docker镜像管理实例

程序员文章站 2022-04-19 08:52:07

...

Docker 搭建软件集群

[aaa@qq.com docker]# pwd
/tmp/docker


构建yum源
[aaa@qq.com docker]# vim dvd.repo 
[aaa@qq.com docker]# cat dvd.repo 
[rhel-dvd]
name="rhel7"
baseurl=http://172.25.53.250/rhel7.3
gpgcheck=0

[docker]
name=docker
baseurl=http://172.25.254.250/pub/docker
gpgcheck=0  #我把这里设置成了0、说明我信任了这个源，不对它的rpm进行检察

以下是最终的版本，是经过下面的测试一步一步完善的

[aaa@qq.com docker]# vim Dockerfile 
FROM rhel7
EXPOSE 80 22
COPY dvd.repo /etc/yum.repos.d/dvd.repo
RUN rpmdb --rebuilddb && yum install -y httpd openssh-server openssh-clients supervisor && yum clean all && ssh-****** -q -t rsa -f /etc/ssh/ssh_host_rsa_key -N "" && ssh-****** -q -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N "" && ssh-****** -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" && echo root:westos | chpasswd
COPY supervisord.conf /etc/supervisord.conf
CMD ["/usr/bin/supervisord"]

Yum源与安装软件需要通过测试
我们再开一个docker进行测试

[aaa@qq.com docker]# docker cp dvd.repo vm1:/etc/yum.repos.d/


[aaa@qq.com ssh]# docker run -it --name vm1 rhel7 bash




or
bash-4.2# vim /etc/yum.repos.d/dvd.repo 
[rhel-dvd]
name="rhel7"
baseurl=http://172.25.254.53/rhel7.3
gpgcheck=0

[docker]
name=docker
baseurl=http://172.25.254.250/pub/docker
gpgcheck=0



bash-4.2# rpmdb --rebuilddb
bash-4.2# yum install -y httpd openssh-server openssh-clients  supervisor

配置文件都在
bash-4.2# ls -l /usr/bin/supervisord 
-rwxr-xr-x 1 root root 318 Aug 20  2015 /usr/bin/supervisord
bash-4.2# ls -l /usr/bin/supervisorctl 
-rwxr-xr-x 1 root root 322 Aug 20  2015 /usr/bin/supervisorctl


测试无问题

[root@foundation53 docker]# vim supervisord.conf 
[supervisord]
nodaemon=true

[program:sshd]
command=/usr/sbin/sshd -D

[program:httpd]
command=/usr/sbin/httpd


封装镜像
[root@foundation53 docker]# docker build -t rhel7:v3 .

运行镜像
[root@foundation53 docker]# docker run -d --name vm3 -v /tmp/docker/web:/var/www/html rhel7:v3
7335883ac3f8fe71378f532092de80331dbe7f483c1aa3766042eaebc547530c

docker镜像管理实例
[aaa@qq.com docker]# docker inspect vm3

docker镜像管理实例

CMD 与 ENTRYPOINT
ENTRYPOINT 容器启动后执行的命令,让容器执行表现的像一个可执行程序一样,与
CMD 的区别是不可以被 docker run 覆盖 , 会把 docker run 后面的参数当作传递给ENTRYPOINT 指令的参数。Dockerfile 中只能指定一个 ENTRYPOINT,如果指定了很多,只有最后一个有效。 docker run 命令的 -entrypoint 参数可以把指定的参数继续传递给ENTRYPOINT。

CMD 会被echo+参数覆盖
ENTRYPOINT echo +参数不会被覆盖

[root@foundation53 docker]# mkdir test
[root@foundation53 docker]# cd test/
[root@foundation53 test]# vim Dockerfile
[root@foundation53 test]# cat Dockerfile 
FROM rhel7
ENTRYPOINT ["/bin/echo","hello"]
CMD ["world"]



[root@foundation53 test]# docker build -t rhel7:v4 .


[root@foundation53 test]# docker run --rm rhel7:v4
hello world
[root@foundation53 test]# docker run --rm rhel7:v4 westos
hello westos

docker镜像管理实例

[root@foundation53 test]# vim Dockerfile
[root@foundation53 test]# cat Dockerfile 
FROM rhel7
ENV name westos
ENTRYPOINT ["/bin/sh","-c","echo $name"]
[root@foundation53 test]# docker build -t rhel7:v4 .



[root@foundation53 test]# docker run --rm rhel7:v4
westos
[root@foundation53 test]# docker run --rm rhel7:v4 hello
westos
[root@foundation53 test]# docker run --rm rhel7:v4 echo hello
westos

docker镜像管理实例

[aaa@qq.com docker]# docker run -it –name vm2 ubuntu
网卡没有权限管理

docker镜像管理实例

[aaa@qq.com docker]# docker run -it –name vm4 –privileged=True ubuntu
网卡有权限管理

docker镜像管理实例

测试内存，压测

导入压测工具 docker load -i stress.tar 
[aaa@qq.com docker]# docker run --rm -it --name vm1 -m 100M --memory-swap 100M stress --vm 1 --vm-bytes 90M

docker镜像管理实例

[aaa@qq.com docker]# docker run --rm -it --name vm1 -m 100M --memory-swap 100M stress --vm 1 --vm-bytes 110M

docker镜像管理实例
不设定swap大小( 默认是内存的两倍 )

[aaa@qq.com docker]# docker run --rm -it --name vm1 -m 100M stress --vm 1 --vm-bytes 210M

docker镜像管理实例
[aaa@qq.com docker]# docker run –rm -it –name vm1 -m 100M stress –vm 1 –vm-bytes 190M

docker镜像管理实例

测试cpu优先级

四核

[aaa@qq.com docker]# docker run --rm -it --cpu-shares 512 stress -c 4


[aaa@qq.com ssh]# docker run --rm -it --cpu-shares 1024 stress -c 4

docker镜像管理实例
Top查看

压力测试磁盘写入速度
限速10M

[root@foundation53 ssh]# docker run --rm -it --device-write-bps /dev/sda:10M ubuntu

root@6da63201480f:/# time dd if=/dev/zero of=testfile bs=1M count=100 oflag=direct
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 9.95397 s, 10.5 MB/s

real    0m9.957s
user    0m0.001s
sys 0m0.067s

限速100M
docker镜像管理实例

限速5M

docker镜像管理实例

Server1

Cgroup（虚拟机）

Cgroups是control groups的缩写，是Linux内核提供的一种可以限制、记录、隔离进程组（process groups）所使用的物理资源（如：cpu,memory,IO等等）的机制

[root@server1 ~]# yum install -y libcgroup.x86_64



[root@server1 ~]# /etc/init.d/cgconfig start
Starting cgconfig service:                                 [  OK  ]
[root@server1 ~]# cd /cgroup/
[root@server1 cgroup]# ll
total 0
drwxr-xr-x 2 root root 0 Aug 21 15:14 blkio
drwxr-xr-x 2 root root 0 Aug 21 15:14 cpu
drwxr-xr-x 2 root root 0 Aug 21 15:14 cpuacct
drwxr-xr-x 2 root root 0 Aug 21 15:14 cpuset
drwxr-xr-x 2 root root 0 Aug 21 15:14 devices
drwxr-xr-x 2 root root 0 Aug 21 15:14 freezer
drwxr-xr-x 2 root root 0 Aug 21 15:14 memory
drwxr-xr-x 2 root root 0 Aug 21 15:14 net_cls

内存控制

[root@server1 cgroup]# vim /etc/cgconfig.conf 
[root@server1 cgroup]# cat /etc/cgconfig.conf | tail -n 5
group x1 {
    memory {
        memory.limit_in_bytes = 209715200;
    }
}
[root@server1 cgroup]# cd
[root@server1 ~]# /etc/init.d/cgconfig restart
Stopping cgconfig service:                                 [  OK  ]
Starting cgconfig service:                                 [  OK  ]
[root@server1 ~]# cd /dev/shm/
[root@server1 shm]# ls

[root@server1 shm]# free -m
             total       used       free     shared    buffers     cached
Mem:           490        339        151          0         75        144
-/+ buffers/cache:        119        370
Swap:          991          0        991
[root@server1 shm]# dd if=/dev/zero of=file2 bs=1M count=100
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 0.0637548 s, 1.6 GB/s
[root@server1 shm]# free -m
             total       used       free     shared    buffers     cached
Mem:           490        439         50          0         75        244
-/+ buffers/cache:        120        370
Swap:          991          0        991
[root@server1 shm]# vmstat
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 0  0      0  51976  77352 250012    0    0   132    86   44   48  2  0 95  2  0

docker镜像管理实例

[aaa@qq.com shm]# cgexec -g memory:x1 dd if=/dev/zero of=file2 bs=1M count=300
dd: writing `file2': No space left on device
146+0 records in
145+0 records out
152256512 bytes (152 MB) copied, 0.0728536 s, 2.1 GB/s
[aaa@qq.com shm]# free -m
             total       used       free     shared    buffers     cached
Mem:           490        452         38          0         66        269
-/+ buffers/cache:        116        373
Swap:          991          0        991

[aaa@qq.com shm]# free -m
             total       used       free     shared    buffers     cached
Mem:           490        207        283          0         66         25
-/+ buffers/cache:        115        374
Swap:          991          0        991
[aaa@qq.com shm]# cgexec -g memory:x1 dd if=/dev/zero of=file2 bs=1M count=300
Killed

要求能运行memapp1 不能运行memapp2
已知1内存大小为4096pages
2内存大小为8192pages

[root@server1 ~]# ls
memapp1  memapp2
[root@server1 ~]# chmod +x memapp*
[root@server1 ~]# ls
memapp1  memapp2

[root@server1 ~]# yum install -y glibc


[root@server1 ~]# vim /etc/cgconfig.conf 
[root@server1 ~]# tail -n 6 /etc/cgconfig.conf
group x1 {
    memory {
        memory.limit_in_bytes = 20480000;
        memory.memsw.limit_in_bytes = 20480000;
}
}

[root@server1 ~]# useradd ha
[root@server1 ~]# cd /dev/shm/
[root@server1 shm]# ls
[root@server1 shm]# vim /etc/cgrules.conf 
[root@server1 shm]# tail -n 3 /etc/cgrules.conf
ha:memapp1  memory      x1/
ha:memapp2  memory      x1/

[root@server1 ~]# /etc/init.d/cgred restart
Stopping CGroup Rules Engine Daemon...                     [  OK  ]
Starting CGroup Rules Engine Daemon:                       [  OK  ]
[root@server1 ~]# /etc/init.d/cgconfig restart
Stopping cgconfig service:                                 [  OK  ]
Starting cgconfig service:                                 [  OK  ]

[aaa@qq.com ~]# mv * /home/ha/
[aaa@qq.com ~]# su - ha

docker镜像管理实例

Cpu

[root@server1 ~]# cd /cgroup/cpu
[root@server1 cpu]# pwd
/cgroup/cpu
[root@server1 cpu]# ls
cgroup.event_control  cpu.cfs_quota_us   cpu.shares         release_agent
cgroup.procs          cpu.rt_period_us   cpu.stat           tasks
cpu.cfs_period_us     cpu.rt_runtime_us  notify_on_release
[root@server1 cpu]# cat cpu.shares 
1024
[root@server1 cpu]# cd
[root@server1 ~]# vim /etc/cgconfig.conf 
[root@server1 ~]# tail -n 10 /etc/cgconfig.conf 
        memory.limit_in_bytes = 20480000;
        memory.memsw.limit_in_bytes = 20480000;
    }
}

group x2 {
    cpu {
        cpu.shares = 100;
    }
}

[root@server1 ~]# /etc/init.d/cgconfig restart
Stopping cgconfig service:                                 [  OK  ]
Starting cgconfig service:                                 [  OK  ]

[root@server1 ~]# dd if=/dev/zero of=/dev/null &
[4] 13506
[3]   Killed                  cgexec -g cpu:x2 dd if=/dev/zero of=/dev/null

docker镜像管理实例

aaa@qq.com ~]# cgexec -g cpu:x2 dd if=/dev/zero of=/dev/null &
[5] 13507

docker镜像管理实例
[aaa@qq.com ~]# killall dd

磁盘写入

[root@server1 ~]# vim /etc/cgconfig.conf 
[4]-  Terminated              dd if=/dev/zero of=/dev/null
[5]+  Terminated              cgexec -g cpu:x2 dd if=/dev/zero of=/dev/null
[root@server1 ~]# cat /etc/cgconfig.conf | tail -n 5
group x3 {
    blkio {
        blkio.throttle.read_bps_device = "252:0 1000000";
    }
}
[root@server1 ~]# /etc/init.d/cgconfig restart
Stopping cgconfig service:                                 [  OK  ]
Starting cgconfig service:                                 [  OK  ]
[root@server1 ~]# cat /cgroup/blkio/x3/blkio.throttle.read_bps_device
252:0   1000000


[root@server1 ~]# cgexec -g blkio:x3 dd if=/dev/vda of=/dev/null &
[3] 13543

docker镜像管理实例

[root@server1 ~]# vim /etc/cgconfig.conf 
[root@server1 ~]# cat /etc/cgconfig.conf | tail -n 3
group x4 {
    freezer {}
}
[root@server1 ~]#  /etc/init.d/cgconfig restart
Stopping cgconfig service:                                 [  OK  ]
Starting cgconfig service:                                 [  OK  ]
[root@server1 ~]#  cd /cgroup/freezer/x4/
[root@server1 x4]# ls
cgroup.event_control  cgroup.procs  freezer.state  notify_on_release  tasks
[root@server1 x4]# cat tasks
[root@server1 x4]# dd if=/dev/zero of=/dev/null &
[1] 13559

docker镜像管理实例

[root@server1 x4]# echo 13559 > tasks 
[root@server1 x4]# cat freezer.state 
THAWED

docker镜像管理实例

[root@server1 x4]# echo FROZEN > freezer.state 
[root@server1 x4]# cat freezer.state 
FROZEN

docker镜像管理实例

仓库管理
私有仓库
Docker 仓库:
Docker 官方已经把仓库封装为镜像,直接通过启动容器就可以部署完成仓库:
目录 /var/lib/registry 是仓库存放镜像的位置。除了使用数据卷做镜像存储之外,Registry
还支持将镜像存储到亚马逊的 S3,OpenStack 的 Swift/Glance 等存储后端。

[root@foundation53 docker]# docker load -i registry.tar
[root@foundation53 docker]# docker images registry 
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
registry            latest              bca04f698ba8        2 years ago         423 MB
[root@foundation53 docker]# docker load -i registry-2.3.1.tar

docker镜像管理实例

[aaa@qq.com docker]# docker run -d -p 5000:5000 -v /opt/registry:/var/lib/registry registry:2.3.1 
da02f32c4f9b0c407952602d225fcf167c13cd0da3ae6f57f04fadc2d2e40253

docker镜像管理实例

添加解析，以便加密上传
[aaa@qq.com docker]# vim /etc/hosts
[aaa@qq.com docker]# ping westos.org
PING server1 (172.25.254.53) 56(84) bytes of data.
64 bytes from westos.org (172.25.254.53): icmp_seq=1 ttl=64 time=0.033 ms
64 bytes from westos.org (172.25.254.53): icmp_seq=2 ttl=64 time=0.035 ms

打包
[root@foundation53 docker]# docker tag nginx localhost:5000/nginx

上传
[root@foundation53 docker]# docker push localhost:5000/nginx

docker镜像管理实例

上传成功后会有以下目录
[root@foundation53 docker]# cd /opt/registry/
[root@foundation53 registry]# ls
docker

[aaa@qq.com registry]# tree .
.
└── docker
    └── registry
        └── v2
            ├── blobs
            │   └── sha256
            │       ├── 0d
            │       │   └── 0daaf845be0541282e1f266cfb8be89da2be9b94464a3809671df38794fab673
            │       │       └── data
            │       ├── 1c
            │       │   └── 1c445a4de5f51e7f8ecfad0512e5a22bf491aa1641210735e2b50cb28b66b1f2
            │       │       └── data
            │       ├── a3
            │       │   └── a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
            │       │       └── data
            │       ├── af
            │       │   └── af4b3d7d5401624ed3a747dc20f88e2b5e92e0ee9954aab8f1b5724d7edeca5e
            │       │       └── data
            │       ├── e5
            │       │   └── e59bbe13ca0c309644d9bca972c1b660c170fbdee7ff81eda9ff966b86f14e63
            │       │       └── data
            │       └── f1
            │           └── f12d0e96cd3d5845c6ad2e8b6989902a0c769cb29ca079a1c778c8d80aaf7c5e
            │               └── data
            └── repositories
                └── nginx
                    ├── _layers
                    │   └── sha256
                    │       ├── 0daaf845be0541282e1f266cfb8be89da2be9b94464a3809671df38794fab673
                    │       │   └── link
                    │       ├── 1c445a4de5f51e7f8ecfad0512e5a22bf491aa1641210735e2b50cb28b66b1f2
                    │       │   └── link
                    │       ├── a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
                    │       │   └── link
                    │       ├── af4b3d7d5401624ed3a747dc20f88e2b5e92e0ee9954aab8f1b5724d7edeca5e
                    │       │   └── link
                    │       └── f12d0e96cd3d5845c6ad2e8b6989902a0c769cb29ca079a1c778c8d80aaf7c5e
                    │           └── link
                    ├── _manifests
                    │   ├── revisions
                    │   │   └── sha256
                    │   │       └── e59bbe13ca0c309644d9bca972c1b660c170fbdee7ff81eda9ff966b86f14e63
                    │   │           └── link
                    │   └── tags
                    │       └── latest
                    │           ├── current
                    │           │   └── link
                    │           └── index
                    │               └── sha256
                    │                   └── e59bbe13ca0c309644d9bca972c1b660c170fbdee7ff81eda9ff966b86f14e63
                    │                       └── link
                    └── _uploads

37 directories, 14 files

我们把本地nginx镜像删除，然后尝试下载
可以看出，除了删除nginx之外，其他的都仅仅是把名字删了而已
[root@foundation53 registry]# docker rmi westos.org:5000/nginx
Untagged: westos.org:5000/nginx:latest
[root@foundation53 registry]# docker rmi localhost:5000/nginx
Untagged: localhost:5000/nginx:latest
Untagged: localhost:5000/nginx@sha256:e59bbe13ca0c309644d9bca972c1b660c170fbdee7ff81eda9ff966b86f14e63
[root@foundation53 registry]# docker rmi nginx

docker镜像管理实例

下载
[root@foundation53 registry]# docker pull localhost:5000/nginx

下载完成后我们可以改名
[root@foundation53 registry]# docker tag localhost:5000/nginx nginx

docker镜像管理实例

上面因为要加密传输，所以我们并没有指定网址，若要指定网址，可如下
添加要上传的网址解析
[root@foundation53 registry]# vim /etc/docker/deamon.json 
[root@foundation53 registry]# cat /etc/docker/deamon.json 
{
  "registry-mirrors": ["https://0hll14bg.mirror.aliyuncs.com"]
  "insecure-registries": ["westos.org:5000"]
}

[root@foundation53 registry]# ls
[root@foundation53 registry]# pwd
/opt/registry
[root@foundation53 registry]# cd /tmp/docker/
[root@foundation53 docker]# ls
Dockerfile  dvd.repo  ssh  supervisord.conf  test  web
[root@foundation53 docker]# mkdir certs
[root@foundation53 docker]# cd certs/
[root@foundation53 certs]# cd ..
[root@foundation53 docker]# ls
certs  Dockerfile  dvd.repo  ssh  supervisord.conf  test  web
[root@foundation53 docker]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key -x509 -days 365 -out certs/domain.crt

docker镜像管理实例

[aaa@qq.com docker]# docker run -d --restart=always --name registry -v `pwd`/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key -p 443:443 registry:2.3.1 
86feeeeced0d5535be220d603b7b7d1ddf58a9323c9c80235361bbd485d56002

docker镜像管理实例

[aaa@qq.com docker]# cd /etc/docker/
[aaa@qq.com docker]# ls
deamon.json  key.json
[aaa@qq.com docker]# mkdir certs.d
[aaa@qq.com docker]# ls
certs.d  deamon.json  key.json
[aaa@qq.com docker]# cd certs.d/
[aaa@qq.com certs.d]# mkdir westos.org
[aaa@qq.com certs.d]# cd westos.org/
[aaa@qq.com westos.org]# pwd
/etc/docker/certs.d/westos.org
[aaa@qq.com westos.org]# cp /tmp/docker/certs/domain.crt ./ca.crt
[aaa@qq.com westos.org]# docker tag rhel7 westos.org/rhel7
[aaa@qq.com westos.org]# docker push westos.org/rhel7
The push refers to a repository [westos.org/rhel7]
18af9eb19b5f: Pushed 
latest: digest: sha256:f1b19bc905965d1ff157c76b9ef6615c119aadad3cf4652bc881d3354ba3fdc4 size: 528

docker镜像管理实例

上一篇： Manjaro快速上手指南

下一篇： Docker应用部署

docker镜像管理实例

Docker配置本地镜像与容器的存储位置

Docker 批量删除中间镜像缓存

使用Docker官方镜像搭建ZooKeeper集群

浅谈使用Maven插件构建Docker镜像的方法

SpringMVC+MyBatis 事务管理（实例）

详解Maven Docker镜像使用技巧

Spring Boot项目利用Redis实现session管理实例

Docker 部署 SpringBoot 项目整合 Redis 镜像做访问计数示例代码

java GUI实现学生图书管理简单实例

浅谈使用Maven插件构建Docker镜像的方法