編輯/etc/yum.repos.d/docker.repo增長如下內容:html
[docker] name=docker enabled=1 baseurl=https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/7/x86_64/stable/ gpgcheck=0 enabled=1
執行安裝:node
[root@nfs yum.repos.d]# yum install -y docker-ce
安裝結果:linux
Total 2.3 MB/s | 35 MB 00:00:14 Running transaction check Running transaction test Transaction test succeeded Running transaction Warning: RPMDB altered outside of yum. Installing : pigz-2.3.4-1.el7.x86_64 1/3 Installing : 2:container-selinux-2.55-1.el7.noarch 2/3 setsebool: SELinux is disabled. Installing : docker-ce-18.03.1.ce-1.el7.centos.x86_64 3/3 Verifying : docker-ce-18.03.1.ce-1.el7.centos.x86_64 1/3 Verifying : 2:container-selinux-2.55-1.el7.noarch 2/3 Verifying : pigz-2.3.4-1.el7.x86_64 3/3 Installed: docker-ce.x86_64 0:18.03.1.ce-1.el7.centos Dependency Installed: container-selinux.noarch 2:2.55-1.el7 pigz.x86_64 0:2.3.4-1.el7 Complete!
啓用服務:nginx
[root@nfs ~]# systemctl start docker
[root@nfs ~]# docker version Client: #客戶端版本 Version: 18.03.1-ce API version: 1.37 Go version: go1.9.5 Git commit: 9ee9f40 Built: Thu Apr 26 07:20:16 2018 OS/Arch: linux/amd64 Experimental: false Orchestrator: swarm Server: #服務端版本 Engine: Version: 18.03.1-ce API version: 1.37 (minimum version 1.12) Go version: go1.9.5 Git commit: 9ee9f40 Built: Thu Apr 26 07:23:58 2018 OS/Arch: linux/amd64 Experimental: false
查看更多信息:太長,有空了再翻譯web
[root@nfs ~]# docker info Containers: 0 Running: 0 Paused: 0 Stopped: 0 Images: 0 Server Version: 18.03.1-ce Storage Driver: overlay2 Backing Filesystem: extfs Supports d_type: true Native Overlay Diff: true Logging Driver: json-file Cgroup Driver: cgroupfs Plugins: #插件 Volume: local #本地卷 Network: bridge host macvlan null overlay #支持的網絡類型:bridge host macvlan(藉助mac技術構建的vlan) null overlay(疊加網絡) Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog Swarm: inactive Runtimes: runc Default Runtime: runc Init Binary: docker-init containerd version: 773c489c9c1b21a6d78b5c538cd395416ec50f88 runc version: 4fc53a81fb7c994640722ac585fa9ca548971871 init version: 949e6fa Security Options: seccomp Profile: default Kernel Version: 3.10.0-862.3.3.el7.x86_64 Operating System: CentOS Linux 7 (Core) OSType: linux Architecture: x86_64 CPUs: 4 Total Memory: 7.622GiB Name: nfs.lxk.com ID: KXW3:MYH3:A64H:7GZX:WEHB:AN7I:MM77:RNBO:QSXN:QCKI:HU6P:5SPI Docker Root Dir: /var/lib/docker Debug Mode (client): false Debug Mode (server): false Registry: https://index.docker.io/v1/ Labels: Experimental: false Insecure Registries: 127.0.0.0/8 Live Restore Enabled: false
查看命令幫助:docker
[root@nfs ~]# docker -h Flag shorthand -h has been deprecated, please use --help Usage: docker COMMAND A self-sufficient runtime for containers Options: --config string Location of client config files (default "/root/.docker") -D, --debug Enable debug mode -H, --host list Daemon socket(s) to connect to -l, --log-level string Set the logging level ("debug"|"info"|"warn"|"error"|"fatal") (default "info") --tls Use TLS; implied by --tlsverify --tlscacert string Trust certs signed only by this CA (default "/root/.docker/ca.pem") --tlscert string Path to TLS certificate file (default "/root/.docker/cert.pem") --tlskey string Path to TLS key file (default "/root/.docker/key.pem") --tlsverify Use TLS and verify the remote -v, --version Print version information and quit Management Commands: config Manage Docker configs container Manage containers image Manage images network Manage networks node Manage Swarm nodes plugin Manage plugins secret Manage Docker secrets service Manage services swarm Manage Swarm system Manage Docker trust Manage trust on Docker images volume Manage volumes
登陸阿里雲 --> 容器服務 --> 市場 --> 鏡像 --> 容器鏡像控制檯 --> 鏡像加速器
在鏡像加速器下會看到專屬加速器地址。shell
[root@nfs ~]# mkdir -p /etc/docker [root@nfs ~]# tee /etc/docker/daemon.json <<-'EOF' > { > "registry-mirrors": ["https://bugdjqkt.mirror.aliyuncs.com"] > } > EOF { "registry-mirrors": ["https://bugdjqkt.mirror.aliyuncs.com"] } [root@nfs ~]# cat /etc/docker/daemon.json { "registry-mirrors": ["https://bugdjqkt.mirror.aliyuncs.com"] } [root@nfs ~]# systemctl daemon-reload [root@nfs ~]# systemctl restart docker [root@nfs ~]# echo $? 0
注意:若是開了代理可能會影響下載鏡像json
docker pull 用法:後端
[root@nfs ~]# docker pull -h Flag shorthand -h has been deprecated, please use --help Usage: docker pull [OPTIONS] NAME[:TAG|@DIGEST] Pull an image or a repository from a registry Options: -a, --all-tags Download all tagged images in the repository --disable-content-trust Skip image verification (default true)
示例:centos
[root@nfs ~]# docker pull busybox #默認下載TAG爲latest的 Using default tag: latest latest: Pulling from library/busybox 07a152489297: Pull complete Digest: sha256:141c253bc4c3fd0a201d32dc1f493bcf3fff003b6df416dea4f41046e0f37d47 Status: Downloaded newer image for busybox:latest [root@nfs ~]# docker pull httpd:2.4 #下載latest爲2.4的httpd 2.4: Pulling from library/httpd 3d77ce4481b1: Pull complete 73674f4d9403: Pull complete d266646f40bd: Pull complete ce7b0dda0c9f: Pull complete 01729050d692: Pull complete 014246127c67: Pull complete 7cd2e04cf570: Pull complete Digest: sha256:72f2b4aa99235509146bd12054d1a93c1c869ba60212d21729118c93ca4305d3 Status: Downloaded newer image for httpd:2.4
查看已經下載的Dockerfile:
[root@nfs ~]# docker images -a REPOSITORY TAG IMAGE ID CREATED SIZE nginx latest cd5239a0906a 2 weeks ago 109MB busybox latest 8c811b4aec35 4 weeks ago 1.15MB httpd 2.4 fb2f3851a971 8 weeks ago 178MB hello-world latest e38bc07ac18e 2 months ago 1.85kB
docker run 參數:
--name string Assign a name to the container #給建立的container分配一個名字 --rm Automatically remove the container when it exits #當container退出時就自動刪除 有可能與-it相沖突 -i, --interactive Keep STDIN open even if not attached #始終打開交互式界面 -t, --tty Allocate a pseudo-TTY #分配一個終端 --ip string IPv4 address (e.g., 172.30.100.104) #指定IPv4地址,只支持用戶自定義的網絡 -d, --detach Run container in background and print container ID #在後臺運行並打印出container的ID
建立一個Container
[root@nfs ~]# docker run --name a1 -it alpine / # ifconfig eth0 Link encap:Ethernet HWaddr 02:42:AC:11:00:02 inet addr:172.17.0.2 Bcast:172.17.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:6 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:508 (508.0 B) TX bytes:0 (0.0 B) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) / # ping -c 1 -w 1 www.baidu.com PING www.baidu.com (61.135.169.125): 56 data bytes 64 bytes from 61.135.169.125: seq=0 ttl=54 time=21.822 ms --- www.baidu.com ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max = 21.822/21.822/21.822 ms / #
切換到另外一tty查看當前正在運行的Container
[root@nfs ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 01a889819374 alpine "/bin/sh" 44 minutes ago Up 29 seconds a1
當退出Container以後,查看當前主機上的Container須要加-a選項
[root@nfs ~]# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 01a889819374 alpine "/bin/sh" About an hour ago Up 5 minutes a1 42573024611c hello-world "/hello" About an hour ago Exited (0) About an hour ago sad_dubinsky 99b8f22ed189 hello-world "/hello" About an hour ago Exited (0) About an hour ago stupefied_keldysh
當前終端和docker終端創建鏈接:docker attach命令
[root@nfs ~]# docker attach --help Usage: docker attach [OPTIONS] CONTAINER Attach local standard input, output, and error streams to a running container Options: --detach-keys string Override the key sequence for detaching a container --no-stdin Do not attach STDIN --sig-proxy Proxy all received signals to the process (default true)
啓動a1再與之創建聯繫
[root@nfs ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES [root@nfs ~]# docker start a1 #啓用名爲a1的Container a1 [root@nfs ~]# docker ps #查看當前運行的Container CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 01a889819374 alpine "/bin/sh" About an hour ago Up 3 seconds a1 [root@nfs ~]# docker attach a1 #與a1創建聯繫 / # exit #退出a1 [root@nfs ~]# docker attach a1 #與a1創建聯繫,提示須要先start You cannot attach to a stopped container, start it first [root@nfs ~]# docker start a1 #啓動a1 a1 [root@nfs ~]# docker attach a1 #與a1創建聯繫 / #
Container創建以後會自動建立一個網卡
vethc37c497: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet6 fe80::d07b:57ff:fe94:7191 prefixlen 64 scopeid 0x20<link> ether d2:7b:57:94:71:91 txqueuelen 0 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 8 bytes 648 (648.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
刪除容器(不會刪除鏡像文件)
[root@nfs ~]# docker rm --help Usage: docker rm [OPTIONS] CONTAINER [CONTAINER...] Remove one or more containers Options: -f, --force Force the removal of a running container (uses SIGKILL) -l, --link Remove the specified link -v, --volumes Remove the volumes associated with the container
例:刪除名爲a1的容器
[root@nfs ~]# docker rm a1 a1 [root@nfs ~]# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 42573024611c hello-world "/hello" 5 hours ago Exited (0) 5 hours ago sad_dubinsky 99b8f22ed189 hello-world "/hello" 5 hours ago Exited (0) 5 hours ago stupefied_keldysh
下載一個nginx鏡像
啓動nginx容器:
[root@nfs ~]# docker run --name ngx1 -d nginx # -d :啓動爲後臺進程,不會佔據當前終端 936b5ecac0abdaa9009694029cf946a05282281fcdc507ccb62c1d6566a6a885
查看正在運行的容器
[root@nfs ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 936b5ecac0ab nginx "nginx -g 'daemon of…" 52 seconds ago Up 51 seconds 80/tcp ngx1
docker inspect:查看docker對象底層信息
可經過JSON格式返回docker對象的屬性
[root@nfs ~]# docker inspect --help Usage: docker inspect [OPTIONS] NAME|ID [NAME|ID...] Return low-level information on Docker objects Options: -f, --format string Format the output using the given Go template #只看對應格式信息 -s, --size Display total file sizes if the type is container --type string Return JSON for specified type
查看ngx1的底層信息:
[root@nfs ~]# docker inspect ngx1 [ { "Id": "936b5ecac0abdaa9009694029cf946a05282281fcdc507ccb62c1d6566a6a885", "Created": "2018-06-26T14:02:22.260021481Z", "Path": "nginx", "Args": [ "-g", "daemon off;" ], "State": { "Status": "running", "Running": true, "Paused": false, "Restarting": false, "OOMKilled": false, "Dead": false, "Pid": 6759, "ExitCode": 0, "Error": "", ……如下省略
查看鏡像文件信息:
[root@nfs ~]# docker inspect nginx:latest [ { "Id": "sha256:cd5239a0906a6ccf0562354852fae04bc5b52d72a2aff9a871ddb6bd57553569", "RepoTags": [ "nginx:latest" ], "RepoDigests": [ "nginx@sha256:3e2ffcf0edca2a4e9b24ca442d227baea7b7f0e33ad654ef1eb806fbd9bedcf0" ], "Parent": "", "Comment": "", "Created": "2018-06-05T18:20:14.421990858Z", "Container": "d2bbdbfdb590190edd92eadc4ef8a0453986e63da5f5853e451121df7da73668", "ContainerConfig": { "Hostname": "d2bbdbfdb590", "Domainname": "", "User": "", "AttachStdin": false, "AttachStdout": false, "AttachStderr": false, "ExposedPorts": { "80/tcp": {} ……如下省略
查看nginx鏡像文件的信息:
#查看一級配置段 [root@nfs ~]# docker inspect -f {{.RepoTags}} nginx:latest [nginx:latest] [root@nfs ~]# docker inspect -f {{.Metadata}} nginx:latest {0001-01-01 00:00:00 +0000 UTC} #查看二級配置段 [root@nfs ~]# docker inspect -f {{.ContainerConfig.Hostname}} nginx:latest d2bbdbfdb590 #查看三級配置段 [root@nfs ~]# docker inspect -f {{.GraphDriver.Data.WorkDir}} nginx:latest /var/lib/docker/overlay2/e2c4a62d73120b51c3f30247eb79a7b3b3419bd1fec68723b16006de455c049b/work
Run a command in a running containeer
在運行中的container中運行命令
[root@nfs ~]# docker exec --help Usage: docker exec [OPTIONS] CONTAINER COMMAND [ARG...] Run a command in a running container Options: -d, --detach Detached mode: run command in the background --detach-keys string Override the key sequence for detaching a container -e, --env list Set environment variables -i, --interactive Keep STDIN open even if not attached --privileged Give extended privileges to the command -t, --tty Allocate a pseudo-TTY -u, --user string Username or UID (format: <name|uid>[:<group|gid>]) -w, --workdir string Working directory inside the container
查看container中nginx的配置文件,可在exec的幫助下啓動一個shell進程
[root@nfs ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 936b5ecac0ab nginx "nginx -g 'daemon of…" 30 minutes ago Up 30 minutes 80/tcp ngx1 [root@nfs ~]# docker exec -it ngx1 /bin/sh # hostname 936b5ecac0ab #此處主機名與docker ps中的主機名一致 # exit #退出以後不會關閉Container,只是退出當前交互式界面。 [root@nfs ~]# docker ps #查看當前運行的Container CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 936b5ecac0ab nginx "nginx -g 'daemon of…" 31 minutes ago Up 31 minutes 80/tcp ngx1
運行命令並退出
[root@nfs ~]# docker exec ngx1 hostname 936b5ecac0ab
[root@nfs ~]# docker logs --help Usage: docker logs [OPTIONS] CONTAINER Fetch the logs of a container Options: --details Show extra details provided to logs -f, --follow Follow log output --since string Show logs since timestamp (e.g. 2013-01-02T13:23:37) or relative (e.g. 42m for 42 minutes) --tail string Number of lines to show from the end of the logs (default "all") -t, --timestamps Show timestamps --until string Show logs before a timestamp (e.g. 2013-01-02T13:23:37) or relative (e.g. 42m for 42 minutes)
容器內日誌記錄位置:
都是連接文件,連接至stdout和stderr
[root@nfs ~]# docker exec -it ngx1 /bin/sh # ls -l /var/log/nginx/ total 0 lrwxrwxrwx 1 root root 11 Jun 5 18:20 access.log -> /dev/stdout lrwxrwxrwx 1 root root 11 Jun 5 18:20 error.log -> /dev/stderr
爲運行nginx的Container生成一條訪問日誌並查看:
#查看ngx1的IP地址 [root@nfs ~]# docker inspect ngx1 -f {{.NetworkSettings.IPAddress}} 172.17.0.2 [root@nfs ~]# curl 172.17.0.2 <!DOCTYPE html> <html> <head> <title>Welcome to nginx!</title> <style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; } </style> </head> <body> <h1>Welcome to nginx!</h1> <p>If you see this page, the nginx web server is successfully installed and working. Further configuration is required.</p> <p>For online documentation and support please refer to <a href="http://nginx.org/">nginx.org</a>.<br/> Commercial support is available at <a href="http://nginx.com/">nginx.com</a>.</p> <p><em>Thank you for using nginx.</em></p> </body> </html> [root@nfs ~]# curl -I 172.17.0.2 HTTP/1.1 200 OK Server: nginx/1.15.0 Date: Tue, 26 Jun 2018 14:44:30 GMT Content-Type: text/html Content-Length: 612 Last-Modified: Tue, 05 Jun 2018 12:00:18 GMT Connection: keep-alive ETag: "5b167b52-264" Accept-Ranges: bytes [root@nfs ~]# docker logs ngx1 #查看名爲ngx1的Container的訪問日誌 172.17.0.1 - - [26/Jun/2018:14:44:20 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.29.0" "-" 172.17.0.1 - - [26/Jun/2018:14:44:30 +0000] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.29.0" "-"
[root@nfs ~]# docker stats --help Usage: docker stats [OPTIONS] [CONTAINER...] Display a live stream of container(s) resource usage statistics Options: -a, --all Show all containers (default shows just running) #顯示全部Container的信息,默認顯示運行中的 --format string Pretty-print images using a Go template #用Go模板打印出漂亮的樣式 --no-stream Disable streaming stats and only pull the first result #只顯示第一個結果,若不加此選項,效果與watch相似。 --no-trunc Do not truncate output #不截斷輸出
[root@nfs ~]# docker stats --no-stream ngx1 CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS 936b5ecac0ab ngx1 0.00% 1.367MiB / 7.622GiB 0.02% 1.75kB / 1.78kB 10.3MB / 0B 2
CONTAINER ID:容器ID
NAME:容器名稱
CPU %:CPU使用率
MEM USAGE / LIMIT:內存使用量和限制大小,默認不限制就是宿主機總體內存
MEM %:內存使用率
NET I/O:網絡IO
BLOCK I/O:磁盤IO
PIDS:不知道
排出來容器內進程資源使用,倒序,靜態顯示
[root@nfs ~]# docker top --help Usage: docker top CONTAINER [ps OPTIONS] Display the running processes of a container Options: [root@nfs ~]# docker top ngx1 UID PID PPID C STIME TTY TIME CMD root 6759 6743 0 22:02 ? 00:00:00 nginx: master process nginx -g daemon off; 101 6795 6759 0 22:02 ? 00:00:00 nginx: worker process
Docker鏡像含有啓動容器所須要的文件系統及內容,所以其用於建立並啓動Docker容器
採用分層構建機制,最底層爲bootfs,其上爲rootfs
bootfs:用於系統引導的文件系統,包括bootloader和kernel,容器啓動完會被卸載以節約內存資源。
rootfs:位於bootfs之上,表現爲docker容器的根文件系統。
- 傳統模式中,系統啓動時,內核掛載rootfs時會首先將其掛載爲只讀模式,完整性自檢完成後將其從新掛載爲讀寫模式。
- docker中,rootfs由內核掛載爲只讀模式,然後經過聯合掛載技術額外掛載一個可寫層。
鏡像文件須要先加載至本地,而後才能啓動。
須要圖示驅動系統支持:GraphDriver,經過overlay2實現。
在本地文件系統之上附加一個抽象層,這個抽象層專門用於存儲分層文件系統。
若啓動三個系統,三個系統基於鏡像文件的抽象層來運行。每一個容器都有本身專有的層,寫操做都保存在這層之上。
建立文件就是在這層之上存放一個文件,刪除就是把文件設置爲隱藏。修改:寫時複製。從底層複製一份,原文件隱藏,修改複製的一份。位於下層的鏡像稱爲父鏡像(parent image),最底層的稱爲基礎鏡像(base image)。
最上層爲可讀寫層,其下均爲只讀層。advanced multi-layered unification filesystem:高級多層統一文件系統
用於爲Linux文件系統實現聯合掛載
aufs是以前的UnionFS的從新實現,2006年由Junjiro Okajima開發
Docker最初使用aufs做爲容器文件系統層,它目前仍做爲存儲後端之一來使用
aufs的競爭產品是overlayfs,後者自從3.18版本開始被合併到Linux內核
Docker的分層鏡像,除了aufs,docker還支持btrfs,devicemapper和vfs等
在Ubuntu系統下,Docker默認Ubuntu的aufs。而在CentOS 7上,用的是devicemapper
devicemapper:慢的像一坨翔分層構建和聯合掛載確定會影響性能
由於多個容器共用一個鏡像文件。
啓動容器時,Docker daemon會試圖從本地獲取相關的鏡像,本地鏡像不存在時,其將從Registry中下載該鏡像並保存到本地。
用戶可以使用自建的Registry或者使用官方的Docker Hub
分類:
第三方很是著名的Registry:quay.io