

##5.1,数据卷

特性:

1,数据卷可以在容器之间共享和重用

2,对数据卷的修改会马上生效

3,对数据卷的更新,不会影响镜像

4,卷会一直存在,直到没有容器使用

在容器内创建一个数据卷

[root@localhost ~]# docker run -it --name web -v /data docker.io/centos:7  

[root@97913ebaae69 /]# ls
anaconda-post.log  bin  data  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

挂载一个主机目录作为数据卷

问题:
[root@localhost ~]# docker run -it --name web -v /data/wwwroot:/data:rw docker.io/centos:7 

[root@6013616fad9d /]# cd /data/

[root@6013616fad9d data]# ls
ls: cannot open directory .: Permission denied

解决:
[root@localhost ~]# docker run -it --privileged=true --name web -v /data/wwwroot:/data docker.io/centos:7

[root@0fa11af5d212 /]# cd /data/

[root@0fa11af5d212 data]# ls
test

##5.2,数据卷容器

创建一个数据卷容器

[root@localhost ~]# docker run -it --name datadocker -v /data docker.io/centos:7      

[root@f20dfc369021 /]# ls
anaconda-post.log  bin  data  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root 	 run  sbin  srv  sys  tmp  usr  var

[root@f20dfc369021 /]# cd data/

[root@f20dfc369021 data]# ls

创建新docker,并连接到数据卷容器,并测试
[root@localhost ~]# docker run -it --volumes-from datadocker --name testdata1 docker.io/centos:7 

[root@3ab18f1456ff /]# ls
anaconda-post.log  bin  data  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

[root@3ab18f1456ff /]# cd data/

[root@3ab18f1456ff data]# ls

[root@3ab18f1456ff data]# touch testdata1

[root@3ab18f1456ff data]# ls
testdata1

在数据卷容器上查看
[root@f20dfc369021 data]# ls
testdata1

数据卷容器删除

删除顺序,应该先删除挂载数据卷容器的容器,再删除数据卷容器。如果反过来执行,挂载数据卷容器的容器仍然可以写入数据,但是如果退出后再挂载进入容器就会报错。另外原数据卷容器删除再挂载目录为空。

##5.3,备份数据卷

备份 窗口1 [root@localhost ~]# docker run --privileged=true -it -v /webdata --name webdocker docker.io/centos:7

[root@5d030ddacbf0 ~]# ls /webdata/
aaa.txt

窗口2
[root@localhost ~]# docker run --privileged=true  --volumes-from webdocker -v $(pwd):/backup --name webdata.bak docker.io/centos:7 tar cvf /backup/backup.tar /webdata 
tar: Removing leading `/' from member names
/webdata/
/webdata/aaa.txt
$(pwd)就是指宿主机的当前目录,/root

窗口1
在执行备份的当前目录下查看
[root@localhost ~]# ls
backup.tar     

恢复

窗口1
[root@localhost ~]# docker run --privileged=true -it -v /webdata --name webdocker2 docker.io/centos:7 

[root@d51a14c3a1b1 /]# cd /webdata/

[root@d51a14c3a1b1 webdata]# ls

[root@d51a14c3a1b1 webdata]#

窗口2
[root@localhost ~]# docker run --privileged=true -it --volumes-from webdocker2 -v $(pwd):/backup docker.io/centos:7 tar xvf /backup/backup.tar
webdata/
webdata/aaa.txt

窗口1
[root@d51a14c3a1b1 webdata]# ls
aaa.txt

#第六部分 网络

##6.1,端口映射实现访问容器

下载nginx镜像
[root@localhost ~]# docker pull daocloud.io/library/nginx:1.7.1

-P:随机方式映射本地端口到docker
[root@localhost ~]# docker run -d -P daocloud.io/library/nginx:1.7.1
a7526362757d74257fe175ba54401f19a7874e8b21dbc161a51b7066c3104620

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE                             COMMAND             CREATED             STATUS                  PORTS                   NAMES
a7526362757d        daocloud.io/library/nginx:1.7.1   "nginx"             4 seconds ago       Up 3 seconds        0.0.0.    0:32769->80/tcp   sick_murdock

[root@localhost ~]# curl 10.1.13.232:32769
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
...    

-p:指定方式映射本地端口都docker
[root@localhost ~]# docker run -d -p 80:80 daocloud.io/library/nginx:1.7.1 
822d1b66480d960d0e35d7c48c5b6508a1840927fde00833d738d8baddac197a

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE                             COMMAND             CREATED             STATUS              PORTS                   NAMES
822d1b66480d        daocloud.io/library/nginx:1.7.1   "nginx"             6 seconds ago       Up 5 seconds        0.0.0.0:80->80/tcp      pensive_meninsky

[root@localhost ~]# curl 10.1.13.232:80
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
... 

-p:映射指定地址的ip
[root@localhost ~]# docker run -d -p 127.0.0.1:8000:80 daocloud.io/library/nginx:1.7.1  
a710dec3bfb29f6eae4867852f265833b79bf03cdbbd3d17737ba70529386343

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE                             COMMAND             CREATED             STATUS              PORTS                    NAMES
a710dec3bfb2        daocloud.io/library/nginx:1.7.1   "nginx"             11 seconds ago      Up 9 seconds        127.0.0.1:8000->80/tcp   clever_hamilton


-p:映射指定地址的任意端口
[root@localhost ~]# docker run -d -p 127.0.0.1::80 daocloud.io/library/nginx:1.7.1    
739c20fe63e277158424633513159d772b4977ce8b0b7c2e8cf2ff0363db9825

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE                             COMMAND             CREATED              STATUS              PORTS                     NAMES
739c20fe63e2        daocloud.io/library/nginx:1.7.1   "nginx"             6 seconds ago        Up 4 seconds        127.0.0.1:32768->80/tcp   sharp_yonath

查看映射端口配置

[root@localhost ~]# docker port 739c20fe63e2 80
127.0.0.1:32768

[root@localhost ~]# docker port 822d1b66480d 80
0.0.0.0:80

##6.2,容器互联

[root@localhost ~]# docker run --name mysql_local -e MYSQL_ROOT_PASSWORD=123456 -d -P daocloud.io/mysql:5.7.6

[root@localhost ~]# docker ps
CONTAINER ID        IMAGE                             COMMAND                  CREATED             STATUS              PORTS                     NAMES
b5cd65599eb9        daocloud.io/mysql:5.7.6           "/entrypoint.sh mysql"   27 minutes ago      Up 27 minutes       0.0.0.0:32772->3306/tcp       mysql_local


[root@localhost ~]# docker run -it --name testnet --link mysql_local:mysql docker.io/centos

[root@e084b78d4343 /]# ping mysql
PING mysql (172.17.0.3) 56(84) bytes of data.
64 bytes from mysql (172.17.0.3): icmp_seq=1 ttl=64 time=0.107 ms
64 bytes from mysql (172.17.0.3): icmp_seq=2 ttl=64 time=0.152 ms
64 bytes from mysql (172.17.0.3): icmp_seq=3 ttl=64 time=0.125 ms
^C
--- mysql ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6000ms
rtt min/avg/max/mdev = 0.106/0.132/0.152/0.020 ms

[root@51000c252130 /]#yum install mysql -y

[root@51000c252130 /]# mysql -hmysql -P3306 -uroot -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 6
Server version: 5.7.6-m16 MySQL Community Server (GPL)

Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> show databaes;\
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near     'databaes' at line 1
MySQL [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
3 rows in set (0.00 sec)

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE                             COMMAND                  CREATED             STATUS              PORTS                     NAMES
e084b78d4343        docker.io/centos                  "/bin/bash"              9 seconds ago       Up 8 seconds                                  testnet
b5cd65599eb9        daocloud.io/mysql:5.7.6           "/entrypoint.sh mysql"   30 minutes ago      Up 30 minutes       0.0.0.0:32772->3306/tcp       mysql_local    

查看容器见的连接信息

在容器中查询

[root@e084b78d4343 /]# cat /etc/hosts
127.0.0.1       localhost
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.3      mysql b5cd65599eb9 mysql_local

容器外查询

[root@localhost ~]# docker run --rm --name nginx_local --link mysql_local:mysql daocloud.io/library/nginx:1.7.1 env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=c189b6d0935b
MYSQL_PORT=tcp://172.17.0.3:3306
MYSQL_PORT_3306_TCP=tcp://172.17.0.3:3306
MYSQL_PORT_3306_TCP_ADDR=172.17.0.3
MYSQL_PORT_3306_TCP_PORT=3306
MYSQL_PORT_3306_TCP_PROTO=tcp
MYSQL_NAME=/nginx_local/mysql
MYSQL_ENV_MYSQL_ROOT_PASSWORD=123456
MYSQL_ENV_MYSQL_MAJOR=5.7
MYSQL_ENV_MYSQL_VERSION=5.7.6-m16
HOME=/

#第七部分 dockerfile

基本格式

FROM daocloud.io/library/centos:latest
#基于那个镜像
#在版本1.7以上,FROM可以直接指定docker images中的镜像。 如果使用--pull=true会优先从线上仓库中拉取镜像

MAINTAINER duxuefeng duxuefeng@oasgames.com
#镜像的作者信息

RUN rpm -ivh http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
RUN yum install telnet curl net-tools -y
RUN yum install nginx -y
RUN echo "daemon off;" >> /etc/nginx/nginx.conf

RUN ["mkdir","/mydata"]
RUN ["mkdir","-p","/data/htdocs"]

CMD nginx -c /etc/nginx/nginx.conf
#在实际执行变更为:CMD [ "sh", "-c", "echo $HOME" ]
#CMD ["nginx","-g","daemon off;"]
#ENTRYPOINT ["docker-enterypoint.sh"]
#无论放在那个位置都会在最后执行docker-enterypoint.sh

#RUN是在building image时会运行的指令, 在Dockerfile中可以写多条RUN指令.
#CMD和ENTRYPOINT则是在运行container 时会运行的指令, 都只能写一条, 如果写了多条, 则最后一条生效.
#CMD和ENTRYPOINT的区别是: 
#CMD在运行时会被command覆盖, ENTRYPOINT不会被运行时的command覆盖, 但是也可以指定.

COPY ./COPY*.test /mydata/
ADD ADD_test.tar.gz /mydata
#复制文件时,尽可能使用COPY,只有需要自动解压缩的情况下使用ADD

ENV VERSION=1.0 DEBUG=on \
    NAME="test dockerfile"
#后面的指令或者是RUN,都可以使用这里定义的环境变量

VOLUME ["data/htdocs","/data/wwwroot"]
#容器应尽量保持容器存储层不发生写操作,所以尽量不挂载本地卷到容器中
#VOLUME ["/mydata","/data"]
#对于数据库类要保存动态数据的应用,数据库文件应保存在卷中。所以在安装mysql时应制定数据文件及log的存放位置为/data

EXPOSE 80
#1,帮助镜像使用者理解这个镜像服务的守护端口,以方便配置映射
#2,在运行时使用随机端口映射时,也就是 docker run -P 时,会自动随机映射 EXPOSE 的端口。

WORKDIR /mydata
#以后的层都会在该目录下执行命令。
RUN echo "WORKDIR test" > WORKDIR.test
#指定工作目录,使用方式和cd类似
#RUN cd /mydata
#RUN echo "hello world" > world.txt
#如果使用cd,由于docker有一个分层的概念,所以执行cd和执行echo并不是一个读写层上,所以就找不到这个文件。
WORKDIR /

RUN useradd duxuefeng
USER duxuefeng 
#切换用户,以后的层都会在该用户下执行命令。
RUN echo "USER test" >> /home/duxuefeng/USER.test
USER root


HEALTHCHECK --interval=5s --timeout=3s \
  CMD curl -fs http://localhost/ || exit 1

#每 5 秒检查一次(这里为了试验所以间隔非常短,实际应该相对较长),如果健康检查命令超过 3 秒没响应就视为失败,并且使用 curl -fs     http://localhost/ || exit 1 作为健康检查命令。
#当运行该镜像后,可以通过 docker ps 看到最初的状态为 (health: starting):
#STATUS                            
#Up 2 seconds (health: starting)

#在等待几秒钟后,再次 docker ps,就会看到健康状态变化为了 (healthy):
#STATUS
#Up 2 seconds (health)

#如果健康检查连续失败超过了重试次数,状态就会变为 (unhealthy)。
#为了帮助排障,健康检查命令的输出(包括 stdout 以及 stderr)都会被存储于健康状态里,可以用 docker inspect 来查看
#docker inspect --format '{{json .State.Health}}' web | python -m json.tool


ONBUILD RUN echo "ONBUILD test" > ONBUILD.test
#假设当前为A镜像,ONBUILD后的命令不被执行。
#新建一个B镜像,是基于A镜像的,B镜像会执行A镜像dockerfile中的ONBUILD后的命令    

构建镜像

[root@localhost ~]# docker build -t dockerfile/nginx:v1 .

[root@localhost ~]# docker build -t dockerfile/nginx:v1 - < Dockerfile

[root@localhost ~]# docker build -t dockerfile/nginx:v1 - < mydockerfile.tar.gz

使用images

[root@localhost ~]# docker run -d --name web dockerfile/nginx:v1

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE                             COMMAND                  CREATED             STATUS                    PORTS                     NAMES
c88bae1554e5        dockerfile/nginx:v1               "/bin/sh -c 'nginx -c"   28 minutes ago      Up 28 minutes (healthy)   80/tcp   					web

[root@localhost ~]# docker exec -it c88bae1554e5 /bin/bash
[root@c88bae1554e5 /]# ps -ef                                                                                                               
UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  0 09:35 ?        00:00:00 nginx: master process nginx -c /etc/nginx/nginx.conf
nginx        5     1  0 09:35 ?        00:00:00 nginx: worker process
root      2230     0  0 10:06 ?        00:00:00 /bin/bash
root      2247  2230  0 10:06 ?        00:00:00 ps -ef

#第八部分 高级网络配置

##8.1,配置容器的dns和主机名

[root@localhost ~]# docker run -it 22f57c447f0f /bin/bash 

[root@22f57c447f0f /]# mount
...
/dev/mapper/cl-root on /etc/resolv.conf type xfs (rw,relatime,seclabel,attr2,inode64,noquota)
#每次启动会同步宿主机上的/etc/resolv.conf
/dev/mapper/cl-root on /etc/hostname type xfs (rw,relatime,seclabel,attr2,inode64,noquota)
#只记录容器自身的主机名
/dev/mapper/cl-root on /etc/hosts type xfs (rw,relatime,seclabel,attr2,inode64,noquota)
#只记录容器自身的一些地址和名称
...
#运行中的容器里可以直接编辑修改这三个文件,但是都是临时生效,只要退出容器便失效。

修改方式

#修改hostname,hosts
[root@localhost ~]# docker run -it -h rename.test a8493f5f50ff /bin/bash

[root@rename /]# cat /etc/hosts
127.0.0.1       localhost
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.3      rename.test

[root@rename /]# cat /etc/hostname 
rename.test  
#修改dns

[root@localhost ~]# docker run -it -h rename.test --dns=8.8.8.8 a8493f5f50ff /bin/bash  

[root@rename /]# cat /etc/resolv.conf 
nameserver 8.8.8.8

##8.2,容器访问外部实现

假设容器内部的网络地址是172.17.0.2,本地网络地址为10.1.13.231,容器要能访问外部网络,源地址不能为172.17.0.2,需要进行源地址映射,在容器启动时,会自动添加iptables规则进行源地址映射。

[root@localhost ~]# iptables -t nat -nvL POSTROUTING
Chain POSTROUTING (policy ACCEPT 97 packets, 6596 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  443 27569 MASQUERADE  all  --  *      !docker0  172.17.0.0/16        0.0.0.0/0           
 1792  123K POSTROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 1792  123K POSTROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 1792  123K POSTROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0  

##8.3,外部访问容器

外部访问容器,可以在启动容器的时候加上-p或-P指定绑定宿主机的端口。执行启动命令时会在宿主机上添加一条iptables规则。

[root@localhost ~]#docker run -d -p 5000:5000 -v /data/docker_images:/tmp/registry daocloud.io/library/registry

[root@localhost ~]# docker ps 
CONTAINER ID        IMAGE                          COMMAND                  CREATED             STATUS                  PORTS                    NAMES
69f96b24af09        daocloud.io/library/registry   "/entrypoint.sh /etc/"   3 weeks ago         Up 3 weeks          0.0.0.    0:5000->5000/tcp   gloomy_hamilton

[root@localhost ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 3443K packets, 485M bytes)
 pkts bytes target     prot opt in     out     source               destination         
   74  4300 DOCKER     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 2837K packets, 371M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 41 packets, 2484 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    4   240 DOCKER     all  --  *      *       0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 41 packets, 2484 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      !docker0  172.17.0.0/16        0.0.0.0/0           
    0     0 MASQUERADE  tcp  --  *      *       172.17.0.2           172.17.0.2           tcp dpt:5000

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  docker0 *       0.0.0.0/0            0.0.0.0/0           
   66  3960 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5000 to:172.17.0.2:5000    

##8.4,自定义网桥

安装bridge-utils

[root@localhost ~]# yum install bridge-utils

自定义网桥

[root@localhost ~]# systemctl stop docker
[root@localhost ~]# ip link set dev docker0 down
[root@localhost ~]# brctl delbr docker0
[root@localhost ~]# brctl addbr br0
[root@localhost ~]# ip addr add 192.168.1.1/24 dev br0
[root@localhost ~]# ip link set dev br0 up
[root@localhost ~]# ip addr show br0
42: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether ae:a4:7a:8c:c3:f3 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::70ca:3fff:fec7:5180/64 scope link 
       valid_lft forever preferred_lft forever

[root@localhost ~]# vim /etc/sysconfig/docker
...
 OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false -b=br0'
 systemctl start docker
...

[root@localhost ~]# docker run -it docker.io/centos /bin/bash   

[root@35265fd51ae0 /]# cat /etc/hosts
127.0.0.1       localhost
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
192.168.1.2     35265fd51ae0

##8.5,docker网络创建过程

docker允许在启动容器的时候通过--net参数指定不同的网络类型。

   --net=bridge:默认值,桥接到默认的网桥。
   --net=host:不将容器网络放到隔离的namespace,此时docker不会容器化容器内的网络,这样创建出来的容器使用的是本地的网络,拥有完全的本地主机接口访问权限。
   --net=contianer:name_or_id:使用一个已经存在的容器的网络栈,共享已存在容器的ip地址和端口等网络资源。
   --net=none:将新容器放到隔离的网络栈中,不进行网络配置,我们为容器配置网络需要指定该项。

--net=none,docker网络创建过程

[root@localhost ~]# docker run -it --rm --name=mynetwork --net=none duxuefeng/centos:7 /bin/bash  

[root@fe45a4c90f52 /]# ifconfig 
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

#另起一个终端
[root@localhost ~]# PID=$(docker inspect -f '{{.State.Pid}}' mynetwork)
[root@localhost ~]# mkdir -p /var/run/netns
[root@localhost ~]# ln -s /proc/$PID/ns/net /var/run/netns/$PID
[root@localhost ~]# ip link add A type veth peer name B
[root@localhost ~]# brctl addif docker0 A
[root@localhost ~]# ip link set A up
[root@localhost ~]# ip link set B netns $PID
[root@localhost ~]# ip netns exec $PID ip link set dev B name eth0
[root@localhost ~]# ip netns exec $PID ip link set eth0 up
[root@localhost ~]# ifconfig 
A: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::68eb:a5ff:fe87:3746  prefixlen 64  scopeid 0x20<link>
        ether 6a:eb:a5:87:37:46  txqueuelen 1000  (Ethernet)
        RX packets 8  bytes 648 (648.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8  bytes 648 (648.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

br0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.1.1  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::70ca:3fff:fec7:5180  prefixlen 64  scopeid 0x20<link>
        ether 00:00:00:00:00:00  txqueuelen 1000  (Ethernet)
        RX packets 4774  bytes 238605 (233.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5522  bytes 11840622 (11.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 0.0.0.0
        inet6 fe80::42:79ff:fecf:91fa  prefixlen 64  scopeid 0x20<link>
        ether 02:42:79:cf:91:fa  txqueuelen 0  (Ethernet)
        RX packets 16  bytes 1072 (1.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8  bytes 648 (648.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.1.13.231  netmask 255.255.240.0  broadcast 10.1.15.255
        inet6 fe80::766a:fdcd:a625:9467  prefixlen 64  scopeid 0x20<link>
        inet6 fe80::2f37:6f59:83d:7e82  prefixlen 64  scopeid 0x20<link>
        ether 08:00:27:9a:94:7a  txqueuelen 1000  (Ethernet)
        RX packets 42228479  bytes 4629098928 (4.3 GiB)
        RX errors 21  dropped 26215  overruns 0  frame 21
        TX packets 337090  bytes 277401689 (264.5 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 9488  bytes 72749522 (69.3 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 9488  bytes 72749522 (69.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@localhost ~]# ip netns exec $PID ip addr add 172.17.0.5/24 dev eth0

[root@localhost ~]# ip netns exec $PID ip route add default via 172.17.0.1

#在容器中查看网卡信息
[root@6a5821b10eb6 /]# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.5  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::50fe:b7ff:fe9a:dc7f  prefixlen 64  scopeid 0x20<link>
        ether 52:fe:b7:9a:dc:7f  txqueuelen 1000  (Ethernet)
        RX packets 8  bytes 648 (648.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8  bytes 648 (648.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0    

##8.6,docker的网络配置工具pipework

#pipework工具的安装
[root@localhost ~]# wget https://github.com/jpetazzo/pipework/archive/master.zip

[root@localhost ~]# unzip master.zip 
Archive:  master.zip
2ed107e43be8aebc63f884a158535c14d71fa0aa
   creating: pipework-master/
 extracting: pipework-master/.gitignore  
  inflating: pipework-master/LICENSE  
  inflating: pipework-master/README.md  
  inflating: pipework-master/docker-compose.yml  
   creating: pipework-master/doctoc/
  inflating: pipework-master/doctoc/Dockerfile  
  inflating: pipework-master/pipework  
  inflating: pipework-master/pipework.spec  

[root@localhost ~]# cp pipework-master/pipework /usr/local/bin/

[root@localhost ~]# chmod +x /usr/local/bin/pipework 

#pipework使用
#方法1
[root@localhost ~]# did=$(docker run -it -d --net=none duxuefeng/centos:7)  

[root@localhost ~]# pipework br0 $did 192.168.1.2/24@192.168.1.1

[root@localhost ~]# docker ps
CONTAINER ID        IMAGE                COMMAND             CREATED             STATUS              PORTS               NAMES
fb450e3606be        duxuefeng/centos:7   "/bin/bash"         2 minutes ago       Up 2 minutes                                trusting_poitras

[root@localhost ~]# docker exec -it fb450e3606be /bin/bash

[root@fb450e3606be /]# ifconfig 
eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.2  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::f400:8dff:fe47:ca17  prefixlen 64  scopeid 0x20<link>
        ether f6:00:8d:47:ca:17  txqueuelen 1000  (Ethernet)
        RX packets 8  bytes 648 (648.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 9  bytes 690 (690.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@fb450e3606be /]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth1
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
#方法2
[root@localhost ~]# docker run -itd --name pipework.test duxuefeng/centos:7 /bin/bash
359459f5e44c05182b295466d122f81dc1c35c851998ea40ffee10d9852f9a35

[root@localhost ~]# ifconfig 
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.1  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::70ca:3fff:fec7:5180  prefixlen 64  scopeid 0x20<link>
        ether d6:31:65:2e:9e:ad  txqueuelen 1000  (Ethernet)
        RX packets 4797  bytes 240129 (234.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5522  bytes 11840622 (11.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

docker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 0.0.0.0
        inet6 fe80::42:79ff:fecf:91fa  prefixlen 64  scopeid 0x20<link>
        ether 02:42:79:cf:91:fa  txqueuelen 0  (Ethernet)
        RX packets 41  bytes 2573 (2.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 13  bytes 970 (970.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
...

veth375ce49: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::d431:65ff:fe2e:9ead  prefixlen 64  scopeid 0x20<link>
        ether d6:31:65:2e:9e:ad  txqueuelen 0  (Ethernet)
        RX packets 6  bytes 508 (508.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3  bytes 258 (258.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@localhost ~]# pipework br0 pipework.test dhcp
Unable to find image 'busybox:latest' locally
Trying to pull repository docker.io/library/busybox ... 
latest: Pulling from docker.io/library/busybox
7520415ce762: Pulling fs layer
7520415ce762: Verifying Checksum
7520415ce762: Download complete
7520415ce762: Pull complete
Digest: sha256:32f093055929dbc23dec4d03e09dfe971f5973a9ca5cf059cbfb644c206aa83f

[root@localhost ~]# pipework br0 pipework.test 192.168.1.3/24@192.168.1.1
Link veth1pl25477 exists and is up

[root@localhost ~]# ifconfig 
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.1  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::70ca:3fff:fec7:5180  prefixlen 64  scopeid 0x20<link>
        ether 7a:be:69:f3:f1:52  txqueuelen 1000  (Ethernet)
        RX packets 4799  bytes 240241 (234.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5522  bytes 11840622 (11.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

docker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 0.0.0.0
        inet6 fe80::42:79ff:fecf:91fa  prefixlen 64  scopeid 0x20<link>
        ether 02:42:79:cf:91:fa  txqueuelen 0  (Ethernet)
        RX packets 41  bytes 2573 (2.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 13  bytes 970 (970.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
...
veth1pl25477: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 7a:be:69:f3:f1:52  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth375ce49: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::d431:65ff:fe2e:9ead  prefixlen 64  scopeid 0x20<link>
        ether d6:31:65:2e:9e:ad  txqueuelen 0  (Ethernet)
        RX packets 8  bytes 648 (648.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8  bytes 648 (648.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

pipework配置docker网络过程

1,pipework检查是否存在br0网桥,若不存在,就自己创建。若以”ovs”开头,就会创建OpenVswitch网桥,以”br”开头,创建Linux bridge。
2,创建veth pair设备,用于为容器提供网卡并连接到br0网桥。
3,使用docker inspect找到容器在主机中的PID,然后通过PID将容器的网络命名空间链接到/var/run/netns/    目录下。这么做的目的是,方便在主机上使用ip netns命令配置容器的网络。因为,在Docker容器中,我们没有权限配置网络环境。
4,将之前创建的veth pair设备分别加入容器和网桥中。在容器中的名称默认为eth1,可以通过pipework的-i参数修改该名称。
5,然后就是配置新网卡的IP。若在IP地址的后面加上网关地址,那么pipework会重新配置默认路由。这样容器通往外网的流量会经由新配置的eth1    出去,而不是通过eth0和docker0。(若想完全抛弃自带的网络设置,在启动容器的时候可以指定--net=none)

##8.7,docker跨主机网络配置

###8.7.1,对容器网络的需求

  • 提供类似传统网络的体验
  • VPS(Virtual Private Server)× n + 虚拟网络 = VPC(Virtual Private Cloud):不同租户的子网彼此隔离,租户可以指定或被分配IP网段,DHCP或静态指定IP,关联公网IP以便与互联网连通;
  • 租户可以有多个子网,设置虚拟路由器;
  • 安全组,防火墙,负载均衡,DNS;
  • 性能:高带宽,低延迟,扩展性。VXLAN和calico是目前性能比较好的2种技术。
  • 容器与物理主机,虚拟机互联共存:这一点目前还没有比较好的实现。

###8.7.2,跨主机网络方案 1,flannel(vxlan)

优势

  • 成熟的解决方案
  • 部署简单,性能还行,可以兼容老版本 docker 的启动分配行为,避免 launcher

劣势

  • cpu占用过高
  • 没法实现固定 IP 的容器漂移,没法多子网隔离,对上层设计依赖度高,没有 IPAM,对 docker 启动方法有绑定

2,calico

Calico的优势

  • 网络拓扑直观易懂,平行式扩展,可扩展性强
  • 容器间网络三层隔离,无需要担心arp风暴
  • 基于iptable/linux kernel包转发效率高,损耗低
  • 更容易的编程语言(python)
  • 社区活跃,正式版本较成熟

Calico的劣势

  • calico仅支持TCP, UDP, ICMP andICMPv6协议,如果你想使用L4协议,你只能选择Flannel,Weave或Docker Overlay Network。
  • Calico没有加密数据路径。 用不可信网络上的Calico建立覆盖网络是不安全的。
  • 没有IP重叠支持。 虽然Calico社区正在开发一个实验功能,将重叠IPv4包放入IPv6包中。 但这只是一个辅助解决方案,并不完全支持技术上的IP重叠。
  • 操作起来还是比较复杂,比如对 iptables 的依赖

3,overlay

优势

  • docker原生支持
  • Docker network虽然也需要封包拆包,但其过程发生在内核中,性能要优于Flannel

劣势

  • 对内核要求高(>3.16),对 docker daemon 有依赖需求 ( consul / etcd ),本身驱动实现还是略差点,可以看到对 cpu 利用率和带宽比同样基于 vxlan 的 flannel 要差一些,虽然有 api 但对 network 以及多子网隔离局部交叉这种需求还是比较麻烦。

###8.7.3,overlay方案

环境

centos:7.3
docker:1.12.6
kernel:3.10.0-514.6.1.el7.x86_64 (最好升级到4.10以上)
consul:0.8.1
s221:10.1.13.221
c222:10.1.13.222

注意:virtualbox上运行两套主机系统,设置使用桥接模式,网卡混杂模式开启全部允许.

两台服务器都有的操作
# wget https://releases.hashicorp.com/consul/0.8.1/consul_0.8.1_linux_amd64.zip
# unzip consul_0.8.1_linux_amd64.zip
# mv consul /usr/local/bin/
# mkdir /opt/consul
# systemctl stop firewalld

[s221:10.1.13.221]
[root@s221 ~]# nohup consul agent -server -bootstrap -data-dir /opt/consul -node=s221 -bind=10.1.13.221 &

[c222:10.1.13.222]
[root@c222 ~]# nohup consul agent -data-dir /opt/consul -join=10.1.13.221 -node=c222 -bind=10.1.13.222 &

两台均可执行查看
# consul members
Node  Address           Status  Type    Build  Protocol  DC
c222  10.1.13.222:8301  alive   client  0.8.1  2         dc1
s221  10.1.13.221:8301  alive   server  0.8.1  2         dc1

两台均执行
# vi /etc/sysconfig/docker
...
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false  -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock --cluster-store consul://127.0.0.1:8500 --cluster-advertise “对应机器的ip”:2375'
...

–-cluster-store= 参数指向docker daemon所使用key value service的地址(本例中即consul的服务地址)
-–cluster-advertise= 参数决定了所使用网卡以及docker daemon端口信息,ip地址加端口号,如:10.1.13.221:2375. 也可以写成网卡名加端口如:enp0s3:2375(测试不成功),可能使用eth0:2375 可以把。

# systemctl start docker

两台均可执行添加网络配置
# docker network create -d overlay docker_ove

# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
e4b7bc0bd546        bridge              bridge              local               
f9fe6d132994        docker_gwbridge     bridge              local               
f65320896afb        docker_ove          overlay             global              
27553614f7dd        host                host                local               
6b5b7fca84c2        none                null                local   

分别启动docker实例,指定网络类型
[s221:10.1.13.221]
[root@s221 ~]# docker run -it --net=docker_ove --name=net1.test duxuefeng/centos:7 /bin/bash

[c222:10.1.13.222]
[root@c222 ~]# docker run -it --net=docker_ove --name=net2.test duxuefeng/centos:7 /bin/bash

测试
[s221:10.1.13.221]
[root@414b4c7bd553 /]# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1450
        inet 10.0.0.3  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::42:aff:fe00:3  prefixlen 64  scopeid 0x20<link>
        ether 02:42:0a:00:00:03  txqueuelen 0  (Ethernet)
        RX packets 14  bytes 1128 (1.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8  bytes 648 (648.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.18.0.2  netmask 255.255.0.0  broadcast 0.0.0.0
        inet6 fe80::42:acff:fe12:2  prefixlen 64  scopeid 0x20<link>
        ether 02:42:ac:12:00:02  txqueuelen 0  (Ethernet)
        RX packets 8  bytes 648 (648.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8  bytes 648 (648.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@414b4c7bd553 /]# ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.740 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.471 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.413 ms
^Z
[2]+  Stopped                 ping 10.0.0.2


[root@414b4c7bd553 /]# ping 10.1.13.221
PING 10.1.13.221 (10.1.13.221) 56(84) bytes of data.
64 bytes from 10.1.13.221: icmp_seq=1 ttl=64 time=0.076 ms
64 bytes from 10.1.13.221: icmp_seq=2 ttl=64 time=0.055 ms
^X^Z
[1]+  Stopped                 ping 10.1.13.221


[root@414b4c7bd553 /]# ping 172.18.0.1
PING 172.18.0.1 (172.18.0.1) 56(84) bytes of data.
64 bytes from 172.18.0.1: icmp_seq=1 ttl=64 time=0.057 ms
64 bytes from 172.18.0.1: icmp_seq=2 ttl=64 time=0.053 ms
64 bytes from 172.18.0.1: icmp_seq=3 ttl=64 time=0.065 ms
^Z
[3]+  Stopped                 ping 172.18.0.1

[c222:10.1.13.222]
[root@04ede6553cfe /]# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1450
        inet 10.0.0.2  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::42:aff:fe00:2  prefixlen 64  scopeid 0x20<link>
        ether 02:42:0a:00:00:02  txqueuelen 0  (Ethernet)
        RX packets 10  bytes 836 (836.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 508 (508.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.18.0.2  netmask 255.255.0.0  broadcast 0.0.0.0
        inet6 fe80::42:acff:fe12:2  prefixlen 64  scopeid 0x20<link>
        ether 02:42:ac:12:00:02  txqueuelen 0  (Ethernet)
        RX packets 6  bytes 508 (508.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 508 (508.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0



[root@04ede6553cfe /]# ping 10.1.13.223
PING 10.1.13.223 (10.1.13.223) 56(84) bytes of data.
64 bytes from 10.1.13.223: icmp_seq=1 ttl=64 time=0.077 ms
64 bytes from 10.1.13.223: icmp_seq=2 ttl=64 time=0.056 ms
^X^Z
[1]+  Stopped                 ping 10.1.13.223

[root@04ede6553cfe /]# ping 172.18.0.1 
PING 172.18.0.1 (172.18.0.1) 56(84) bytes of data.
64 bytes from 172.18.0.1: icmp_seq=1 ttl=64 time=0.052 ms
64 bytes from 172.18.0.1: icmp_seq=2 ttl=64 time=0.054 ms
64 bytes from 172.18.0.1: icmp_seq=3 ttl=64 time=0.051 ms
^Z
[2]+  Stopped                 ping 172.18.0.1

[root@04ede6553cfe /]# ping 10.0.0.3 
PING 10.0.0.3 (10.0.0.3) 56(84) bytes of data.
64 bytes from 10.0.0.3: icmp_seq=1 ttl=64 time=0.416 ms
64 bytes from 10.0.0.3: icmp_seq=2 ttl=64 time=0.540 ms
64 bytes from 10.0.0.3: icmp_seq=3 ttl=64 time=0.443 ms
^Z
[3]+  Stopped                 ping 10.0.0.3



配置静态ip
两台均可执行添加网络配置
[s221:10.1.13.221]
[root@s221 ~]# docker network create -d overlay --ip-range=192.168.1.0/24 --gateway=192.168.1.1 --subnet=192.168.1.0/24 static_ovs
27526007c14e18cb41f3047226aca8ff593fb1bc0cfdbd99e9eb67251fd1ebb1

[root@s221 ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
29a9a96ab20d        bridge              bridge              local               
ffdca72a2e73        docker_gwbridge     bridge              local               
f65320896afb        docker_ove          overlay             global              
109921d53cf8        host                host                local               
04c85868abf3        none                null                local               
27526007c14e        static_ovs          overlay             global   



[root@s221 ~]# docker run -it --name=net3.test --net=static_ovs --ip=192.168.1.2 duxuefeng/centos:7  


[root@c222 ~]# docker run -it --name=net4.test --net=static_ovs --ip=192.168.1.3 duxuefeng/centos:7   



测试
[root@dba0a8df132c /]# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1450
        inet 192.168.1.2  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::42:c0ff:fea8:102  prefixlen 64  scopeid 0x20<link>
        ether 02:42:c0:a8:01:02  txqueuelen 0  (Ethernet)
        RX packets 10  bytes 848 (848.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 508 (508.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.18.0.3  netmask 255.255.0.0  broadcast 0.0.0.0
        inet6 fe80::42:acff:fe12:3  prefixlen 64  scopeid 0x20<link>
        ether 02:42:ac:12:00:03  txqueuelen 0  (Ethernet)
        RX packets 6  bytes 508 (508.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 508 (508.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@dba0a8df132c /]# ping 192.168.1.3
PING 192.168.1.3 (192.168.1.3) 56(84) bytes of data.
64 bytes from 192.168.1.3: icmp_seq=1 ttl=64 time=0.419 ms
64 bytes from 192.168.1.3: icmp_seq=2 ttl=64 time=0.375 ms
64 bytes from 192.168.1.3: icmp_seq=3 ttl=64 time=0.587 ms
^Z
[1]+  Stopped                 ping 192.168.1.3


[root@1d2b05da35a9 /]# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1450
        inet 192.168.1.3  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::42:c0ff:fea8:103  prefixlen 64  scopeid 0x20<link>
        ether 02:42:c0:a8:01:03  txqueuelen 0  (Ethernet)
        RX packets 10  bytes 836 (836.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 508 (508.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.18.0.3  netmask 255.255.0.0  broadcast 0.0.0.0
        inet6 fe80::42:acff:fe12:3  prefixlen 64  scopeid 0x20<link>
        ether 02:42:ac:12:00:03  txqueuelen 0  (Ethernet)
        RX packets 6  bytes 508 (508.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 508 (508.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@1d2b05da35a9 /]# ping 192.168.1.2
PING 192.168.1.2 (192.168.1.2) 56(84) bytes of data.
64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=0.518 ms
64 bytes from 192.168.1.2: icmp_seq=2 ttl=64 time=0.328 ms
64 bytes from 192.168.1.2: icmp_seq=3 ttl=64 time=0.364 ms
^Z
[3]+  Stopped                 ping 192.168.1.2

如果所有配置都正确,但是两台docker仍然不通,可以尝试升级宿主机的内核到最新版本。

还可以使用docker镜像配置consul

两台均执行

# systemctl stop firewalld
# setenforce 0
# docker pull consul:v0.6.4

[s221:10.1.13.221]
[root@s221 ~]# vi /etc/sysconfig/docker
...
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false  -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock --cluster-store consul://10.1.13.221:8500 --cluster-advertise 10.1.13.221:2375'	
...

[root@s221 ~]# systemctl restart docker

[root@s221 ~]# docker run -d -h node1 -v /mnt:/data/docker.data -p 8300:8300 -p 8301:8301 -p 8301:8301/udp -p 8302:8302 -p 8302:8302/udp -p 8400:8400 -p 8500:8500 -p 53:53/udp consul:v0.6.4 agent -server -bootstrap -client=0.0.0.0  -advertise 10.1.13.221 -node=consul-s221

[c222:10.1.13.222]
[root@s221 ~]# vi /etc/sysconfig/docker
...
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false  -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock --cluster-store consul://10.1.13.221:8500 --cluster-advertise 10.1.13.222:2375'
...

[root@c222 ~]# systemctl restart docker

[root@c222 ~]# docker run -d -h node1 -v /mnt:/dat a/docker.data -p 8300:8300 -p 8301:8301 -p 8301:8301/udp -p 8302:8302 -p 8302:8302/udp -p 8400:8400 -p 8500:8500 -p 53:53/udp consul:v0.6.4 agent -server -advertise 10.1.13.222 -node=consul-c222 -join 10.1.13.221

查看consul集群状态,两台均可操作
[root@c222 ~]# curl http://10.1.13.221:8500/v1/status/leader
"10.1.13.221:8300"

[root@c222 ~]# curl http://10.1.13.221:8500/v1/status/peers
["10.1.13.222:8300","10.1.13.221:8300"]

创建overlay网络
[root@c222 ~]# docker network create -d overlay  n1

[root@c222 ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
b3bd058d1d78        bridge              bridge              local               
f9fe6d132994        docker_gwbridge     bridge              local               
27553614f7dd        host                host                local               
24c1a54840df        n1                  overlay             global              
6b5b7fca84c2        none                null                local 

[root@c221 ~]# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
00df21d79d53        bridge              bridge              local               
ffdca72a2e73        docker_gwbridge     bridge              local               
109921d53cf8        host                host                local               
24c1a54840df        n1                  overlay             global              
04c85868abf3        none                null                local   

两台宿主机上安装consul,为了查看consul状态。
上文有安装步骤

宿主机上查看(两台均可)
[root@c221 ~]# consul members
Node         Address           Status  Type    Build  Protocol  DC
consul-c222  10.1.13.221:8301  alive   server  0.6.4  2         dc1
consul-s221  10.1.13.221:8301  alive   server  0.6.4  2         dc1


测试
[root@s221 ~]#  docker run -it --name=net5.test --net=n1 duxuefeng/centos:7

[root@522f32e73bf5 /]# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1450
        inet 10.0.0.3  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::42:aff:fe00:3  prefixlen 64  scopeid 0x20<link>
        ether 02:42:0a:00:00:03  txqueuelen 0  (Ethernet)
        RX packets 7  bytes 586 (586.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5  bytes 418 (418.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.18.0.2  netmask 255.255.0.0  broadcast 0.0.0.0
        inet6 fe80::42:acff:fe12:2  prefixlen 64  scopeid 0x20<link>
        ether 02:42:ac:12:00:02  txqueuelen 0  (Ethernet)
        RX packets 5  bytes 418 (418.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5  bytes 418 (418.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@c222 ~]# docker run -it --name=net6.test --net=n1 duxuefeng/centos:7
                            
[root@b8747b7d4274 /]# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1450
        inet 10.0.0.2  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::42:aff:fe00:2  prefixlen 64  scopeid 0x20<link>
        ether 02:42:0a:00:00:02  txqueuelen 0  (Ethernet)
        RX packets 15  bytes 1206 (1.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8  bytes 648 (648.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.18.0.2  netmask 255.255.0.0  broadcast 0.0.0.0
        inet6 fe80::42:acff:fe12:2  prefixlen 64  scopeid 0x20<link>
        ether 02:42:ac:12:00:02  txqueuelen 0  (Ethernet)
        RX packets 8  bytes 648 (648.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8  bytes 648 (648.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


[root@522f32e73bf5 /]# ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.321 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.367 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.368 ms
^Z
[1]+  Stopped                 ping 10.0.0.2

[root@b8747b7d4274 /]# ping 10.0.0.3
PING 10.0.0.3 (10.0.0.3) 56(84) bytes of data.
64 bytes from 10.0.0.3: icmp_seq=1 ttl=64 time=0.512 ms
64 bytes from 10.0.0.3: icmp_seq=2 ttl=64 time=0.346 ms
64 bytes from 10.0.0.3: icmp_seq=3 ttl=64 time=0.377 ms
^Z
[1]+  Stopped                 ping 10.0.0.3  

###8.7.4,flannel方案

配置etcd集群(两台)
[root@s221 ~]# wget https://github.com/coreos/etcd/releases/download/v3.2.0-rc.0/etcd-v3.2.0-rc.0-linux-amd64.tar.gz

[root@s221 ~]# tar zxvf etcd-v3.2.0-rc.0-linux-amd64.tar.gz 

[root@s221 ~]# mv etcd-v3.2.0-rc.0-linux-amd64/etcd* /usr/local/bin/

[root@s221 ~]# systemctl stop firewalld

清理网卡,处理本机网卡和lo,其他都不要
[root@s221 ~]# ip link delete docker0

[root@s221 ~]# nohup etcd --name infra0   --initial-advertise-peer-urls http://10.1.13.221:2380   --listen-peer-urls http://10.1.13.221:2380   --listen-client-urls     http://10.1.13.221:2379,http://127.0.0.1:2379   --advertise-client-urls http://10.1.13.221:2379   --initial-cluster-token etcd-cluster-1   --initial-cluster     infra0=http://10.1.13.221:2380,infra1=http://10.1.13.222:2380   --initial-cluster-state new &

检查etcd状态
[root@s221 ~]# etcdctl cluster-health
member 8e9e05c52164694d is healthy: got healthy result from http://10.1.13.221:2379
cluster is healthy

查看集群结点的访问是否正常
[root@s221 ~]# curl -L http://10.1.13.221:4012/version
{"etcdserver":"3.2.0-rc.0","etcdcluster":"3.2.0"}


[root@s222 ~]# nohup etcd --name infra1   --initial-advertise-peer-urls http://10.1.13.222:2380   --listen-peer-urls http://10.1.13.222:2380   --listen-client-urls     http://10.1.13.222:2379,http://127.0.0.1:2379   --advertise-client-urls http://10.1.13.222:2379   --initial-cluster-token etcd-cluster-1   --initial-cluster     infra0=http://10.1.13.221:2380,infra1=http://10.1.13.222:2380   --initial-cluster-state new &


设置分配给docker网络的网段
[root@s221 ~]# etcdctl mk /coreos.com/network/config '{"Network":"172.16.0.0/16", "SubnetMin": "172.16.1.0", "SubnetMax": "172.16.254.0"}'


安装配置flanneld(两台)
[root@s221 ~]# wget https://github.com/coreos/flannel/releases/download/v0.7.1/flannel-v0.7.1-linux-arm64.tar.gz

[root@s221 ~]# tar zxvf flannel-v0.7.1-linux-arm64.tar.gz 

[root@s221 ~]# mv flanneld /usr/local/bin/ && mv mk-docker-opts.sh /usr/local/bin/

启动flannel
[root@s221 ~]# nohup flanneld -etcd-endpoints=http://10.1.13.221:2379 >> /var/log/flanneld.log 2>&1 &
[root@c222 ~]# nohup flanneld -etcd-endpoints=http://10.1.13.222:2379 >> /var/log/flanneld.log 2>&1 &    

配置docker
[root@s221 ~]# cat /etc/sysconfig/docker
...
OPTIONS="--selinux-enabled --log-driver=journald --signature-verification=false -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock  --bip=172.16.1.1/24 --mtu=1472"
...

[root@c222 ~]# cat /etc/sysconfig/docker
...
OPTIONS="--selinux-enabled --log-driver=journald --signature-verification=false -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock  --bip=172.16.2.1/24 --mtu=1472"
...

启动docker(两台)
#systemctl start docker

测试
[root@s221 ~]# docker run -it   daocloud.io/library/centos /bin/bash   
[root@579a6732e834 /]# ifconfig 
	eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1472
    inet 172.16.1.2  netmask 255.255.255.0  broadcast 0.0.0.0
    inet6 fe80::42:acff:fe10:102  prefixlen 64  scopeid 0x20<link>
    ether 02:42:ac:10:01:02  txqueuelen 0  (Ethernet)
    RX packets 5706  bytes 11897001 (11.3 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 4700  bytes 268788 (262.4 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@c222 ~]# docker run -it   daocloud.io/library/centos /bin/bash 

[root@18f56f7cc54c /]# ifconfig 
	eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1472
    inet 172.16.2.2  netmask 255.255.255.0  broadcast 0.0.0.0
    inet6 fe80::42:acff:fe10:202  prefixlen 64  scopeid 0x20<link>
    ether 02:42:ac:10:02:02  txqueuelen 0  (Ethernet)
    RX packets 5613  bytes 11881515 (11.3 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 4486  bytes 262831 (256.6 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


[root@18f56f7cc54c /]# ping 172.16.1.2
PING 172.16.1.2 (172.16.1.2) 56(84) bytes of data.
64 bytes from 172.16.1.2: icmp_seq=1 ttl=62 time=0.735 ms
64 bytes from 172.16.1.2: icmp_seq=2 ttl=62 time=0.761 ms
64 bytes from 172.16.1.2: icmp_seq=3 ttl=62 time=0.969 ms
....

#第九部分 docker的监控

##9.1,cAdvisor+InfluxDB+Grafana监控docker

###9.1.1基础概念 cAdvisor

​ cAdvisor 为Docker容器用户提供了了解运行时容器资源使用和性能特征的工具。cAdvisor的容器抽象基于Google的lmctfy容器栈,因此原生支持Docker容器并能够“开箱即用”地支持其他的容器类型。cAdvisor部署为一个运行中的daemon,它会收集、聚集、处理并导出运行中容器的信息。这些信息能够包含容器级别的资源隔离参数、资源的历史使用状况、反映资源使用和网络统计数据完整历史状况的柱状图。

InfluxDB

InfluxDB 是一个开源分布式时序、事件和指标数据库。使用 Go 语言编写,无需外部依赖。其设计目标是实现分布式和水平伸缩扩展.

其主要特色功能 基于时间序列,支持与时间有关的相关函数(如最大,最小,求和等) 可度量性:你可以实时对大量数据进行计算 基于事件:它支持任意的事件数据 ​InfluxDB的主要特点

无结构(无模式):可以是任意数量的列可拓展的 支持min, max, sum, count, mean, median 等一系列函数,方便统计 原生的HTTP支持,内置HTTP API 强大的类SQL语法 自带管理界面,方便使用 Grafana

Graphite 是一款开源的监控绘图工具。可以实时收集、存储、显示时间序列类型的数据(time series data),有些类似Kibana的东西。 ​- 以下是官方的说明

用于可视化大型测量数据的开源程序,他提供了强大和优雅的方式去创建、共享、浏览数据。dashboard中显示了你不同metric数据源中的数据。 常用于因特网基础设施和应用分析,但在其他领域也有机会用到,比如:工业传感器、家庭自动化、过程控制等等。 有热插拔控制面板和可扩展的数据源,目前已经支持Graphite、Cloudwatch、Prometheus、InfluxDB、Elasticsearch。

###9.1.2 环境搭建

启动cadvisor
[root@monitor ~]# docker run -d -p 8083:8083 -p 8086:8086 --expose 8090 --expose 8099 --name influxsrv -e PRE_CREATE_DB=cadvisor tutum/influxdb:0.13
注:默认情况下,InfluxDB使用以下网络端口:
  TCP端口8083用于InfluxDB的管理面板
  TCP端口8086用于通过InfluxDB的HTTP API进行客户端 - 服务器的通信
创建完成后,打开浏览器,访问http://宿主机ip:8083,默认用户名,密码是root、root

启动influxsrv
[root@monitor ~]# docker run --volume=/:/rootfs:ro --volume=/var/run:/var/run:rw --volume=/sys:/sys:ro --volume=/var/lib/docker/:/var/lib/docker:ro --publish=8080:8080 --detach=true --link influxsrv:influxsrv --name=cadvisor google/cadvisor:latest -storage_driver=influxdb -storage_driver_db=cadvisor -storage_driver_host=influxsrv:8086

启动grafana
[root@monitor ~]# docker run -d -p 3000:3000 -e INFLUXDB_HOST=localhost -e INFLUXDB_PORT=8086 -e INFLUXDB_NAME=cadvisor -e INFLUXDB_USER=root -e INFLUXDB_PASS=root --link influxsrv:influxsrv --name grafana grafana/grafana:4.0.2
打开浏览器,访问http://宿主机ip:3000/ Grafana界面,用户名密码都是admin

###9.1.3 使用

主要是在grafana中配置监控项

http://宿主机ip:3000/

监控项添加见:http://www.cnblogs.com/hanyifeng/p/6233851.htm

#第十部分 docker的web界面管理

##10.1,Docker集中化web界面管理平台-Shipyard

###10.1.1,shipyard概念

engine

一个shipyard管理的docker集群可以包含一个或多个engine(引擎),一个engine就是监听tcp端口的docker daemon。shipyard管理docker daemon、images、containers完全基于Docker API,不需要做其他的修改。另外,shipyard可以对每个engine做资源限制,包括CPU和内存;因为TCP监听相比Unix socket方式会有一定的安全隐患,所以shipyard还支持通过SSL证书与docker后台进程安全通信。

rethinkdb

RethinkDB是一个shipyard项目的一个docker镜像,用来存放账号(account)、引擎(engine)、服务密钥(service key)、扩展元数据(extension metadata)等信息,但不会存储任何有关容器或镜像的内容。一般会启动一个shipyard/rethinkdb容器shipyard-rethinkdb-data来使用它的/data作为数据卷供另外rethinkdb一个挂载,专门用于数据存储。

###10.1.2,Shipyard生态介绍 shipyard是由shipyard控制器以及周围生态系统构成,都是以容器封装,以下按照启动顺序进行介绍。

1)RethinkDB

首先启动的就是RethinkDB容器,shipyard采用RethinkDB作为数据库来保存账户,引擎,服务键值以及元信息等信息。

2)Discovery

为了使用Swarm的选举机制,我们需要一个外部的密钥值存储容器,shipyard默认采用了etcd。

3)shipyard_certs

证书管理容器,实现证书验证功能

4)Proxy

默认情况下,Docker引擎只监听Socket,我们可以重新配置引擎使用TLS或者使用一个代理容器,转发请求从TCP到Docker监听的UNIX Socket。

5)Swarm Manager

Swarm管理器

6)Swarm Agent

Swarm代理,运行在每个节点上。

7)Controller

shipyard控制器,Remote API的实现和web的实现。

###10.1.3, 安装配置

环境介绍
centos:7.3
docker:1.12.6
kernel:3.10.0-514.6.1.el7.x86_64 (4.11)
s221:10.1.13.221
c222:10.1.13.222

关闭防火墙(两台)
# systemctl stop firewalld

[root@s221 ~]# vi /etc/sysconfig/docker
...
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false -H tcp://0.0.0.0:4243 -H unix:///var/run/docker.sock'
...

安装shipyard
[root@s221 ~]# curl -sSL http://dockerclub.net/public/script/deploy |  bash -s                      ==> 中文版
[root@s221 ~]# curl -sSL https://shipyard-project.com/deploy | bash -s                              ==> 英文版
...
Shipyard available at http://10.1.13.221:8080
Username: admin Password: shipyard

[root@s221 ~]# docker ps
CONTAINER ID        IMAGE                          COMMAND                  CREATED             STATUS              PORTS                                            NAMES
61a4696f240d        shipyard/shipyard:latest       "/bin/controller --de"   7 minutes ago       Up 7 minutes        0.0.0.0:8080->8080/tcp                           shipyard-controller
1714fad470e9        swarm:latest                   "/swarm j --addr 10.1"   7 minutes ago       Up 7 minutes        2375/tcp                                         shipyard-swarm-agent
acdf1c4998bd        swarm:latest                   "/swarm m --replicati"   7 minutes ago       Up 7 minutes        2375/tcp                                         shipyard-swarm-manager
260eda87461d        shipyard/docker-proxy:latest   "/usr/local/bin/run"     7 minutes ago       Up 7 minutes        0.0.0.0:2375->2375/tcp                           shipyard-proxy
e185ffdf342a        alpine                         "sh"                     7 minutes ago       Up 7 minutes                                                         shipyard-certs
61a98498df26        microbox/etcd:latest           "/bin/etcd -addr 10.1"   7 minutes ago       Up 7 minutes        0.0.0.0:4001->4001/tcp, 0.0.0.0:7001->7001/tcp   shipyard-discovery
5ceba925acd6        rethinkdb                      "rethinkdb --bind all"   7 minutes ago       Up 7 minutes        8080/tcp, 28015/tcp, 29015/tcp                   shipyard-rethinkdb


至此,shipyard就已经安装完成了。使用http://10.1.13.221:8080就可以访问了



添加节点
[root@c222 ~]# curl -sSL http://dockerclub.net/public/script/deploy | ACTION=node DISCOVERY=etcd://10.1.13.221:4001 bash -s                ==> 中文版
[root@c222 ~]# curl -sSL https://shipyard-project.com/deploy | ACTION=node DISCOVERY=etcd://10.1.13.221:4001 bash -s                       ==> 英文版

删除shipyard(在节点机上执行,就会将节点从shipyard管理里踢出)
[root@c222 ~]# curl http://dockerclub.net/public/script/deploy | ACTION=remove bash -s                   ==> 中文版
[root@c222 ~]# curl -sSL https://shipyard-project.com/deploy | ACTION=remove bash -s                     ==> 英文版


注意:如果进入到http://10.1.13.221:8080页面中不能显示本机正在运行的docker,可能的原因是内核版本低,需要升级到最新的版本。

###10.1.4, 使用

界面功能介绍

  • CONTAINERS:查看正在运行的docker,等同与命令行:docker ps

  • IMAGES:查看本机上的images,等同与命令行:docker images

  • NODES:查看有那些宿主机器被管理

  • REGISTRIES:添加仓库地址,最好使用私有仓库。

  • ACCOUNTS:shipyard用户管理

  • EVENTS:查看操作记录

使用

登录界面后,首先应该做的是添加仓库地址,添加私有仓库的时候可能会有以下报错: Error... Cannot ping registry

原因:shipyard不支持registry v2

解决:http://www.jianshu.com/p/b0f9739b5c25

另一种解决方案:在docker启动配置文件中指定私有仓库地址,这样虽然在REGISTRIES下看不到仓库地址,但是该私有仓库下的镜像可以直接使用。

[root@localhost ~]# vim /etc/sysconfig/docker
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --insecure-registry 10.1.13.231:5000'
注:10.1.13.231:5000是私有仓库地址

使用中发现,Shipyard 似乎不支持网页上部署其他节点的容器,只能部署本节点的。可能这个版本的 Shipyard 有 bug。

添加containers时报错如下:

error...

no resources available to schedule container

版本

# docker images
REPOSITORY                  TAG                 IMAGE ID            CREATED             SIZE
10.1.13.224:5000/mycentos   latest              8140d0c64310        13 days ago         192.6 MB
alpine                      latest              02674b9cb179        2 weeks ago         3.987 MB
rethinkdb                   latest              b66f932ecd3c        2 weeks ago         182.7 MB
nginx                       latest              3448f27c273f        2 weeks ago         109.4 MB
ehazlett/curl               latest              c8127af118e0        3 months ago        6.38 MB
swarm                       latest              36b1e23becab        4 months ago        15.85 MB
shipyard/shipyard           latest              36fb3dc0907d        7 months ago        58.84 MB
shipyard/docker-proxy       latest              cfee14e5d6f2        17 months ago       9.468 MB
microbox/etcd               latest              6aef84b9ec5a        21 months ago       17.87 MB
展开阅读全文
打赏
0
1 收藏
分享
加载中
更多评论
打赏
0 评论
1 收藏
0
分享
返回顶部
顶部