420 lines
16 KiB
Markdown
420 lines
16 KiB
Markdown
# docker tips
|
||
|
||
#docker #tips
|
||
|
||
官方教程
|
||
|
||
[Samples | Docker Documentation](https://docs.docker.com/samples/)
|
||
|
||
## docker 验证
|
||
|
||
docker_auth
|
||
[GitHub - cesanta/docker_auth: Authentication server for Docker Registry 2](https://github.com/cesanta/docker_auth)
|
||
|
||
harbor
|
||
[GitHub - goharbor/harbor: An open source trusted cloud native registry project that stores, signs, and scans content.](https://github.com/goharbor/harbor)
|
||
|
||
nexus
|
||
|
||
## docker 安装源
|
||
|
||
[Debian Docker 安装 | 菜鸟教程](https://www.runoob.com/docker/debian-docker-install.html)
|
||
|
||
```bash
|
||
curl -fsSL https://mirrors.ustc.edu.cn/docker-ce/linux/debian/gpg | sudo apt-key add -
|
||
add-apt-repository \
|
||
"deb [arch=amd64] https://mirrors.ustc.edu.cn/docker-ce/linux/debian \
|
||
$(lsb_release -cs) \
|
||
stable"
|
||
apt-get update
|
||
apt-get install docker-ce docker-ce-cli containerd.io
|
||
```
|
||
|
||
## docker 容器镜像源
|
||
|
||
[阿里云容器镜像服务](https://cr.console.aliyun.com/cn-hangzhou/instances/mirrors)
|
||
镜像库可能只包含流行的公有镜像，而私有镜像仍需要从美国镜像库中拉取。
|
||
但是portianer 要先在images中pull 可以找到80x86/filebrowser
|
||
|
||
Registry
|
||
|
||
```
|
||
https://upm3cnhv.mirror.aliyuncs.com
|
||
```
|
||
|
||
[汇总最近更新的一些docker镜像，群晖威联通等通用_网摘资源部落_社区_115，一生相伴](https://q.115.com/22495040/T31798.html)
|
||
[oldiy's Profile - Docker Hub](https://hub.docker.com/u/oldiy/)
|
||
[30多个N1可用docker镜像-百度云同步、1898种dos游戏、花生壳、可道云、蚂蚁笔记... - 斐讯无线路由器以及其它斐迅网络设备 - 恩山无线论坛 - Powered by Discuz!](https://www.right.com.cn/forum/thread-911375-1-1.html)
|
||
[DaoCloud | Docker 极速下载](http://get.daocloud.io/)
|
||
|
||
### docker国内镜像源Azure 中国(最快镜像源)
|
||
|
||
`vim /etc/docker/daemon.json`
|
||
|
||
```json
|
||
{
|
||
"registry-mirrors": ["https://dockerhub.azk8s.cn","http://hub-mirror.c.163.com"]
|
||
}
|
||
```
|
||
|
||
## docker 容器启动后立马退出的解决方法
|
||
|
||
Docker容器后台运行,就必须有一个前台进程
|
||
|
||
```
|
||
tail -f /dev/null
|
||
|
||
docker run -d --name mycentos-zp5 -d centos:7.4.1708 /bin/sh -c "while true;do echo hello;sleep 5;done"
|
||
sudo docker run -d ubuntu:14.04 /bin/sh -c "while true; do echo hello world; sleep 1; done"
|
||
|
||
docker run -d --name mycentos-zp4 -d centos:7.4.1708 ping 8.8.8.8
|
||
|
||
docker run -dit --name ubuntu2 ubuntu
|
||
docker run -d --name ubuntu ubuntu /bin/bash -c "tail -f /dev/null"
|
||
|
||
|
||
|
||
|
||
|
||
#####
|
||
# docker-nginx-amplify/entrypoint.sh
|
||
有这种写法
|
||
nginx -g "daemon off;" &
|
||
nginx_pid=$!
|
||
wait ${nginx_pid}
|
||
```
|
||
|
||
## 查看docker container内进程信息及与宿主机上进程的映射关系
|
||
|
||
1、docker ps 找到对应的容器
|
||
2、根据container id 找到容器在宿主机上映射后的进程信息
|
||
`docker top id`
|
||
就会得到类似下面的信息，其中PID是容器内进程在宿主机上的pid，ppid是容器内进程在宿主机上的父进程pid
|
||
[查看docker container内进程信息及与宿主机上进程的映射关系 - 衣舞晨风 - CSDN博客](https://blog.csdn.net/jiankunking/article/details/85853187)
|
||
|
||
## 映射的host目录 好像会自己建立
|
||
|
||
在portainer上试验是这样的
|
||
|
||
## PUID=1000 and PGID=1000
|
||
|
||
id应该是按主机上的用户id来定义
|
||
建立文件和文件夹的权限是该账户的
|
||
-e TZ="Asia/Shanghai" -e HOST_OS="Unraid" -e 'PUID'='99' -e 'PGID'='100'
|
||
|
||
[Understanding PUID and PGID - LinuxServer.io](https://docs.linuxserver.io/general/understanding-puid-and-pgid)
|
||
|
||
`id $user`
|
||
|
||
## 查看一个正在运行的Docker容器的启动命令
|
||
|
||
`docker ps -a --no-trunc`
|
||
|
||
apt-get install python-pip
|
||
pip install setuptools
|
||
pip install runlike
|
||
runlike Docker_container_name
|
||
runlike -p Docker_container_name
|
||
|
||
## docker开启远程tcp监听端口
|
||
|
||
[Docker TCP远程连接_慕课手记](https://www.imooc.com/article/details/id/28426)
|
||
|
||
https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file
|
||
|
||
> You cannot set options in daemon.json that have already been set on daemon startup as a flag. On systems that use systemd to start the Docker daemon, -H is already set, so you cannot use the hosts key in daemon.json to add listening addresses. See https://docs.docker.com/engine/admin/systemd/#custom-docker-daemon-options for how to accomplish this task with a systemd drop-in file.
|
||
>
|
||
|
||
configure-docker-to-start-on-boot
|
||
[Post-installation steps for Linux | Docker Documentation](https://docs.docker.com/engine/install/linux-postinstall/#configure-docker-to-start-on-boot)
|
||
|
||
Configure where the Docker daemon listens for connections
|
||
[Post-installation steps for Linux | Docker Documentation](https://docs.docker.com/engine/install/linux-postinstall/#configure-where-the-docker-daemon-listens-for-connections)
|
||
|
||
按官方文档的说法，好像在centos里面用不了 daemon.json 来配置 host
|
||
|
||
/etc/docker/daemon.json
|
||
|
||
```json
|
||
{
|
||
"registry-mirrors": ["https://upm3cnhv.mirror.aliyuncs.com"],
|
||
"hosts": ["tcp://192.168.66.254:2375", "unix:///var/run/docker.sock"]
|
||
|
||
"hosts": ["tcp://0.0.0.0:22375", "unix:///var/run/docker.sock"]
|
||
|
||
}
|
||
```
|
||
|
||
所以使用下面的方法
|
||
|
||
systemctl edit docker.service
|
||
|
||
```
|
||
[Service]
|
||
ExecStart=
|
||
ExecStart=/usr/bin/dockerd -H fd:// -H tcp://0.0.0.0:22375
|
||
```
|
||
|
||
重启docker网络
|
||
|
||
```
|
||
systemctl daemon-reload
|
||
```
|
||
|
||
重启docker服务 重启 docker
|
||
|
||
```bash
|
||
systemctl restart docker
|
||
systemctl status docker.service
|
||
```
|
||
|
||
curl -l http://localhost:22375/info
|
||
|
||
## Non-Root
|
||
|
||
[Work With Non-Root Containers for Bitnami Applications](https://docs.bitnami.com/containers/how-to/work-with-non-root-containers/)
|
||
|
||
## docker 普通用户 将docker权限添加给普通用户
|
||
|
||
[将docker权限添加给普通用户 - 简书](https://www.jianshu.com/p/b0245f0360ca)
|
||
[使用普通用户执行 docker - klvchen - 博客园](https://www.cnblogs.com/klvchen/p/9098745.html)
|
||
|
||
```shell
|
||
cat /etc/group
|
||
sudo gpasswd -a userapp docker
|
||
|
||
|
||
|
||
# 最好不要用这个命令，这个命令可以添加一个用户到指定的组，但是以前添加的组就会清空掉
|
||
# 所以想要添加一个用户到一个组，同时保留以前添加的组时，请使用 gpasswd 这个命令来添加操作用户
|
||
# usermod -G docker userapp
|
||
|
||
#####
|
||
groupadd docker
|
||
gpasswd -a ${USER} docker
|
||
|
||
```
|
||
|
||
## 网络
|
||
|
||
### drone 有时候会导致整个服务器网络异常
|
||
```shell
|
||
docker network ls
|
||
docker network rm drone-ysqYZHndoYiYX2ndglk8
|
||
```
|
||
|
||
### docker 中访问宿主
|
||
|
||
宿主执行 ip a
|
||
看docker0 网卡的ip
|
||
一般是
|
||
`172.17.0.1`
|
||
|
||
### host 模式
|
||
|
||
[docker 网络-host - 简书](https://www.jianshu.com/p/1dd65ab5b997)
|
||
容器与主机在相同的网络命名空间下面，使用相同的网络协议栈，容器可以直接使用主机的所有网络接口
|
||
|
||
host 模式 不能使用端口映射和自定义路由规则，这些都与主机一致，-p 与-icc 参数是无效的
|
||
|
||
host 模式下面的网络模型是最简单和最低延迟的模式，容器进程直接与主机网络接口通信，与物理机性能一致
|
||
|
||
```bash
|
||
docker run -itd --net host --name C1 hub.c.163.com/library/alpine:latest
|
||
```
|
||
|
||
## 判断系统是否运行在Docker环境中
|
||
|
||
[判断系统是否运行在Docker环境中_白帽子技术/思路_i春秋社区-分享你的技术，为安全加点温度.](https://bbs.ichunqiu.com/thread-47469-1-1.html)
|
||
|
||
`cat /proc/1/cgroup|grep docker`
|
||
|
||
```bash
|
||
# docker
|
||
root@55ff7ae5bdae:~# cat /proc/1/sched | head -n 1
|
||
startWebLogic.s (8212, #threads: 1)
|
||
root@55ff7ae5bdae:~#
|
||
|
||
# real
|
||
root@kali:~# cat /proc/1/sched | head -n 1
|
||
systemd (1, #threads: 1)
|
||
root@kali:~#
|
||
|
||
|
||
|
||
# real
|
||
root@kali:~# ps -q1
|
||
PID TTY TIME CMD
|
||
1 ? 00:00:02 systemd
|
||
root@kali:~#
|
||
|
||
|
||
# docker
|
||
root@55ff7ae5bdae:~# ps -p 1
|
||
PID TTY TIME CMD
|
||
1 ? 00:00:00 startWebLogic.s
|
||
root@55ff7ae5bdae:~#
|
||
```
|
||
|
||
## 容器内查看运行时间
|
||
|
||
[uptime command gives weird results in a docker image - Server Fault](https://serverfault.com/questions/830643/uptime-command-gives-weird-results-in-a-docker-image)
|
||
`stat /proc/1/cmdline`
|
||
|
||
## unraid 的docker命令
|
||
|
||
```bash
|
||
root@localhost:# /usr/local/emhttp/plugins/dynamix.docker.manager/scripts/docker create --name='nginx' --net='bridge' --log-opt max-size='50m' --log-opt max-file='1' -e TZ="Asia/Shanghai" -e HOST_OS="Unraid" -e 'PUID'='99' -e 'PGID'='100' -p '2280:80/tcp' -p '22443:443/tcp' -v '/mnt/user/appdata/nginx':'/config':'rw' 'linuxserver/nginx'
|
||
1c20c14ca61487a84313eac231c46fdaa0818eb1e5a872246abd6147c97f8945
|
||
```
|
||
|
||
## docker restart policy
|
||
|
||
[Docker容器的重启策略及docker run的--restart选项详解_运维_成长的足迹-CSDN博客](https://blog.csdn.net/taiyangdao/article/details/73076019)
|
||
|
||
no：不自动重新启动容器。（默认）默认策略，在容器退出时不重启容器
|
||
|
||
on-failure ：由于一个错误退出，它表现为退出状态不等于0，自动启动容器
|
||
on-failure:3，在容器非正常退出时重启容器，最多重启3次
|
||
|
||
unless-stopped ：除非被显式停止 stop、kill 否则docker服务停止或自动重启，自动启动容器
|
||
在容器退出时总是重启容器，但是不考虑在Docker守护进程启动时就已经停止了的容器
|
||
|
||
always：如果容器停止，总是重新启动容器。（这是官方解释，如果手动kill容器 无法自动重启，应该也属于正常 如果手动都不能让他停止 也许我们会更烦恼怎么停止它~~~~）在容器退出时总是重启容器
|
||
|
||
使用重新启动策略时请记住以下几点：
|
||
|
||
1. 重新启动策略仅在容器启动成功后才生效。在这种情况下，启动成功意味着容器已启动至少10秒，并且Docker已开始监视它。这可以防止根本不启动的容器进入重启循环。
|
||
2. 如果手动停止容器，则会忽略其重新启动策略，直到Docker守护程序重新启动或手动重新启动容器。这是另一个防止重启循环的尝试。
|
||
3. 重新启动策略仅适用于容器。群集服务的重新启动策略配置不同。
|
||
https://docs.docker.com/engine/reference/commandline/service_create/
|
||
|
||
## Configure Docker to use a proxy server 容器内代理
|
||
|
||
两种方式
|
||
|
||
一个是配置文件
|
||
一个是容器的环境变量
|
||
|
||
| Variable | Dockerfile example | `docker run` Example |
|
||
| ------------- | ------------------------------------------------- | --------------------------------------------------- |
|
||
| `HTTP_PROXY` | `ENV HTTP_PROXY "http://127.0.0.1:3001"` | `--env HTTP_PROXY="http://127.0.0.1:3001"` |
|
||
| `HTTPS_PROXY` | `ENV HTTPS_PROXY "https://127.0.0.1:3001"` | `--env HTTPS_PROXY="https://127.0.0.1:3001"` |
|
||
| `FTP_PROXY` | `ENV FTP_PROXY "ftp://127.0.0.1:3001"` | `--env FTP_PROXY="ftp://127.0.0.1:3001"` |
|
||
| `NO_PROXY` | `ENV NO_PROXY "*.test.example.com,.example2.com"` | `--env NO_PROXY="*.test.example.com,.example2.com"` |
|
||
|
||
## 宿主机进程的问题
|
||
|
||
[在Linux宿主机审计docker进程和网络连接 - 血梦博客 - 专注于网络安全|渗透测试|代码审计|国内最专业的黑客技术博客](http://www.hacksec.cn/Penetration-test/965.html)
|
||
|
||
有docker字样的是docker进程
|
||
|
||
```bash
|
||
root@unRaid:~# cat /proc/23437/cgroup
|
||
10:pids:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
9:perf_event:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
8:net_cls:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
7:freezer:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
6:devices:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
5:memory:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
4:blkio:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
3:cpuacct:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
2:cpu:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
1:cpuset:/docker/069de498d1d22d31565ea8816981cb4d546e5437bb0e84ff0d6bdc2655475b5f
|
||
```
|
||
|
||
## 保存修改后的容器
|
||
|
||
[保存对容器的修改 - Docker入门教程 - docker中文社区](http://www.docker.org.cn/book/docker/docer-save-changes-10.html)
|
||
|
||
commit 之前最好停止容器
|
||
|
||
查看被修改的容器：docker ps -l
|
||
提交指定容器保存为新的镜像： `docker commit <container id> <new image name>`
|
||
查看本地所有镜像：docker images
|
||
|
||
[Docker保存修改后的镜像 - 知乎](https://zhuanlan.zhihu.com/p/86524042)
|
||
|
||
```text
|
||
docker run -it ubuntu:16.04 /bin/bash
|
||
|
||
docker run -it openjdk:8-jdk /bin/bash
|
||
docker commit d3742a06f8ae openjdk-tesseract
|
||
```
|
||
|
||
## Docker 配置 HTTP 代理
|
||
|
||
[Docker配置HTTP代理 - Hazx小屋](https://hazx.hmacg.cn/server/docker-http-proxy.html)
|
||
|
||
配置的 HTTP 代理主要用于 Docker 拉取 (pull) 和推送 (push) 镜像使用。不会影响 Docker 容器的联网状态。
|
||
Docker 代理仅支持 HTTP 协议。
|
||
若有特殊需求，请自备梯子。
|
||
代理地址配置为自己的本地服务器地址，必须是 HTTP 代理协议。
|
||
NO_PROXY 配置跳过代理的地址，需要填入所以用到的本地地址，支持 *，多个地址用逗号隔开。
|
||
|
||
```bash
|
||
mkdir -p /etc/systemd/system/docker.service.d
|
||
vim /etc/systemd/system/docker.service.d/http-proxy.conf
|
||
|
||
[Service]
|
||
Environment="HTTP_PROXY=http://192.168.100.100:8080/"
|
||
Environment="HTTPS_PROXY=http://192.168.100.100:8080/"
|
||
Environment="NO_PROXY=localhost,127.0.0.1,10.96.0.1,192.168.*"
|
||
|
||
|
||
systemctl daemon-reload
|
||
|
||
systemctl restart docker
|
||
```
|
||
|
||
## docker 运行 代理
|
||
|
||
[Configure Docker to use a proxy server | Docker Documentation](https://docs.docker.com/network/proxy/)
|
||
|
||
| Variable | Dockerfile example | `docker run` Example |
|
||
| ------------- | ------------------------------------------------- | --------------------------------------------------- |
|
||
| `HTTP_PROXY` | `ENV HTTP_PROXY="http://127.0.0.1:3001"` | `--env HTTP_PROXY="http://127.0.0.1:3001"` |
|
||
| `HTTPS_PROXY` | `ENV HTTPS_PROXY="https://127.0.0.1:3001"` | `--env HTTPS_PROXY="https://127.0.0.1:3001"` |
|
||
| `FTP_PROXY` | `ENV FTP_PROXY="ftp://127.0.0.1:3001"` | `--env FTP_PROXY="ftp://127.0.0.1:3001"` |
|
||
| `NO_PROXY` | `ENV NO_PROXY="*.test.example.com,.example2.com"` | `--env NO_PROXY="*.test.example.com,.example2.com"` |
|
||
|
||
## ERROR: Failed to Setup IP tables: Unable to enable SKIP DNAT rule
|
||
|
||
原因是防火墙关闭之后需要重启docker服务
|
||
|
||
`service docker restart`
|
||
|
||
## tools
|
||
|
||
ctop 监控
|
||
[ctop](https://ctop.sh/)
|
||
[CTOP一款管理Docker容器的TOP命令 | 佰阅部落](https://baiyue.one/archives/1135.html)
|
||
|
||
## links
|
||
|
||
[Docker 与 Vagrant 的区别？ - V2EX](https://www.v2ex.com/t/296100#reply17)
|
||
[docker 部署方式 - V2EX](https://www.v2ex.com/t/401144#reply9)
|
||
[有什么好玩的自建服务没？ 最近在玩 docker，搭上瘾了。。。。。 - V2EX](https://www.v2ex.com/t/226691#reply7)
|
||
|
||
[实在没理解 docker 或 vagrant 是怎么统一 开发 环境的 - V2EX](https://www.v2ex.com/t/388777#reply34)
|
||
[Dockerize PostgreSQL | Docker Documentation](https://docs.docker.com/engine/examples/postgresql_service/)
|
||
|
||
[docker 使用 mysql 时选择新建 mysql 容器还是单一容器内新开 mysql 进程？ - V2EX](https://www.v2ex.com/t/357237#reply32)
|
||
|
||
> docker 建议是单一进程的，也就是这一个容器里只跑一个进程
|
||
> 别在 docker 上跑数据库，会被坑死的
|
||
>
|
||
|
||
[京东MySQL数据库Docker化最佳实践（附PPT） - MySQL - dbaplus社群：围绕Data、Blockchain、AiOps的企业级专业社群。技术大咖、原创干货，每天精品原创文章推送，每周线上技术分享，每月线下技术沙龙。](https://dbaplus.cn/news-11-1118-1.html)
|
||
|
||
[容器监控实践—cAdvisor - 简书](https://www.jianshu.com/p/91f9d9ec374f)
|
||
|
||
[Samples | Docker Documentation](https://docs.docker.com/samples/)
|
||
|
||
### 资料
|
||
|
||
[WORKDIR 指定工作目录-Docker — 从入门到实践](https://www.cntofu.com/book/139/image/dockerfile/workdir.md)
|
||
|
||
### books
|
||
|
||
[Docker — 从入门到实践](https://www.cntofu.com/book/139/index.html) |