{"id":548,"date":"2020-06-14T20:29:12","date_gmt":"2020-06-14T12:29:12","guid":{"rendered":"https:\/\/www.funnymuddy.com\/?p=548"},"modified":"2020-07-06T21:04:18","modified_gmt":"2020-07-06T13:04:18","slug":"docker%e9%82%a3%e7%82%b9%e4%ba%8b%e5%84%bf","status":"publish","type":"post","link":"https:\/\/www.funnymuddy.com\/?p=548","title":{"rendered":"Docker\u90a3\u70b9\u4e8b\u513f"},"content":{"rendered":"\n

Docker\u662f\u4e00\u79cdContainer\u6280\u672f\uff0c\u8fd0\u884c\u5728OS\u7279\u522b\u662fLinux\u4e4b\u4e0a\u3002\u867d\u7136\u652f\u6301\u591a\u79cdOS\uff0c\u4f46\u5927\u591a\u60c5\u51b5\u4e0b\uff0cLinux\u662f\u5e94\u7528\u6700\u5e7f\u6cdb\u7684\u5bbf\u4e3bOS\u3002<\/p>\n\n\n\n

\u6838\u5fc3\u7ec4\u4ef6\u6709Client\uff0cDocker Daemon\uff0cImage\uff0cRegistry\u548cContainer\u3002<\/p>\n\n\n\n

\"\"
Docker<\/figcaption><\/figure>\n\n\n\n

Container<\/h2>\n\n\n\n

Container\u662fDocker\u7684\u6838\u5fc3\u3002\u4e00\u79cd\u8fd0\u884c\u5728OS\u4e0a\u53ef\u79fb\u690d\u7684\u8ba1\u7b97\u5355\u5143\uff0c\u4f53\u91cf\u8fdc\u8fdc\u5c0f\u4e8eVM\uff0c\u4e0d\u9700\u8981VM\u7684Hypervisor\uff0c\u4e0d\u9700\u8981VM\u7684OS\u3002\u501f\u52a9\u4e8e\u5bbf\u4e3bOS\u6bd4\u5982Linux\u7684\u4e00\u4e9b\u7279\u6027\uff0c\u6a21\u62df\u51fa\u6765\u7684\u9694\u79bb\u8ba1\u7b97\u73af\u5883\u3002\u4ee5Linux\u4e3a\u4f8b\uff0c\u5229\u7528Linux Kernel Namespace\u6765\u8fdb\u884c\u8ba1\u7b97\u8d44\u6e90\u7b49\u7684\u9694\u79bb\uff0c\u6bd4\u5982PID\uff0cNetwork\uff0cMount\uff0cUser\u7b49\u3002\u501f\u52a9\u4e8eKernel cgroup\uff0c\u6765\u63a7\u5236\u8d44\u6e90\u7684\u5927\u5c0f\u3002<\/p>\n\n\n\n

\u4e00\u4e2acontainer\u7684\u521b\u5efa\u9700\u8981\u4e00\u4e2aimage\uff0c\u8fd8\u9700\u8981\u4e00\u4e2aruntime\u3002\u6700\u6709\u540d\u7684image registry\u4e3ahub.docker.com\u548cquay.io\uff0c\u5728\u90a3\u91cc\u53ef\u53d1\u73b0\u5404\u79cd\u8f6f\u4ef6\u53d1\u884c\u7248\u672c\u7684image\u3002Docker\u7684runtime\u4e3arunc\u3002<\/p>\n\n\n\n

\u5e94\u7528\u7a0b\u5e8f\u548c\u4f9d\u8d56\u88ab\u6253\u5305\u5c01\u88c5\u4e3aDocker image\uff0c\u501f\u52a9\u4e8eDocker runtime\u90e8\u7f72\uff0c\u5f62\u6210\u4e86\u4e00\u4e2acontainer\u3002\u5e94\u7528\u7a0b\u5e8f\u4e0d\u4f1a\u518d\u4ee5war\u5305rpm\u5305\u7b49\u5f62\u5f0f\u5448\u73b0\u7ed9\u5f00\u53d1\u548c\u8fd0\u7ef4\u3002<\/p>\n\n\n\n

Image<\/h2>\n\n\n\n

image\u662f\u5206\u5c42\u7684\uff0c\u6bcf\u4e00\u5c42\u5bf9\u5e94\u7740Dockerfile\u4e2d\u7684\u4e00\u884c\u6307\u4ee4\uff0c\u7528”docker history image_name”\u6765\u67e5\u770b\u6240\u6709\u5206\u5c42\u3002image\u7684\u6240\u6709\u5c42\u5728host\u4e2d\u4fdd\u5b58\uff0c\u662f\u53ea\u8bfb\u7684\uff0c\u53ef\u88ab\u591a\u4e2acontainer\u5171\u4eab\u3002\u4e0d\u540c\u5c42\u7684image\u5982\u679c\u6709\u76f8\u540c\u8def\u5f84\uff0c\u90a3\u4e48\u4e0a\u5c42\u7684\u4f1a\u8986\u76d6\u4e0b\u5c42\u7684\u3002<\/p>\n\n\n\n

Image\u5c42\u4e4b\u4e0a\u4e3acontainer\u5c42\uff0c\u53ea\u6709\u8fd9\u4e00\u5c42\u662f\u53ef\u8bfb\u5199\u7684\u3002\u6dfb\u52a0\u6587\u4ef6\u65f6\uff0c\u76f4\u63a5\u5c06\u6587\u4ef6\u6dfb\u52a0\u5230container\u5c42\u3002\u8bfb\u53d6\u6587\u4ef6\u65f6\uff0c\u7531\u4e0a\u800c\u4e0b\u4e00\u6b21\u8bfb\u53d6\u3002\u4fee\u6539\u6587\u4ef6\u65f6\uff0c\u5148\u627e\u5230\u8be5\u6587\u4ef6\uff0c\u62f7\u8d1d\u5230container\u5c42\uff0c\u518d\u5728container\u5c42\u4fee\u6539\u3002\u5220\u9664\u6587\u4ef6\uff0c\u5148\u627e\u5230\u8be5\u6587\u4ef6\uff0c\u518d\u5728container\u5c42\u8bb0\u5f55\u6b64\u6587\u4ef6\u5df2\u7ecf\u88ab\u5220\u9664\u3002\u6240\u6709\u8fd9\u4e9b\u7279\u6027\u5c31\u662f\u8457\u540d\u7684COW\uff0ccopy on write\u3002COW\u662f\u7531\u6240\u8c13\u7684storage driver\u6765\u5b9e\u73b0\u7684\uff0c\u6bd4\u5982AUFS\uff0cDevice Mapper\u7b49\u3002Linux\u53d1\u884c\u7248\u672c\u4f1a\u6709\u4e0d\u540c\u7684driver\uff0cDocker\u5b89\u88c5\u65f6\u4f1a\u9009\u62e9\u5bbf\u4e3bOS\u9ed8\u8ba4\u7684driver\uff0c\u6bd4\u5982Ubuntu\u662fAUFS\uff0cCentOS\u662fDevice Mapper\u3002 <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u5171\u4eabKernel<\/h2>\n\n\n\n

Linux\u64cd\u4f5c\u7cfb\u7edf\u7531\u5185\u6838Kernel\u7a7a\u95f4\u548c\u7528\u6237\u7a7a\u95f4\u7ec4\u6210\u3002\u5185\u6838\u7a7a\u95f4\u5bf9\u5e94\u7740bootfs\u6587\u4ef6\u7cfb\u7edf\uff0cLinux\u521a\u542f\u52a8\u65f6\u4f1a\u52a0\u8f7d bootfs\uff0c\u4e4b\u540e bootfs \u4f1a\u88ab\u5378\u8f7d\u6389\u3002\u7528\u6237\u7a7a\u95f4\u7684\u6587\u4ef6\u7cfb\u7edf\u662f rootfs\uff0c\u5305\u542b\u6211\u4eec\u719f\u6089\u7684 \/dev, \/proc, \/bin \u7b49\u76ee\u5f55\u3002\u5bf9\u4e8eDocker image\u6765\u8bf4\uff0c\u5e95\u5c42\u76f4\u63a5\u7528 Host \u7684 kernel\uff0c\u81ea\u5df1\u53ea\u9700\u8981\u63d0\u4f9b rootfs \u5c31\u884c\u4e86\u3002<\/p>\n\n\n\n

\u6240\u6709\u6240\u6709container\u5171\u4eab\u4e00\u4e2a\u5bbf\u4e3b\u7684Kernel\u3002\u4f1a\u51fa\u73b0\u8fd9\u79cd\u60c5\u51b5\uff0c\u6784\u5efabase image\u6bd4\u5982CentOS7.6\u7684Kernel\u7248\u672c\u6709\u53ef\u80fd\u548c\u5b9e\u9645\u8fd0\u884c\u7684\u5bbf\u4e3b\u673a\u4e0a\u7684Kernel\u7248\u672c\u4e0d\u540c\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Dockerfile<\/h2>\n\n\n\n

Dockerfile\u6709\u51e0\u4e2a\u547d\u4ee4\u6bd4\u8f83\u76f8\u4f3c\uff0c\u73b0\u5728\u5217\u51fa\u6765\u52a0\u4ee5\u533a\u5206\u3002<\/p>\n\n\n\n

CMD – container\u542f\u52a8\u540e\u6267\u884c\u7684\u547d\u4ee4\uff0c\u4f1a\u88abdocker run \u4e4b\u540e\u7684\u547d\u4ee4\u66ff\u6362
RUN – \u6784\u5efaimage\u65f6\u8fd0\u884c\u7684\u547d\u4ee4\uff0c\u5e38\u7528\u6765\u5b89\u88c5\u8f6f\u4ef6\u5305
ENTRYPOINT – \u7528\u6765\u8bbe\u7f6e\u542f\u52a8\u5e94\u7528\u7a0b\u5e8f\u6216\u8005\u670d\u52a1\uff0c\u4e0d\u4f1a\u88abdocker run\u540e\u7684\u547d\u4ee4\u66ff\u6362<\/p>\n\n\n\n

\u7f51\u7edc<\/h2>\n\n\n\n

Docker\u6709\u51e0\u79cd\u7f51\u7edc\u7c7b\u578b: none, host, bridge, overlay\u3002<\/p>\n\n\n\n

none<\/h4>\n\n\n\n

\u901a\u8fc7docker run –network=none\u6307\u5b9anone\u7f51\u7edc\u3002none\u7f51\u7edc\u5c31\u662f\u6ca1\u6709\u4efb\u4f55\u7f51\u7edc\uff0c\u5bf9\u5e94\u7684container\u662f\u5c01\u95ed\u7684\u3002<\/p>\n\n\n\n

host<\/h4>\n\n\n\n

host\u7f51\u7edc\u901a\u8fc7docker run –network=host\u6307\u5b9a\u3002\u5bf9\u5e94\u7684container\u548chost\u5171\u4eab\u7f51\u7edc\u6808\uff0c\u5728container\u53ef\u770b\u5230host\u6240\u6709\u7f51\u5361\u3002<\/p>\n\n\n\n

bridge<\/h4>\n\n\n\n

Docker\u5b89\u88c5\u65f6\u9ed8\u8ba4\u5b89\u88c5\u7684Linux bridge\u4e3adocker0\uff0cdocker run\u4e0d\u6307\u5b9anetwork\u65f6\u6240\u6709container\u4f1a\u6302\u5230docker0\u3002\u7528\u4ee5\u4e0b\u547d\u4ee4\u53ef\u67e5\u770bdocker0\u7684\u7f51\u6bb5\u3002<\/p>\n\n\n\n

docker network inspect bridge<\/p>\n\n\n\n

bridge\u4e0a\u7684container\u80fd\u8bbf\u95ee\u5916\u7f51\uff0c\u662f\u901a\u8fc7NAT\u5b9e\u73b0\u7684\u3002\u5728host\u4e0a\u67e5\u770biptables\uff1aiptables -t nat -S\uff0c\u53ef\u770b\u5230\u76f8\u5173\u914d\u7f6e\u3002\u5982\u679cdocker0\u6536\u5230\u5916\u51fa\u5305\uff0c\u5219MASQUERADE\u5c06\u5305\u7684\u6e90\u5730\u5740\u6539\u4e3ahost\u5730\u5740\u3002\u53ef\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u6765\u67e5\u770b\u9a8c\u8bc1\u3002<\/p>\n\n\n\n

ip r #\u67e5\u770b\u8def\u7531\uff0c\u770b\u7531\u54ea\u4e2a\u7f51\u5361\u53d1\u5305\u51fa\u53bb\uff0c\u8fd9\u91cc\u5047\u8bbe\u662feth2
ping www.bing.com #\u5728container\u5185ping
tcpdump -i docker0 -n icmp #\u5c06\u4f1a\u770b\u5230\u5185\u7f51IP
tcpdump -i eth2 -n icmp #\u5c06\u4f1a\u770b\u5230\u5185\u7f51IP\u53d8\u6210\u4e86eth2\u7684\u5730\u5740<\/p>\n\n\n\n

\u5916\u90e8\u8bbf\u95eecontainer\u53ef\u901a\u8fc7\u7aef\u53e3\u6620\u5c04\uff0c\u7531docker-proxy\u7684\u8fdb\u7a0b\u6765\u5b8c\u6210\u3002docker run -d -p 80:80 nginx\u3002Port:Port\uff0c \u524d\u4e00\u4e2a\u4e3ahost\u7684\u7aef\u53e3\uff0c\u540e\u4e00\u4e2a\u4e3acontainer\u7684\u7aef\u53e3\u3002
<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

user-defined network<\/h4>\n\n\n\n

bridge<\/strong> – \u53ef\u4ee5\u521b\u5efa\u548cdocker0\u76f8\u4f3c\u7684\u7f51\u7edc\u3002docker network create –driver bridge –subnet 172.11.11.0\/24 –gateway=172.11.11.1 new_bridge<\/p>\n\n\n\n

\u4e24\u4e2abridge\u4e0a\u7684\u4e0d\u540c\u7f51\u7edc\u4e4b\u95f4\u539f\u5219\u4e0a\u53ef\u4ee5\u901a\u4fe1\uff0c\u9700\u8981\u6253\u5f00ip forwarding \uff08sysctl net.ipv4.ip_forward\uff09\u3002\u4f46\u662f\u4ecd\u7136\u8de8bridge\u6253\u4e0d\u901a\uff0c\u539f\u56e0\u662fiptables Drop\u4e86\u4e24\u4e2abridge\u4e4b\u95f4\u7684\u901a\u4fe1\u3002\u4f46container\u53ef\u6dfb\u52a0\u4e00\u5757\u7f51\u5361\uff0c\u6307\u5411\u522b\u7684\u7f51\u7edc\u3002docker network connect new_bridge container_ID<\/p>\n\n\n\n

overlay<\/strong> – \u8de8\u4e3b\u673a\u7f51\u7edc\u3002
\u5efa\u7acb\u7f51\u7edc\u3002docker network create -d overlay my_overlay_net\uff0c\u8fd0\u884c\u540e\u4f1a\u5728\u96c6\u7fa4(\u53ef\u7528docker-machine\u642d\u5efa\uff09\u4e0a\u6bcf\u4e00\u4e2ahost\u4f1a\u770b\u5230\u6b64\u7f51\u7edc\u3002
\u7ed1\u5b9a\u7f51\u7edc\u5230container\u3002docker run –network=my_overlay_net \u6307\u5b9a\u521a\u521b\u5efa\u7684\u7f51\u7edc\u3002\u67e5\u770b\u6b64container\u540e\u4f1a\u53d1\u73b0\u6709\u4e24\u4e2a\u7f51\u53e3\uff0ceth0 \u548c eth1\uff0ceth0\u8fde\u63a5my_overlay_net\u3002
container\u548c\u5916\u7f51\u7684\u901a\u4fe1\u3002eth1\u8fde\u63a5\u521adocker network create\u65f6\u521b\u5efa\u7684Linux bridge\u7f51\u7edcdocker_gwbridge\uff0c\u6240\u6709overlay\u5bb9\u5668\u901a\u8fc7docker_gwbridge\u6253\u901a\u5916\u7f51\u3002\u6ce8\u610fmy_overlay_net\u548cdocker_gwbridge\u4e24\u4e2a\u7f51\u7edc\u6709\u4e0d\u540c\u7684\u7f51\u6bb5\uff0c\u53ef\u4ee5\u8fd9\u6837\u67e5\u770b\uff0cdocker network inspect docker_gwbridge (docker0)\u3002
container\u4e4b\u95f4\u7684\u901a\u4fe1\u3002Docker \u4f1a\u4e3a\u6bcf\u4e2a overlay \u7f51\u7edc\u521b\u5efa\u4e00\u4e2a\u72ec\u7acb\u7684 network namespace\uff0c\u6bcf\u4e2anamespace\u4e2d\u4f1a\u6709\u4e00\u4e2alinux bridge br0\uff0cbr0\u901a\u8fc7vxlan\u8bbe\u5907\u548c\u4e0d\u540chost\u5efa\u7acbvxlan tunnel\u3002container\u4e4b\u95f4\u501f\u52a9\u4e8e\u6b64vxlan tunnel\u8fdb\u884c\u901a\u4fe1\u3002
\u4e0d\u540coverlay\u4e4b\u95f4\u7684\u901a\u4fe1\u3002\u4e0d\u540coverlay\u7f51\u7edc\u5185\u5bb9\u5668\u4e0d\u80fd\u4e92\u901a\uff0c\u4f46\u53ef\u901a\u8fc7docker network connect my_overlay_net container_ID\u6253\u901a\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

macvlan<\/strong> – \u8de8\u4e3b\u673a\u7f51\u7edc\u3002
macvlan \u672c\u8eab\u662fLinux Kernel \u6a21\u5757\uff0c\u5176\u529f\u80fd\u662f\u5141\u8bb8\u5728\u540c\u4e00\u4e2a\u7269\u7406\u7f51\u5361\u4e0a\u914d\u7f6e\u591a\u4e2a MAC \u5730\u5740\uff0c\u5373\u591a\u4e2a interface\uff0c\u6bcf\u4e2a interface \u53ef\u4ee5\u914d\u7f6e\u81ea\u5df1\u7684 IP\u3002macvlan \u7684\u6700\u5927\u4f18\u70b9\u662f\u6027\u80fd\u6781\u597d\uff0c\u76f8\u6bd4\u5176\u4ed6\u5b9e\u73b0\uff0cmacvlan \u4e0d\u9700\u8981\u521b\u5efa Linux bridge\uff0c\u800c\u662f\u76f4\u63a5\u901a\u8fc7\u4ee5\u592a interface \u8fde\u63a5\u5230\u7269\u7406\u7f51\u7edc\u3002macvlan\u662f\u4e00\u79cdunderlay\u7f51\u7edc\u3002<\/p>\n\n\n\n

flannel<\/strong>\u7b49\u7b2c\u4e09\u65b9\u8de8\u4e3b\u673a\u7f51\u7edc\u3002flannel \u662f CoreOS \u5f00\u53d1\u7684\u5bb9\u5668\u7f51\u7edc\u89e3\u51b3\u65b9\u6848\u3002flannel \u4e3a\u6bcf\u4e2a host \u5206\u914d\u4e00\u4e2a subnet\uff0c\u5bb9\u5668\u4ece\u6b64 subnet \u4e2d\u5206\u914d IP\uff0c\u8fd9\u4e9b IP \u53ef\u4ee5\u5728 host \u95f4\u8def\u7531\uff0c\u5bb9\u5668\u95f4\u65e0\u9700 NAT \u548c port mapping \u5c31\u53ef\u4ee5\u8de8\u4e3b\u673a\u901a\u4fe1\u3002\u6bcf\u4e2a subnet \u90fd\u662f\u4ece\u4e00\u4e2a\u66f4\u5927\u7684 IP \u6c60\u4e2d\u5212\u5206\u7684\uff0cflannel \u4f1a\u5728\u6bcf\u4e2a\u4e3b\u673a\u4e0a\u8fd0\u884c\u4e00\u4e2a\u53eb flanneld \u7684 agent\uff0c\u5176\u804c\u8d23\u5c31\u662f\u4ece\u6c60\u5b50\u4e2d\u5206\u914d subnet\u3002\u4e3a\u4e86\u5728\u5404\u4e2a\u4e3b\u673a\u95f4\u5171\u4eab\u4fe1\u606f\uff0cflannel \u7528 etcd\uff08\u4e0e consul \u7c7b\u4f3c\u7684 key-value \u5206\u5e03\u5f0f\u6570\u636e\u5e93\uff09\u5b58\u653e\u7f51\u7edc\u914d\u7f6e\u3001\u5df2\u5206\u914d\u7684 subnet\u3001host \u7684 IP \u7b49\u4fe1\u606f\u3002\uff08\u6b64\u6bb5\u53c2\u8003\u81eaCloudMan)<\/p>\n\n\n\n

\u5b58\u50a8<\/h2>\n\n\n\n

\u76d1\u63a7<\/h2>\n\n\n\n

\u96c6\u7fa4<\/h2>\n
<\/div>

<\/path><\/svg><\/i> <\/p>

<\/div>","protected":false},"excerpt":{"rendered":"

Docker\u662f\u4e00\u79cdContainer\u6280\u672f\uff0c\u8fd0\u884c\u5728OS\u7279\u522b\u662fLinux\u4e4b\u4e0a\u3002\u867d\u7136\u652f\u6301\u591a\u79cdOS\uff0c\u4f46\u5927\u591a\u60c5\u51b5\u4e0b\uff0cLi… \u9605\u8bfb\u66f4\u591a »Docker\u90a3\u70b9\u4e8b\u513f<\/span><\/a><\/p>\n

<\/div>\n

<\/path><\/svg><\/i> <\/p>\n

<\/div>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[21],"class_list":["post-548","post","type-post","status-publish","format-standard","hentry","category-6","tag-docker"],"_links":{"self":[{"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=\/wp\/v2\/posts\/548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=548"}],"version-history":[{"count":17,"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=\/wp\/v2\/posts\/548\/revisions"}],"predecessor-version":[{"id":592,"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=\/wp\/v2\/posts\/548\/revisions\/592"}],"wp:attachment":[{"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.funnymuddy.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}