Docker學習筆記01-概述

Docker是什麼

Docker是一個開源的應用容器引擎，讓開發者能夠打包他們的應用以及依賴包到一個可移植的容器中，而後發佈到任何流行的Linux機器上，也能夠實現虛擬化。容器是徹底使用沙箱機制，相互之間不會有任何接口。

上面的描述引用自百度百科，簡單的來講Docker就是容器引擎，很是輕量，使用Docker能夠新建不少容器，且容器之間是徹底隔離互不干擾的，咱們能夠把咱們的應用打包成一個鏡像來實例化容器來運行應用

傳統部署方式的問題

• 運維工做量大：當咱們要部署應用的時候，首先須要不少臺服務器，例如要在web服務器上部署Apache、Nginx等應用，要在應用服務器上部署多個Tomcat、Jetty、Undertow等中間件，在數據庫服務器上部署Mysql、Redis等應用，以及還要部署各類Zookeeper、RabbitMQ等等應用，那運維就須要在這些服務器上安裝配置應用所須要的環境，並進行一系列的調試、檢查服務器之間的網絡鏈接等工做，這是很是麻煩且巨大的工做量
• 服務的擴展伸縮麻煩：並且隨着業務量的增大，須要增長服務器來作集羣，運維對於新增的服務器又須要進行配置與網絡調試，增長了重複的工做量，而當一些業務減小乃至廢棄後又會致使服務器閒置形成沒必要要的損失
• 服務的相互影響：當咱們在同一臺服務器上部署多個應用時，有時可能由於一些應用的出錯致使CPU、內存佔用太高，或是存在過多的日誌打印佔用了過多的磁盤空間致使磁盤緊張等一系列未知緣由致使服務器崩了，從而影響到這臺服務器上部署的全部應用

Docker部署方式的好處

• 減輕運維工做量：Docker使用鏡像來建立容器，鏡像就像是類，而一個容器就是類的一個具體實例化對象。所以建立容器只須要在Docker倉庫下載指定應用的鏡像，在這基礎上作屬於本身的定製
• 服務的彈性伸縮：Docker只須要新增服務器後建立容器就能實現快速擴展
• 服務相互不受影響：Docker容器使用沙箱機制，徹底隔離，每一個容器有分配的硬件資源，一個容器掛了不會影響到其餘容器，即便整個服務器掛了也能夠經過部署高可用的Docker集羣來解決

Docker的分層結構

Docker容器在本質上是宿主機上的一個進程，經過Bootfs和Rootfs加載系統內核與標準目錄，LXC技術來實現進程與資源的隔離，AUFS文件系統來分層並把不一樣物理位置的目錄合併到同一個目錄中，使得每一個容器感受就像一個獨立的操做系統

LXC爲Linux Container的簡寫，一種內核虛擬化技術，能夠提供輕量級的虛擬化，以便隔離進程和資源。且與宿主機使用同一個內核，性能損耗小
Bootfs爲Boot File System的簡寫，包含Boot loader和Kernel（內核），Bootloader主要引導加載Kernel, 整個內核加載進內存後，Bootfs會被卸載掉從而釋放出所佔用的內存
Rootfs爲Root File System的簡寫，包含典型的目錄結構，包括/dev、/proc、/bin、/etc等標準目錄和文件

對於不一樣的Linux發行版, Bootfs基本是一致的, 但Rootfs會有差異, 所以不一樣的發行版能夠公用Bootfs

鏡像的最底層是一個Base Image，提供了一個基本的操做系統環境，一般爲Linux發行版（即以Linux爲內核的系統）的鏡像，例如：Centos、Ubuntu等
能夠在Base Image的基礎上添加各類應用，例如Emacs編輯器、Apache服務器，上層的Image的父引用是下層的Image即依賴於下層的Image，鏡像層都是隻讀的，最上層是容器層，是可寫的

Docker的架構

Docker architecture

Docker uses a client-server architecture. The Docker client talks to the Docker daemon, which does the heavy lifting of building, running, and distributing your Docker containers. The Docker client and daemon can run on the same system, or you can connect a Docker client to a remote Docker daemon. The Docker client and daemon communicate using a REST API, over UNIX sockets or a network interface.

Docker使用客戶端-服務器架構。Docker客戶端與Docker守護進程進行對話，該守護進程負責構建、運行和分發Docker容器。Docker客戶端和守護進程能夠在同一個系統上運行，也能夠將Docker客戶端鏈接到遠程Docker守護進程。Docker客戶端和守護進程經過UNIX套接字或網絡接口使用REST API進行通訊。

Docker守護進程

The Docker daemon

The Docker daemon (dockerd) listens for Docker API requests and manages Docker objects such as images, containers, networks, and volumes. A daemon can also communicate with other daemons to manage Docker services.

Docker守護進程(dockerd)監聽Docker API請求，並管理Docker對象，如鏡像、容器、網絡和卷。守護進程還能夠與其餘守護進程通訊，以管理Docker服務。

Docker客戶端

The Docker client

The Docker client (docker) is the primary way that many Docker users interact with Docker. When you use commands such as docker run, the client sends these commands to dockerd, which carries them out. The docker command uses the Docker API. The Docker client can communicate with more than one daemon.

Docker客戶端(Docker)是許多Docker用戶與Docker交互的主要方式。當你使用諸如docker run之類的命令時，客戶端將這些命令發送給dockerd, dockerd執行這些命令。docker命令使用docker API。Docker客戶端能夠與多個守護進程通訊。

Docker註冊表

Docker registries

A Docker registry stores Docker images. Docker Hub and Docker Cloud are public registries that anyone can use, and Docker is configured to look for images on Docker Hub by default. You can even run your own private registry. If you use Docker Datacenter (DDC), it includes Docker Trusted Registry (DTR).

When you use the docker pull or docker run commands, the required images are pulled from your configured registry. When you use the docker push command, your image is pushed to your configured registry.

Docker store allows you to buy and sell Docker images or distribute them for free. For instance, you can buy a Docker image containing an application or service from a software vendor and use the image to deploy the application into your testing, staging, and production environments. You can upgrade the application by pulling the new version of the image and redeploying the containers.

Docker註冊表存儲Docker鏡像。Docker Hub和Docker Cloud是任何人均可以使用的公共註冊中心，Docker默認配置在Docker Hub上查找鏡像。你甚至能夠運行本身的私有註冊表。若是你使用Docker Datacenter (DDC)，它包括Docker可信註冊表(DTR)。
當你使用docker pull或docker run命令時，所需的鏡像將從配置的註冊表中拉取。當你使用docker push命令時，你的鏡像將被推到配置的註冊表中。
Docker商店容許你購買和出售Docker鏡像或免費分發。例如，你能夠從軟件供應商購買包含應用程序或服務的Docker鏡像，並使用該映像將應用程序部署到你的測試、演示和生產環境中。你能夠經過提取鏡像的新版本並從新部署容器來升級應用程序。

Docker對象

Docker objects

When you use Docker, you are creating and using images, containers, networks, volumes, plugins, and other objects. This section is a brief overview of some of those objects.

當你使用Docker時，你正在建立和使用鏡像、容器、網絡、卷、插件和其餘對象。本節簡要概述其中的一些對象。

鏡像

IMAGES

An image is a read-only template with instructions for creating a Docker container. Often, an image is based on another image, with some additional customization. For example, you may build an image which is based on the ubuntu image, but installs the Apache web server and your application, as well as the configuration details needed to make your application run.

You might create your own images or you might only use those created by others and published in a registry. To build your own image, you create a Dockerfile with a simple syntax for defining the steps needed to create the image and run it. Each instruction in a Dockerfile creates a layer in the image. When you change the Dockerfile and rebuild the image, only those layers which have changed are rebuilt. This is part of what makes images so lightweight, small, and fast, when compared to other virtualization technologies.

鏡像是具備建立Docker容器的指令的只讀模板。一般，一個鏡像基於另外一個鏡像，並進行一些額外的定製。例如，你能夠構建一個基於ubuntu鏡像的鏡像，在此基礎上定製安裝Apache web服務器和應用程序，以及使應用程序運行所需的配置。
你能夠建立本身的鏡像，也能夠只使用其餘人建立並在註冊表中發佈的鏡像。要構建本身的鏡像，須要建立一個Dockerfile，並使用簡單的語法定義建立和運行鏡像所需的步驟。Dockerfile中的每一個指令都在鏡像中建立一個層。當你更改Dockerfile並從新構建鏡像時，只會從新構建已更改的層。與其餘虛擬化技術相比，這是使映像如此輕量級、小型和快速的部分緣由。

容器

CONTAINERS

A container is a runnable instance of an image. You can create, start, stop, move, or delete a container using the Docker API or CLI. You can connect a container to one or more networks, attach storage to it, or even create a new image based on its current state.

By default, a container is relatively well isolated from other containers and its host machine. You can control how isolated a container’s network, storage, or other underlying subsystems are from other containers or from the host machine.

A container is defined by its image as well as any configuration options you provide to it when you create or start it. When a container is removed, any changes to its state that are not stored in persistent storage disappear.

Example docker run command

The following command runs an ubuntu container, attaches interactively to your local command-line session, and runs /bin/bash.

$ docker run -i -t ubuntu /bin/bash

When you run this command, the following happens (assuming you are using the default registry configuration):

1. If you do not have the ubuntu image locally, Docker pulls it from your configured registry, as though you had run docker pull ubuntu manually.
2. Docker creates a new container, as though you had run a docker container create command manually.
3. Docker allocates a read-write filesystem to the container, as its final layer. This allows a running container to create or modify files and directories in its local filesystem.
4. Docker creates a network interface to connect the container to the default network, since you did not specify any networking options. This includes assigning an IP address to the container. By default, containers can connect to external networks using the host machine’s network connection.
5. Docker starts the container and executes /bin/bash. Because the container is running interactively and attached to your terminal (due to the -i and -t flags), you can provide input using your keyboard while the output is logged to your terminal.
6. When you type exit to terminate the /bin/bash command, the container stops but is not removed. You can start it again or remove it.

容器是鏡像的可運行實例。你可使用Docker API或CLI建立、啓動、中止、移動或刪除容器。你能夠將容器鏈接到一個或多個網絡，將存儲附加到它，甚至能夠根據其當前狀態建立新的鏡像。
默認狀況下，容器與其餘容器及其主機相對獨立。你能夠控制容器的網絡、存儲或其餘底層子系統與其餘容器或主機的隔離程度。
容器是由它的鏡像以及在建立或啓動它時提供給它的任何配置選項定義的。當一個容器被刪除時，對其狀態的任何更改都不會被存儲在持久性存儲中。

演示docker命令：
下面的命令運行ubuntu容器，交互地鏈接到本地命令行會話，而後運行/bin/bash
$ docker run -i -t ubuntu /bin/bash
當你運行此命令時，會發生如下狀況(假設你正在使用默認的註冊表配置)

1. 若是你沒有本地的ubuntu鏡像，Docker會從你配置的註冊表中提取它，就像你已經手動運行Docker同樣。
2. Docker建立一個新的容器，就好像你已經手動運行了Docker容器建立命令同樣。
3. Docker將一個讀寫文件系統分配給容器，做爲它的最後一層。這容許運行的容器在其本地文件系統中建立或修改文件和目錄。
4. Docker建立一個網絡接口，將容器鏈接到默認網絡，由於你沒有指定任何網絡選項。這包括爲容器分配IP地址。默認狀況下，容器可使用主機的網絡鏈接鏈接到外部網絡。
5. Docker啓動容器並執行/bin/bash開啓容器內的終端。
6. 輸入exit以終止/bin/bash命令，容器中止，但未被刪除。您能夠從新啓動或刪除它。

服務

SERVICES

Services allow you to scale containers across multiple Docker daemons, which all work together as a swarm with multiple managers and workers. Each member of a swarm is a Docker daemon, and the daemons all communicate using the Docker API. A service allows you to define the desired state, such as the number of replicas of the service that must be available at any given time. By default, the service is load-balanced across all worker nodes. To the consumer, the Docker service appears to be a single application. Docker Engine supports swarm mode in Docker 1.12 and higher.

服務容許你跨多個Docker守護進程擴展容器，這些守護進程都做爲一個集羣與多個管理人員和工做人員一塊兒工做。羣集的每一個成員都是Docker守護進程，守護進程都使用Docker API進行通訊。服務容許你定義所需的狀態，例如在任何給定時間必須可用的服務的副本數量。默認狀況下，服務是跨全部worker節點的負載均衡。對於使用者來講，Docker服務彷佛是一個單獨的應用程序。Docker 1.12和更高的版本支持集羣模式。

參考文章

http://www.uml.org.cn/pzgl/20...
https://www.cnblogs.com/sammy...
https://docs.docker.com/engin...