容器化企业级应用
容器化部署企业级应用
使用docker容器化部署企业级应用必要性
- 有利于快速实现企业级应用部署
- 有利于快速实现企业级应用恢复
使用docker容器化部署企业级应用参考资料
容器实现 nginx 部署
参考资料：https://hub.docker.com
- 不在docker host暴露端口
# 运行一个 nginx 容器 -d:以守护进程运行 -v：映射宿主机目录给容器 ro：read-only 只读
[root@Docker-1 ~]# docker run -d --name nginx -v /some/content:/usr/sshare/nginx/html:ro nginx:latest
# 创建访问页面，容器中也会在映射目录创建
[root@Docker-1 ~]# cat /some/content/index.html
123456
# 访问容器
[root@Docker-1 ~]# curl 172.17.0.2
123456
- 在docker host暴露80端口
# 运行一个 nginx 容器 -d:以守护进程运行 -v：映射宿主机目录给容器 ro：read-only 只读 -p 映射主机端口给容器
[root@Docker-1 ~]# docker run -d -p 80:80 --name nginx-port -v /some/content-port/:/usr/share/nginx/html:ro nginx:latest
# 创建访问页面，容器中也会在映射目录创建
[root@Docker-1 ~]# cat /some/content-port/index.html
123456
# 访问宿主机
[root@Docker-1 ~]# curl 10.1.8.101
123456
- 挂载配置文件，需要创建1个nginx容器，把配置文件复制出来修改后使用
# 查看容器运行的进程，work进程根据CPU的核心数量一致
[root@Docker-1 ~]# docker top nginx-port
UID PID PPID C STIME TTY TIME CMD
root 6853 6833 0 10:51 ? 00:00:00 nginx: master process nginx -g daemon off;
101 6897 6853 0 10:51 ? 00:00:00 nginx: worker process
101 6898 6853 0 10:51 ? 00:00:00 nginx: worker process
# 创建放置配置文件的目录
[root@Docker-1 ~]# mkdir /opt/nginx_conf
# 复制容器中的 nginx 配置文件到宿主机
[root@Docker-1 ~]# docker cp nginx-port:/etc/nginx/nginx.conf /opt/nginx_conf/
# 将进程数修改为4，适用于高并发
[root@Docker-1 ~]# cat /opt/nginx_conf/nginx.conf
user nginx;
worker_processes 4;
......
# 运行一个 nginx 容器 -d:以守护进程运行 -v：映射宿主机目录给容器 ro：read-only 只读 -p 映射主机端口给容器
# 挂载完成后也可使用 docker restart nginx-conf 来重启容器使配置文件生效
[root@Docker-1 ~]# docker run -d \
-p 82:80 --name nginx-conf \
-v /some/content-index/:/usr/share/nginx/html:ro \
-v /opt/nginx_conf/nginx.conf:/etc/nginx/nginx.conf:ro \
nginx:latest
# 发现核心数变为了4，配置文件生效
[root@Docker-1 ~]# docker top nginx-conf
UID PID PPID C STIME TTY TIME CMD
root 8377 8357 0 11:44 ? 00:00:00 nginx: master process nginx -g daemon off;
101 8420 8377 0 11:44 ? 00:00:00 nginx: worker process
101 8421 8377 0 11:44 ? 00:00:00 nginx: worker process
101 8422 8377 0 11:44 ? 00:00:00 nginx: worker process
101 8423 8377 0 11:44 ? 00:00:00 nginx: worker process
容器实现 tomcat 部署
不暴露端口运行
# 下载镜像
[root@Docker-1 ~]# docker pull tomcat
# 运行容器 --rm 运行结束后删除容器
[root@Docker-1 ~]# docker run -d --name tomcat-1 --rm tomcat:latest
# 访问容器
[root@Docker-1 ~]# curl http://172.17.0.2:8080
<!doctype html><html lang="en"><head><title>HTTP Status 404 – Not Found</title>
<style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b
{color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {fontsize:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line
{height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP
Status 404 – Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p>
<b>Description</b> The origin server did not find a current representation for
the target resource or is not willing to disclose that one exists.</p><hr
class="line" /><h3>Apache Tomcat/11.0.9</h3></body></html>
暴露端口运行
# 创建容器
[root@Docker-1 ~]# docker run -d --name tomcat:2 -p 8080:8080 tomcat:latest
宿主机访问
暴露端口及添加网站文件
# 创建容器
[root@Docker-1 ~]# docker run -d --name tomcat-3 -p 8081:8080 -v /opt/tomcat_web:/usr/local/tomcat/webapps/ROOT tomcat:latest
# 部署对应页，容器中映射目录也会有
[root@Docker-1 ~]# cat /opt/tomcat_web/index.html
kajdldask
宿主机访问
容器实现 Mysql 部署
单节点部署
# 下载镜像
[root@Docker-1 ~]# docker pull mysql:5.7
# 运行容器 -v 映射目录 -e 指定环境变量
[root@Docker-1 ~]# docker run -d -p 3306:3306 \
--name mysql-01 \
-v /opt/mysql/log:/var/log/mysql \ # 映射日志文件
-v /opt/mysql/data:/var/lib/mysql \ # 映射数据文件
-v /opt/mysql/conf:/etc/mysql/conf.d \ # 映射配置文件
-e MYSQL_ROOT_PASSWORD=root \ # 指定环境变量，启用ROOT用户并设置密码
mysql:5.7
# 在宿主机直接访问容器数据库
[root@Docker-1 ~]# docker exec -it mysql-01 mysql -uroot -proot
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.44 MySQL Community Server (GPL)
Copyright (c) 2000, 2023, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
# 在宿主机访问mysql，需要安装一个mysql
[root@Docker-1 ~]# yum -y install mysql
# -h：指定连接地址 -u：用户 -p：密码 -P：端口
[root@Docker-1 ~]# mysql -h 10.1.8.101 -uroot -proot -P 3306
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MySQL connection id is 3
Server version: 5.7.44 MySQL Community Server (GPL)
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MySQL [(none)]>`
# 在宿主机连接容器mysql创建一个数据库，在进入容器验证是否存在
# 宿主机连接并创建数据库
[root@Docker-1 ~]# mysql -h 10.1.8.101 -uroot -proot -P 3306
MySQL [mysql]> create database school;
# 进入容器中查看验证
[root@Docker-1 ~]# docker exec -it mysql-01 mysql -uroot -proot
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| school |
| sys |
+--------------------+
# 可以看到容器中有添加的 school 数据库
主从复制集群部署
主节点部署
# 创建主节点容器
[root@Docker-1 ~]# docker run -d --name mysql-master \
-p 3306:3306 \
-v /opt/mysql-master/log:/var/log/mysql \
-v /opt/mysql-master/data:/var/lib/mysqsl \
-v /opt/mysql-master/conf:/etc/mysql/conf.d \
-e MYSQL_ROOT_PASSWORD=root \
mysql:5.7
# 修改配置文件，对应容器映射里面也会被修改
[root@Docker-1 ~]# cat /opt/mysql-master/conf/my.cnf
[client]
default-character-set=utf8
[mysql]
default-character-set=utf8
[mysqld]
init_connect='SET collation_connection = utf8_unicode_ci'
init_connect='SET NAMES utf8'
character-set-server=utf8
collation-server=utf8_unicode_ci
skip-character-set-client-handshake
skip-name-resolve
server_id=1 # 设置ID
log-bin=mysql-bin # 开启二进制文件
read-only=0 # 关闭只读
binlog-do-db=school # 同步的数据库
# 复制忽略默认数据库
replicate-ignore-db=mysql
replicate-ignore-db=sys
replicate-ignore-db=information_schema
replicate-ignore-db=performance_schema
# 进入主节点容器数据库，创建一个授权主从同步的用户
[root@Docker-1 ~]# mysql -h 10.1.8.101 -uroot -proot -P3306
MySQL [(none)]> grant replication slave on *.* to 'backup'@'%' identified by '123456';
MySQL [(none)]> flush privileges; # 刷新策略
# 查看二进制文件信息
MySQL [(none)]> show master status\G;
*************************** 1. row ***************************
File: mysql-bin.000001
Position: 154
Binlog_Do_DB: school
Binlog_Ignore_DB:
Executed_Gtid_Set:
1 row in set (0.00 sec)
从节点部署
# 创建从节点容器 --link 指定连接数据库，这里连接主数据库
[root@Docker-1 ~]# docker run -d --name mysql-slave \
-p 3307:3306 \
-v /opt/mysql-slave/log:/var/log/mysql \
-v /opt/mysql-slave/data:/var/lib/mysqsl \
-v /opt/mysql-slave/conf:/etc/mysql/conf.d \
-e MYSQL_ROOT_PASSWORD=root \
--link mysql-master:mysql-master \ # 前面是主数据库容器名称，后面是别名
mysql:5.7
# 修改配置文件，对应容器映射的目录也会被更改
[root@Docker-1 ~]# cat /opt/mysql-slave/conf/my.cnf
[client]
default-character-set=utf8
[mysql]
default-character-set=utf8
[mysqld]
init_connect='SET collation_connection = utf8_unicode_ci'
init_connect='SET NAMES utf8'
character-set-server=utf8
collation-server=utf8_unicode_ci
skip-character-set-client-handshake
skip-name-resolve
server-id=2 # 设置数据库ID
log-bin=mysql-bin # 开启二进制文件
read-only=1 # 只读
binlog-do-db=school # 同步的数据库
# 复制忽略默认数据库
replicate-ignore-db=mysql
replicate-ignore-db=sys
replicate-ignore-db=information_schema
replicate-ignore-db=performance_schema
# 从节点数据库容器同步主节点数据库容器
MySQL [(none)]> change master to master_host='mysql-master',master_user='backup',master_password='123456',master_log_file='mysql-bin.000001',master_log_pos=154,master_port=3306;
# 开启从库同步
MySQL [(none)]> start slave;
# 查看从节点，有双 YES 代表同步成功
MySQL [(none)]> show slave status\G;
*************************** 1. row ***************************
Slave_IO_State: Waiting for master to send event
Master_Host: mysql-master
Master_User: backup
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: mysql-bin.000001
Read_Master_Log_Pos: 154
Relay_Log_File: 7c3309d7e79a-relay-bin.000002
Relay_Log_Pos: 320
Relay_Master_Log_File: mysql-bin.000001
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
......
# 如果启动失败清空配置，重新配置
MySQL root@(none):(none)> reset slave all;
验证主从集群
# 主容器数据库创建复制数据库
MySQL [(none)]> create database school;
# 使用数据库创建一个表和一个表信息
MySQL [(none)]> use school;
MySQL [school]> create table info (id int primary key,name varchar(10));
MySQL [school]> insert into info (id,name) values (1,'zhangsan');
MySQL [school]> select * from info;
+----+----------+
| id | name |
+----+----------+
| 1 | zhangsan |
+----+----------+
# 从容器数据库验证同步信息是否完成
MySQL [(none)]> use school;
MySQL [school]> select * from info;
+----+----------+
| id | name |
+----+----------+
| 1 | zhangsan |
+----+----------+
容器实现 ElasticSearch+Kibana 部署
ElasticSearch
# 下载镜像
[root@Docker-1 ~]# docker pull elasticsearch:7.17.0
# 创建配置文件目录
[root@Docker-1 ~]# mkdir -p /opt/es/config
# 创建数据文件目录
[root@Docker-1 ~]# mkdir -p /opt/es/data
# 创建监听端口资源
[root@Docker-1 ~]# echo "http.host: 0.0.0.0" >> /opt/es/config/elasticsearch.yml
# 开启修改权限
[root@Docker-1 ~]# chmod -R 777 /opt/es/
# 启动容器
# discovery.type：发现类型
# ES_JAVA_OPTS：启动内存设置 64m，最大512m
[root@Docker-1 ~]# docker run -d --name elasticsearch \
-p 9200:9200 -p 9300:9300 \
-e "discovery.type=single-node" \
-e ES_JAVA_OPTS="-Xms64m -Xmx512m" \
-v /opt/es/config/elasticsearch.yml:/usr/share/elasticsearch.yml \
-v /opt/es/data:/usr/share/elasticsearch/data \
-v /opt/es/plugins:/usr/share/elasticsearch/plugins \
elasticsearch:7.17.0
通过宿主机访问
Kibana
# 下载镜像
[root@Docker-1 ~]# docker pull kibana:7.17.0
# 创建容器,指向 es 的位置
[root@Docker-1 ~]# docker
[root@Docker-1 ~]# docker run -d --name kibana \
-e ELASTICSEARCH_HOSTS=http://10.1.8.101:9200 \
-p 5601:5601 \
kibana:7.17.0
通过宿主机进行访问
容器实现 Redis 部署
Redis 容器单节点部署
# 下载 redis 镜像
[root@Docker-1 ~]# docker pull redis
# 创建映射的配置文件目录
[root@Docker-1 ~]# mkdir -p /opt/redis/conf
# 创建配置文件
[root@Docker-1 ~]# touch /opt/redis/conf/redis.conf
# 创建容器 redis-server：启动并加载redis配置文件
[root@Docker-1 ~]# docker run -d --name redis \
-p 6379:6379 \
-v /opt/redis/data:/data \
-v /opt/redis/conf/:/etc/redis \
redis \
redis-server /etc/redis/redis.conf
# 验证：
# 使用容器客户端连接
[root@Docker-1 ~]# docker run -it --name redis-cli redis:latest redis-cli -h 172.17.0.2
172.17.0.2:6379>
# 也可使用宿主机下载 redis 客户端连接，或者修改配置文件 bind 监听后直接访问容器宿主机的6479端口访问
[root@Docker-1 ~]# yum -y install redis
[root@Docker-1 ~]# redis-cli -h 172.17.0.2
172.17.0.2:6379>
[root@Docker-1 ~]# redis-cli -h 10.1.8.101 -p 6379
10.1.8.101:6379>
# 创建一个数据查看是否有效
172.17.0.2:6379> set id 100
OK
172.17.0.2:6379> get id
"100"
Redis 集群
方式：三主，三从
三主：实现数据分片
三从：实现数据备份
# 写一个可执行的循环脚本运行容器
[root@Docker-1 ~]# cat redis.sh
#!/bin/bash
for (( port=8001;port<=8006;port++)); \ # 定义端口
do \
mkdir -p /opt/redis/node-${port}/conf # 创建映射的配置文件目录
touch /opt/redis/node-${port}/conf/redis.conf # 创建映射的配置文件
cat >/opt/redis/node-${port}/conf/redis.conf << EOF # 定义配置文件的内容
port ${port} # redis 的监听端口
cluster-enabled yes # 开启集群
cluster-config-file nodes.conf # 指定配置文件位置
cluster-node-timeout 5000 # 设置超时时间
cluster-announce-ip 10.1.8.101 # 指定集群对外的ip地址
cluster-announce-port ${port} # 指定集群对外各自的port端口
cluster-announce-bus-port 1${port} # 指定集群内部通讯的端口
appendonly yes # 允许写入
EOF
docker run -p ${port}:${port} -p 1${port}:1${port} --name redis-${port} \
-v /mydata/redis/node-${port}/data:/data \
-v /mydata/redis/node-${port}/conf/redis.conf:/etc/redis/redis.conf \
-d redis:latest redis-server /etc/redis/redis.conf; \
done
# 执行脚本
[root@Docker-1 ~]# chmod +x redis.sh
[root@Docker-1 ~]# ./redis.sh
# 查看容器 状态都是up，代表没有问题
[root@Docker-1 ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
3db203c9beeb redis:latest "docker-entrypoint.s…" 9 minutes ago Up 9 minutes 0.0.0.0:8006->8006/tcp, :::8006->8006/tcp, 6379/tcp, 0.0.0.0:18006->18006/tcp, :::18006->18006/tcp redis-8006
6263a80ded20 redis:latest "docker-entrypoint.s…" 9 minutes ago Up 9 minutes 0.0.0.0:8005->8005/tcp, :::8005->8005/tcp, 6379/tcp, 0.0.0.0:18005->18005/tcp, :::18005->18005/tcp redis-8005
f0e030adf4be redis:latest "docker-entrypoint.s…" 9 minutes ago Up 9 minutes 0.0.0.0:8004->8004/tcp, :::8004->8004/tcp, 6379/tcp, 0.0.0.0:18004->18004/tcp, :::18004->18004/tcp redis-8004
0939162bd741 redis:latest "docker-entrypoint.s…" 9 minutes ago Up 9 minutes 0.0.0.0:8003->8003/tcp, :::8003->8003/tcp, 6379/tcp, 0.0.0.0:18003->18003/tcp, :::18003->18003/tcp redis-8003
a0d755a4cf65 redis:latest "docker-entrypoint.s…" 9 minutes ago Up 9 minutes 0.0.0.0:8002->8002/tcp, :::8002->8002/tcp, 6379/tcp, 0.0.0.0:18002->18002/tcp, :::18002->18002/tcp redis-8002
a7635f97e20f redis:latest "docker-entrypoint.s…" 9 minutes ago Up 9 minutes 0.0.0.0:8001->8001/tcp, :::8001->8001/tcp, 6379/tcp, 0.0.0.0:18001->18001/tcp, :::18001->18001/tcp redis-8001
# 进入容器，创建集群
# --cluster：创建集群
# --cluster-replicas 1：有一个主就要有一个从，如果是2就代表一个主两个从
root@a7635f97e20f:/data# redis-cli --cluster create 10.1.8.101:8001 10.1.8.101:8002 10.1.8.101:8003 10.1.8.101:8004 10.1.8.101:8005 10.1.8.101:8006 --cluster-replicas 1
>>> Performing hash slots allocation on 6 nodes...
Master[0] -> Slots 0 - 5460
Master[1] -> Slots 5461 - 10922
Master[2] -> Slots 10923 - 16383
Adding replica 10.1.8.101:8005 to 10.1.8.101:8001
Adding replica 10.1.8.101:8006 to 10.1.8.101:8002
Adding replica 10.1.8.101:8004 to 10.1.8.101:8003
>>> Trying to optimize slaves allocation for anti-affinity
[WARNING] Some slaves are in the same host as their master
M: f36d6d6adecd0322386da36ae12218993fe02c9e 10.1.8.101:8001
slots:[0-5460] (5461 slots) master
M: babedb7291e8e68593b1bc4f228d2b5b42874ca7 10.1.8.101:8002
slots:[5461-10922] (5462 slots) master
M: ae2d676b57db44cee8e769a04ca2a9e591817b89 10.1.8.101:8003
slots:[10923-16383] (5461 slots) master
S: a3bd240139f668bf609854c8bb7475b56d8b3607 10.1.8.101:8004
replicates f36d6d6adecd0322386da36ae12218993fe02c9e
S: 28b3585c637fc77b93b167d9d9123ac2d8774fb1 10.1.8.101:8005
replicates babedb7291e8e68593b1bc4f228d2b5b42874ca7
S: 77fedebb32184b3dddf962cf4a53834dc551d14a 10.1.8.101:8006
replicates ae2d676b57db44cee8e769a04ca2a9e591817b89
# 这里输入 yes 即可开始创建集群
Can I set the above configuration? (type 'yes' to accept): yes
>>> Nodes configuration updated
>>> Assign a different config epoch to each node
>>> Sending CLUSTER MEET messages to join the cluster
Waiting for the cluster to join
.
>>> Performing Cluster Check (using node 10.1.8.101:8001)
M: f36d6d6adecd0322386da36ae12218993fe02c9e 10.1.8.101:8001
slots:[0-5460] (5461 slots) master
1 additional replica(s)
M: ae2d676b57db44cee8e769a04ca2a9e591817b89 10.1.8.101:8003
slots:[10923-16383] (5461 slots) master
1 additional replica(s)
M: babedb7291e8e68593b1bc4f228d2b5b42874ca7 10.1.8.101:8002
slots:[5461-10922] (5462 slots) master
1 additional replica(s)
S: a3bd240139f668bf609854c8bb7475b56d8b3607 10.1.8.101:8004
slots: (0 slots) slave
replicates f36d6d6adecd0322386da36ae12218993fe02c9e
S: 77fedebb32184b3dddf962cf4a53834dc551d14a 10.1.8.101:8006
slots: (0 slots) slave
replicates ae2d676b57db44cee8e769a04ca2a9e591817b89
S: 28b3585c637fc77b93b167d9d9123ac2d8774fb1 10.1.8.101:8005
slots: (0 slots) slave
replicates babedb7291e8e68593b1bc4f228d2b5b42874ca7
[OK] All nodes agree about slots configuration.
>>> Check for open slots...
>>> Check slots coverage...
[OK] All 16384 slots covered.
# 客户端进行验证
[root@Docker-1 ~]# redis-cli -h 10.1.8.101 -p 8001
10.1.8.101:8001>
docker image 容器镜像构建
基于docker commit创建
定制 sshd 服务镜像
# 创建镜像并下载相应软件包
[root@docker ~]# docker container run -it \
registry.access.redhat.com/ubi8/ubi:latest
[root@f0039929839d /]# yum install -y openssh-server
# 生成所需要的文件
[root@f0039929839d /]# /usr/libexec/openssh/sshd-keygen rsa
[root@f0039929839d /]# /usr/libexec/openssh/sshd-keygen dsa
[root@f0039929839d /]# /usr/libexec/openssh/sshd-keygen ecdsa
[root@f0039929839d /]# /usr/libexec/openssh/sshd-keygen ed25519
[root@f0039929839d /]# echo "root:200308gzq." | chpasswd
# 启动服务
[root@f0039929839d /]# /usr/sbin/sshd -D &
[1] 103
宿主机测试
[root@docker ~]# ssh root@172.17.0.3
Warning: Permanently added '172.17.0.3' (ECDSA) to the list of known hosts.
root@172.17.0.3's password:
[root@ead7ef456e77 ~]# logout
定制 httpd 服务镜像
# 安装软件包并生成相应文件
[root@ead7ef456e77 /]# yum -y install httpd
[root@ead7ef456e77 /]# echo 1234 > /var/www/html/index.html
# 启动服务
[root@ead7ef456e77 /]# /usr/sbin/httpd -D FOREGROUND
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.3. Set the 'ServerName' directive globally to suppress this message
httpd (pid 149) already running
宿主机测试
[root@docker ~]# curl 172.17.0.3
1234
commit 提交为本地镜像
docker 通过 commit 和 build 操作实现镜像的构建。commit 将容器提交为一个镜像，build 在一个镜像的基础上构建镜像。使用 commit 将容器提交为一个镜像
[root@docker ~]# docker commit --help
Usage: docker commit [OPTIONS] CONTAINER [REPOSITORY[:TAG]]
Create a new image from a container's changes
Options:
-a, --author string Author (e.g., "John Hannibal Smith <hannibal@a-team.com>")
-c, --change list Apply dockerfile instruction to the created image
-m, --message string Commit message
-p, --pause Pause container during commit (default true)
[root@docker ~]# docker commit ead7ef456e77 ubi8_ssh_httpd:latest
sha256:1fb86966527b13ebb07c3391f392c5b1a64a574b84cacbca2d75fd2cae0c41fb
创建新的容器测试：
# 创建容器
[root@docker ~]# docker run -it --name ubi8 ubi8_ssh_httpd:latest bash
# 启动 httpd 服务
[root@4eb2af388fde /]# /usr/sbin/httpd -D FOREGROUND
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.3. Set the 'ServerName' directive globally to suppress this message
# 启动 sshd 服务
[root@4eb2af388fde /]/usr/sbin/sshd -D &
[1] 233
# 宿主机测试
[root@docker ~]# curl 172.17.0.3
1234
[root@docker ~]# ssh root@172.17.0.3
root@172.17.0.3's password:
[root@4eb2af388fde ~]# logout
分析容器与镜像的区别
# 将以容器提交为镜像
[root@Docker-1 ~]# docker commit centos7 centos:test
sha256:af7970d94241d2deaf3083da1459bae68572b6f772c8a122f9124c8838574083
# 查看新镜像与原镜像的区别
# 新镜像
[root@Docker-1 ~]# cat /var/lib/docker/image/overlay2/imagedb/content/sha256/af7970d94241d2deaf3083da1459bae68572b6f772c8a122f9124c8838574083 | jq
"rootfs": {
"type": "layers",
"diff_ids": [
"sha256:174f5685490326fc0a1c0f5570b8663732189b327007e47ff13d2ca59673db02",
"sha256:c3da9fedff504900d218c8060dd83c1a6bc66f2af54a4cc132bf1538ca8506be"
]
}
# 原镜像
[root@Docker-1 ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
centos test af7970d94241 3 minutes ago 204MB
nginx latest 22bd15417453 7 days ago 192MB
centos 7 eeb6ee3f44bd 3 years ago 204MB
[root@Docker-1 ~]# cat /var/lib/docker/image/overlay2/imagedb/content/sha256/eeb6ee3f44bd0b5103bb561b4c16bcb82328cfe5809ab675bb17ab3a16c517c9 | jq
"rootfs": {
"type": "layers",
"diff_ids": [
"sha256:174f5685490326fc0a1c0f5570b8663732189b327007e47ff13d2ca59673db02"
]
}
# 发现新镜像会比原镜像多了一层，从而会使镜像体积增加
# 查看新创建镜像中的内容
# 根据基础层和中间层计算出cache-id，
[root@Docker-1 ~]# echo -n "sha256:174f5685490326fc0a1c0f5570b8663732189b327007e47ff13d2ca59673db02" "sha256:c3da9fedff504900d218c8060dd83c1a6bc66f2af54a4cc132bf1538ca8506be" | sha256sum -
ac3ef2fec047509b3bd01d3670f87d54df0d61062dab545c0596d0f9c1f0be8a -
# 查看cache-id 并根据此查看镜像文件内容
[root@Docker-1 ~]# cat /var/lib/docker/image/overlay2/layerdb/sha256/ac3ef2fec047509b3bd01d3670f87d54df0d61062dab545c0596d0f9c1f0be8a/cache-id
8c478b3c6ca01213e1899d5ba712b4c6b5830420b8e5e7185f2018cfb1dbc267
# 查看新镜像的内容
[root@Docker-1 ~]# ls /var/lib/docker/overlay2/8c478b3c6ca01213e1899d5ba712b4c6b5830420b8e5e7185f2018cfb1dbc267/diff/
root test.txt
# 发现新镜像有创建的text.txt文件，因此创建的新镜像会有在原容器中做的操作创建的文件
结论：
- 使用容器创建镜像，如果做了操作，构建的新镜像将会多出分层信息
- 创建出的镜像会有在容器中所做操作的文件
基于 dockerfile 创建自定义镜像
Dockerfile介绍
Dockerfile是一种能够被Docker程序解释的剧本。Dockerfile由一条一条的指令组成，并且有自己的书写格式和支持的命令。当我们需要在容器镜像中指定自己额外的需求时，只需在Dockerfile上添加或修改指令，然后通过docker build生成我们自定义的容器镜像(image)。
dockerfile 结构指令
dockerfile由一行行命令语句组成，并且支持以#开头的注释行。一般而言，dockerfile分为四部分：基础镜像信息、维护者信息、镜像操作指令和容器启动时执行指令。
-
构建类指令
- 用于构建image
- 其指定的操作不会在运行image的容器上执行(FROM、MAINTAINER、RUN、ENV、ADD、COPY)
-
设置类指令
- 用于设置image的属性
- 其指定的操作将在运行image的容器中执行(CMD、ENTRYPOINT、USER、EXPOSE、VOLUME、WORKDIR、ONBUILD)
-
指令说明
指令 描述 FROM 基础镜像，必须为第一层，默认去 Docker Hub下载 MAINTAINER 描述信息 LABEL 标签 RUN 构建镜像时运行的shell命令 COPY 拷贝文件或目录到镜像中 VOLUME 创建一个数据卷挂载点 ADD 解压压缩包并拷贝 ENV 设置环境变量 USER 为RUN、CMD和ENTRYPOINT执行命令指定运行用户 EXPOSE 声明容器运行的服务端口，暴露端口 WORKDIR 为RUN、CMD、ENTRYPOINT、COPY和ADD设置工作目录，类似CD CMD 运行容器时默认执行，如果有多个CMD指令，最后一个生效 ENTRYPOINT 与CMD类似，启动容器时作为根命令执行
创建镜像
创建dockerfile文件
# 创建 dockerfile文件
[root@docker ~]# cat ubi8.dockerfile
FROM registry.access.redhat.com/ubi8/ubi:latest
RUN yum install -y openssh-server \
&& /usr/libexec/openssh/sshd-keygen rsa \
&& /usr/libexec/openssh/sshd-keygen dsa \
&& /usr/libexec/openssh/sshd-keygen ecdsa \
&& /usr/libexec/openssh/sshd-keygen ed25519 \
&& echo "root:200308gzq." | chpasswd # 修改 root 密码
RUN yum install -y httpd \
&& echo Hello World > /var/www/html/index.html
EXPOSE 22 80
ENTRYPOINT /usr/sbin/sshd -D & /usr/sbin/httpd -D FOREGROUND
bulid 构建镜像
# -t 打标签，指定名称 -f 指定dockerfile文件 .指定当前目录
[root@docker ~]# docker build -t ubi8_sshd_httpd:latest -f ubi8.dockerfile .
# 查看镜像
[root@docker ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
ubi8_sshd_httpd latest d6b7e52c6b5e 26 minutes ago 254MB
# 创建容器
[root@docker ~]# docker run -d -it --name ubi8 -p 8080:80 -p 2022:22 ubi8_sshd_httpd:latest
# 宿主机验证
[root@docker ~]# ssh root@localhost -p 2022
Warning: Permanently added '[localhost]:2022' (ECDSA) to the list of known hosts.
root@localhost's password:
[root@b864a6ce3136 ~]# logout
[root@docker ~]# curl localhost:8080
Hello World
应用案例
构建SSH镜像
- 构建镜像
# 准备环境
[root@Docker-1 ~]# mkdir -p /docker_work/sshd
[root@Docker-1 ~]# cd /docker_work/sshd
# 编写 dockerfile 文件
[root@Docker-1 sshd]# cat Dockerfile
# 基础镜像,FROM必须第一层
FROM centos:7
# 描述信息
MAINTAINER This is project <cloud-centos>
# 执行指令，配置阿里云镜像源
RUN mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
RUN curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
# 安装环境包
RUN yum -y update
RUN yum -y install openssh* net-tools lsof telnet passwd
# 指定 root 密码
RUN echo '200308gzq.' | passwd --stdin root
# 禁用 PAM 可插拔认证模块
RUN sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
# 生成密钥对
RUN ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
RUN sed -i '/^session\s\+required\s\+pam_loginuid.so/s/^/#/' /etc/pam.d/sshd
# 创建root的ssh隐藏目录，并修改权限
RUN mkdir -p /root/.ssh && chown root.root /root && chmod 700 /root/.ssh
# 指定 ssh 暴露端口
EXPOSE 22
# 启动sshd服务 -D:以守护进程启动
CMD ["/usr/sbin/sshd","-D"]
# 构建镜像 -t：打标签 可以-f 指定dockerfile文件名
[root@Docker-1 sshd]# docker build -t centos7:ssh .
# 查看镜像
[root@Docker-1 sshd]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
centos7 ssh a352567190a4 29 seconds ago 916MB
- 验证镜像可用
# 基于镜像创建容器
[root@Docker-1 ~]# docker run -d --name centos7-ssh -P centos7:ssh
[root@Docker-1 ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
946b6e54a06e centos7:ssh "/usr/sbin/sshd -D" 3 minutes ago Up 3 minutes 0.0.0.0:32769->22/tcp, :::32769->22/tcp centos7-ssh
[root@Docker-1 ~]# ssh localhost -p 32769
[root@946b6e54a06e ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.2 netmask 255.255.0.0 broadcast 172.17.255.255
ether 02:42:ac:11:00:02 txqueuelen 0 (Ethernet)
RX packets 47 bytes 6139 (5.9 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 28 bytes 4837 (4.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
构建 nginx 镜像
- 构建镜像
# 环境准备
[root@Docker-1 docker_work]# mkdir nginx
[root@Docker-1 docker_work]# cd nginx/
# 上传nginx源码包
[root@Docker-1 nginx]# ls
nginx-1.24.0.tar.gz
# 创建启动脚本
[root@Docker-1 nginx]# cat run.sh
#!/bin/bash
/usr/local/nginx/sbin/nginx
# 构建 dockerfile 文件
[root@Docker-1 nginx]# cat Dockerfile
#基于基础镜像
FROM centos:7
#用户信息
MAINTAINER this is nginx image <chen>
#添加环境包
RUN mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOSBase.repo.backup
RUN curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
RUN yum -y update
RUN yum -y install pcre-devel zlib-devel gcc gcc-c++ make
# 创建nginx用户，-M：不创建家目录 -s：指定登录的Shell
RUN useradd -M -s /sbin/nologin nginx
# 将 nginx 源码包解压并上传到容器指定路径
ADD nginx-1.24.0.tar.gz /usr/local/src
# 指定ADD的工作目录
WORKDIR /usr/local/src/nginx-1.24.0
# 编译配置
# 指定源码安装路径
# 指定运行用户
# 指定运行组
RUN ./configure \
--prefix=/usr/local/nginx \
--user=nginx \
--group=nginx \
--with-http_stub_status_module
# 编译并安装
RUN make && make install
ENV PATH /usr/local/nginx/sbin:$PATH
# 暴露nginx端口
EXPOSE 80
EXPOSE 443
RUN echo "daemon off;" >> /usr/local/nginx/conf/nginx.conf
# 添加运行启动脚本并赋予权限
ADD run.sh /run.sh
RUN chmod 755 /run.sh
CMD ["/run.sh"]
# 构建镜像
[root@Docker-1 nginx]# docker build -t centos:nginx .
# 创建容器
[root@Docker-1 nginx]# docker run -d --name nginx -P centos:nginx
[root@Docker-1 nginx]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
9d252ea68c0b centos:nginx "/run.sh" 25 seconds ago Up 24 seconds 0.0.0.0:32771->80/tcp, :::32771->80/tcp, 0.0.0.0:32770->443/tcp, :::32770->443/tcp nginx
- 访问页面验证
构建 tomcat 镜像
- 构建镜像
# 环境准备
[root@Docker-1 docker_work]# mkdir tomcat
[root@Docker-1 docker_work]# cd tomcat/
# 上传tomcat源码包
[root@Docker-1 tomcat]# ls
apache-tomcat-9.0.16.tar.gz jdk-8u291-linux-x64.tar.gz
# 构建dockerfile
[root@Docker-1 tomcat]# cat Dockerfile
# 基于基础镜像
FROM centos:7
# 基本信息
MAINTAINER this is tomcat image <chen>
# 将jdk包解压到容器，并指定工作路径
ADD jdk-8u291-linux-x64.tar.gz /usr/local
WORKDIR /usr/local/
# 指定环境变量
# JAVA_HOME：指定JAVA目录
# JAVA_BIN：指定JAVA命令目录
# JRE_HOME：指定JRE虚拟机目录
RUN mv jdk1.8.0_291 /usr/local/java
ENV JAVA_HOME /usr/local/java
ENV JAVA_BIN /usr/local/java/bin
ENV JRE_HOME /usr/local/java/jre
ENV PATH $PATH:/usr/local/java/bin:/usr/local/java/jre/bin
ENV CLASSPATH /usr/local/java/jre/bin:/usr/local/java/lib:/usr/local/java/jre/lib/charsets.jar
# 解压tomcat到容器，并指定工作路径
ADD apache-tomcat-9.0.16.tar.gz /usr/local
WORKDIR /usr/local/
# 重命名
RUN mv apache-tomcat-9.0.16 /usr/local/tomcat9
# 暴露tomcat端口
EXPOSE 8080
# 启动容器运行tomcat
ENTRYPOINT ["/usr/local/tomcat9/bin/catalina.sh","run"]
# 查看镜像
[root@Docker-1 tomcat]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
centos tomcat 70461ef4d3ae 13 seconds ago 953MB
# 创建容器
[root@Docker-1 tomcat]# docker run -d --name tomcat -P centos:tomcat
[root@Docker-1 tomcat]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d0e4c4cec8d7 centos:tomcat "/usr/local/tomcat9/…" 31 seconds ago Up 30 seconds 0.0.0.0:32772->8080/tcp, :::32772->8080/tcp tomcat
- 访问页面进行验证
docker registry 管理
华为云仓库
网址：https://console.huaweicloud.com/swr/
镜像中心
镜像中心提供的镜像名称格式：swr.{区域代码}.myhuaweicloud.com/library/{镜像名称}:{镜像标签}
示例：swr.cn-east-3.myhuaweicloud.com/library/nginx:latest
镜像加速
上传镜像
创建组织
上传镜像
阿里云仓库
网址：https://cr.console.aliyun.com/cn-hangzhou/instances
镜像中心
镜像加速
- 阿里镜像加速现已停用，无法加速
上传镜像
实例列表
命名空间
访问凭证
创建镜像仓库
上传镜像
registry 构建个人私有仓库
- 通过 docker 官方提供的 registry 镜像即可搭建本地私有仓库
- 搭建私有仓库需要在/etc/docker/daemon.json中添加 insecure-registries 记录，默认端口为 80
搭建私有仓库
# 使用 registry 镜像搭建私有仓库
[root@docker ~]# docker container run -d -p 5000:5000 --restart=always --name registry -v /registry:/var/lib/registry registry
# 添加 insecure-registries 记录，默认端口是 80
[root@docker ~]# cat /etc/docker/daemon.json
{
"insecure-registries": ["10.1.8.100:5000","registry.zhiqiang.cloud:5000"],
"registry-mirrors": [ "https://4ea231efcaa04848b052b78077895cd0.mirror.swr.myhuaweicloud.com" ]
}
# 重启服务
[root@docker ~]# systemctl restart docker
# 添加域名解析
[root@docker ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.1.8.100 registry.zhiqiang.cloud
推送镜像到私有仓库
# 给镜像打标签，这里需要与之前添加的记录一致
[root@docker ~]# docker image tag registry:latest registry.zhiqiang.cloud:5000/tools/registry
# 推送镜像至私有仓库
[root@docker ~]# docker image push registry.zhiqiang.cloud:5000/tools/registry
Using default tag: latest
The push refers to repository [registry.zhiqiang.cloud:5000/tools/registry]
9bcac7a87f86: Pushed
6eb5be4323de: Pushed
3311d1492d9c: Pushed
cff9b31ae282: Pushed
08000c18d16d: Pushed
latest: digest: sha256:09db43e63e872352b4de393a10ea05f18b075a1037c3da5ce168798ff0c05848 size: 1364
查看私有仓库镜像列表
# 查看私有仓库，格式不舒服
[root@docker ~]# curl -s registry.zhiqiang.cloud:5000/v2/_catalog
{"repositories":["tools/registry","tools/ubi8_sshd_httpd"]}
# 安装 yajl 使用标准化输出
[root@docker ~]# dnf -y install yajl
# 清晰明了
[root@docker ~]# curl -s registry.zhiqiang.cloud:5000/v2/_catalog | json_reformat
{
"repositories": [
"tools/registry",
"tools/ubi8_sshd_httpd"
]
}
# 查看私有仓库的 tags
[root@docker ~]# curl -s registry.zhiqiang.cloud:5000/v2/tools/registry/tags/list | json_reformat
{
"name": "tools/registry",
"tags": [
"latest"
]
}
从私有仓库下载镜像
[root@docker ~]# docker pull registry.zhiqiang.cloud:5000/tools/registry
Using default tag: latest
latest: Pulling from tools/registry
Digest: sha256:09db43e63e872352b4de393a10ea05f18b075a1037c3da5ce168798ff0c05848
Status: Downloaded newer image for registry.zhiqiang.cloud:5000/tools/registry:latest
registry.zhiqiang.cloud:5000/tools/registry:latest
配置优先从本地仓库下载
- 需在 cat /etc/docker/daemon.json 中的 registry-mirros 里面添加本地仓库加速即可从本地仓库下载
# 配置 registry-mirros
[root@docker ~]# cat /etc/docker/daemon.json
{
"insecure-registries": ["10.1.8.100:5000","registry.zhiqiang.cloud:5000"],
"registry-mirrors": [ "http://registry.zhiqiang.cloud:5000","https://4ea231efcaa04848b052b78077895cd0.mirror.swr.myhuaweicloud.com" ]
}
[root@docker ~]# systemctl restart docker
# 从本地拉取镜像
[root@docker ~]# docker pull tools/ubi8_sshd_httpd
Using default tag: latest
latest: Pulling from tools/ubi8_sshd_httpd
00bcf30019d4: Already exists
84e75432e519: Already exists
6b9728b96091: Already exists
Digest: sha256:3fae75f795375d40a3ca418bc399c16da063aae884026fed91c8667efdab0ad8
Status: Downloaded newer image for tools/ubi8_sshd_httpd:latest
docker.io/tools/ubi8_sshd_httpd:latest
删除私有仓库镜像
配置删除工具
- 删除私有仓库镜像需要下载相应工具
- 工具地址（需翻墙）：https://raw.githubusercontent.com/burnettk/delete-docker-registry-image/master/delete_docker_registry_image.py
# 下载工具
[root@docker ~]# wget https://raw.githubusercontent.com/burnettk/delete-docker-registry-image/master/delete_docker_registry_image.py
# 移动到执行目录并赋予执行权限
[root@docker ~]# mv delete_docker_registry_image.py /usr/local/bin/
[root@docker ~]# chmod +x /usr/local/bin/delete_docker_registry_image.py
# 下载 python 软件包
[root@docker ~]# dnf —y -install python3.11
# 创建软链接 python3 指向 python，或者直接修改配置文件
[root@docker ~]# ln -s /usr/bin/python3 /usr/bin/python
# 修改配置文件也可以
[root@docker ~]# cat /usr/local/bin/delete_docker_registry_image.py
# #!/usr/bin/env python 改成 #!/usr/bin/env python3
#!/usr/bin/env python3
# 设置 registry 仓库路径，/registry是创建registry容器时本地映射的路径，export是临时的，永久生效需要加到bashrc
[root@docker ~]# export REGISTRY_DATA_DIR=/registry/docker/registry/v2
删除私有仓库镜像
[root@docker ~]# delete_docker_registry_image -h
usage: delete_docker_registry_image [-h] -i IMAGE [-v] [-n] [-f] [-p] [-u]
Cleanup docker registry
optional arguments:
-h, --help show this help message and exit
-i IMAGE, --image IMAGE
Docker image to cleanup
-v, --verbose verbose
-n, --dry-run Dry run
-f, --force Force delete (deprecated)
-p, --prune Prune
-u, --untagged Delete all untagged blobs for image
# 删除本地镜像仓库
[root@docker ~]# delete_docker_registry_image.py -i tools/registry
INFO [2025-05-30 19:22:15,920] Deleting /registry/docker/registry/v2/blobs/sha256/e1/e1822bac1992d5c8ec6516886a75b7e6d3018ef07516b9e71fc2a6e1e53e709a
INFO [2025-05-30 19:22:15,920] Deleting /registry/docker/registry/v2/blobs/sha256/3d/3dec7d02aaeabc6faad1421be2570b4666be359853098ac7836ad0aa51b52d79
INFO [2025-05-30 19:22:15,920] Deleting /registry/docker/registry/v2/blobs/sha256/09/09db43e63e872352b4de393a10ea05f18b075a1037c3da5ce168798ff0c05848
INFO [2025-05-30 19:22:15,921] Deleting /registry/docker/registry/v2/blobs/sha256/e5/e5a9c19e7b9ded1170de9efd509fa08adaa16821aa7c17412b56416ffe0380f7
INFO [2025-05-30 19:22:15,921] Deleting /registry/docker/registry/v2/blobs/sha256/e8/e8a894506e86bf28b556f2981f5bdbfee8e689c04f636f7586de1a1cf619023b
INFO [2025-05-30 19:22:15,921] Deleting /registry/docker/registry/v2/blobs/sha256/b5/b5da7f963a9e69f979708ee8dd91417cd95926b746899f8f1962fd6fea44cb11
INFO [2025-05-30 19:22:15,922] Deleting /registry/docker/registry/v2/blobs/sha256/f1/f18232174bc91741fdf3da96d85011092101a032a93a388b79e99e69c2d5c870
INFO [2025-05-30 19:22:15,922] Deleting /registry/docker/registry/v2/repositories/tools/registry
# 查看仓库
[root@docker ~]# curl -s registry.zhiqiang.cloud:5000/v2/_catalog | json_reformat
{
"repositories": [
"tools/ubi8_sshd_httpd"
]
}
harbor 企业级私有仓库
Harbor 是 VMware 公司开源的企业级 Docker Registry 项目，其目标是帮助用户迅速搭建一个企业级的 Docker Registry 服务。
Harbor以 Docker 公司开源的 Registry 为基础，提供了图形管理 UI 、基于角色的访问控制(Role Based AccessControl) 、AD/LDAP 集成、以及审计日志(Auditlogging) 等企业用户需求的功能，同时还原生支持中文。
Harbor 的每个组件都是以 Docker 容器的形式构建的，使用 docker-compose 来对它进行部署。
用于部署 Harbor 的 docker-compose 模板位于 harbor/docker-compose.yml。
部署 harbor
- harbor：可以提供企业级私有仓库的部署
- harbor 下载地址：https://github.com/goharbor/harbor/releases
# 安装软件包
[root@docker ~]# wget https://github.com/docker/compose/releases/download/v2.10.2/harbor-offline-installer-v2.10.2.tgz
# 解压软件包，并导入harbor镜像
[root@docker ~]# tar -xf harbor-offline-installer-v2.10.2.tgz
[root@docker ~]# docker load -i harbor/harbor.v2.10.2.tar.gz
# 修改 harboryum.temp
# 修改 hostname 为自己的主机名
# 注释 https
# 修改 password 密码
[root@docker ~]# cat harbor/harbor.yml
......
hostname: registry.zhiqiang.cloud
......
# https related config
#https:
# # https port for harbor, default is 443
# port: 443
# # The path of cert and key files for nginx
# certificate: /your/certificate/path
# private_key: /your/private/key/path
# # enable strong ssl ciphers (default: false)
# # strong_ssl_ciphers: false
......
harbor_admin_password: 200308gzq.
......
# 将配置文件更名为 harbor.yml
[root@docker ~]# mv harbor/harbor.yml.tmpl harbor/harbor.cfg
# 执行 install.sh
[root@docker ~]# ./harbor/install.sh
-
验证访问是否成功 -
登录账户：admin -
登录密码：自己设置的密码
配置 harbor
创建用户
创建项目
添加用户
客户端配置
- 需要在仓库加速配置文件中添加insecure-registries
- 由于客户端和服务端在同一个服务器上，重启docker服务会影响harbor，此时重新执行 ./install.sh配置一次harbor
# 以下方法只能选择其中一个
# 添加仓库加速记录
[root@docker ~]# cat /etc/docker/daemon.json
{
"insecure- registries": ["10.1.8.100","registry.zhiqiang.cloud"],
"registry-mirrors": [ "http://registry.zhiqiang.cloud","https://4ea231efcaa04848b052b78077895cd0.mirror.swr.myhuaweicloud.com" ]
}
# 或者修改docker.service服务里面第13行
[root@Docker-2 ~]# cat /usr/lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd -H fd:// --insecure-registry 10.1.8.1 01 --containerd=/run/containerd/containerd.sock
[root@Docker-2 ~]# docker login -u jerry -p Gzq200308. http://10.1.8.101
测试 harbor
# 打标签 并推送
[root@docker ~]# docker tag registry:latest registry.zhiqiang.cloud/tools/registry
[root@docker ~]# docker push registry.zhiqiang.cloud/tools/registry
Using default tag: latest
The push refers to repository [registry.zhiqiang.cloud/tool/registry]
9bcac7a87f86: Mounted from tools/registry
6eb5be4323de: Mounted from tools/registry
3311d1492d9c: Mounted from tools/registry
cff9b31ae282: Mounted from tools/registry
08000c18d16d: Mounted from tools/registry
latest: digest: sha256:09db43e63e872352b4de393a10ea05f18b075a1037c3da5ce168798ff0c05848 size: 1364
# 拉取镜像
[root@docker ~]# docker pull registry.zhiqiang.cloud/tools/registry
Using default tag: latest
latest: Pulling from tools/registry
Digest: sha256:09db43e63e872352b4de393a10ea05f18b075a1037c3da5ce168798ff0c05848
Status: Downloaded newer image for registry.zhiqiang.cloud/tools/registry:latest
registry.zhiqiang.cloud/tools/registry:latest
卸载 habor
# 清理容器
[root@docker ~]# cd harbor
[root@docker harbor]# docker compose down
# 清理镜像
[root@docker harbor]# docker image rm `docker images | grep v2.10.2`
# 清理 harbor 使用的 /data 目录
[root@docker harbor]# rm -fr /data/
# 删除软件包
[root@docker harbor]# cd ..
[root@docker ~]# rm -fr harbor harbor-offline-installer-v2.10.2.tgz
01 --containerd=/run/containerd/containerd.sock
[root@Docker-2 ~]# docker login -u jerry -p Gzq200308. http://10.1.8.101
#### **测试 harbor**
```bash
# 打标签 并推送
[root@docker ~]# docker tag registry:latest registry.zhiqiang.cloud/tools/registry
[root@docker ~]# docker push registry.zhiqiang.cloud/tools/registry
Using default tag: latest
The push refers to repository [registry.zhiqiang.cloud/tool/registry]
9bcac7a87f86: Mounted from tools/registry
6eb5be4323de: Mounted from tools/registry
3311d1492d9c: Mounted from tools/registry
cff9b31ae282: Mounted from tools/registry
08000c18d16d: Mounted from tools/registry
latest: digest: sha256:09db43e63e872352b4de393a10ea05f18b075a1037c3da5ce168798ff0c05848 size: 1364
# 拉取镜像
[root@docker ~]# docker pull registry.zhiqiang.cloud/tools/registry
Using default tag: latest
latest: Pulling from tools/registry
Digest: sha256:09db43e63e872352b4de393a10ea05f18b075a1037c3da5ce168798ff0c05848
Status: Downloaded newer image for registry.zhiqiang.cloud/tools/registry:latest
registry.zhiqiang.cloud/tools/registry:latest
卸载 habor
# 清理容器
[root@docker ~]# cd harbor
[root@docker harbor]# docker compose down
# 清理镜像
[root@docker harbor]# docker image rm `docker images | grep v2.10.2`
# 清理 harbor 使用的 /data 目录
[root@docker harbor]# rm -fr /data/
# 删除软件包
[root@docker harbor]# cd ..
[root@docker ~]# rm -fr harbor harbor-offline-installer-v2.10.2.tgz
扫一扫
707
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
