1
2
3

#运行一个Ubuntu镜像，交互地连接到本地命令会话

docker run -i -t ubuntu /bin/bash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

 #安装依赖
yum install -y yum-utils device-mapper-persistent-data lvm2


 #设置repository
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo


 #安装Docker CE
yum install -y docker-ce

 #Docker安装但未启动，docker group会被创建，但没有用户添加到组中


 #在生产环境中，你可能需要安装特定版本的Docker CE，而不是最新版
yum list docker-ce --showduplicates | sort -r
yum search docker-ce --showduplicates


 #开启docker
systemctl start docker


 #测试docker
docker run hello-world

 #此命令下载一个测试image并将其运行到container中
 #Hello from Docker!

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

 #下载rpm包
https://download.docker.com/linux/centos/7/x86_64/stable/Packages/


 #安装
yum install -y /path/docker-cexxx.rpm


systemctl start docker

docker run hello-world

1
2
3
4
5
6

curl -fsSL get.docker.com -o get-docker.sh

sh get-docker.sh

 #手动添加group合user
usermod -aG docker your-user

1
2
3
4
5
6

yum remove docker-ce

 #默认文件
rm -rf /var/lib/docker

 #你还需要手动删除其它配置文件

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

docker --version


#查看详细信息
docker info


#测试安装工作是否正常
docker run hello-world


#查看镜像
docker image ls


#列出容器
docker container ls -all


#docker命令
docker
docker container --help

1

docker run hello-world

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# Use an official Python runtime as a parent image
FROM python:2.7-slim

# Set the working directory to /app
WORKDIR /app

# Copy the current directory contents into the container at /app
ADD . /app

# Install any needed packages specified in requirements.txt
RUN pip install --trusted-host pypi.python.org -r requirements.txt

# Make port 80 available to the world outside this container
EXPOSE 80

# Define environment variable
ENV NAME World

# Run app.py when the container launches
CMD ["python", "app.py"]

1
2

Flask
Redis

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

from flask import Flask
from redis import Redis, RedisError
import os
import socket

# Connect to Redis
redis = Redis(host="redis", db=0, socket_connect_timeout=2, socket_timeout=2)

app = Flask(__name__)

@app.route("/")
def hello():
    try:
        visits = redis.incr("counter")
    except RedisError:
        visits = "<i>cannot connect to Redis, counter disabled</i>"

    html = "<h3>Hello {name}!</h3>" \
           "<b>Hostname:</b> {hostname}<br/>" \
           "<b>Visits:</b> {visits}"
    return html.format(name=os.getenv("NAME", "world"), hostname=socket.gethostname(), visits=visits)

if __name__ == "__main__":
    app.run(host='0.0.0.0', port=80)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

#查看是否还在顶层
ls

Dockerfile		app.py			requirements.txt



#在此目录运行build命令，这将创建一个Docker image，用 -t 命名
docker build -t friendlyhello .


#查看你build的image
docker image ls

REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
friendlyhello       latest              b24e21d7645f        13 minutes ago      150MB


#运行APP
docker run -p 4000:80 friendlyhello


#测试
curl http://localhost:4000
links http://localhost:4000


#在后台运行
docker run -d -p 4000:80 friendlyhello


#查看容器
docker container ls

CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS                  NAMES
146662dca737        friendlyhello       "python app.py"     16 seconds ago      Up 16 seconds       0.0.0.0:4000->80/tcp   goofy_chaplygin


#停止
Ctrl + C
docker container stop docker-ID
docker container stop 146662dca737

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

docker login

docker login -u zhang21

#时候docker login认证过后，会有~/.docker/config.json文件，里面包含了docker认证信息
#k8s可使用此信息添加secret

cat ~/.docker/config.json
{
        "auths": {
                "https://index.docker.io/v1/": {
                        "auth": "base64encoding"
                }
        },
        "HttpHeaders": {
                "User-Agent": "Docker-Client/18.03.1-ce (linux)"
        }

1
2
3
4
5
6
7
8

docker tag image username/repository:tag

#例子
docker tag friendlyhello zhang/test:tag-test


#查看tag
docker images ls

1
2
3
4
5
6

#上传你标记了的image到repository
docker push username/repository:tag

docker push zhang21/test:tag-test

#完成后，此image便可以公开获取

1
2
3

docker run -p 4000:80 username/repository:tag

docker run -p 80:80 zhang21/test:tag-test

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

#从Dockerfile创建image
docker build -t image-name .

#运行image
docker run -p 4000:80 image-name

#后台运行
docker run -d -p 4000:80 image-name

#列出运行的容器
docker container ls
#列出所有容器，包括未运行
docker container ls -a

#优雅停止容器
docker container stop 容器ID
#强制停止
docker container kill 容器ID

#删除容器
docker container rm 容器ID
#删除所有容器
docker container rm $(docker container ls -a -q)

#列出镜像
docker image ls
#列出所有镜像
docker image ls -a

#删除镜像
docker image rm 镜像ID
#删除所有镜像
docker image rm $(docker image ls -a -q)

#登录
docker login

#标记
docker tag 镜像 username/repository:tag

#上传到注册表
docker push username/repository:tag

#从注册表拉取
docker run username/repository:tag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

version: "3"
services:
  web:
    # replace username/repo:tag with your name and image details
    image: username/repo:tag
    deploy:
      replicas: 5
      resources:
        limits:
          cpus: "0.1"
          memory: 50M
      restart_policy:
        condition: on-failure
    ports:
      - "80:80"
    networks:
      - webnet
networks:
  webnet:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

docker swarm init


#运行并设置APP名字
docker stack -c docker-compose.yml app-name

docker stack -c docker-compose.yml LoadBalance


#在一个主机上，单个服务栈通过部署的image运行5个container instance


#获取service ID
docker service ls

ID                  NAME                MODE                REPLICAS            IMAGE                   PORTS
3d1a48yse0t4        LoabBalance_web     replicated          5/5                 zhang21/test:tag-test   *:80->80/tcp


#查看服务中的任务
docker service ps app-name_web


docker container ls -q

#5个容器ID
c7ce0075890e
52ba026bf28c
6d4381be438f
bd297a42e89d
357b05cc38eb


#访问的时候容器ID会在此5个负载中变化

1
2
3
4
5
6
7
8

#app
docker stack rm app-name

docker stack rm LoadBalance


#swarm
docker swarm leave --force

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

#列出栈或APP
docker stack ls

#运行指定配置文件
docker stack deploy -c <composefile> <appname>

#列出与APP相关联的服务
docker service ls

#列出与APP相关联的任务
docker service ps <service>

#检查任务
docker inspect <task or container>

#列出容器ID
docker container ls -q

#除掉APP
docker stack rm <appname>

#从管理中除掉一个单一节点swarm
docker swarm leave --force

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

#CentOS7

#安装VirtualBox
wget https://download.virtualbox.org/virtualbox/5.2.8/VirtualBox-5.2-5.2.8_121009_el7-1.x86_64.rpm && yum install -y Virtual.xx.rpm


#安装docker-machine
 curl -L https://github.com/docker/machine/releases/download/v0.14.0/docker-machine-`uname -s`-`uname -m` >/tmp/docker-machine && install /tmp/docker-machine /usr/local/bin/docker-machine


#在BIOS中开启虚拟化支持

#在VMware中开启虚拟化支持(如果是VM)


docker-machine create --driver virtual myvm1
docker-machine create --driver virtual myvm2


#列出虚拟机
docker-machine ls

1
2
3
4
5
6
7
8

docker-machine ssh <swarm manager> "docker swarm init --advertise-assr <mananger-IP>"

#add worker
docker swarm jion --toker <token> <wroker-ip>:<port>


#添加manager
docker swarm join-token manaer

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

#初始化这台机器默认为manager
docker swarm init


#作为worker加入，ip是manager的
#以下信息会在manager初始化时生成
#注意防火墙，可能会阻碍加入

docker swarm join --toker <toker> <ip:port>
docker swarm join --token token-xxxxxxxxxxxxxxxxxx 172.16.129.150:2377


#查看swarm
docker node ls


#离开swarm
docker swarm leave

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

#在manager部署
docker stack deploy -c ./docker-compose.yml LoadBalance


docker service ls

docker stack ls


#注意node名
docker stack ps LoadBalance

ID                  NAME                IMAGE                   NODE                DESIRED STATE       CURRENT STATE             ERROR               PORTS
6nrn4mwc6pvt        LoadBalance_web.1   zhang21/test:tag-test   zhang22             Running             Preparing 2 minutes ago
bpssrnzesl7n        LoadBalance_web.2   zhang21/test:tag-test   zhang22             Running             Preparing 2 minutes ago
kmhd8p5wkc12        LoadBalance_web.3   zhang21/test:tag-test   zhang21             Running             Running 2 minutes ago
i0pkf4foms87        LoadBalance_web.4   zhang21/test:tag-test   zhang22             Running             Preparing 2 minutes ago
rvtpjk781frn        LoadBalance_web.5   zhang21/test:tag-test   zhang21             Running             Running 2 minutes ago


#分别访问个主机的IP
#创建的网络在它们之间共享并负载均衡
links ip1
links ip2

1

docker stack rm LoadBalance

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

version: "3"
services:
  web:
    # replace username/repo:tag with your name and image details
    image: username/repo:tag
    deploy:
      replicas: 5
      restart_policy:
        condition: on-failure
      resources:
        limits:
          cpus: "0.1"
          memory: 50M
    ports:
      - "80:80"
    networks:
      - webnet
  #可视化
  visualizer:
    image: dockersamples/visualizer:stable
    ports:
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    deploy:
      placement:
        constraints: [node.role == manager]
    networks:
      - webnet
networks:
  webnet:

1
2
3
4
5
6
7
8
9

docker stack deploy -c ./docker-compose2.yml stack-test

Creating network stack-test_webnet
Creating service stack-test_visualizer
Creating service stack-test_web


#查看visualizer，要等一会才能正常访问，别着急
访问 IP:8080

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

version: "3"
services:
  web:
    # replace username/repo:tag with your name and image details
    image: username/repo:tag
    deploy:
      replicas: 5
      restart_policy:
        condition: on-failure
      resources:
        limits:
          cpus: "0.1"
          memory: 50M
    ports:
      - "80:80"
    networks:
      - webnet
  visualizer:
    image: dockersamples/visualizer:stable
    ports:
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    deploy:
      placement:
        constraints: [node.role == manager]
    networks:
      - webnet
  redis:
    image: redis
    ports:
      - "6379:6379"
    volumes:
      - "/home/docker/data:/data"
    deploy:
      placement:
        constraints: [node.role == manager]
    command: redis-server --appendonly yes
    networks:
      - webnet
networks:
  webnet:




#部署
docker stack deploy -c docker-compose3.yml redis-test



#测试
访问 IP:port

1
2
3
4
5

docker node ls

docker service ls

docker service ps <service>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

systemctl stop docker
cd /etc/docker

vim daemon.json

{
	"graph": "/opt/docker"
}


systemctl start docker
#systemctl reload docker

#查看变更
docker info

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

systemctl stop docker
cd /etc/sysconfig/

vim docker-storage

DOCKER_STORAGE_OPTIONS=--graph=/opt/docker


systemctl start docker

#查看变更
docker info

1
2
3
4
5

docker run --restart=always -d -p 80:80 <container-id>

#对于已启动的容器服务，更新它
docker update --restart=always <container-id>

1
2
3
4

docker exec -it <container> /bin/bash

docker exec -it <container> /bin/sh

1
2
3

#centos:7
docker run -dit --privileged --name=centos7-systemd  centos:7 init

1
2
3
4
5
6
7
8
9

#查看本机docker iptabels rules
iptables-save

#我的一个hexo镜像
#-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 4000 -j ACCEPT


#再它在添加一个端口
iptables -t nat -A DOCKER ! -i dokcer0 -p tcp -m tcp --dport 56789 -j DNAT --to-destination 172.17.0.2:56789

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

Usage:  docker commit [OPTIONS] CONTAINER [REPOSITORY[:TAG]]

docker commit -m "Just a test" -p ${container-id} Zhang21/test:01
docker image ls
docker login
docker push




Usage:  docker save [OPTIONS] IMAGE [IMAGE...] [flags]

docker save -o /path/${image}.tar ${image}
ls /path

1
2
3
4

Usage:  docker load [OPTIONS]

docker load -i /path/${image}.tar
docker image ls

1
2
3
4
5

FROM nginx


#特殊镜像，scratch，空白镜像
FROM scratch

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

FROM debian:jessie


RUN apt-get update
RUN apt-get install -y gcc libc6-dev make
RUN wget -O redis.tar.gz "http://download.redis.io/releases/redis-3.2.5.tar.gz"
RUN mkdir -p /usr/src/redis
RUN tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1
RUN make -C /usr/src/redis
RUN make -C /usr/src/redis install

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

FROM debian:jessie

RUN buildDeps='gcc libc6-dev make' \
    && apt-get update \
    && apt-get install -y $buildDeps \
    && wget -O redis.tar.gz "http://download.redis.io/releases/redis-3.2.5.tar.gz" \
    && mkdir -p /usr/src/redis \
    && tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1 \
    && make -C /usr/src/redis \
    && make -C /usr/src/redis install \
    && rm -rf /var/lib/apt/lists/* \
    && rm redis.tar.gz \
    && rm -r /usr/src/redis \
    && apt-get purge -y --auto-remove $buildDeps

1
2
3
4
5
6
7

#docker build [OPTIONS] PATH | URL | - [flags]
#Build an image from a Dockerfile


#-t指定镜像名称
#.指的是上下文目录
docker build -t nginx:test .

1
2

#复制上下文目录下的package.json
COPY ./package.json /app/

1
2
3
4

#docker build URL

docker build https://github.com/twang2218/gitlab-ce-zh.git#:8.14
#docker会自己去clone、切换分支、并进入指定目录开始构建

1
2
3

docker build http://server/context.tar.gz

#自动下载/解压缩 压缩包，以其作为上下文，开始构建

1
2
3
4
5
6
7

docker build - < Dockerfile


cat Dockerfile | docker build -


docker build - < context.tar.gz

1
2
3
4
5
6

# Set multiple labels at once, using line-continuation characters to break long lines
LABEL vendor=ACME\ Incorporated \
      com.example.is-beta= \
      com.example.is-production="" \
      com.example.version="0.0.1-beta" \
      com.example.release-date="2015-02-12"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

COPY  <sourch>  <destination>

#或
COPY  ["<source1>", ... "<destination>"]


#栗子
COPY package.json /usr/src/app/
COPY hom* /mydir/
COPY hom?.txt /mydir/


#目录
COPY dir/ /dir/
#复制目录的错误用法
#COPY  dir/* /dir/

1
2
3
4
5
6
7
8

FROM scratch

ADD ADD http://foo.com/bar.go /tmp/main.go

ADD abc.tar.gz / && \
    http://example.com/big.tar.xz /usr/src/things/ && \
RUN tar -xJf /usr/src/things/big.tar.xz -C /usr/src/things
RUN make -C /usr/src/things all

1
2
3
4
5
6
7
8
9

CMD echo $HOME

#转变为
CMD["sh", "-c", "echo $HOME"]

#-c string If  the  -c option is present, then commands are read from string.


#这就是为什么我们可以使用环境变量的原因，因为这些环境变量会被 shell 进行解析处理

1

<ENTRYPOINT> "<CMD>"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#可以从腾讯上拉取，快一些
#ccr.ccs.tencentyun.com/qcloud/ubuntu

FROM ubuntu:16.04
RUN apt-get update \
    && apt-get install -y curl \
    && rm -rf /var/lib/apt/lists/*
CMD [ "curl", "-s", "http://ip.cn" ]


docker build -t myip
docker run myip
#当前 IP：182.150.x.xx 来自：四川省成都市 电信

1
2
3
4
5
6
7

docker run myip -i
#这样会报错，-i替换了CMD命令，而不是-s参数，然而-i并不是命令


#重新完整输入命令
docker run myip curl -s http://ip.cn -i
#这样又太麻烦

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

FROM ubuntu:16.04
RUN apt-get update \
    && apt-get install -y curl \
    && rm -rf /var/lib/apt/lists/*
ENTRYPOINT [ "curl", "-s", "http://ip.cn" ]


docker build it myip
docker run myip
#当前 IP：182.150.x.xx 来自：四川省成都市 电信


docker run myip -i
#成功

1
2
3
4

ENV PATH $PATH:/root/bin \
	EMAIL [email protected] \
	NAME="Zhang21"

1
2
3
4
5
6

#在运行时自动挂载为匿名卷
VOLUME /data


#覆盖挂载
docker run -d -v mydata:/data xxx

1
2

RUN groupadd -r group && \
	useradd -r -g group group

1
2

USER redis
RUN ["redis-server"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# syntax=docker/dockerfile:1

# stage build
FROM node:12.20.0-alpine as builder

WORKDIR /app

COPY package.json /app/

# 依赖缓存
RUN --mount=type=cache,target=/app/node_modules,id=app_cache \
    --mount=type=cache,target=/root/.npm,id=npm_cache \
    npm install --registry=https://registry.npm.taobao.org

COPY . /app/

RUN npm run build


# stage image
FROM nginx:1.20.0-alpine

COPY --from=builder /app/dist /usr/share/nginx/html

EXPOSE 80

1
2

# 参考: https://yeasy.gitbook.io/docker_practice/buildx/buildkit
DOCKER_BUILDKIT=1 docker build -t name:tag .

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# 开启此功能
export DOCKER_CLI_EXPERIMENTAL=enabled

# 需要使用qemu-user
# 注意内核版本，升级到5.x的内核大版本
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
docker buildx create --name builder --driver docker-container --use
docker buildx inspect --bootstrap


# arm64，--load存放本地
docker buildx build -t xxx:arm64-tag --load --platform linux/arm64 .
# amd64，--push推送
docker buildx build -t xxx:amd64-tag --push --platform linux/amd64 .

# 多平台
docker buildx build --platform linux/arm64,linux/amd64 -t user/test:latest --push .

1
2
3
4

FROM ubuntu:15.04
COPY . /app
RUN make /app
CMD python /app/app.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#local build-context
docker build -t . -f-<<EOF
FROM busybox
RUN echo "hello world"
COPY . /my-copied-files
EOF


#remote
docker build -t foo https://github.com/thajeztah/pgadmin4-docker.git -f-<<EOF
FROM busybox
COPY LICENSE config_local.py /usr/local/lib/python2.7/site-packages/pgadmin4/
EOF

1
2
3
4
5

vim ./dockerignore

file1
dir2
...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

FROM golang:1.9.2-alpine3.6 AS build

# Install tools required for project
# Run `docker build --no-cache .` to update dependencies
RUN apk add --no-cache git
RUN go get github.com/golang/dep/cmd/dep

# List project dependencies with Gopkg.toml and Gopkg.lock
# These layers are only re-built when Gopkg files are updated
COPY Gopkg.lock Gopkg.toml /go/src/project/
WORKDIR /go/src/project/
# Install library dependencies
RUN dep ensure -vendor-only

# Copy the entire project and build it
# This layer is rebuilt when a file changes in the project directory
COPY . /go/src/project/
RUN go build -o /bin/project

# This results in a single layer image
FROM scratch
COPY --from=build /bin/project /bin/project
ENTRYPOINT ["/bin/project"]
CMD ["--help"]

1
2
3
4
5
6

RUN apt-get update && apt-get install -y \
  bzr \
  cvs \
  git \
  mercurial \
  subversion

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

FROM golang:1.7.3
WORKDIR /go/src/github.com/alexellis/href-counter/
RUN go get -d -v golang.org/x/net/html
COPY app.go .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .

FROM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /root/
COPY --from=0 /go/src/github.com/alexellis/href-counter/app .
CMD ["./app"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

FROM golang:1.7.3 as builder
WORKDIR /go/src/github.com/alexellis/href-counter/
RUN go get -d -v golang.org/x/net/html
COPY app.go    .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .

FROM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /root/
COPY --from=builder /go/src/github.com/alexellis/href-counter/app .
CMD ["./app"]

1

docker build --target builder -t alexellis2/href-counter:latest .

1

COPY --from=nginx:latest /etc/nginx/nginx.conf /nginx.conf

1

go get github.com/docker/docker/client

1

pip install docker

1
2
3

import docker
client = docker.from_env()
print (client.containers.run("alpine", ["echo", "hello", "world"]))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

$ curl --unix-socket /var/run/docker.sock -H "Content-Type: application/json" \
  -d '{"Image": "alpine", "Cmd": ["echo", "hello world"]}' \
  -X POST http:/v1.24/containers/create
{"Id":"1c6594faf5","Warnings":null}

$ curl --unix-socket /var/run/docker.sock -X POST http:/v1.24/containers/1c6594faf5/start

$ curl --unix-socket /var/run/docker.sock -X POST http:/v1.24/containers/1c6594faf5/wait
{"StatusCode":0}

$ curl --unix-socket /var/run/docker.sock "http:/v1.24/containers/1c6594faf5/logs?stdout=1"
hello world

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

docker network create --help

#创建一个用户自定义桥接网络
#你还可以指定子网，范围，网关...
docker network creat ${name}

docker network creat my-net


#删除
docker network rm ${name}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#创建时
docker create --name my-nginx \
  --network my-net \
  --publish 8080:80 \
  nginx:latest


#运行中的容器
docker network connect my-net my-nginx


#断开连接
docker network disconnect my-net my-nginx

1
2
3
4
5
6
7

#配置Linux内核
sysctl net.ipv4.conf.all.forwarding=1

#修改iptables FORWARD默认策略
iptables -P FORWARD ACCEPT

#重启后无效，请写入配置文件

1
2
3
4
5
6
7
8
9

{
  "bip": "192.168.1.5/24",
  "fixed-cidr": "192.168.1.5/25",
  "fixed-cidr-v6": "2001:db8::/64",
  "mtu": 1500,
  "default-gateway": "10.20.1.1",
  "default-gateway-v6": "2001:db8:abcd::89",
  "dns": ["10.20.1.2","10.20.1.3"]
}

1
2
3
4
5
6
7
8

docker network create -d overlay my-overlay


#创建可供集群服务或独立容器与其它docker daemon上的独立容器进行通信
docker network create -d overlay --attachable my-attachable-overlay


#你可以指定IP地址范围，子网，网关...

1
2

#SWARM MODE OVERLAY NETWORKS AND STANDALONE CONTAINERS
 docker network create --opt encrypted --driver overlay --attachable my-attachable-multi-host-network

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

#显示详细信息
docker network inspect ingress

#移除现有网络
docker network rm ingress

#创建新网络 --ingress
docker network create \
  --driver overlay \
  --ingress \
  --subnet=10.11.0.0/16 \
  --gateway=10.11.0.2 \
  --opt com.docker.network.driver.mtu=1200 \
  my-ingress

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

1. 停止docker

2. 删除已存在的docker_gwbridge
ip link set docker_gwbridge doen
ip link del dev docker_gwbridge

3. 启动docker，但不加入或初始化集群

4. 创建docker_gwbridge
docker network create \
--subnet 10.11.0.0/16 \
--opt com.docker.network.bridge.name=docker_gwbridge \
--opt com.docker.network.bridge.enable_icc=false \
--opt com.docker.network.bridge.enable_ip_masquerade=true \
docker_gwbridge

5. 集群初始化或加入集群

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

docker networkcreate --driver macvlan \
  --subnet=172.16.86.0/24 \
  --gateway=172.16.86.1  \
  -o parent=eth0 pub_net


#--aux-addresses排除IP地址
docker networkcreate --driver macvlan \
  --subnet=172.16.86.0/24 \
  --gateway=172.16.86.1  \
  --aux-address="my-router=192.168.32.129" \
  -o parent=eth0 pub_net

1
2
3
4

docker network  create  --driver macvlan \
  --subnet=192.168.50.0/24 \
  --gateway=192.168.50.1 \
  -o parent=eth0.50 macvlan50

1
2
3
4
5
6

docker network create -d ipvlan \
  --subnet=192.168.210.0/24 \
  --subnet=192.168.212.0/24 \
  --gateway=192.168.210.254  \
  --gateway=192.168.212.254  \
  -o ipvlan_mode=l2 ipvlan210

1
2
3
4
5
6

docker network  create  -d macvlan \
  --subnet=192.168.216.0/24 --subnet=192.168.218.0/24 \
  --gateway=192.168.216.1  --gateway=192.168.218.1 \
  --subnet=2001:db8:abc8::/64 --gateway=2001:db8:abc8::10 \
  -o parent=eth0.218 \
  -o macvlan_mode=bridge macvlan216

1
2
3
4
5

$ docker run --rm -dit \
  --network none \
  --name no-net-alpine \
  alpine:latest \
  ash

1
2
3
4
5

docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
8d3b84bfe5a0        bridge              bridge              local
3579d63da633        host                host                local
f766b990db47        none                null                local

1
2

docker run -dit --name alpine1 alpine ash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

docker network inspect bridge


[
    {
        "Name": "bridge",
        "Id": "8d3b84bfe5a034c65d043af80976a1e6127011fc1ab312446252f562e221d351",
        "Created": "2018-05-24T18:38:35.538308064+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "893903129d869f384bd78d63a382f1c9527d6979be0a6cf3c13ea4f45a1554d6": {
                "Name": "hardcore_rosalind",
                "EndpointID": "515d1435470c9f72d3b07680515d9c503457b8eb5bcaaaa915bb53901eac9424",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

docker attach alpine1


/ # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
506: eth0@if507: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever


/ # ping -c 2 www.baidu.com
PING www.baidu.com (119.75.216.20): 56 data bytes
64 bytes from 119.75.216.20: seq=0 ttl=55 time=46.521 ms
64 bytes from 119.75.216.20: seq=1 ttl=55 time=45.189 ms

1
2
3
4

/ # ping -c 2 172.17.0.2
PING 172.17.0.2 (172.17.0.2): 56 data bytes
64 bytes from 172.17.0.2: seq=0 ttl=64 time=0.125 ms
64 bytes from 172.17.0.2: seq=1 ttl=64 time=0.075 ms

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

docker network create --driver bridge alpine-net


docket network ls
NETWORK ID          NAME                DRIVER              SCOPE
810fb1e02000        alpine-net          bridge              local
8d3b84bfe5a0        bridge              bridge              local
3579d63da633        host                host                local
f766b990db47        none                null                local

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

docker network inspect alpine-net

[
    {
        "Name": "alpine-net",
        "Id": "810fb1e020008c7c6598f3b830ca25896dde638b1190d383ee6a5214d284e77d",
        "Created": "2018-06-14T15:45:19.43941906+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {},
        "Labels": {}
    }
]

1
2
3
4
5
6

#alpine-net
docker run -dit --name alpine1 --network alpine-net alpine ash

#default bridge
docker run -dit --name alpine2 alpine ash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "8d3b84bfe5a034c65d043af80976a1e6127011fc1ab312446252f562e221d351",
        "Created": "2018-05-24T18:38:35.538308064+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "893903129d869f384bd78d63a382f1c9527d6979be0a6cf3c13ea4f45a1554d6": {
                "Name": "hardcore_rosalind",
                "EndpointID": "515d1435470c9f72d3b07680515d9c503457b8eb5bcaaaa915bb53901eac9424",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            },
            "e7472c3ddda5043bc03868f4bf7ed59562220f05772f02f57ff589d086630562": {
                "Name": "alpine2",
                "EndpointID": "ba565a247e347feb59713c188eb38e184d781da0489ae80e26ecad6d24e165c2",
                "MacAddress": "02:42:ac:11:00:03",
                "IPv4Address": "172.17.0.3/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]




docker network inspect alpine-net
[
    {
        "Name": "alpine-net",
        "Id": "810fb1e020008c7c6598f3b830ca25896dde638b1190d383ee6a5214d284e77d",
        "Created": "2018-06-14T15:45:19.43941906+08:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "264ccde8b1d5198551d689f0dd49ffbfb612255e0bf76c9543325d7c2e588acb": {
                "Name": "alpine1",
                "EndpointID": "563c48cc6b936bcd9d3f57e9bb5e162a8cb52a23c8980346f288d42cc9b0a8fc",
                "MacAddress": "02:42:ac:12:00:02",
                "IPv4Address": "172.18.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {},
        "Labels": {}
    }
]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

docker container attach alpine1

#网段内通
/ # ping -c 2 172.18.0.3
PING 172.18.0.1 (172.18.0.3): 56 data bytes
64 bytes from 172.18.0.3: seq=0 ttl=64 time=0.097 ms
64 bytes from 172.18.0.3: seq=1 ttl=64 time=0.070 ms

--- 172.18.0.1 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.070/0.083/0.097 ms


#网段外不通
/ # ping -c 2 172.17.0.2
PING 172.17.0.2 (172.16.0.1): 56 data bytes

--- 172.17.0.2 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss

1
2
3
4
5
6
7

docker network connect bridge apline1


/ # ping -c 2 172.17.0.2
PING 172.17.0.2 (172.17.0.2): 56 data bytes
64 bytes from 172.17.0.2: seq=0 ttl=64 time=0.102 ms
64 bytes from 172.17.0.2: seq=1 ttl=64 time=0.071 ms

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

#默认主机上的80端口
docker run -rm -dit --network host --name my_nginx nginx


#访问
http://localhost:80
Welcome to nginx!


docker network inspect host
[
    {
        "Name": "host",
        "Id": "3579d63da633adcc497417d39b8b1d270cf329a68b9222f6a75fae72086509d6",
        "Created": "2018-04-27T11:31:17.900886126+08:00",
        "Scope": "local",
        "Driver": "host",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": []
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "f02a3b11fce7228ad6ee196771bd9cf0b64966bfc2aa7c27719bc120dbdc7189": {
                "Name": "my_nginx",
                "EndpointID": "4ee67fb4d0a0c1a357b5fdd141f856a70c205fad5c49b1cb6a4f5245df0318a8",
                "MacAddress": "",
                "IPv4Address": "",
                "IPv6Address": ""
            }
        },
        "Options": {},
        "Labels": {}
    }
]

1
2
3
4
5
6
7
8
9

docker network ls


NETWORK ID          NAME                DRIVER              SCOPE
495c570066be        bridge              bridge              local
961c6cae9945        docker_gwbridge     bridge              local
ff35ceda3643        host                host                local
trtnl4tqnc3n        ingress             overlay             swarm
c8357deec9cb        none                null                local

1
2
3
4
5
6
7
8
9

docker network create -d overlay nginx-net


$ docker service create \
  --name my-nginx \
  --publish target=80,published=80 \
  --replicas=5 \
  --network nginx-net \
  nginx

1
2
3
4
5
6
7
8
9

docker network create -d overlay my-overlay


$ docker service create \
  --name my-nginx \
  --network my-overlay \
  --replicas 1 \
  --publish published=8080,target=80 \
  nginx:latest

1
2
3
4
5

$ docker network create -d macvlan \
  --subnet=172.16.86.0/24 \
  --gateway=172.16.86.1 \
  -o parent=eth0 \
  my-macvlan-net

1
2
3
4
5
6
7

docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
810fb1e02000        alpine-net          bridge              local
8d3b84bfe5a0        bridge              bridge              local
3579d63da633        host                host                local
6be80655739d        my-macvlan-net      macvlan             local
f766b990db47        none                null                local

1
2
3
4
5

$ docker run --rm -itd \
  --network my-macvlan-net \
  --name my-macvlan-alpine \
  alpine:latest \
  ash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

docker network inspect my-macvlan-net
[
    {
        "Name": "my-macvlan-net",
        "Id": "6be80655739deffe204e087d098f97fc75072d95f9818e129cfd7d5667ed01f3",
        "Created": "2018-06-14T16:52:30.507647877+08:00",
        "Scope": "local",
        "Driver": "macvlan",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.16.86.0/24",
                    "Gateway": "172.16.86.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "8301b669b4b63afb20911b46243f11b70e5a9d0880beaafa922b52bcb8ab0477": {
                "Name": "my-macvlan-alpine",
                "EndpointID": "4f2971ba4bd92c34e2a299d301f739867d2b1b65d35566aef07d7a26b079662c",
                "MacAddress": "02:42:ac:10:56:02",
                "IPv4Address": "172.16.86.2/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "parent": "ens160"
        },
        "Labels": {}
    }
]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

docker exec my-macvlan-alpine ip addr show eth0
517: eth0@if2: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UNKNOWN
    link/ether 02:42:ac:10:56:02 brd ff:ff:ff:ff:ff:ff
    inet 172.16.86.2/24 brd 172.16.86.255 scope global eth0
       valid_lft forever preferred_lft forever

docker exec my-macvlan-alpine ip route
default via 172.16.86.1 dev eth0
172.16.86.0/24 dev eth0 scope link  src 172.16.86.2

1
2
3
4
5

docker network create -d macvlan \
  --subnet=172.16.87.0/24 \
  --gateway=172.16.87.1 \
  -o parent=eth0.10 \
  my-8021q-macvlan-net

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

docker network ls

NETWORK ID          NAME                   DRIVER              SCOPE
2aeafd44fd67        my-8021q-macvlan-net   macvlan             local
6be80655739d        my-macvlan-net         macvlan             local



ifconfig
eth0.10: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::20c:29ff:feaa:7e75  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:aa:7e:75  txqueuelen 0  (Ethernet)

1
2
3
4
5

docker run --rm -itd \
  --network my-8021q-macvlan-net \
  --name my-second-macvlan-alpine \
  alpine:latest \
  ash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

docker network inspect my-8021q-macvlan-net
[
    {
        "Name": "my-8021q-macvlan-net",
        "Id": "2aeafd44fd67e6ee937c82788745b1d45fb291efd61f545537528eafdff94e3d",
        "Created": "2018-06-14T17:06:33.426800076+08:00",
        "Scope": "local",
        "Driver": "macvlan",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.16.87.0/24",
                    "Gateway": "172.16.87.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "90103673d94915c3c7fb572eec8bd97b2aee1c3dab877c598d0a62e6d797b06d": {
                "Name": "my-second-macvlan-alpine",
                "EndpointID": "5c93f2ea1d29150ee57f099d42fc8e04a571efd0d1273a4f6bed755dc34f2e54",
                "MacAddress": "02:42:ac:10:57:02",
                "IPv4Address": "172.16.87.2/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "parent": "ens160.10"
        },
        "Labels": {}
    }
]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

docker exec my-second-macvlan-alpine ip addr show eth0
519: eth0@if518: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UNKNOWN 
    link/ether 02:42:ac:10:57:02 brd ff:ff:ff:ff:ff:ff
    inet 172.16.87.2/24 brd 172.16.87.255 scope global eth0
       valid_lft forever preferred_lft forever


docker exec my-second-macvlan-alpine ip route
default via 172.16.87.1 dev eth0
172.16.87.0/24 dev eth0 scope link  src 172.16.87.2

1
2
3
4
5
6

/etc/docker/daemon.json

{
  "ipv6": true
}

1
2

iptables -I DOCKER-USER -m iprange -i ext_if ! --src-range 192.168.1.1-192.168.1.3 -j DROP

1
2
3
4

-p 8080:80
-p 192.168.1.100:8080:80
-p 8080:80/udp
-p 8080:80/tcp -p 8080:80/udp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

#指定运行网络
docker run xxx --network


#运行的容器连接到其它网络
docker network connect


#--ip，指定IP地址
docker network connect my-bridge --ip 172.18.0.111


#--hostname，指定主机名
docker run xxx --network xxx --hostname container-01

docker network connect my-bridge --hostname container-02

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

#DNS server
--dns

#DNS搜索域
--dns-search

#表示DNS选项值的键值对
--dns-opt

--hostname

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

{
 "proxies":
 {
   "default":
   {
     "httpProxy": "http://127.0.0.1:3001",
     "noProxy": "*.test.example.com,.example2.com"
   }
 }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

-v/--volume


#此选项更详细和简单
#如果你需要指定volume driver，请使用此flag
--mount

docker service create \
  --mount 'type=volume,src=<VOLUME-NAME>,dst=<CONTAINER-PATH>,volume-driver=local,volume-opt=type=nfs,volume-opt=device=<nfs-server>:<nfs-path>,"volume-opt=o=addr=<nfs-address>,vers=4,soft,timeo=180,bg,tcp,rw"'
  --name myservice \
  <IMAGE>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

docker volume create my-vol


docker volume ls
DRIVER              VOLUME NAME
local               my-vol


docker volume inspect my-vol
[
    {
        "CreatedAt": "2018-06-15T17:19:02+08:00",
        "Driver": "local",
        "Labels": {},
        "Mountpoint": "/opt/docker/volumes/my-vol/_data",
        "Name": "my-vol",
        "Options": {},
        "Scope": "local"
    }
]


docker volume rm my-vol

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

#--mount
docker run -d \
  --name devtest \
  --mount source=myvol2,target=/app \
  nginx:latest


#--volume
docker run -d \
  --name devtest \
  --volume myvol2:/app \
  nginx:latest

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

docker volume ls
DRIVER              VOLUME NAME
local               my-vol
local               myvol2


docker inspect devtest
#找到挂载
        "Mounts": [
            {
                "Type": "volume",
                "Name": "myvol2",
                "Source": "/opt/docker/volumes/myvol2/_data",
                "Destination": "/app",
                "Driver": "local",
                "Mode": "z",
                "RW": true,
                "Propagation": ""
            }
        ]

1
2
3
4
5

docker service create -d \
  --replicas=4 \
  --name devtest-service \
  --mount source=myvol2,target=/app \
  nginx:latest

1

docker plugin install --grant-all-permissions vieux/sshfs

1
2
3
4
5

#操作node2
docker volume create --driver vieux/sshfs \
  -o sshcmd=test@node2:/home/test \
  -o password=testpassword \
  sshvolume

1
2
3
4
5

docker run -d \
  --name sshfs-container \
  --volume-driver vieux/sshfs \
  --mount src=sshvolume,target=/app,volume-opt=sshcmd=test@node2:/home/test,volume-opt=password=testpassword \
  nginx:latest

1
2
3
4
5
6
7
8

#备份
docker run --rm --volumes-from dbstore -v $(pwd):/backup ubuntu tar cvf /backup/backup.tar /dbdata


#从备份还原
docker run -v /dbdata --name dbstore2 ubuntu /bin/bash
docker run --rm --volumes-from dbstore2 -v $(pwd):/backup ubuntu bash -c "cd /dbdata && tar xvf /backup/backup.tar --strip 1"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

#--mount
docker run -d \
  -it \
  --name devtest \
  --mount type=bind,source="$(pwd)"/target,target=/app \
  nginx:latest


#--volume
docker run -d \
  -it \
  --name devtest \
  -v "$(pwd)"/target:/app \
  nginx:latest

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

#--mount
docker run -d \
  -it \
  --name broken-container \
  --mount type=bind,source=/tmp,target=/usr \
  nginx:latest


#--volume
docker run -d \
  -it \
  --name broken-container \
  -v /tmp:/usr \
  nginx:latest

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

#--mount
docker run -d \
  -it \
  --name devtest \
  --mount type=bind,source="$(pwd)"/target,target=/app,readonly \
  nginx:latest


#--volume
docker run -d \
  -it \
  --name devtest \
  -v "$(pwd)"/target:/app:ro \
  nginx:latest

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

#--mount
docker run -d \
  -it \
  --name devtest \
  --mount type=bind,source="$(pwd)"/target,target=/app \
  --mount type=bind,source="$(pwd)"/target,target=/app2,readonly,bind-propagation=rslave \
  nginx:latest


#--volume
docker run -d \
  -it \
  --name devtest \
  -v "$(pwd)"/target:/app \
  -v "$(pwd)"/target:/app2:ro,rslave \
  nginx:latest

1
2
3
4
5
6

#不支持--mount
docker run -d \
  -it \
  --name devtest \
  -v "$(pwd)"/target:/app:z \
  nginx:latest

1
2
3
4

FROM ubuntu:15.04
COPY . /app
RUN make /app
CMD python /app/app.py

1
2
3
4
5
6

ls /var/lib/docker/aufs/layers

1d6674ff835b10f76e354806e16b950f91a191d3b471236609ab13a930275e24
5dbb0cbe0148cf447b9464a358c1587be586058d9a4c9ce079320265e2bb94e7
bef7199f2ed8e86fa4ada1309cfad3089e0542fec8894690529e4c04a7ca2d73
ebf814eccfe98f2704660ca1d844e4348db3b5ccc637eb905d4818fbfb00a06a

1
2
3
4
5

docker info


Server Version: 18.03.1-ce
Storage Driver: overlay2

1
2

grep aufs /proc/filesystems

1
2

docker info

1
2
3
4

vim /etc/docker/daemon.json

#或
--storage-driver

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

#loop-lvm模式
/etc/docker/daemon.json


{
  "storage-driver": "devicemapper"
}


#查看
docker info

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

#安装依赖
RHEL / CentOS: device-mapper-persistent-data, lvm2, and all dependencies
Ubuntu / Debian: thin-provisioning-tools, lvm2, and all dependencies


#创建物理卷(physical volume)
pvcreate /dev/cvdf


#创建卷组(volume group)
vgcreat docker /dev/xvdf


#创建逻辑卷(logical volume)
lvcreate --wipesignatures y -n thinpool docker -l 95%VG
lvcreate --wipesignatures y -n thinpoolmeta docker -l 1%VG


#转换卷为精简池
lvconvert -y \
--zero n \
-c 512K \
--thinpool docker/thinpool \
--poolmetadata docker/thinpoolmeta


#配置lvm配置文件精简池自动扩展
/etc/lvm/profile/docker-thinpool.profile


#指定thin_pool_autoextend_threshold 和 thin_pool_autoextend_percent的值
activation {
  thin_pool_autoextend_threshold=80
  thin_pool_autoextend_percent=20
}


#应用LVM profile
lvchange --metadataprofile docker-thinpool docker/thinpool


#启用监控LV
lvs -o+seg_monitor


#配置devicemapper存储驱动
/etc/docker/daemon.json
{
    "storage-driver": "devicemapper",
    "storage-opts": [
    "dm.thinpooldev=/dev/mapper/docker-thinpool",
    "dm.use_deferred_removal=true",
    "dm.use_deferred_deletion=true"
    ]
}


#查看
docker info

1
2
3
4
5
6
7

#查看LVM logs
journalctl -fu dm-event.service


pvdisplay
vgdisplay/vgextend
lvdisplay/lvextend/lvchange

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

vim /etc/docker/daemon.json


{
  "storage-driver": "vfs"
}



#控制大小
{
  "storage-opts": ["size=256M"]
}


#查看
docker info

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

#prune image
docker image prune
 docker image prune -a --filter "until=24h"


#prune container
docker container prune


#prune volume
docker volume prune
docker volume prune --filter "label!=keep"


#prune everything
docker system prune
docker system prune --volumes

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

#join
docker inspect --format '{{join .Args " , "}}' container


#json
docker inspect --format '{{json .Mounts}}' container


#lower
docker inspect --format "{{lower .Name}}" container


#split
docker inspect --format '{{split .Image ":"}}'


#title
docker inspect --format "{{title .Name}}" container


#upper
docker inspect --format "{{upper .Name}}" container


#printIn
docker inspect --format='{{range .NetworkSettings.Networks}}{{println .IPAddress}}{{end}}' container

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

/etc/docker/daemon.json

{
  "debug": true,
  "tls": true,
  "tlscert": "/var/docker/server.pem",
  "tlskey": "/var/docker/serverkey.pem",
  "hosts": ["tcp://192.168.59.3:2376"]
}


#或
dockerd --debug \
  --tls=true \
  --tlscert=/var/docker/server.pem \
  --tlskey=/var/docker/serverkey.pem \
  --host tcp://192.168.59.3:2376

1
2
3
4
5
6

cat /usr/lib/systemd/system/docker.service
#or
cat /etc/systemd/system/docker.service


systemctl enable/start/stop/status docker

1
2
3
4
5
6

vim /etc/docker/daemon.json

{
    "data-root": "/mnt/docker-data",
    "storage-driver": "overlay"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

mkdir -p /etc/systemd/system/docker.service.d


#/etc/systemd/system/docker.service.d/http-proxy.conf
[Service]
Environment="HTTP_PROXY=http://proxy.example.com:80/"

#/etc/systemd/system/docker.service.d/https-proxy.conf
[Service]
Environment="HTTPS_PROXY=https://proxy.example.com:443/"


systemctl daemon-reload
systemctl restart docker
systemctl show --property=Environment docker

1
2
3
4

{
  "metrics-addr" : "127.0.0.1:9323",
  "experimental" : true
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

/tmp/prometheus.yml


# my global config
global:
  scrape_interval:     15s # Set the scrape interval to every 15 seconds. Default is every 1 minute.
  evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
  # scrape_timeout is set to the global default (10s).

  # Attach these labels to any time series or alerts when communicating with
  # external systems (federation, remote storage, Alertmanager).
  external_labels:
      monitor: 'codelab-monitor'

# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.
rule_files:
  # - "first.rules"
  # - "second.rules"

# A scrape configuration containing exactly one endpoint to scrape:
# Here it's Prometheus itself.
scrape_configs:
  # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
  - job_name: 'prometheus'

    # metrics_path defaults to '/metrics'
    # scheme defaults to 'http'.

    static_configs:
      - targets: ['localhost:9090']

  - job_name: 'docker'
         # metrics_path defaults to '/metrics'
         # scheme defaults to 'http'.

    static_configs:
      - targets: ['localhost:9323']

1
2
3
4

docker service create --replicas 1 --name my-prometheus \
    --mount type=bind,source=/tmp/prometheus.yml,destination=/etc/prometheus/prometheus.yml \
    --publish published=9090,target=9090,protocol=tcp \
    prom/prometheus

1
2

#栗子
docker run -dit --restart unless-stopped redis

1
2
3
4
5

/etc/docker/daemon.json

{
  "live-restore": true
}

1

dockerd xxx --live-restore

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

vim my_wrapper.sh

#!/bin/bash
xxxxx
xxx


vim Dockerfile

FROM ubuntu:latest
COPY my_first_process my_first_process
COPY my_second_process my_second_process
COPY my_wrapper_script.sh my_wrapper_script.sh
CMD ./my_wrapper_script.sh

1
2
3
4
5
6
7

FROM ubuntu:latest
RUN apt-get update && apt-get install -y supervisor
RUN mkdir -p /var/log/supervisor
COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
COPY my_first_process my_first_process
COPY my_second_process my_second_process
CMD ["/usr/bin/supervisord"]

1
2
3
4
5

docker stats redis1 redis2

CONTAINER           CPU %               MEM USAGE / LIMIT     MEM %               NET I/O             BLOCK I/O
redis1              0.07%               796 KB / 64 MB        1.21%               788 B / 648 B       3.568 MB / 512 KB
redis2              0.07%               2.746 MB / 64 MB      4.29%               1.266 KB / 648 B    12.4 MB / 0 B

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

grep cgroup /proc/mounts

#or
mount -l | grep cgroup


#进程
/proc/<pid>/cgroup


#/表示进程尚未分配给group
cat /proc/1/cgroup
11:devices:/
10:cpuset:/
9:hugetlb:/
8:memory:/
7:blkio:/
6:net_prio,net_cls:/
5:pids:/
4:perf_event:/
3:cpuacct,cpu:/
2:freezer:/
1:name=systemd:/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

/sys/fs/cgroup/memory/docker/<docker-longid>/

cd /sys/fs/cgroup/memory/docker/893903129d869f384bd78d63a382f1c9527d6979be0a6cf3c13ea4f45a1554d6
cat memory.stat

cache 36282368
rss 196608
rss_huge 0
mapped_file 1077248
swap 0
pgpgin 212904
pgpgout 205531
pgfault 314692
pgmajfault 204
inactive_anon 131072
active_anon 65536
inactive_file 18223104
active_file 18059264
unevictable 0
hierarchical_memory_limit 9223372036854771712
hierarchical_memsw_limit 9223372036854771712
total_cache 36282368
total_rss 196608
total_rss_huge 0
total_mapped_file 1077248
total_swap 0
total_pgpgin 212904
total_pgpgout 205531
total_pgfault 314692
total_pgmajfault 204
total_inactive_anon 131072
total_active_anon 65536
total_inactive_file 18223104
total_active_file 18059264
total_unevictable 0



#其它信息类似

1
2
3
4

docker run --it --cpu-rt-runtime=950000 \
                  --ulimit rtprio=99 \
                  --cap-add=sys_nice \
                  debian:jessie

1
2
3
4
5
6

/etc/docker/daemon.json

#设置为syslog
{
  "log-driver": "syslog"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

/etc/docker/daemon.json

{
  "log-driver": "json-file",
  "log-opts": {
    "labels": "production_status",
    "env": "os,customer"
  }
}


#查看
docker info | grep 'Loggin Driver'
Logging Driver: json-file

1
2
3
4
5

docker run -it --log-driver none alpine ash


#查看容器日志驱动
docker inspect -f '{{.HostConfig.LogConfig.Type}}' <CONTAINER>

1

docker run -it --log-opt mode=non-blocking --log-opt max-buffer-size=4m alpine ping 127.0.0.1

1

docker run -dit --label production_status=testing -e os=ubuntu alpine sh

1
2
3

docker plugin install <org/image>

docker plugin ls

1
2
3
4
5

/etc/docker/daemon.josn


#or
--loggin-driver

1

docker run xxx --log-driver

1
2
3

docker run --log-driver=fluentd \
		  --log-opt fluentd-address=myhost.local:24224 \
		  --log-opt tag="mailer"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

{{.ID}}
The first 12 characters of the container ID


{{.FullID}}
The full container ID


{{.Name}}
The container name


{{.ImageID}}
The first 12 characters of the container’s image ID


{{.ImageFullID}}
The container’s full image ID


{{.ImageName}}
The name of the image used by the container


{{.DaemonName}}
The name of the docker program (docker)

1
2
3

--log-opt tag="{{.ImageName}}/{{.Name}}/{{.ID}}"

Aug  7 18:33:19 HOSTNAME hello-world/foobar/5790672ab6a0[9103]: Hello from Docker.

1
2
3

dockerd --log-driver=logentries

#可在docker.service中设置

1
2

docker run --log-driver=logentries ...

1
2

docker run --log-driver=logentries --log-opt logentries-token=abcd1234-12ab-34cd-5678-0123456789ab

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

/etc/docker/daemon.json

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m"
  }
}


#or
docker run \
      --log-driver json-file --log-opt max-size=10m \
      alpine echo hello world


#栗子
docker run -it --log-opt max-size=10m --log-opt max-file=3 alpine ash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

/etc/docker/daemon.json


{
  "log-driver": "gelf",
  "log-opts": {
    "gelf-address": "udp://1.2.3.4:12201"
  }
}


#or
dockerd --log-driver gelf –-log-opt gelf-address=udp://1.2.3.4:12201


#容器
docker run \
      --log-driver gelf –-log-opt gelf-address=udp://1.2.3.4:12201 \
      alpine echo hello world

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

/etc/docker/daemon.json


{
  "log-driver": "syslog",
  "log-opts": {
    "syslog-address": "udp://1.2.3.4:1111"
  }
}


#or
#syslog-address支持tcp和udp
docker run \
      -–log-driver syslog –-log-opt syslog-address=udp://1.2.3.4:1111 \
      alpine echo hello world

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

/etc/docker/daemon.json

{
   "log-driver": "fluentd",
   "log-opts": {
     "fluentd-address": "fluentdhost:24224"
   }
}


#or
docker run --log-driver=fluentd --log-opt fluentd-address=fluentdhost:24224
docker run --log-driver=fluentd --log-opt fluentd-address=tcp://fluentdhost:24224
docker run --log-driver=fluentd --log-opt fluentd-address=unix:///path/to/fluentd.sock

1
2
3
4
5
6
7
8
9

/etc/docker/daemon.json

{
  "log-driver": "journald"
}


#or
docker run --log-driver=journald ...

1
2
3
4
5
6

docker run --log-driver=journald \
    --log-opt labels=location \
    --log-opt env=TEST \
    --env "TEST=false" \
    --label location=west \
    your/application

1
2

journalctl CONTAINER_NAME=webserver
journalctl -o json CONTAINER_NAME=webserver

1
2
3
4
5
6
7
8
9

#python

import systemd.journal

reader = systemd.journal.Reader()
reader.add_match('CONTAINER_NAME=web')

for msg in reader:
    print '{CONTAINER_ID_FULL}: {MESSAGE}'.format(**msg)

1
2
3
4
5
6
7
8

sudo ls -l /proc/8734/ns
total 0
lrwxrwxrwx. 1 root root 0 4月  24 10:49 ipc -> ipc:[4026531839]
lrwxrwxrwx. 1 root root 0 4月  24 10:49 mnt -> mnt:[4026531840]
lrwxrwxrwx. 1 root root 0 4月  24 10:49 net -> net:[4026531956]
lrwxrwxrwx. 1 root root 0 4月  24 10:49 pid -> pid:[4026531836]
lrwxrwxrwx. 1 root root 0 4月  24 10:49 user -> user:[4026531837]
lrwxrwxrwx. 1 root root 0 4月  24 10:49 uts -> uts:[4026531838]