docker Dockerfile 创建镜像
Docker 组件
1. docker client : docker的客户端
2. docker server : docker daemon的主要组成部分,接受用户通过docker client发送的请求,并按照响应的路由规则实时路由分发。
3. docker image : docker镜像运行之后变成容器 (docker run),启动快,采用了分层模式。
4.docker Registry: registry是 docker镜像的中央存储仓库(pull/push)
docker 使用yum 安装最新版
[root@docker1 yum.repos.d]# cat docker.repo [dockerrepo] name=Docker Repository baseurl=https://yum.dockerproject.org/repo/main/centos/7 enabled=1 gpgcheck=1 gpgkey=https://yum.dockerproject.org/gpg
docker 安装
[root@docker1 ~]# yum -y install docker-engine 启动docker [root@docker1 ~]# systemctl start docker.service [root@docker1 ~]# systemctl enable docker.service
使用dockerfile 生成docker镜像, 从docker.io 下载镜像。
搜索centos镜像 [root@docker1 ~]#docker search centos pull centos镜像 [root@docker1 ~]#docker pull centos 查看下载的镜像 [root@docker1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE centos latest 67591570dd29 7 weeks ago 192 MB
[root@docker1 ~]# git clone https://git.oschina.net/dockerf/docker-training.git
[root@docker1 ~]# ls
docker-training
[root@docker1 ~]# cd docker-training
[root@docker1 docker-training]# ls
centos7 mysql php-fpm wordpress 4个目录
构建一个 centos7 php-fpm mysql wordpress 的docker镜像
[root@docker1 centos7]# ls
1.repo Centos-7.repo Dockerfile supervisord.conf
Dockerfile 是一个自动构建docker镜像的配置文件,
[root@docker1 centos7]# cat Dockerfile #需要一个基础镜像,centos7.1.1503 是从docker上pull下来 #FROM centos:centos7.1.1503
FROM centos:latest
#维护者
MAINTAINER fengjian <fengjian@senyint.com>
#设置一个时区的环境变量
ENV TZ "Asia/Shanghai"
#虚拟终端 ENV TERM xterm
#dockerfile中有2条命令可以复制文件,1.copy 2.add, add比copy多2个功能,可以写成连接 直接copy到container,如果是压缩文件,add能自动解压 ADD Centos-7.repo /etc/yum.repos.d/CentOS-Base.repo ADD 1.repo /etc/yum.repos.d/epel.repo RUN yum install -y curl wget tar bzip2 libtool-ltdl-devel unzip vim-enhanced passwd sudo yum-utils hostname net-tools rsync man && \ yum install -y gcc gcc-c++ git make automake cmake patch logrotate python-devel libpng-devel libjpeg-devel && \ yum install -y python-pip #RUN pip install --upgrade pip
#supervisor 进程管理工具,运行单个进程可以不使用
RUN pip install -i https://pypi.tuna.tsinghua.edu.cn/simple supervisor ADD supervisord.conf /etc/supervisord.conf
#/etc/supervisor.conf.d 存放启动进程的配置文件 RUN mkdir -p /etc/supervisor.conf.d && \ mkdir -p /var/log/supervisor
#container想暴露22端口给宿主机
EXPOSE 22
#最后一条ENTRYPOINT 才能生效
ENTRYPOINT ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisord.conf"]
[root@docker1 centos7]# cat 1.repo [bash] name=centos7 baseurl=http://192.168.20.220/centos7/Packages/ enabled=1 gpgcheck=0
[root@docker1 centos7]# cat Centos-7.repo # CentOS-Base.repo # # The mirror system uses the connecting IP address of the client and the # update status of each mirror to pick mirrors that are updated to and # geographically close to the client. You should use this for CentOS updates # unless you are manually picking other mirrors. # # If the mirrorlist= does not work for you, as a fall back you can try the # remarked out baseurl= line instead. # # [base] name=CentOS-$releasever - Base - mirrors.aliyun.com failovermethod=priority baseurl=http://mirrors.aliyun.com/centos/$releasever/os/$basearch/ http://mirrors.aliyuncs.com/centos/$releasever/os/$basearch/ #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os gpgcheck=1 gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7 #released updates [updates] name=CentOS-$releasever - Updates - mirrors.aliyun.com failovermethod=priority baseurl=http://mirrors.aliyun.com/centos/$releasever/updates/$basearch/ http://mirrors.aliyuncs.com/centos/$releasever/updates/$basearch/ #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates gpgcheck=1 gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7 #additional packages that may be useful [extras] name=CentOS-$releasever - Extras - mirrors.aliyun.com failovermethod=priority baseurl=http://mirrors.aliyun.com/centos/$releasever/extras/$basearch/ http://mirrors.aliyuncs.com/centos/$releasever/extras/$basearch/ #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras gpgcheck=1 gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7 #additional packages that extend functionality of existing packages [centosplus] name=CentOS-$releasever - Plus - mirrors.aliyun.com failovermethod=priority baseurl=http://mirrors.aliyun.com/centos/$releasever/centosplus/$basearch/ http://mirrors.aliyuncs.com/centos/$releasever/centosplus/$basearch/ #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=centosplus gpgcheck=1 enabled=0 gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7 #contrib - packages by Centos Users [contrib] name=CentOS-$releasever - Contrib - mirrors.aliyun.com failovermethod=priority baseurl=http://mirrors.aliyun.com/centos/$releasever/contrib/$basearch/ http://mirrors.aliyuncs.com/centos/$releasever/contrib/$basearch/ #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=contrib gpgcheck=1 enabled=0 gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
[root@docker1 centos7]# cat supervisord.conf [unix_http_server] file=/var/run/supervisor.sock ; (the path to the socket file) chmod=0700 ; socket file mode (default 0700) [supervisord] logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log) logfile_maxbytes=50MB logfile_backup=10 loglevel=info pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid) nodaemon=true ; (Start in foreground if true; default false) minfds=1024 ; (min. avail startup file descriptors;default 1024) minprocs=200 ; (min. avail process descriptors;default 200) [rpcinterface:supervisor] supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface [supervisorctl] serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL for a unix socket [include] files = /etc/supervisor.conf.d/*.conf
从docker.io 下载centos,根据dockerfile 生成docker镜像,
[root@docker1 centos7]# docker build -t fengjian/centos:7.3 .
查看生成的镜像
[root@docker1 centos7]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE fengjian/centos 7.1 03a49ca4b7b9 13 days ago 667.8 MB
通过docker镜像 生成docker 容器。 docker run命令
-p 小写, container 端口,指定到宿主机的端口
-P 大写, container的 端口,映射到宿主机的 随机端口
生成docker 容器
[root@docker1 ~]#docker run -d -p 2222:22 --name base fengjian/centos:7.3
查看容器信息
[root@docker1 ~]#docker ps -a
[root@docker1 ~]# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES ebce60d09d31 fengjian/centos:7.1 "/usr/bin/supervisord" About a minute ago Up About a minute 2222/tcp, 0.0.0.0:2222->22/tcp base
进入docker container中
[root@docker1 ~]# docker exec -it ebce60d09d31 /bin/bash
制作php-fpm的镜像
[root@docker1 php-fpm]# ls
Dockerfile nginx_default.conf nginx_nginx.conf php_www.conf supervisor_nginx.conf supervisor_php-fpm.conf
[root@docker1 php-fpm]# vim Dockerfile FROM fengjian/centos:7.3 MAINTAINER fengjian <fengjian@senyint.com> # Set environment variable ENV APP_DIR /app RUN yum -y swap -- remove fakesystemd -- install systemd systemd-libs && \ yum -y install nginx php-cli php-mysql php-pear php-ldap php-mbstring php-soap php-dom php-gd php-xmlrpc php-fpm php-mcrypt && \ yum clean all ADD nginx_nginx.conf /etc/nginx/nginx.conf ADD nginx_default.conf /etc/nginx/conf.d/default.conf ADD php_www.conf /etc/php-fpm.d/www.conf RUN sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/' /etc/php.ini RUN mkdir -p /app && echo "<?php phpinfo(); ?>" > ${APP_DIR}/info.php EXPOSE 80 443 ADD supervisor_nginx.conf /etc/supervisor.conf.d/nginx.conf ADD supervisor_php-fpm.conf /etc/supervisor.conf.d/php-fpm.conf ONBUILD ADD . /app ONBUILD RUN chown -R nginx:nginx /app
[root@docker1 php-fpm]# vim supervisor_nginx.conf [program:nginx] directory=/ command=/usr/sbin/nginx -c /etc/nginx/nginx.conf user=root autostart=true autorestart=true stdout_logfile=/var/log/supervisor/%(program_name)s.log stderr_logfile=/var/log/supervisor/%(program_name)s.log [program:php-fpm] directory=/ command=/usr/sbin/php-fpm user=root autostart=true autorestart=true stdout_logfile=/var/log/supervisor/%(program_name)s.log stderr_logfile=/var/log/supervisor/%(program_name)s.log
创建php-fpm的 镜像
[root@docker1 php-fpm]# docker build -t fengjian/php-fpm:5.4 .
启动一个container
[root@docker1 php-fpm]# docker run -d -p 8080:80 --name wesite fengjian/php-fpm:5.4
访问宿主机的 8080端口
http://192.168.20.209:8080/info.php
创建mysql镜像
[root@docker1 mysql]# docker build -t fengjian/mysql:5.5 .
###docker run -d -p 3306:3306 -v host_dir:container_dir -v参数是映射container路径到宿主机上###########
[root@docker1 mysql]# docker run -d -p 3306:3306 -v /data/mysql/data:/var/lib/mysql --name dbserver fengjian/mysql:5.5
宿主机上的/data/mysql/data目录文件
[root@docker1 data]# ll /data/mysql/data/ total 28700 -rw-rw---- 1 27 27 16384 Jan 19 15:25 aria_log.00000001 -rw-rw---- 1 27 27 52 Jan 19 15:25 aria_log_control drwx------ 2 27 27 19 Jan 19 15:40 fengjian -rw-rw---- 1 27 27 18874368 Jan 19 15:25 ibdata1 -rw-rw---- 1 27 27 5242880 Jan 19 15:26 ib_logfile0 -rw-rw---- 1 27 27 5242880 Jan 19 15:25 ib_logfile1 drwx------ 2 27 root 4096 Jan 19 15:25 mysql srwxrwxrwx 1 27 27 0 Jan 19 15:26 mysql.sock drwx------ 2 27 27 4096 Jan 19 15:25 performance_schema drwx------ 2 27 root 6 Jan 19 15:25 test [root@docker1 data]#
删除container后, 在生成新的container 数据还可以继续使用。
[root@docker1 data]# docker rm -f dbserver (删除)
[root@docker1 data]# docker run -d -p 3306:3306 -v /data/mysql/data:/var/lib/mysql --name newmysqldb fengjian/mysql:5.5
构建动态网站wordpress, 使用php-fpm镜像
[root@docker1 wordpress]# ls Dockerfile init.sh readme.html wp-admin wp-comments-post.php wp-content wp-includes wp-load.php wp-mail.php wp-signup.php xmlrpc.php index.php license.txt wp-activate.php wp-blog-header.php wp-config-sample.php wp-cron.php wp-links-opml.php wp-login.php wp-settings.php wp-trackback.php
[root@docker1 wordpress]# vim Dockerfile
from fengjian/php-fpm:5.4 add init.sh /init.sh entrypoint ["/init.sh", "/usr/bin/supervisord", "-n", "-c", "/etc/supervisord.conf"]
#先执行 /init.sh脚本, 然后再执行后面的服务,其实是启动了nginx 和php-fpm
父镜像php-fpm 的Dockerfile最后两行
ONBUILD ADD . /app
ONBUILD RUN chown -R nginx:nginx /app
ONBUILD 在构建 wordpress 的时候生效
所有的代码文件全部copy到/app下, 但是Dockerfile没有作用,所以 可以在目录下新建一个.dockerignore, 排除Dockerfile
[root@docker1 wordpress]# vim .dockerignore
Dockerfile
创建wordpress镜像,版本4.2
[root@docker1 wordpress]# docker build -t fengjian/wordpress:4.2 .
查看镜像
[root@docker1 wordpress]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE fengjian/wordpress 4.2 8591f07cc2e2 15 seconds ago 848.4 MB fengjian/mysql 5.5 b54f78aeefb8 21 hours ago 848.2 MB fengjian/php-fpm 5.4 fc1856e25486 21 hours ago 810.8 MB fengjian/centos 7.1 fbafb1b36c30 21 hours ago 712.8 MB tomcat latest 47bd812c12f6 5 weeks ago 355.2 MB mysql latest 594dc21de8de 5 weeks ago 400.1 MB centos centos7.1.1503 285396d0a019 4 months ago 212.1 MB centos centos7.1.1503 285396d0a019 4 months ago 212.1 MB kubeguide/tomcat-app v1 a29e200a18e9 6 months ago 358.2 MB
启动一个容器, 使用-e 参数,传递环境变量,WORDPRESS_DB_HOST是在init.sh 脚本中定义的
[root@docker1 wordpress]# docker run -d -p 80:80 --name wordpress -e WORDPRESS_DB_HOST=192.168.20.209 -e WORDPRESS_DB_USER=fengjian -e WORDPRESS_DB_PASSWORD=123456 fengjian/wordpress:4.2
访问ip的80端口
ENTRYPOINT 与 CMD 命令区别 运行一个Docker容器像运行一个程序一样,如果写了10条,只有最后一条生效。 1. ENTRYPOINT ["executable","param1","param2"] 2. ENTRPOINT command param1 param2 (shell from) docker run -it -entrypoint=覆盖 Dockerfile ENTRYPOINT[]
CMD 用法
1.CMD["executable","param1","param2"] (exec from , this is the preferred form)
第一种用法:运行一个可执行的文件并提供参数
2.CMD [“param1”,"param2"] (as default parameters to ENTRYPOINT)
第二种用法: 为ENTRPOINT指定参数
3.CMD command param1 param2 (sehll form)
第三种用法(shell form): 是以"/bin/sh -c" 的方法执行的命令
例子:
CMD ["/bin/echo","This is test CMD"]
docker run -it -rm fengjian/cmd:0.1 /bin/bash
#################################################################################################
第二docker 实战之 Registry 以及持续集成
构建一个企业内部的registry
docker1: 192.168.20.209
registry: 192.168.20.135 5000端口
[root@registry ~]# docker search registry
再次把registry pull到本地
[root@registry ~]# docker pull registry Using default tag: latest latest: Pulling from library/registry b7f33cc0b48e: Pull complete 46730e1e05c9: Pull complete 458210699647: Pull complete 0cf045fea0fd: Pull complete b78a03aa98b7: Pull complete Digest: sha256:0e40793ad06ac099ba63b5a8fae7a83288e64b50fe2eafa2b59741de85fd3b97 Status: Downloaded newer image for registry:latest
查看docker1 192.168.20.209 镜像
[root@docker1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE fengjian/wordpress 4.2 8591f07cc2e2 2 days ago 848.4 MB fengjian/mysql 5.5 b54f78aeefb8 3 days ago 848.2 MB fengjian/php-fpm 5.4 fc1856e25486 3 days ago 810.8 MB fengjian/centos 7.1 fbafb1b36c30 3 days ago 712.8 MB registry latest d1e32b95d8e8 4 days ago 33.17 MB tomcat latest 47bd812c12f6 5 weeks ago 355.2 MB mysql latest 594dc21de8de 5 weeks ago 400.1 MB centos centos7.1.1503 285396d0a019 4 months ago 212.1 MB centos centos7.1.1503 285396d0a019 4 months ago 212.1 MB
查看registry 192.168.20.135 镜像
[root@registry ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE registry latest d1e32b95d8e8 2 weeks ago 33.2 MB
registry启动一个 registry的容器
[root@registry ~]# docker run -d -p 5000:5000 -v /opt/registry:/var/lib/registry -p 5000:5000 --restart=always --name registry registry:latest
Registry服务默认会将上传的镜像保存在容器的/var/lib/registry,我们将主机的/opt/registry目录挂载到该目录,即可实现将镜像保存到主机的/opt/registry目录了。
registry_url: 启动的registry,本地registry:5000地址
namespace : 指定目录
name: 镜像的名字
registry_url/namespace/tomcat:v1.0
通过 docker tag 可以为容器打一个标记,类似于别名的作用,
[root@docker1 ~] docker pull fengjian/fengjian
对fengjian 打标记成 192.168.20.209:5000/fengjian/fengjian/fengjian:20170122v1.0
[root@docker1 ~]# docker tag fengjian/fengjian:latest 192.168.20.135:5000/fengjian/fengjian/fengjian:20170122v1.0
查看镜像
[root@docker1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE fengjian/wordpress 4.2 8591f07cc2e2 2 days ago 848.4 MB fengjian/mysql 5.5 b54f78aeefb8 3 days ago 848.2 MB fengjian/php-fpm 5.4 fc1856e25486 3 days ago 810.8 MB fengjian/centos 7.1 fbafb1b36c30 3 days ago 712.8 MB registry latest d1e32b95d8e8 4 days ago 33.17 MB tomcat latest 47bd812c12f6 5 weeks ago 355.2 MB mysql latest 594dc21de8de 5 weeks ago 400.1 MB centos centos7.1.1503 285396d0a019 4 months ago 212.1 MB centos centos7.1.1503 285396d0a019 4 months ago 212.1 MB kubeguide/tomcat-app v1 a29e200a18e9 6 months ago 358.2 MB 192.168.20.135:5000/fengjian/fengjian/fengjian 20170122v1.0 3468c34fa83b 13 months ago 97.95 MB fengjian/fengjian latest 3468c34fa83b 13 months ago 97.95 MB
运行docker push将hello-world镜像push到我们的私有仓库中
[root@docker ~]# docker push 192.168.20.135:5000/fengjian/fengjian/fengjian:20170122v1.0
The push refers to a repository [192.168.20.135:5000/fengjian/nginx20170203]
Get https://192.168.20.135:5000/v1/_ping: http: server gave HTTP response to HTTPS client
出现无法push镜像到私有仓库的问题。这是因为我们启动的registry服务不是安全可信赖的。这是我们需要修改docker的配置文件/usr/lib/systemd/system/docker.service,添加下面的内容,注意: registry 和 docker1 2台服务器都需要修改
上传镜像到 192.168.20.135
[root@docker overlay]# docker push 192.168.20.135:5000/fengjian/fengjian/fengjian:20170122v1.0
The push refers to a repository [192.168.20.135:5000/fengjian/fengjian/fengjian:20170122v1.0]
23c8d40ebb9e: Pushed
5526182de2ab: Pushed
652f3c2c3f57: Pushed
bf76891beffc: Pushed
f696adb3bd45: Pushed
46db44806cd4: Pushed
2dd577fe2559: Pushed
bbc4847eb1d2: Pushed
747f5baee8ac: Pushed
29003cbb49e1: Pushed
f5d4b5d6f2ff: Pushed
ee745a500b91: Pushed
3383431a5cc0: Pushed
8aabcc6c5e8d: Pushed
967105df7f61: Pushed
0c051da11cb4: Pushed
34e7b85d83e4: Pushed
v1: digest: sha256:4e5d763dfb99ecd95128d1033e14bb4740613045c89bb2646006ac7db08f5a6f size: 3871
通过浏览器,查询上传结果
使用docker pull从我们的私有仓库中获取192.168.20.135:5000/fengjian/fengjian/fengjian:20170122v1.0镜像
[root@docker ~ ]# docker pull 192.168.20.135:5000/fengjian/nginx20170203:v1
v1: Pulling from fengjian/nginx20170203
17385548ba54: Already exists
59da822a5404: Already exists
ec5de50f3658: Already exists
751fb563feef: Already exists
8145f1a2090b: Already exists
575600a5843d: Already exists
035deb98f67f: Already exists
2e1f8c7e36ce: Already exists
3cf27705cd77: Pull complete
d4e37a9633b1: Pull complete
1aab1e953ef2: Pull complete
31afde0ced92: Pull complete
253eadce8153: Pull complete
750606d876c8: Pull complete
f96cc19c204f: Pull complete
eea9946ffb66: Pull complete
da59d6a4a8bd: Pull complete
Digest: sha256:4e5d763dfb99ecd95128d1033e14bb4740613045c89bb2646006ac7db08f5a6f
Status: Downloaded newer image for 192.168.20.135:5000/fengjian/nginx20170203:v1
192.168.20.209启动一个容器
[root@docker ~ ]# docker run -d -p 8081:80 --name nginx 192.168.20.135:5000/fengjian/nginx20170203:v1
[root@docker ~ ]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
7539cd87c9bd 192.168.20.135:5000/fengjian/nginx20170203:v1 "/usr/bin/supervis..." 2 minutes ago Up 2 minutes 22/tcp, 0.0.0.0:8081->80/tcp nginx
登陆到容器中
[root@docker overlay]# docker exec -it nginx /bin/bash
容器nginx启动正常
[root@7539cd87c9bd nginx-1.11.2]# ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 17:21 ? 00:00:00 /usr/bin/python2 /usr/bin/supervisord -n -c /etc/supervisord.conf
root 9 1 0 17:21 ? 00:00:00 nginx: master process /data/nginx/sbin/nginx
nobody 10 9 0 17:21 ? 00:00:00 nginx: worker process
root 88 0 1 17:25 ? 00:00:00 /bin/bash
root 104 1 0 17:25 ? 00:00:00 /data/nginx/sbin/nginx
root 105 88 0 17:25 ? 00:00:00 ps -ef
注: registry服务器,暂时看不到上传的image镜像。已经存在的镜像,在
[root@registry repositories]# pwd
/data/registry/docker/registry/v2/repositorie
docker registry https服务
1. 启动registry仓库的镜像,与上面相同
[root@registry ~]# docker run -d -p 5000:5000 -v /opt/registry:/var/lib/registry --restart=always --name registry registry:latest
2. 关闭 /usr/lib/systemd/system/docker.service 配置文件中 "--insecure-registry=192.168.20.135:5000" [root@registry ~]# systemctl daemon-reload [root@registry ~]# systemctl restart docker.service 3. 启动 nginx容器 映射443端口 [root@registry ~]# docker pull nginx (也可以自己制作nginx镜像) 运行nginx容器 [root@registry ~]# docker run -d -p 443:443 --name nginx nginx:latest 4. 修改nginx 配置文件,已经添加域名证书 [root@registry ~]# docker cp nginx.conf /etc/nginx/nginx.conf [root@registry ~]# docker cp sslkey /etc/nginx/
5. 登陆到容器中重新启动nginx [root@123131nginx ~]# /etc/init.d/nginx restart ######################## nginx.conf 配置文件 events { worker_connections 1024; } http { upstream docker-registry { server 192.168.20.135:5000; } server { listen 443 ssl; server_name docker.cinyi.com; ssl_certificate /data/nginx/sslkey/cinyi.crt; ssl_certificate_key /data/nginx/sslkey/cinyi.key; client_max_body_size 0; chunked_transfer_encoding on; location / { proxy_pass http://docker-registry; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 900; } } }
6. 在 192.168.20.209 服务器上,查看镜像,对镜像打tag,然后push 到registry
[root@docker1 ~]# docker images
[root@docker1 ~]# docker tag senyint/im-web docker.cinyi.com:443/senyint/im-web:443
[root@docker1 ~]# docker push docker.cinyi.com:443/senyint/im-web:443
查看registry 里面存储的镜像 使用 Registry V2 API。可以列出所有镜像: curl http://<私有registry地址>/v2/_catalog 例如 [root@docker225 ~]# curl https://docker.cinyi.com/v2/_catalog {"repositories":["fengjian/nginx20170203","mysql20170203","senyint/centos7.3","senyint/im-web","senyint/nginx"]}
查看registry 里面存储的镜像tag 使用 Registry V2 API。可以列出所有镜像: curl GET <protocol>://<registry_host>/v2/<镜像名>/tags/list 例如 [root@docker225 ~]# curl GET https://docker.cinyi.com/v2/senyint/im-web/tags/list {"name":"senyint/im-web","tags":["latest","443"]}
删除docker.cinyi.com docker registry的镜像
1.在启动仓库时,需在配置文件中的storage配置中增加delete=true配置项,允许删除镜像
[root@registry ~]#tail -f /etc/docker/registry/config.yml文件 ,修改容器yml文件后,一直显示在报错,后续在处理
storage:
delete:
enabled: true
2. 拿到disgest_hash参数 curl --header "Accept: application/vnd.docker.distribution.manifest.v2+json" -I -X GET https://docker.cinyi.com/v2/senyint/nginx/manifests/latest HTTP/1.1 200 OK Server: nginx/1.11.2 Date: Wed, 15 Feb 2017 01:24:56 GMT Content-Type: application/vnd.docker.distribution.manifest.v2+json Content-Length: 3669 Connection: keep-alive Docker-Content-Digest: sha256:609a595020f0827301064ebc07b3ec3a5751641ef975a7a186518cf6b0d70f63 Docker-Distribution-Api-Version: registry/2.0 Etag: "sha256:609a595020f0827301064ebc07b3ec3a5751641ef975a7a186518cf6b0d70f63" X-Content-Type-Options: nosniff 3.复制disgest_hash Docker-Content-Digest: <digest_hash>
Docker-Content-Digest: sha256:609a595020f0827301064ebc07b3ec3a5751641ef975a7a186518cf6b0d70f63
4.删除registry镜像
curl -I -X DELETE <protocol>://<registry_host>/v2/<repo_name>/manifests/<digest_hash>
[root@docker225 ~]# curl -I -X DELETE https://docker.cinyi.com/v2/senyint/im-web/manifests/sha256:609a595020f0827301064ebc07b3ec3a5751641ef975a7a186518cf6b0d70f63
第二种方法
1. 打开镜像的存储目录, 删除镜像文件夹
[root@registry repositories]# docker exec registry rm -rf senyint
2.执行垃圾回收操作
[root@registry repositories]# docker exec registry /bin/registry garbage-collect /etc/docker/registry/config.yml
3. 重启容器
[root@registry repositories]# docker restart registry
docker-compose编排工具安装,一次启动多个容器。
#对安装好的pip进行一次升级 pip install --upgrade pip 安装docker-compose pip install docker-compose 运行docker-compose 出现报错 pkg_resources.DistributionNotFound: backports.ssl-match-hostname>=3.5 使用pip 更新backports.ssl-match-hostname的版本 pip install --upgrade backports.ssl_match_hostname 更新backports.ssl_match_hostname 到3.5版本后问题解决
[root@docker1 certs]# docker-compose up
ERROR:
Can't find a suitable configuration file in this directory or any
parent. Are you in the right directory?
Supported filenames: docker-compose.yml, docker-compose.yaml
编写docker-compose.yml 文件
[root@docker1 second]# vim docker-compose.yml
mysql:
image: fengjian/mysql:5.5
ports:
- "3306:3306"
volumes:
- /var/lib/docker/vfs/dir/dataxc:/var/lib/mysql
hostname: mydb.server.com
tomcat:
image: tomcat
ports:
- "8080:8080"
links:
- mysql:db
environment:
- TOMCAT_USER=admin
- TOMCAT_PASS=admin
hostname: tomcat.server.com
在后台启动,在docker-compose.yml 下启动
[root@docker1 second]# docker-compose up -d
查看启动的容器
[root@docker1 second]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
5b844baf351e tomcat "catalina.sh run" 6 minutes ago Up 6 minutes 0.0.0.0:8080->8080/tcp second_tomcat_1
f88ccf720119 fengjian/mysql:5.5 "/scripts/start" 6 minutes ago Up 6 minutes 22/tcp, 0.0.0.0:3306->3306/tcp second_mysql_1
停掉2个container
[root@docker1 second]# docker-compose stop
通过ps 查看通过docker-compose启动的有那些container。
[root@docker1 second]# docker-compose ps
Name Command State Ports
----------------------------------------------------
second_mysql_1 /scripts/start Exit 137
second_tomcat_1 catalina.sh run Exit 143
删除通过docker-compose建立的2个container.
[root@docker1 second]# docker-compose rm
Name Command State Ports
----------------------------------------------------
second_mysql_1 /scripts/start Exit 137
second_tomcat_1 catalina.sh run Exit 143
通过docker仓库自动构建(jenkins)
构建jenkins 镜像
构建maven镜像:
[root@docker /]# mkdir maven-tar
[root@docker /]# cd maven-tar/
[root@docker maven-tar]# wget http://mirror.bit.edu.cn/apache/maven/maven-3/3.3.9/binaries/apache-maven-3.3.9-bin.tar.gz
docker最大的优势在于部署,jenkins最强大的在于作业调度和插件系统,如何结合两者?
创建一个jenkins镜像
apache-maven-3.3.9-bin.tar.gz Dockerfile jdk.tar.gz jenkins.war rc.local settings.xml supervisor_tomcat.conf tomcat
DockerFile 文件
FROM centos7.3:20170204 MAINTAINER fengjian <fengjian@senyint.com> # Install maven ADD apache-maven-3.3.9-bin.tar.gz /data/ ADD jdk.tar.gz /data/ COPY tomcat /data/tomcat COPY jenkins.war /data/tomcat/webapps/ COPY settings.xml /data/maven/conf/settings.xml ADD supervisor_tomcat.conf /etc/supervisor.conf.d/tomcat.conf
supervisor tomcat的启动配置文件
[root@docker maven-tar]# vim supervisor_tomcat.conf [program:tomcat] directory=/ command=/data/tomcat/bin/catalina.sh start user=root autostart=true autorestart=true stdout_logfile=/var/log/supervisor/%(program_name)s.log stderr_logfile=/var/log/supervisor/%(program_name)s.log ~
tomcat 启动文件 vim /data/tomcat/bin/catalina.sh
export JENKINS_HOME="/data/jenkins_home" export JAVA_HOME=/data/jdk export JRE_HOME=${JAVA_HOME}/jre export CLASSPATH=.:${JAVA_HOME}/lib:${JRE_HOME}/lib # OS specific support. $var _must_ be set to either true or false.
创建jenkins镜像, 启动jenkins镜像
[root@docker ~]# docker build -t jenkins . [root@docker ~]# docker run -d -p 8080:80 --name jenkins jenkins
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170204164737901-1939629342.png)
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170204184055761-158416315.png)
把 container 容器 打包成镜像
1. 关闭jenkins [root@docker ~ ]# docker stop jenkins root@docker maven-tar]# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 9174cf36cdfc jenkins "/usr/bin/supervis..." 2 hours ago Up About an hour 22/tcp, 0.0.0.0:8080->80/tcp jenkins 2. 把容器打包成镜像 [root@docker ~ ]# docker commit 9174cf36cdfc jenkins20170204
3. 查看新的jenkins 镜像
[root@docker ~] docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
jenkins20170204 latest 5254a69cb614 41 seconds ago 1.62 GB
jenkins镜像里内置了docker client命令行工具,/usr/bin/docker
,因此我们只需要传递 DOCKER_HOST
环境变量 或者映射 docker.sock
文件给jenkins容器,就可以让jenkins容器里面拥有docker的操作能力,进而将两者结合起来。
创建jenkins 新的镜像,把/usr/bin/docker 和 /var/run/docker.sock 映射给 jenkins 容器
创建jenkins 新的镜像,把/usr/bin/docker 和 /var/run/docker.sock 映射给 jenkins 容器
docker run -d -p 8080:80 -v /usr/bin/docker:/usr/bin/docker -v /var/run/docker.sock:/var/run/docker.sock --name jenkins20170204 jenkins20170204:latest
登陆到jenkins容器中,查看jenkins 进程是否启动
[root@docker ~]# docker exec -it jenkins20170204 /bin/bash
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170204185552104-1770210021.png)
测试docker 是否可用
解决办法:
yum install libtool-ltdl-devel
再次执行,查看启动的容器
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170204185943729-1714511691.png)
查看镜像
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170204190010386-267433877.png)
打开浏览器,通过jenkins,把build-nginx git到jenkins本地后,打包成镜像。
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170204190758823-1782167741.png)
注意 $WORKSPACE是指定的 git 下载的路径名称:比如 build-nginx
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170204190829808-1061931717.png)
开始构建
已经生成镜像。
java项目实现流程
1.jenkins 新建一个项目
2.从git仓库把项目克隆到本地
3.通过docker构建成镜像
4.上传到registry服务器
5.client 通过 docker pull registry镜像到本地,启动容器。
6.测试环境,研发环境,通过images传递。
分成三层: 1. 基础镜像
2. 中间件镜像
3. 应用镜像
构建java项目docker镜像,首先 把java 用maven 编译,并且构建成镜像,通过 docker cp命令把war包拷贝 到中间件。
FROM centos7.3:20170204 MAINTAINER fengjian <fengjian@senyint.com> # Install maven ADD apache-maven-3.3.9-bin.tar.gz /data/ ADD jdk.tar.gz /data #COPY tomcat /data/tomcat #COPY jenkins.war /data/tomcat/webapps/ COPY apache-maven-3.3.9 /data/maven COPY settings.xml /data/maven/conf/settings.xml CMD ["source /etc/profile"] #ADD supervisor_tomcat.conf /etc/supervisor.conf.d/tomcat.conf ADD hello /hello RUN cd /hello && \ /data/maven/bin/mvn install package
1.构建maven镜像,已经通过mvn install package 编译java代码 [root@docker ~]# docker build -t senyint/maven:v1 2.创建 maven 容器,但是不启动 [root@docker ~]# docker create --name maven senyint/maven:v1 3.把hello.war 的包 从maven容器中拷贝出来 [root@docker ~]# docker cp maven:/hello/target/hello.war .
#########################################################################################################################################################################################################
自己总结
分成三层: 1. 基础镜像 centos:7.3 supervisor
2. 中间件镜像 java maven tomcat
3. 应用镜像 java项目 war包 (jenkins ........)
1. centos7.3 基础镜像
Dockerfile centos7.3基础镜像
FROM centos:latest MAINTAINER fengjian <fengjian@senyint.com> ENV TZ "Asia/Shanghai" ENV TERM xterm ADD 1.repo /etc/yum.repos.d/1.repo ADD aliyun-mirror.repo /etc/yum.repos.d/CentOS-Base.repo ADD aliyun-epel.repo /etc/yum.repos.d/epel.repo RUN yum install -y curl openssl* wget libtool-ltdl-devel tar bzip2 unzippasswd sudo yum-utils hostname net-tools && \ yum install -y gcc gcc-c++ git make automake cmake patch logrotate python-devel libpng-devel libjpeg-devel && \ yum install -y --enablerepo=epel pwgen python-pip && \ yum clean all RUN pip install -i https://pypi.tuna.tsinghua.edu.cn/simple supervisor ADD supervisord.conf /etc/supervisord.conf RUN mkdir -p /etc/supervisor.conf.d && \ mkdir -p /var/log/supervisor ENTRYPOINT ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisord.conf"]
supervisord.conf 配置文件 [root@docker centos7]# cat supervisord.conf [unix_http_server] file=/var/run/supervisor.sock ; (the path to the socket file) chmod=0700 ; socket file mode (default 0700) [supervisord] logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log) logfile_maxbytes=50MB logfile_backup=10 loglevel=info pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid) nodaemon=true ; (Start in foreground if true; default false) minfds=1024 ; (min. avail startup file descriptors;default 1024) minprocs=200 ; (min. avail process descriptors;default 200) [rpcinterface:supervisor] supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface [supervisorctl] serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL for a unix socket [include] files = /etc/supervisor.conf.d/*.conf
二.中间件镜像
[root@docker jdk]# ls
Dockerfile jdk.tar.gz maven.tar.gz profile supervisor_tomcat.conf tomcat.tar.gz
[root@docker jdk]# vim profile 最底部添加环境变量 export JRE_HOME=${JAVA_HOME}/jre export CLASSPATH=.:${JAVA_HOME}/lib:${JRE_HOME}/lib export PATH=$JAVA_HOME/bin:$JRE_HOME/bin:$JAVA_HOME:$PATH MAVEN_HOME=/data/maven export MAVEN_HOME export PATH=${PATH}:${MAVEN_HOME}/bin
[root@docker jdk]# vim supervisor_tomcat.conf 用于启动tomcat [program:tomcat] directory=/ command=/data/tomcat/bin/catalina.sh start user=root autostart=true autorestart=true stdout_logfile=/var/log/supervisor/%(program_name)s.log stderr_logfile=/var/log/supervisor/%(program_name)s.log
[root@docker jdk]# vim Dockerfile
FROM senyint/centos7.3
MAINTAINER fengjian <fengjian@senyint.com.com>
ENV JAVA_HOME /data/jdk
ENV JRE_HOME ${JAVA_HOME}/jre
ENV CLASSPATH .:${JAVA_HOME}/lib:${JRE_HOME}/lib
ENV MAVEN_HOME /data/maven
ENV PATH ${PATH}:${MAVEN_HOME}/bin:$JAVA_HOME/bin:$JRE_HOME/bin:$JAVA_HOME:$PATH
RUN mkdir -p /data/webserver
ADD maven.tar.gz /data
ADD jdk.tar.gz /data
ADD tomcat.tar.gz /data
ADD profile /etc
#ADD env.sh /etc/profile.d/
ADD supervisord.conf /etc/supervisord.conf
ADD supervisor_tomcat.conf /etc/supervisor.conf.d/tomcat.conf
RUN mkdir -p /etc/supervisor.conf.d && \
mkdir -p /var/log/supervisor
ENTRYPOINT ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisord.conf"]
FROM docker.cinyi.com:443/centos7.3 #维护者 MAINTAINER fengjian <fengjian@senyint.com> #设置一个时区的环境变量 ENV TZ "Asia/Shanghai" #虚拟终端 ENV TERM xterm ENV JAVA_HOME /data/jdk ENV JRE_HOME ${JAVA_HOME}/jre ENV CLASSPATH .:${JAVA_HOME}/lib:${JRE_HOME}/lib ENV MAVEN_HOME /data/maven ENV PATH ${PATH}:${MAVEN_HOME}/bin:$JAVA_HOME/bin:$JRE_HOME/bin:$JAVA_HOME:$PATH RUN mkdir -p /data/webserver ADD jdk.tar.gz /data ADD tomcat.tar.gz /data Add host.sh /data ADD profile /etc RUN chmod +x /data/host.sh ; /data/host.sh EXPOSE 80 ENTRYPOINT ["/data/tomcat/bin/catalina.sh", "run" ]
[root@docker jdk]# docker build -t senyint/tomcat:v1 .
启动容器测试 java 环境变量 [root@docker jdk]# docker run -d -p 11112:80 --name tomcat1 senyint/tomcat:v1
[root@docker jdk]# docker exec -it tomcat1 /bin/bash
[root@docker jdk]# java -version 显示java版本
[root@docker jdk]# mvn -version 显示maven版本
3构建应用
(1)构建jenkins
jenkins Dockerfile文件
[root@docker jenkins]# vim Dockerfile
FROM senyint/java1.8:latest
MAINTAINER fengjian <fengjian@senyint.com.com>
ENV JENKINS_HOME /data/jenkins_home
ADD profile /etc/
ADD jenkins.war /data/webserver/
RUN unzip /data/webserver/jenkins.war -d /data/webserver && \
rm /data/webserver/jenkins.war
VOLUME /data/jenkins_home
构建jenkins镜像 [root@docker jenkins]# docker build -t senyint/jenkins . 启动 jenkins 并且登陆到容器中 [root@docker jenkins]# docker run -d -p 11111:80 -v /usr/bin/docker:/usr/bin/docker -v /var/run/docker.sock:/var/run/docker.sock -v /docker_project:/docker_project --name jenkins senyint/jenkins
-v /docker_project:/docker_project 这个是把/docker_project 目录映射到 jenkins 容器中, jenkins容器 编译完war包后,通过cp命令拷贝到 /docker_project/java工程目录/ ,通过senyint/tomcat镜像构建java项目镜像。
[root@docker jenkins]# docker exec -it jenkins/bin/bash
使用docker命令,
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170209143132619-812231306.png)
以下为jenkins 配置,以及 docker 对im-web项目进行编译,构建im-web镜像,并且推送到registry.
从git 仓库 下载java项目代码
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170209153959119-1842254905.png)
构建时出现操作方法
![](https://images2015.cnblogs.com/blog/886010/201703/886010-20170317132840260-35752522.png)
registry="docker.cinyi.com:443"
#取出项目目录
javadir=`echo $WORKSPACE | awk -F'/' '{print $5}'`
#取出war包名称
javaname=`ls $WORKSPACE/target/*war | awk -F'/' '{print $7}' | cut -d . -f 1`
mkdir -p /data/docker_project/$javadir
rm /data/docker_profile/$javadir/$javaname.war -rf
mv $WORKSPACE/target/$javaname.war /data/docker_project/$javadir
#在/data/docker_project 目录下有一个dockerfile模版,根据war包的名字替换成新的dockerfile
sed "s/jenkins/$javaname/g" /data/docker_project/Dockerfile >/data/docker_project/$javadir/Dockerfile
if docker images | grep $javaname ; then
docker rmi -f docker.cinyi.com:443/senyint/$javaname
fi
docker build -t docker.cinyi.com:443/senyint/$javaname /data/docker_project/$javadir/
docker push docker.cinyi.com:443/senyint/$javaname
#定义namespace 为test:
k8s_apicurl="curl --cacert /root/ca.pem"
k8s_url="https://192.168.20.227:6443"
#创建namespaces
if ! `$k8s_apicurl -H "Authorization: Bearer 199e9c8d4ce99c61" -X GET $k8s_url/api/v1/namespaces | grep test >/dev/null` ;then
$k8s_apicurl -H "Authorization: Bearer 199e9c8d4ce99c61" -H "content-Type: application/yaml" -X POST $k8s_url/api/v1/namespaces -d "$(cat /root/namespaces.yaml)"
fi
#创建service
if ! `$k8s_apicurl -H "Authorization: Bearer 199e9c8d4ce99c61" -X GET $k8s_url/api/v1/namespaces/test/services | grep "im-web" >/dev/null` ; then
$k8s_apicurl -H "Authorization: Bearer 199e9c8d4ce99c61" -H "content-Type: application/yaml" -X POST $k8s_url/api/v1/namespaces/test/services -d "$(cat /root/im-web_service.yaml)"
fi
#创建deployment
if ! `$k8s_apicurl -H "Authorization: Bearer 199e9c8d4ce99c61" -X GET $k8s_url/apis/extensions/v1beta1/namespaces/test/deployments | grep "im-web" >/dev/null` ; then
$k8s_apicurl -H "Authorization: Bearer 199e9c8d4ce99c61" -H "content-Type: application/yaml" -X POST $k8s_url/apis/extensions/v1beta1/namespaces/test/deployments/ -d "$(cat /root/im-web_deployment.yaml)"
fi
把docker 命令 sock 直接挂载到容器中,进行打包,做成镜像。
docker run -d -p 80:80 --restart=always -v /usr/bin/docker:/usr/bin/docker -v /var/run/docker.sock:/var/run/docker.sock -v /data/docker_project:/data/docker_project -v /data/jenkins_home:/data/jenkins_home -v /etc/sysconfig/docker:/etc/sysconfig/docker senyint/jenkins
登陆到容器中,出现docker-client, docker版本是1.12.6
[root@6882772021f0 /]# docker ps -a
You don't have either docker-client or docker-client-latest installed. Please install either one and retry.
1.13版本好像没有问题,1.12.6在容器中yum install docker-client
[root@6882772021f0 /]# yum -y install docker-client
###################################################################################
docker资源隔离 使用linux LXC容器技术,主要是使用namespace(命名空间)
kernel namespace(资源隔离) 分为
1.PID,通过pid 隔离,容器有自己独立的进程表和1号进程
2.net,通过网络隔离,容器有自己独立的network info
3.ipc,进程间的交互方法,在ipc通信时,需要加入额外信息来标识进程
4.mnt, 类似chroot,每个容器有自己唯一的目录挂载
5.uts, 可以让容器拥有自己的hostname 和domain
6.user, 可以拥有不通的用户,组
docker 网络模式 1. Nat 网络地址转换 2. Host
创建host网络, 和宿主机的网络相同
[root@docker data]# docker run -d --name centos7-host --net=host centos7.3:20170204
3.other container
容器之间相互通信十分频繁,可以使用这种模式,container网络特点
1.与主机网络空间隔离
2.容器间共享网络空间
3.适合容器间网络通信频繁。
[root@docker data]# docker run -d --name centos7-nat centos7.3:20170204 nat模式
[root@docker data]# docker run -d --name centos-container --net=container:centos7-nat centos7.3:20170204
centos-container容器的 ip地址 与 centos7-nat 的地址相同
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170209183926994-1864224634.png)
4. none docker 容器 无网络配置,可自行配置。
[root@docker data]# docker run -d --name centos-none --net=none centos7.3:20170204
登陆到容器后,没有eth0
5. overlay
![](https://images2015.cnblogs.com/blog/886010/201702/886010-20170209184030166-868907490.png)
overlay 网络特点
1. 跨主机通信
2.无需做端口管理
3.无需担心IP冲突
Consul介绍
Consul 提供了分布式系统的服务发现和配置的解决方案。基于go语言实现。并且在git上开放了源码。consul还包括了分布式一致协议的实现,健康检查和管理UI.
Consul Agent Server、Client介绍
通过运行 consul agent 命令,可以通过后台守护进程的方式运行在所有consul集群节点中。以server或者client 模式运行。并且以HTTP或者DNS 接口方式,
负责运行检查和服务同步。Server模式的agent负责维护consul集群状态,相应RPC查询,并且还要负责和其他数据中心进行WAN Gossips交换。client 节点是
相对无状态的,Client的唯一活动就是转发请求给Server节点,以保持低延迟和少资源消耗。
openvswitch docker 配置
测试环境 ens32:192.168.20.209 docker0:10.0.1.1/24
ens32:192.168.20.135 docker0:10.0.2.1/24
ens32:192.168.20.223 docker0:10.0.3.1/24
ens32:192.168.20.224 docker0:10.0.4.1/24
192.168.20.20服务器操作
[root@docker ~]# rpm -ivh openvswitch-2.5.0-2.el7.x86_64.rpm
warning: openvswitch-2.5.0-2.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID fac8d3c0: NOKEY
error: Failed dependencies:
libatomic.so.1()(64bit) is needed by openvswitch-2.5.0-2.el7.x86_64
[root@docker ~]# yum -y install libatomic
[root@docker ~]# systemctl start openvswitch.service
[root@docker ~]# systemctl status openvswitch.service
openvswitch.service - Open vSwitch
Loaded: loaded (/usr/lib/systemd/system/openvswitch.service; disabled; vendor preset: disabled)
Active: active (exited) since Sat 2017-02-11 10:00:11 CST; 17s ago
Process: 3854 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
Main PID: 3854 (code=exited, status=0/SUCCESS)
Feb 11 10:00:11 docker systemd[1]: Starting Open vSwitch...
Feb 11 10:00:11 docker systemd[1]: Started Open vSwitch.
[root@docker ~]# yum -y install bridge-utils
[root@docker ~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.0242fabe521c no
#创建一个新的网桥
[root@docker ~]# ovs-vsctl add-br br0
#将网络设备端口添加到桥接器
[root@docker ~]# ovs-vsctl add-br br0
[root@docker ~]# ovs-vsctl add-port br0 gre0 -- set interface gre0 type=gre option:remote_ip=192.168.20.135
包括以下命令
[root@docker ~]# ovs-vsctl show
6fde4aed-708a-4ecc-882a-a415b3b3ac3d
Bridge "br0"
Port "br0"
Interface "br0"
type: internal
Port "gre0"
Interface "gre0"
type: gre
options: {remote_ip="192.168.20.135"}
ovs_version: "2.5.0"
#[root@docker ~]# ovs-vsctl del-br br0
#添加br0到本地docker0,使容器流量通过openvswitc的隧道流出
[root@docker ~]# brctl addif docker0 br0
[root@docker ~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.0242fabe521c no br0
[root@docker ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:84:42:8d brd ff:ff:ff:ff:ff:ff
inet 192.168.20.209/24 brd 192.168.20.255 scope global ens32
valid_lft forever preferred_lft forever
inet6 fe80::250:56ff:fe84:428d/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN
link/ether 02:42:fa:be:52:1c brd ff:ff:ff:ff:ff:ff
inet 10.0.1.1/24 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:faff:febe:521c/64 scope link
valid_lft forever preferred_lft forever
422: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether c6:82:46:70:bc:d1 brd ff:ff:ff:ff:ff:ff
424: gre0@NONE: <NOARP> mtu 1476 qdisc noop state DOWN
link/gre 0.0.0.0 brd 0.0.0.0
425: gretap0@NONE: <BROADCAST,MULTICAST> mtu 1462 qdisc noop state DOWN qlen 1000
link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
426: br0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master docker0 state DOWN
link/ether 8e:63:55:ec:3b:41 brd ff:ff:ff:ff:ff:ff
#启用docker0 和 br0 网卡
[root@docker ~]# ip link set dev br0 up
[root@docker ~]# ip link set dev docker0 up
添加一条路由,所有去10.0.0.0/8 的网络从docker0出
[root@docker ~]# ip route add 10.0.0.0/8 dev docker0
启动一个容器
[root@docker ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
centos7.3 20170204 1d6f132807d0 6 days ago 530 MB
[root@docker ~]# docker run -d --name 209test centos7.3:20170204
登录到容器中
[root@docker ~]# docker exec -it 209test /bin/bash
查看ip地址
[root@464241f535e2 /]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.1.2 netmask 255.255.255.0 broadcast 0.0.0.0
inet6 fe80::42:aff:fe00:102 prefixlen 64 scopeid 0x20<link>
ether 02:42:0a:00:01:02 txqueuelen 0 (Ethernet)
RX packets 720 bytes 68496 (66.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 693 bytes 65706 (64.1 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
#ping 192.168.20.135 服务器容器的IP地址
[root@464241f535e2 /]# ping 10.0.2.2
PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data.
64 bytes from 10.0.2.2: icmp_seq=1 ttl=63 time=0.451 ms
64 bytes from 10.0.2.2: icmp_seq=2 ttl=63 time=0.493 ms
From 10.0.1.1 icmp_seq=3 Redirect Host(New nexthop: 10.0.2.2)
From 10.0.1.1: icmp_seq=3 Redirect Host(New nexthop: 10.0.2.2)
出现以上问题,过一会,就恢复正常。
##############################################################################################
192.168.20.135、223、224 服务器操作
[root@registry ~]# rpm -ivh openvswitch-2.5.0-2.el7.x86_64.rpm
warning: openvswitch-2.5.0-2.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID fac8d3c0: NOKEY
error: Failed dependencies:
libatomic.so.1()(64bit) is needed by openvswitch-2.5.0-2.el7.x86_64
[root@registry ~]# yum -y install libatomic
[root@registry ~]# systemctl start openvswitch.service
[root@registry ~]# systemctl status openvswitch.service
● openvswitch.service - Open vSwitch
Loaded: loaded (/usr/lib/systemd/system/openvswitch.service; disabled; vendor preset: disabled)
Active: active (exited) since Sat 2017-02-11 10:00:11 CST; 17s ago
Process: 3854 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
Main PID: 3854 (code=exited, status=0/SUCCESS)
Feb 11 10:00:11 registry systemd[1]: Starting Open vSwitch...
Feb 11 10:00:11 registry systemd[1]: Started Open vSwitch.
[root@registry ~]# yum -y install bridge-utils
[root@registry ~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.0242fabe521c no
#创建一个新的网桥
[root@registry ~]# ovs-vsctl add-br br0
#将网络设备端口添加到桥接器
[root@registry ~]# ovs-vsctl add-br br0
[root@registry ~]# ovs-vsctl add-port br0 gre0 -- set interface gre0 type=gre option:remote_ip=192.168.20.209
包括以下命令,ovs-vsctl show 的结果与 192.168.20.209不一样
[root@registry ~]# ovs-vsctl show
19baf011-40aa-426c-a2b9-568101390834
Bridge "br0"
Port "gre0"
Interface "gre0"
type: gre
options: {remote_ip="192.168.20.209"}
Port "br0"
Interface "br0"
type: internal
ovs_version: "2.5.0"
####删除br0 [root@registry ~]# ovs-vsctl del-br br0
#添加br0到本地registry0,使容器流量通过openvswitc的隧道流出
[root@registry ~]# brctl addif docker0 br0
[root@registry ~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.0242fabe521c no br0
[root@registry ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:84:2b:fc brd ff:ff:ff:ff:ff:ff
inet 192.168.20.135/24 brd 192.168.20.255 scope global ens32
valid_lft forever preferred_lft forever
inet6 fe80::250:56ff:fe84:2bfc/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state DOWN
link/ether 02:42:5e:5d:06:3f brd ff:ff:ff:ff:ff:ff
inet 10.0.2.1/24 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:5eff:fe5d:63f/64 scope link
valid_lft forever preferred_lft forever
28: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether f2:fd:f4:39:e2:20 brd ff:ff:ff:ff:ff:ff
29: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state DOWN
link/ether 0a:29:1e:93:37:41 brd ff:ff:ff:ff:ff:ff
inet6 fe80::829:1eff:fe93:3741/64 scope link
valid_lft forever preferred_lft forever
#启用docker0 和 br0 网卡
[root@registry ~]# ip link set dev br0 up
[root@registry ~]# ip link set dev docker0 up
添加一条路由,所有去10.0.0.0/8 的网络从docker0出
[root@registry ~]# ip route add 10.0.0.0/8 dev docker0
#########################################################################################
192.168.20.223 服务器操作
[root@docker223~]# rpm -ivh openvswitch-2.5.0-2.el7.x86_64.rpm
warning: openvswitch-2.5.0-2.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID fac8d3c0: NOKEY
error: Failed dependencies:
libatomic.so.1()(64bit) is needed by openvswitch-2.5.0-2.el7.x86_64
[root@docker223~]# yum -y install libatomic
[root@docker223~]# systemctl start openvswitch.service
[root@docker223~]# systemctl status openvswitch.service
● openvswitch.service - Open vSwitch
Loaded: loaded (/usr/lib/systemd/system/openvswitch.service; disabled; vendor preset: disabled)
Active: active (exited) since Sat 2017-02-11 10:00:11 CST; 17s ago
Process: 3854 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
Main PID: 3854 (code=exited, status=0/SUCCESS)
Feb 11 10:00:11 docker223systemd[1]: Starting Open vSwitch...
Feb 11 10:00:11 docker223systemd[1]: Started Open vSwitch.
[root@docker223~]# yum -y install bridge-utils
[root@docker223~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.0242fabe521c no
#创建一个新的网桥
[root@docker223~]# ovs-vsctl add-br br0
#将网络设备端口添加到桥接器
[root@docker223~]# ovs-vsctl add-br br0
[root@docker223~]# ovs-vsctl add-port br0 gre1 -- set interface gre1 type=gre option:remote_ip=192.168.20.209
包括以下命令,ovs-vsctl show 的结果与 192.168.20.209不一样
[root@docker223~]# ovs-vsctl show
8256b14a-1da6-4781-b9aa-7c6612ce7ebf
Bridge "br0"
Port "gre1"
Interface "gre1"
type: gre
options: {remote_ip="192.168.20.209"}
Port "br0"
Interface "br0"
type: internal
ovs_version: "2.5.0"
####删除br0 [root@docker223~]# ovs-vsctl del-br br0
#添加br0到本地registry0,使容器流量通过openvswitc的隧道流出
[root@docker223~]# brctl addif docker0 br0
[root@docker223~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.0242fabe521c no br0
[root@docker223~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:84:2b:fc brd ff:ff:ff:ff:ff:ff
inet 192.168.20.223/24 brd 192.168.20.255 scope global ens32
valid_lft forever preferred_lft forever
inet6 fe80::250:56ff:fe84:2bfc/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state DOWN
link/ether 02:42:5e:5d:06:3f brd ff:ff:ff:ff:ff:ff
inet 10.0.3.1/24 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:5eff:fe5d:63f/64 scope link
valid_lft forever preferred_lft forever
28: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether f2:fd:f4:39:e2:20 brd ff:ff:ff:ff:ff:ff
29: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state DOWN
link/ether 0a:29:1e:93:37:41 brd ff:ff:ff:ff:ff:ff
inet6 fe80::829:1eff:fe93:3741/64 scope link
valid_lft forever preferred_lft forever
#启用docker0 和 br0 网卡
[root@docker223~]# ip link set dev br0 up
[root@docker223~]# ip link set dev docker0 up
添加一条路由,所有去10.0.0.0/8 的网络从docker0出
[root@docker223~]# ip route add 10.0.0.0/8 dev docker0
#########################################################################################
192.168.20.224 服务器操作
[root@docker224~]# rpm -ivh openvswitch-2.5.0-2.el7.x86_64.rpm
warning: openvswitch-2.5.0-2.el7.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID fac8d3c0: NOKEY
error: Failed dependencies:
libatomic.so.1()(64bit) is needed by openvswitch-2.5.0-2.el7.x86_64
[root@docker224~]# yum -y install libatomic
[root@docker224~]# systemctl start openvswitch.service
[root@docker224~]# systemctl status openvswitch.service
● openvswitch.service - Open vSwitch
Loaded: loaded (/usr/lib/systemd/system/openvswitch.service; disabled; vendor preset: disabled)
Active: active (exited) since Sat 2017-02-11 10:00:11 CST; 17s ago
Process: 3854 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
Main PID: 3854 (code=exited, status=0/SUCCESS)
Feb 11 10:00:11 docker223systemd[1]: Starting Open vSwitch...
Feb 11 10:00:11 docker223systemd[1]: Started Open vSwitch.
[root@docker223~]# yum -y install bridge-utils
[root@docker224~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.0242fabe521c no
#创建一个新的网桥
[root@docker224~]# ovs-vsctl add-br br0
#将网络设备端口添加到桥接器
[root@docker224~]# ovs-vsctl add-br br0
[root@docker224~]# ovs-vsctl add-port br0 gre1 -- set interface gre1 type=gre option:remote_ip=192.168.20.209
包括以下命令,ovs-vsctl show 的结果与 192.168.20.209不一样
[root@docker224~]# ovs-vsctl show
8256b14a-1da6-4781-b9aa-7c6612ce7ebf
Bridge "br0"
Port "gre2"
Interface "gre2"
type: gre
options: {remote_ip="192.168.20.209"}
Port "br0"
Interface "br0"
type: internal
ovs_version: "2.5.0"
####删除br0 [root@docker224~]# ovs-vsctl del-br br0
#添加br0到本地docker0,使容器流量通过openvswitc的隧道流出
[root@docker224~]# brctl addif docker0 br0
[root@docker224~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.0242fabe521c no br0
[root@docker224~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:84:2b:fc brd ff:ff:ff:ff:ff:ff
inet 192.168.20.224/24 brd 192.168.20.255 scope global ens32
valid_lft forever preferred_lft forever
inet6 fe80::250:56ff:fe84:2bfc/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state DOWN
link/ether 02:42:5e:5d:06:3f brd ff:ff:ff:ff:ff:ff
inet 10.0.4.1/24 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:5eff:fe5d:63f/64 scope link
valid_lft forever preferred_lft forever
28: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether f2:fd:f4:39:e2:20 brd ff:ff:ff:ff:ff:ff
29: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state DOWN
link/ether 0a:29:1e:93:37:41 brd ff:ff:ff:ff:ff:ff
inet6 fe80::829:1eff:fe93:3741/64 scope link
valid_lft forever preferred_lft forever
#启用docker0 和 br0 网卡
[root@docker224~]# ip link set dev br0 up
[root@docker224~]# ip link set dev docker0 up
添加一条路由,所有去10.0.0.0/8 的网络从docker0出
[root@docker224~]# ip route add 10.0.0.0/8 dev docker0
总结,192.168.20.209 在br0 上添加 gre0 gre1 gre2 ,对应关系如下, 而192.168.20.135 br0添加gre0, 192.168.20.223 添加gre1, 192.168.20.224 添加gre2, 之后分别启动容器,不同容器的网段 可以相互ping通。
gr0 192.168.20.135
gr1 192.168.20.223
gr2 192.168.20.224
192.168.20.209自启动脚本
#!/bin/bash
systemctl start openvswitch.service
systemctl enable openvswitch.service
ovs-vsctl add-br br0
ovs-vsctl add-port br0 gre0 -- set interface gre0 type=gre option:remote_ip=192.168.20.135
ovs-vsctl add-port br0 gre1 -- set interface gre1 type=gre option:remote_ip=192.168.20.223
ovs-vsctl add-port br0 gre2 -- set interface gre2 type=gre option:remote_ip=192.168.20.224
ovs-vsctl show
brctl show
brctl addif docker0 br0
ip link set dev br0 up
ip link set dev docker0 up
ip route add 10.0.0./8 dev docker0
192.168.20.135自启动脚本
systemctl start openvswitch.service
systemctl enable openvswitch.service
ovs-vsctl add-br br0
ovs-vsctl add-port br0 gre0 -- set interface gre0 type=gre option:remote_ip=192.168.20.209
ovs-vsctl show
brctl show
brctl addif docker0 br0
ip link set dev br0 up
ip link set dev docker0 up
ip route add 10.0.0.0/8 dev docker0
192.168.20.223自启动脚本
systemctl start openvswitch.service
systemctl enable openvswitch.service
ovs-vsctl add-br br0
ovs-vsctl add-port br0 gre1 -- set interface gre1 type=gre option:remote_ip=192.168.20.209
ovs-vsctl show
brctl show
brctl addif docker0 br0
ip link set dev br0 up
ip link set dev docker0 up
ip route add 10.0.0.0/8 dev docker0
192.168.20.224自启动脚本
systemctl start openvswitch.service
systemctl enable openvswitch.service
ovs-vsctl add-br br0
ovs-vsctl add-port br0 gre1 -- set interface gre1 type=gre option:remote_ip=192.168.20.209
ovs-vsctl show
brctl show
brctl addif docker0 br0
ip link set dev br0 up
ip link set dev docker0 ip
ip route add 10.0.0.0/8 dev docker0