Dokcer使用总结（Dockerfile、Compose、Swarm）

转载自：https://www.cnblogs.com/wyt007/p/11154156.html

Dokcer基础

查看Linux版本

uname -r

查看Linux详尽信息

cat /etc/*elease

CentOS Linux release 7.6.1810 (Core) 
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

CentOS Linux release 7.6.1810 (Core) 
CentOS Linux release 7.6.1810 (Core)

CentOS Linux release 7.6.1810 (Core) 
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

CentOS Linux release 7.6.1810 (Core) 
CentOS Linux release 7.6.1810 (Core)

容器的五大隔离

pid：进程隔离
net：网络隔离（独有的ip地址，网关，子网掩码）
ipc：进程间交互隔离
mnt：文件系统隔离
uts：主机和域名隔离（hostname，domainname）container 有自己的机器名

centos上安装docker

官方地址：https://docs.docker.com/install/linux/docker-ce/centos/

卸载旧版本

sudo yum remove docker \
                  docker-client \
                  docker-client-latest \
                  docker-common \
                  docker-latest \
                  docker-latest-logrotate \
                  docker-logrotate \
                  docker-engine

安装包环境

sudo yum install -y yum-utils \
  device-mapper-persistent-data \
  lvm2

设置仓储地址

# 阿里云
sudo yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
# 官方
sudo yum-config-manager \
    --add-repo \
    https://download.docker.com/linux/centos/docker-ce.repo

安装Docker-CE

sudo yum install docker-ce docker-ce-cli containerd.io

启动Docker，运行开机自启

systemctl start docker
systemctl enable docker

Docker安装位置

查找Docker可执行程序地址 /usr/bin/docker

find / -name docker

/run/docker
/sys/fs/cgroup/pids/docker
/sys/fs/cgroup/cpuset/docker
/sys/fs/cgroup/freezer/docker
/sys/fs/cgroup/devices/docker
/sys/fs/cgroup/blkio/docker
/sys/fs/cgroup/perf_event/docker
/sys/fs/cgroup/memory/docker
/sys/fs/cgroup/net_cls,net_prio/docker
/sys/fs/cgroup/hugetlb/docker
/sys/fs/cgroup/cpu,cpuacct/docker
/sys/fs/cgroup/systemd/docker
/etc/docker
/var/lib/docker
/var/lib/docker/overlay2/ec5a827479e221461a396c7d0695226ec60b642544f2f921e2da967426b1853c/diff/docker
/var/lib/docker/overlay2/cf92e8387d988e9f87dc3656bb21d3a2fefff02e3505e1d282c0d105cb703ab1/merged/docker
/var/lib/docker/overlay2/df3551b1764d57ad79604ace4c1b75ab1e47cdca2fb6d526940af8b400eee4aa/diff/etc/dpkg/dpkg.cfg.d/docker
/usr/bin/docker
/usr/share/bash-completion/completions/docker
/docker

/run/docker
/sys/fs/cgroup/pids/docker
/sys/fs/cgroup/cpuset/docker
/sys/fs/cgroup/freezer/docker
/sys/fs/cgroup/devices/docker
/sys/fs/cgroup/blkio/docker
/sys/fs/cgroup/perf_event/docker
/sys/fs/cgroup/memory/docker
/sys/fs/cgroup/net_cls,net_prio/docker
/sys/fs/cgroup/hugetlb/docker
/sys/fs/cgroup/cpu,cpuacct/docker
/sys/fs/cgroup/systemd/docker
/etc/docker
/var/lib/docker
/var/lib/docker/overlay2/ec5a827479e221461a396c7d0695226ec60b642544f2f921e2da967426b1853c/diff/docker
/var/lib/docker/overlay2/cf92e8387d988e9f87dc3656bb21d3a2fefff02e3505e1d282c0d105cb703ab1/merged/docker
/var/lib/docker/overlay2/df3551b1764d57ad79604ace4c1b75ab1e47cdca2fb6d526940af8b400eee4aa/diff/etc/dpkg/dpkg.cfg.d/docker
/usr/bin/docker
/usr/share/bash-completion/completions/docker
/docker

查找Docker服务端程序 /usr/bin/dockerd

find / -name dockerd

/etc/alternatives/dockerd
/var/lib/alternatives/dockerd
/usr/bin/dockerd

/etc/alternatives/dockerd
/var/lib/alternatives/dockerd
/usr/bin/dockerd

lib + data： /var/lib/docker
config： /etc/docker

查找docker.service服务程序 /usr/lib/systemd/system/docker.service

find / -name docker.service

[root@localhost ~]# cat /usr/lib/systemd/system/docker.service
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
BindsTo=containerd.service
After=network-online.target firewalld.service containerd.service
Wants=network-online.target
Requires=docker.socket

[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always

# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
# Both the old, and new location are accepted by systemd 229 and up, so using the old location
# to make them work for either version of systemd.
StartLimitBurst=3

# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
# this option work for either version of systemd.
StartLimitInterval=60s

# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity

# Comment TasksMax if your systemd version does not supports it.
# Only systemd 226 and above support this option.
TasksMax=infinity

# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes

# kill only the docker process, not all processes in the cgroup
KillMode=process

[Install]
WantedBy=multi-user.target

解读dockerd配置文件

dockerd：https://docs.docker.com/engine/reference/commandline/dockerd/

硬盘挂载

使用 fdisk -l 命令查看主机上的硬盘

fdisk -l

[root@localhost ~]# fdisk -l

Disk /dev/vda: 53.7 GB, 53687091200 bytes, 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x000b0ebb

   Device Boot      Start         End      Blocks   Id  System
/dev/vda1   *        2048   104856254    52427103+  83  Linux

Disk /dev/vdb: 536.9 GB, 536870912000 bytes, 1048576000 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

[root@localhost ~]# fdisk -l

Disk /dev/vda: 53.7 GB, 53687091200 bytes, 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x000b0ebb

   Device Boot      Start         End      Blocks   Id  System
/dev/vda1   *        2048   104856254    52427103+  83  Linux

Disk /dev/vdb: 536.9 GB, 536870912000 bytes, 1048576000 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

使用mkfs.ext4命令把硬盘格式化

# mkfs.ext4    磁盘名称

mkfs.ext4   /dev/vdb

使用mount命令挂载磁盘
```
mount /dev/vdb /boot
```

输入指令： df -h 查看当前磁盘的情况

df -h

[root@localhost ~]# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        50G  7.4G   40G  16% /
devtmpfs        7.8G     0  7.8G   0% /dev
tmpfs           7.8G     0  7.8G   0% /dev/shm
tmpfs           7.8G  592K  7.8G   1% /run
tmpfs           7.8G     0  7.8G   0% /sys/fs/cgroup
overlay          50G  7.4G   40G  16% /var/lib/docker/overlay2/c76fb87ef4c263e24c7f6874121fb161ce9b22db572db66ff1992ca6daf5768b/merged
shm              64M     0   64M   0% /var/lib/docker/containers/afe151311ee560e63904e3e9d3c1053b8bbb6fd5e3b2d4c74001091b132fe3bd/mounts/shm
overlay          50G  7.4G   40G  16% /var/lib/docker/overlay2/5ca6ed8e1671cb590705f53f89af8f8f5b85a6cdfc8137b3e12e4fec6c76fcea/merged
shm              64M  4.0K   64M   1% /var/lib/docker/containers/79427c180de09f78e33974278043736fca80b724db8b9bce42e44656d04823b3/mounts/shm
tmpfs           1.6G     0  1.6G   0% /run/user/0
/dev/vdb        493G   73M  467G   1% /boot

[root@localhost ~]# df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        50G  7.4G   40G  16% /
devtmpfs        7.8G     0  7.8G   0% /dev
tmpfs           7.8G     0  7.8G   0% /dev/shm
tmpfs           7.8G  592K  7.8G   1% /run
tmpfs           7.8G     0  7.8G   0% /sys/fs/cgroup
overlay          50G  7.4G   40G  16% /var/lib/docker/overlay2/c76fb87ef4c263e24c7f6874121fb161ce9b22db572db66ff1992ca6daf5768b/merged
shm              64M     0   64M   0% /var/lib/docker/containers/afe151311ee560e63904e3e9d3c1053b8bbb6fd5e3b2d4c74001091b132fe3bd/mounts/shm
overlay          50G  7.4G   40G  16% /var/lib/docker/overlay2/5ca6ed8e1671cb590705f53f89af8f8f5b85a6cdfc8137b3e12e4fec6c76fcea/merged
shm              64M  4.0K   64M   1% /var/lib/docker/containers/79427c180de09f78e33974278043736fca80b724db8b9bce42e44656d04823b3/mounts/shm
tmpfs           1.6G     0  1.6G   0% /run/user/0
/dev/vdb        493G   73M  467G   1% /boot

用 blkid 获取磁盘的uuid和属性

[root@localhost ~]# blkid
/dev/vda1: UUID="105fa8ff-bacd-491f-a6d0-f99865afc3d6" TYPE="ext4" 
/dev/vdb: UUID="97a17b64-d025-478c-8981-105214e99ff4" TYPE="ext4"

设置开机自动mount

vim /etc/fstab

UUID=97a17b64-d025-478c-8981-105214e99ff4  /data  ext4  defaults  1  1

修改docker存储位置

创建或修改docker配置文件

# 创建或修改docker配置文件
vim /etc/docker/daemon.json

{
 "data-root": "/data/docker"
}

创建docker数据存储文件夹

# 创建docker数据存储文件夹
mkdir /data
mkdir /data/docker

停止Docker
```
# 停止Docker
service docker stop
```

拷贝存储文件

# 拷贝存储文件
cp -r /var/lib/docker/* /data/docker/

删除源文件

# 删除源文件(不建议先删除，后面没问题了再删除)
# rm -rf /var/lib/docker/

验证docker数据存储位置是否改变
```
# 验证docker数据存储位置是否改变
docker info
```
注意：最好在docker刚安装完就执行切换数据目录，不然等容器运行起来后里面的一些volume会还是使用的原来的

镜像加速器

sudo mkdir -p /etc/docker
vim /etc/docker/daemon.json

{
  "registry-mirrors": ["https://uwxsp1y1.mirror.aliyuncs.com"],
  "data-root": "/data/docker"
}

sudo systemctl daemon-reload
sudo systemctl restart docker

查看系统日志

# 修改配置信息
vim /etc/docker/daemon.json

{
  "registry-mirrors": ["https://uwxsp1y1.mirror.aliyuncs.com"],
  "data-root": "/data/docker",
  "debug":true
}


# journalctl 统一查看service所有的日志。
journalctl -u docker.service -f

远程连接docker deamon

修改docker.service启动信息

# 修改docker.service启动信息
vim /usr/lib/systemd/system/docker.service

# ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
ExecStart=/usr/bin/dockerd --containerd=/run/containerd/containerd.sock

修改daemon.json

#修改daemon.json
vim /etc/docker/daemon.json

{
  "registry-mirrors": ["https://uwxsp1y1.mirror.aliyuncs.com"],
  "data-root": "/data/docker",
  "debug":true,
  "hosts": ["192.168.103.240:6381","unix:///var/run/docker.sock"]
}

重载、重启

# 重载、重启
sudo systemctl daemon-reload
service docker restart

查看端口

# 查看端口
netstat -tlnp

[root@localhost docker]# netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 192.168.103.240:6381    0.0.0.0:*               LISTEN      27825/dockerd       
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd           
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      3743/dnsmasq        
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      3122/sshd           
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      3109/cupsd          
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      3479/master         
tcp        0      0 127.0.0.1:6010          0.0.0.0:*               LISTEN      14503/sshd: root@pt 
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd           
tcp6       0      0 :::22                   :::*                    LISTEN      3122/sshd           
tcp6       0      0 ::1:631                 :::*                    LISTEN      3109/cupsd          
tcp6       0      0 ::1:25                  :::*                    LISTEN      3479/master         
tcp6       0      0 ::1:6010                :::*                    LISTEN      14503/sshd: root@pt

远程连接测试

# 远程连接测试
docker -H 192.168.103.240:6381 ps

容器基础

docker container 中常用操控命令

docker run --help

[root@localhost ~]# docker run --help

Usage:    docker run [OPTIONS] IMAGE [COMMAND] [ARG...]

Run a command in a new container

Options:
      --add-host list                  Add a custom host-to-IP mapping (host:ip)
  -a, --attach list                    Attach to STDIN, STDOUT or STDERR
      --blkio-weight uint16            Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)
      --blkio-weight-device list       Block IO weight (relative device weight) (default [])
      --cap-add list                   Add Linux capabilities
      --cap-drop list                  Drop Linux capabilities
      --cgroup-parent string           Optional parent cgroup for the container
      --cidfile string                 Write the container ID to the file
      --cpu-period int                 Limit CPU CFS (Completely Fair Scheduler) period
      --cpu-quota int                  Limit CPU CFS (Completely Fair Scheduler) quota
      --cpu-rt-period int              Limit CPU real-time period in microseconds
      --cpu-rt-runtime int             Limit CPU real-time runtime in microseconds
  -c, --cpu-shares int                 CPU shares (relative weight)
      --cpus decimal                   Number of CPUs
      --cpuset-cpus string             CPUs in which to allow execution (0-3, 0,1)
      --cpuset-mems string             MEMs in which to allow execution (0-3, 0,1)
  -d, --detach                         Run container in background and print container ID
      --detach-keys string             Override the key sequence for detaching a container
      --device list                    Add a host device to the container
      --device-cgroup-rule list        Add a rule to the cgroup allowed devices list
      --device-read-bps list           Limit read rate (bytes per second) from a device (default [])
      --device-read-iops list          Limit read rate (IO per second) from a device (default [])
      --device-write-bps list          Limit write rate (bytes per second) to a device (default [])
      --device-write-iops list         Limit write rate (IO per second) to a device (default [])
      --disable-content-trust          Skip image verification (default true)
      --dns list                       Set custom DNS servers
      --dns-option list                Set DNS options
      --dns-search list                Set custom DNS search domains
      --entrypoint string              Overwrite the default ENTRYPOINT of the image
  -e, --env list                       Set environment variables
      --env-file list                  Read in a file of environment variables
      --expose list                    Expose a port or a range of ports
      --group-add list                 Add additional groups to join
      --health-cmd string              Command to run to check health
      --health-interval duration       Time between running the check (ms|s|m|h) (default 0s)
      --health-retries int             Consecutive failures needed to report unhealthy
      --health-start-period duration   Start period for the container to initialize before starting health-retries countdown (ms|s|m|h) (default 0s)
      --health-timeout duration        Maximum time to allow one check to run (ms|s|m|h) (default 0s)
      --help                           Print usage
  -h, --hostname string                Container host name
      --init                           Run an init inside the container that forwards signals and reaps processes
  -i, --interactive                    Keep STDIN open even if not attached
      --ip string                      IPv4 address (e.g., 172.30.100.104)
      --ip6 string                     IPv6 address (e.g., 2001:db8::33)
      --ipc string                     IPC mode to use
      --isolation string               Container isolation technology
      --kernel-memory bytes            Kernel memory limit
  -l, --label list                     Set meta data on a container
      --label-file list                Read in a line delimited file of labels
      --link list                      Add link to another container
      --link-local-ip list             Container IPv4/IPv6 link-local addresses
      --log-driver string              Logging driver for the container
      --log-opt list                   Log driver options
      --mac-address string             Container MAC address (e.g., 92:d0:c6:0a:29:33)
  -m, --memory bytes                   Memory limit
      --memory-reservation bytes       Memory soft limit
      --memory-swap bytes              Swap limit equal to memory plus swap: '-1' to enable unlimited swap
      --memory-swappiness int          Tune container memory swappiness (0 to 100) (default -1)
      --mount mount                    Attach a filesystem mount to the container
      --name string                    Assign a name to the container
      --network string                 Connect a container to a network (default "default")
      --network-alias list             Add network-scoped alias for the container
      --no-healthcheck                 Disable any container-specified HEALTHCHECK
      --oom-kill-disable               Disable OOM Killer
      --oom-score-adj int              Tune host's OOM preferences (-1000 to 1000)
      --pid string                     PID namespace to use
      --pids-limit int                 Tune container pids limit (set -1 for unlimited)
      --privileged                     Give extended privileges to this container
  -p, --publish list                   Publish a container's port(s) to the host
  -P, --publish-all                    Publish all exposed ports to random ports
      --read-only                      Mount the container's root filesystem as read only
      --restart string                 Restart policy to apply when a container exits (default "no")
      --rm                             Automatically remove the container when it exits
      --runtime string                 Runtime to use for this container
      --security-opt list              Security Options
      --shm-size bytes                 Size of /dev/shm
      --sig-proxy                      Proxy received signals to the process (default true)
      --stop-signal string             Signal to stop a container (default "SIGTERM")
      --stop-timeout int               Timeout (in seconds) to stop a container
      --storage-opt list               Storage driver options for the container
      --sysctl map                     Sysctl options (default map[])
      --tmpfs list                     Mount a tmpfs directory
  -t, --tty                            Allocate a pseudo-TTY
      --ulimit ulimit                  Ulimit options (default [])
  -u, --user string                    Username or UID (format: <name|uid>[:<group|gid>])
      --userns string                  User namespace to use
      --uts string                     UTS namespace to use
  -v, --volume list                    Bind mount a volume
      --volume-driver string           Optional volume driver for the container
      --volumes-from list              Mount volumes from the specified container(s)
  -w, --workdir string                 Working directory inside the container

docker run,docker exec

run可以让容器从镜像中实例化出来，实例化过程中可以塞入很多参数

Usage: docker run [OPTIONS] IMAGE [COMMAND] [ARG...]

docker run -d --name some-redis redis 外界无法访问，因为是网络隔离，默认bridge模式。

-a stdin: 指定标准输入输出内容类型，可选 STDIN/STDOUT/STDERR 三项；
-d: 后台运行容器，并返回容器ID；
-i: 以交互模式运行容器，通常与 -t 同时使用；
-P: 随机端口映射，容器内部端口随机映射到主机的高端口
-p: 指定端口映射，格式为：主机(宿主)端口:容器端口
-t: 为容器重新分配一个伪输入终端，通常与 -i 同时使用；
--name="nginx-lb": 为容器指定一个名称；
--dns 8.8.8.8: 指定容器使用的DNS服务器，默认和宿主一致；
--dns-search example.com: 指定容器DNS搜索域名，默认和宿主一致；
-h "mars": 指定容器的hostname；

-e username="ritchie": 设置环境变量；

# 设置东八区
docker run -e TZ=Asia/Shanghai -d --name some-redis redis

--env-file=[]: 从指定文件读入环境变量；
--cpuset="0-2" or --cpuset="0,1,2": 绑定容器到指定CPU运行；
-m :设置容器使用内存最大值；
--net="bridge": 指定容器的网络连接类型，支持 bridge/host/none/container:<name|id> 四种类型；
--link=[]: 添加链接到另一个容器；
--expose=[]: 开放一个端口或一组端口；

--volume , -v: 绑定一个卷

docker run -p 16379:6379 -d --name some-redis redis

--add-host: 添加自定义ip

# 场景：consul做健康检查的时候，需要宿主机的ip地址
docker run --add-host machineip:192.168.103.240 -d --name some-redis redis

docker exec -it some-redis bash
tail /etc/hosts

docker start,docker stop, docker kill

docker start :启动一个或多个已经被停止的容器
docker stop :停止一个运行中的容器
docker restart :重启容器
docker kill :杀掉一个运行中的容器。

batch delete 容器

docker rm -f 
docker rm -f `docker ps -a -q`
docker containers prune

# 极其强大的删除清理方式，慎重使用
# docker system prune

docker container 状态监控命令

查看容器日志

docker logs

[root@localhost ~]# docker logs some-redis
1:C 09 Jul 2019 03:07:03.406 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
1:C 09 Jul 2019 03:07:03.406 # Redis version=5.0.5, bits=64, commit=00000000, modified=0, pid=1, just started
1:C 09 Jul 2019 03:07:03.406 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf
1:M 09 Jul 2019 03:07:03.406 * Running mode=standalone, port=6379.
1:M 09 Jul 2019 03:07:03.406 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128.
1:M 09 Jul 2019 03:07:03.406 # Server initialized
1:M 09 Jul 2019 03:07:03.406 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
1:M 09 Jul 2019 03:07:03.406 # WARNING you have Transparent Huge Pages (THP) support enabled in your kernel. This will create latency and memory usage issues with Redis. To fix this issue run the command 'echo never > /sys/kernel/mm/transparent_hugepage/enabled' as root, and add it to your /etc/rc.local in order to retain the setting after a reboot. Redis must be restarted after THP is disabled.
1:M 09 Jul 2019 03:07:03.406 * Ready to accept connections

[root@localhost ~]# docker logs some-redis
1:C 09 Jul 2019 03:07:03.406 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
1:C 09 Jul 2019 03:07:03.406 # Redis version=5.0.5, bits=64, commit=00000000, modified=0, pid=1, just started
1:C 09 Jul 2019 03:07:03.406 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf
1:M 09 Jul 2019 03:07:03.406 * Running mode=standalone, port=6379.
1:M 09 Jul 2019 03:07:03.406 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128.
1:M 09 Jul 2019 03:07:03.406 # Server initialized
1:M 09 Jul 2019 03:07:03.406 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
1:M 09 Jul 2019 03:07:03.406 # WARNING you have Transparent Huge Pages (THP) support enabled in your kernel. This will create latency and memory usage issues with Redis. To fix this issue run the command 'echo never > /sys/kernel/mm/transparent_hugepage/enabled' as root, and add it to your /etc/rc.local in order to retain the setting after a reboot. Redis must be restarted after THP is disabled.
1:M 09 Jul 2019 03:07:03.406 * Ready to accept connections

容器性能指标

docker stats

[root@localhost ~]# docker stats

CONTAINER ID        NAME                CPU %               MEM USAGE / LIMIT     MEM %               NET I/O             BLOCK I/O           PIDS
aaa8bec01038        some-redis          0.04%               8.375MiB / 1.795GiB   0.46%               656B / 0B           139kB / 0B          4

[root@localhost ~]# docker stats

CONTAINER ID        NAME                CPU %               MEM USAGE / LIMIT     MEM %               NET I/O             BLOCK I/O           PIDS
aaa8bec01038        some-redis          0.04%               8.375MiB / 1.795GiB   0.46%               656B / 0B           139kB / 0B          4

容器 -> 宿主机端口

查询port映射关系

知道容器的端口，不知道宿主机的端口。。。
不知道容器的端口，知道宿主机的端口。。。

docker port [container]

[root@localhost ~]# docker port some-redis-2
6379/tcp -> 0.0.0.0:16379

[root@localhost ~]# docker port some-redis-2
6379/tcp -> 0.0.0.0:16379

查看容器内运行的进程

docker top [container]

[root@localhost ~]# docker top some-redis-2
UID                 PID                 PPID                C                   STIME               TTY                 TIME                CMD
polkitd             18356               18338               0                   13:20               pts/0               00:00:00            redis-server *:6379

[root@localhost ~]# docker top some-redis-2
UID                 PID                 PPID                C                   STIME               TTY                 TIME                CMD
polkitd             18356               18338               0                   13:20               pts/0               00:00:00            redis-server *:6379

容器的详细信息

docker inspect [OPTIONS] NAME|ID [NAME|ID...]

[root@localhost ~]# docker inspect some-redis-2
[
    {
        "Id": "6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2",
        "Created": "2019-07-09T05:20:06.985445479Z",
        "Path": "docker-entrypoint.sh",
        "Args": [
            "redis-server"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 18356,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2019-07-09T05:20:07.255368955Z",
            "FinishedAt": "0001-01-01T00:00:00Z"
        },
        "Image": "sha256:bb0ab8a99fe694e832e56e15567c83dee4dcfdd321d0ad8ab9bd64d82d6a6bfb",
        "ResolvConfPath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/resolv.conf",
        "HostnamePath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/hostname",
        "HostsPath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/hosts",
        "LogPath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2-json.log",
        "Name": "/some-redis-2",
        "RestartCount": 0,
        "Driver": "overlay2",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": null,
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "default",
            "PortBindings": {
                "6379/tcp": [
                    {
                        "HostIp": "",
                        "HostPort": "16379"
                    }
                ]
            },
            "RestartPolicy": {
                "Name": "no",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": null,
            "CapDrop": null,
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "shareable",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": [],
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DeviceCgroupRules": null,
            "DiskQuota": 0,
            "KernelMemory": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": null,
            "OomKillDisable": false,
            "PidsLimit": 0,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "MaskedPaths": [
                "/proc/asound",
                "/proc/acpi",
                "/proc/kcore",
                "/proc/keys",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug",
                "/proc/scsi",
                "/sys/firmware"
            ],
            "ReadonlyPaths": [
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ]
        },
        "GraphDriver": {
            "Data": {
                "LowerDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7-init/diff:/data/docker/overlay2/d26d3067261173cfa34d57bbdc3371b164805203ff05a2d71ce868ddc5b5a2bc/diff:/data/docker/overlay2/6a35d92d8841364ee7443a84e18b42c22f60294a748f552ad4a0852507236c7f/diff:/data/docker/overlay2/5ed2ceb6771535d14cd64f375cc31462a82ff57503bbc3abace0589be3124955/diff:/data/docker/overlay2/9543ee1ade1f2d4341c00cadef3ec384eb3761c35d10726cc6ade4a3bfb99be2/diff:/data/docker/overlay2/86f47cf021b01ddec50356ae4c5387b910f65f75f97298de089336b4a413ce25/diff:/data/docker/overlay2/df3551b1764d57ad79604ace4c1b75ab1e47cdca2fb6d526940af8b400eee4aa/diff",
                "MergedDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7/merged",
                "UpperDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7/diff",
                "WorkDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7/work"
            },
            "Name": "overlay2"
        },
        "Mounts": [
            {
                "Type": "volume",
                "Name": "88f774ae0567f3e3f834a9f469c0db377be8948b82d05ee757e6eabe185903e6",
                "Source": "/data/docker/volumes/88f774ae0567f3e3f834a9f469c0db377be8948b82d05ee757e6eabe185903e6/_data",
                "Destination": "/data",
                "Driver": "local",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            }
        ],
        "Config": {
            "Hostname": "6248c674f067",
            "Domainname": "",
            "User": "",
            "AttachStdin": true,
            "AttachStdout": true,
            "AttachStderr": true,
            "ExposedPorts": {
                "6379/tcp": {}
            },
            "Tty": true,
            "OpenStdin": true,
            "StdinOnce": true,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "GOSU_VERSION=1.10",
                "REDIS_VERSION=5.0.5",
                "REDIS_DOWNLOAD_URL=http://download.redis.io/releases/redis-5.0.5.tar.gz",
                "REDIS_DOWNLOAD_SHA=2139009799d21d8ff94fc40b7f36ac46699b9e1254086299f8d3b223ca54a375"
            ],
            "Cmd": [
                "redis-server"
            ],
            "ArgsEscaped": true,
            "Image": "redis",
            "Volumes": {
                "/data": {}
            },
            "WorkingDir": "/data",
            "Entrypoint": [
                "docker-entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {}
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "31f5b2c1c0d59c3f8866fa2b02db2889e4d4d54076cbf88ae7d6057758b3f40a",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "6379/tcp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "16379"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/31f5b2c1c0d5",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "ab4f1a16403dfd415703868b52b33ea0b6d9d28b750e5ce80810d0f9b89f4af1",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "172.17.0.3",
            "IPPrefixLen": 16,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:03",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "80fba7499001738402fe35f0c1bb758ddd5f680abf75f4bd6a0456b3021ee5fe",
                    "EndpointID": "ab4f1a16403dfd415703868b52b33ea0b6d9d28b750e5ce80810d0f9b89f4af1",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.3",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:03",
                    "DriverOpts": null
                }
            }
        }
    }
]

[root@localhost ~]# docker inspect some-redis-2
[
    {
        "Id": "6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2",
        "Created": "2019-07-09T05:20:06.985445479Z",
        "Path": "docker-entrypoint.sh",
        "Args": [
            "redis-server"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 18356,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2019-07-09T05:20:07.255368955Z",
            "FinishedAt": "0001-01-01T00:00:00Z"
        },
        "Image": "sha256:bb0ab8a99fe694e832e56e15567c83dee4dcfdd321d0ad8ab9bd64d82d6a6bfb",
        "ResolvConfPath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/resolv.conf",
        "HostnamePath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/hostname",
        "HostsPath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/hosts",
        "LogPath": "/data/docker/containers/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2/6248c674f0672620d0cd8fd4a573c0db48f5f7c75b61fbd5150072eaac6ed4b2-json.log",
        "Name": "/some-redis-2",
        "RestartCount": 0,
        "Driver": "overlay2",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": null,
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "default",
            "PortBindings": {
                "6379/tcp": [
                    {
                        "HostIp": "",
                        "HostPort": "16379"
                    }
                ]
            },
            "RestartPolicy": {
                "Name": "no",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": null,
            "CapDrop": null,
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "shareable",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": [],
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DeviceCgroupRules": null,
            "DiskQuota": 0,
            "KernelMemory": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": null,
            "OomKillDisable": false,
            "PidsLimit": 0,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "MaskedPaths": [
                "/proc/asound",
                "/proc/acpi",
                "/proc/kcore",
                "/proc/keys",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug",
                "/proc/scsi",
                "/sys/firmware"
            ],
            "ReadonlyPaths": [
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ]
        },
        "GraphDriver": {
            "Data": {
                "LowerDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7-init/diff:/data/docker/overlay2/d26d3067261173cfa34d57bbdc3371b164805203ff05a2d71ce868ddc5b5a2bc/diff:/data/docker/overlay2/6a35d92d8841364ee7443a84e18b42c22f60294a748f552ad4a0852507236c7f/diff:/data/docker/overlay2/5ed2ceb6771535d14cd64f375cc31462a82ff57503bbc3abace0589be3124955/diff:/data/docker/overlay2/9543ee1ade1f2d4341c00cadef3ec384eb3761c35d10726cc6ade4a3bfb99be2/diff:/data/docker/overlay2/86f47cf021b01ddec50356ae4c5387b910f65f75f97298de089336b4a413ce25/diff:/data/docker/overlay2/df3551b1764d57ad79604ace4c1b75ab1e47cdca2fb6d526940af8b400eee4aa/diff",
                "MergedDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7/merged",
                "UpperDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7/diff",
                "WorkDir": "/data/docker/overlay2/c7693e58e45a483a6cb66deac7d281a647a56e3c9043722f3379a5dd496646d7/work"
            },
            "Name": "overlay2"
        },
        "Mounts": [
            {
                "Type": "volume",
                "Name": "88f774ae0567f3e3f834a9f469c0db377be8948b82d05ee757e6eabe185903e6",
                "Source": "/data/docker/volumes/88f774ae0567f3e3f834a9f469c0db377be8948b82d05ee757e6eabe185903e6/_data",
                "Destination": "/data",
                "Driver": "local",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            }
        ],
        "Config": {
            "Hostname": "6248c674f067",
            "Domainname": "",
            "User": "",
            "AttachStdin": true,
            "AttachStdout": true,
            "AttachStderr": true,
            "ExposedPorts": {
                "6379/tcp": {}
            },
            "Tty": true,
            "OpenStdin": true,
            "StdinOnce": true,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "GOSU_VERSION=1.10",
                "REDIS_VERSION=5.0.5",
                "REDIS_DOWNLOAD_URL=http://download.redis.io/releases/redis-5.0.5.tar.gz",
                "REDIS_DOWNLOAD_SHA=2139009799d21d8ff94fc40b7f36ac46699b9e1254086299f8d3b223ca54a375"
            ],
            "Cmd": [
                "redis-server"
            ],
            "ArgsEscaped": true,
            "Image": "redis",
            "Volumes": {
                "/data": {}
            },
            "WorkingDir": "/data",
            "Entrypoint": [
                "docker-entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {}
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "31f5b2c1c0d59c3f8866fa2b02db2889e4d4d54076cbf88ae7d6057758b3f40a",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "6379/tcp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "16379"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/31f5b2c1c0d5",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "ab4f1a16403dfd415703868b52b33ea0b6d9d28b750e5ce80810d0f9b89f4af1",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "172.17.0.3",
            "IPPrefixLen": 16,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:03",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "80fba7499001738402fe35f0c1bb758ddd5f680abf75f4bd6a0456b3021ee5fe",
                    "EndpointID": "ab4f1a16403dfd415703868b52b33ea0b6d9d28b750e5ce80810d0f9b89f4af1",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.3",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:03",
                    "DriverOpts": null
                }
            }
        }
    }
]

容器的导入导出

docker export :将文件系统作为一个tar归档文件导出到STDOUT。

docker export [OPTIONS] CONTAINER

# OPTIONS说明：
# -o :将输入内容写到文件。

# PS：
# docker export -o /app2/1.tar.gz some-redis

docker import : 从归档文件中创建镜像。

docker import [OPTIONS] file|URL|- [REPOSITORY[:TAG]]

# OPTIONS说明：
# -c :应用docker 指令创建镜像；
# -m :提交时的说明文字；

# PS：
# 还原镜像
# docker import /app2/1.tar.gz newredis
# 创建容器并运行redis-server启动命令
# docker run -d --name new-some-redis-2 newredis redis-server

docker images命令详解

docker image

[root@localhost app2]# docker image

Usage:    docker image COMMAND

Manage images

Commands:
  build       Build an image from a Dockerfile
  history     Show the history of an image
  import      Import the contents from a tarball to create a filesystem image
  inspect     Display detailed information on one or more images
  load        Load an image from a tar archive or STDIN
  ls          List images
  prune       Remove unused images
  pull        Pull an image or a repository from a registry
  push        Push an image or a repository to a registry
  rm          Remove one or more images
  save        Save one or more images to a tar archive (streamed to STDOUT by default)
  tag         Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE

Run 'docker image COMMAND --help' for more information on a command.

[root@localhost app2]# docker image

Usage:    docker image COMMAND

Manage images

Commands:
  build       Build an image from a Dockerfile
  history     Show the history of an image
  import      Import the contents from a tarball to create a filesystem image
  inspect     Display detailed information on one or more images
  load        Load an image from a tar archive or STDIN
  ls          List images
  prune       Remove unused images
  pull        Pull an image or a repository from a registry
  push        Push an image or a repository to a registry
  rm          Remove one or more images
  save        Save one or more images to a tar archive (streamed to STDOUT by default)
  tag         Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE

Run 'docker image COMMAND --help' for more information on a command.

镜像的获取，删除，查看

docker pull : 从镜像仓库中拉取或者更新指定镜像

docker pull [OPTIONS] NAME[:TAG|@DIGEST]

# OPTIONS说明：
# -a :拉取所有 tagged 镜像
# --disable-content-trust :忽略镜像的校验,默认开启

docker rmi : 删除本地一个或多少镜像。

docker rmi [OPTIONS] IMAGE [IMAGE...]

# OPTIONS说明：
# -f :强制删除；
# --no-prune :不移除该镜像的过程镜像，默认移除；

docker inspect : 获取容器/镜像的元数据。

docker inspect [OPTIONS] NAME|ID [NAME|ID...]

# OPTIONS说明：
# -f :指定返回值的模板文件。
# -s :显示总的文件大小。
# --type :为指定类型返回JSON。

docker images : 列出本地镜像。

docker images [OPTIONS] [REPOSITORY[:TAG]]

# OPTIONS说明：
# -a :列出本地所有的镜像（含中间映像层，默认情况下，过滤掉中间映像层）；
# --digests :显示镜像的摘要信息；
# -f :显示满足条件的镜像；
# --format :指定返回值的模板文件；
# --no-trunc :显示完整的镜像信息；
# -q :只显示镜像ID。

镜像的导入导出，迁移

docker export/import 对容器进行打包
docker save / load 对镜像进行打包

docker save : 将指定镜像保存成 tar 归档文件。

docker save [OPTIONS] IMAGE [IMAGE...]

# OPTIONS 说明：
# -o :输出到的文件。

# PS:
# docker save -o /app2/1.tar.gz redis

docker load : 导入使用 docker save 命令导出的镜像。

docker load [OPTIONS]

# OPTIONS 说明：
# -i :指定导出的文件。
# -q :精简输出信息。

# PS:
# docker load -i /app2/1.tar.gz

docker tag

打标签的目的，方便我上传到自己的私有仓库

docker tag : 标记本地镜像，将其归入某一仓库。

docker tag [OPTIONS] IMAGE[:TAG] [REGISTRYHOST/][USERNAME/]NAME[:TAG]

# PS:
# docker tag redis:latest 13057686866/redis_1
# 登录
# docker login
# 推送到远程私有仓库
# docker push 13057686866/redis_1

手工构建

docker build 命令用于使用 Dockerfile 创建镜像。

docker build [OPTIONS] PATH | URL | -

# OPTIONS说明：
# --build-arg=[] :设置镜像创建时的变量；
# --cpu-shares :设置 cpu 使用权重；
# --cpu-period :限制 CPU CFS周期；
# --cpu-quota :限制 CPU CFS配额；
# --cpuset-cpus :指定使用的CPU id；
# --cpuset-mems :指定使用的内存 id；
# --disable-content-trust :忽略校验，默认开启；
# -f :指定要使用的Dockerfile路径；
# --force-rm :设置镜像过程中删除中间容器；
# --isolation :使用容器隔离技术；
# --label=[] :设置镜像使用的元数据；
# -m :设置内存最大值；
# --memory-swap :设置Swap的最大值为内存+swap，"-1"表示不限swap；
# --no-cache :创建镜像的过程不使用缓存；
# --pull :尝试去更新镜像的新版本；
# --quiet, -q :安静模式，成功后只输出镜像 ID；
# --rm :设置镜像成功后删除中间容器；
# --shm-size :设置/dev/shm的大小，默认值是64M；
# --ulimit :Ulimit配置。
# --tag, -t: 镜像的名字及标签，通常 name:tag 或者 name 格式；可以在一次构建中为一个镜像设置多个标签。
# --network: 默认 default。在构建期间设置RUN指令的网络模式

dockerfile

docker build自己动手构建镜像

官方文档：https://docs.docker.com/engine/reference/builder/

dockerfile参数

FROM
ENV
RUN
CMD
LABEL
EXPOSE
ADD

不仅可以copy文件，还可以下载远程文件。。。
如果是本地的zip包，还能自动解压。
COPY
ENTRYPOINT
VOLUME
USER
WORKDIR
ONBUILD
STOPSIGNAL
HEALTHCHECK

新建项目 WebApplication1 空项目即可

新建 Dockerfile 配置文件

# 1-有了基础镜像
FROM mcr.microsoft.com/dotnet/core/sdk:2.2

# 2-把我的文件拷贝到这个操作系统中的/app文件夹中
COPY . /app

# 工作目录
WORKDIR /app

# 3-publish
RUN cd /app && dotnet publish "WebApplication1.csproj" -c Release -o /work

# 4-告诉外界我的app暴露的是80端口
EXPOSE 80

# else
ENV TZ Asia/Shanghai
ENV ASPNETCORE_ENVIRONMENT Production

# 作者信息
LABEL version="1.0"
LABEL author="wyt"

# 执行角色
USER root

# 设置工作目录
WORKDIR /work

# 4-启动
CMD ["dotnet","WebApplication1.dll"]

将 WebApplication1 整个目录拷贝到远程服务器下

构建镜像

cd /app/WebApplication1
docker build -t 13057686866/webapp:v1 .

运行容器

docker run -d -p 18000:80 --name webapp3 13057686866/webapp:v1

运行成功

curl http://192.168.103.240:18000/
Hello World!

Dockerfile优化策略

使用 .dockerignore 忽略文件

官方地址：https://docs.docker.com/engine/reference/builder/#dockerignore-file

**/.dockerignore
**/.env
**/.git
**/.gitignore
**/.vs
**/.vscode
**/*.*proj.user
**/azds.yaml
**/charts
**/bin
**/obj
**/Dockerfile
**/Dockerfile.develop
**/docker-compose.yml
**/docker-compose.*.yml
**/*.dbmdl
**/*.jfm
**/secrets.dev.yaml
**/values.dev.yaml
**/.toolstarget

我们完全可以使用VS来创建Dockerfile，会自动生成 .dockerignore

使用多阶段构建

多阶段构建：一个From一个阶段

dockerfile中只有最后一个From是生效的，其他的from只是给最后一个from打辅助。。。

当最后一个from生成完毕的时候，其他的from都会自动销毁。。。

FROM build AS publish 给当前的镜像取一个别名。。

FROM mcr.microsoft.com/dotnet/core/aspnet:2.2 AS base
WORKDIR /app
EXPOSE 80

FROM mcr.microsoft.com/dotnet/core/sdk:2.2 AS build
WORKDIR /src
COPY ["WebApplication1.csproj", ""]
RUN dotnet restore "WebApplication1.csproj"
COPY . .
WORKDIR "/src/"
RUN dotnet build "WebApplication1.csproj" -c Release -o /app

FROM build AS publish
RUN dotnet publish "WebApplication1.csproj" -c Release -o /app

FROM base AS final
WORKDIR /app
COPY --from=publish /app .
ENTRYPOINT ["dotnet", "WebApplication1.dll"]

及时移除不必须的包

# 3-publish
RUN cd /app && dotnet publish "WebApplication1.csproj" -c Release -o /work && rm -rf /app

最小化层的个数

可参考官方dockerfile
ADD 和 COPY,ADD 会增加 layer的个数。
RUN尽可能合并

搭建自己的私有registry仓库

官网介绍：https://docs.docker.com/registry/deploying/

搭建自己内网仓库，可以加速

拉取本地仓库镜像
```
docker pull registry:2
```

运行本地仓库容器

# 运行本地仓库容器
docker run -d -p 5000:5000 --restart=always --name registry registry:2

拉取alpine镜像
```
# 拉取alpine镜像
docker pull alpine
```

重命名标签，指向本地仓库

# 重命名标签，指向本地仓库
docker tag alpine 192.168.103.240:5000/alpine:s1

远程推送到本地仓库

# 远程推送到本地仓库
docker push 192.168.103.240:5000/alpine:s1

故障：http: server gave HTTP response to HTTPS client（https client 不接受 http response）
解决办法： https://docs.docker.com/registry/insecure/

# 编辑该daemon.json文件，其默认位置 /etc/docker/daemon.json在Linux或 C:\ProgramData\docker\config\daemon.jsonWindows Server上。如果您使用Docker Desktop for Mac或Docker Desktop for Windows，请单击Docker图标，选择 Preferences，然后选择+ Daemon。
# 如果该daemon.json文件不存在，请创建它。假设文件中没有其他设置，则应具有以下内容：

{
  "insecure-registries" : ["192.168.103.240:5000"]
}

# 将不安全注册表的地址替换为示例中的地址。

# 启用了不安全的注册表后，Docker将执行以下步骤：
# 1-首先，尝试使用HTTPS。
# 2-如果HTTPS可用但证书无效，请忽略有关证书的错误。
# 3-如果HTTPS不可用，请回退到HTTP。

# 重新启动Docker以使更改生效。
service docker restart

验证镜像是否推送成功

docker pull 192.168.103.240:5000/alpine:s1

拉取开源registry UI镜像
官方地址：https://hub.docker.com/r/joxit/docker-registry-ui
```
# 拉取registry-ui镜像
docker pull joxit/docker-registry-ui
```

设置允许repositry跨域

# 设置允许跨域https://docs.docker.com/registry/configuration/
# 复制文件到本地
docker cp registry:/etc/docker/registry/config.yml /app
# 修改配置文件，添加跨域
vim /etc/docker/registry/config.yml

version: 0.1
log:
  fields:
    service: registry
storage:
  cache:
    blobdescriptor: inmemory
  filesystem:
    rootdirectory: /var/lib/registry
http:
  addr: :5000
  headers:
    X-Content-Type-Options: [nosniff]
    Access-Control-Allow-Origin: ['*']
    Access-Control-Allow-Methods: ['*']
    Access-Control-Max-Age: [1728000]
health:
  storagedriver:
    enabled: true
    interval: 10s
    threshold: 3
    
# 重新启动registry容器
docker rm registry -f
docker run -d -p 5000:5000 --restart=always --name registry -v /app/config.yml:/etc/docker/registry/config.yml registry:2

运行registry-ui容器

# 运行容器
docker rm -f registry-ui
docker run -d -p 8002:80 --name registry-ui joxit/docker-registry-ui

访问可视化容器

使用阿里云镜像存储服务

官方地址：https://cr.console.aliyun.com/cn-hangzhou/instances/repositories

接入操作：

登录阿里云Docker Registry
```
sudo docker login --username=tb5228628_2012 registry.cn-hangzhou.aliyuncs.com
```
用于登录的用户名为阿里云账号全名，密码为开通服务时设置的密码。

从Registry中拉取镜像

sudo docker pull registry.cn-hangzhou.aliyuncs.com/wyt_registry/wyt_registry:[镜像版本号]

将镜像推送到Registry

sudo docker tag [ImageId] registry.cn-hangzhou.aliyuncs.com/wyt_registry/wyt_registry:[镜像版本号]
sudo docker push registry.cn-hangzhou.aliyuncs.com/wyt_registry/wyt_registry:[镜像版本号]

volume数据挂载

三种方式可以让数据脱离到容器之外，减少容器层的size，也提升了性能（避免容器的读写层）。

volume 管理

# 创建数据卷
docker volume create redisdata
# 使用数据卷
docker run -d -v redisdata:/data --name some-redis redis

优点：

不考虑宿主机文件结构，所以更加方便迁移，backup。
可以使用 docker cli 命令统一管理
volumes支持多平台，不用考虑多平台下的文件夹路径问题。
使用volumn plugin 可以方便和 aws, 等云平台远程存储。

bind 管理（文件，文件夹）

将宿主机文件夹初始化送入容器中，后续进行双向绑定。

tmpfs 容器内目录挂载到宿主机内存中

# 不隐藏容器内/tmp内文件
docker run --rm -it webapp bash
# 隐藏容器内/tmp内文件
docker run --rm --tmpfs /tmp -it webapp bash

network网络

单机网络

默认情况下是 bridge，overlay，host， macvlan，none

docker host 的bridge 的 docker0 默认网桥

默认的 bridge 的大概原理

当docker启动的时候，会生成一个默认的docker0网桥。。。

当启动容器的时候，docker会生成一对 veth设备。。。。这个设备的一端连接到host的docker0网桥，一端连接到container中，重命名为eth0

veth一端收到了数据，会自动传给另一端。。。

docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 fe80::42:a4ff:fe79:a36f  prefixlen 64  scopeid 0x20<link>
        ether 02:42:a4:79:a3:6f  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 11  bytes 1439 (1.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


vethfc5e4ce: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::f802:99ff:fe73:34d7  prefixlen 64  scopeid 0x20<link>
        ether fa:02:99:73:34:d7  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 17  bytes 1947 (1.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


/ # ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever



[root@localhost ~]#  docker run -it alpine ash
/ # ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
8: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
/ #

docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 fe80::42:a4ff:fe79:a36f  prefixlen 64  scopeid 0x20<link>
        ether 02:42:a4:79:a3:6f  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 11  bytes 1439 (1.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


vethfc5e4ce: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::f802:99ff:fe73:34d7  prefixlen 64  scopeid 0x20<link>
        ether fa:02:99:73:34:d7  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 17  bytes 1947 (1.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


/ # ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever



[root@localhost ~]#  docker run -it alpine ash
/ # ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
8: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
/ #

默认的bridge缺陷

无服务发现功能，同一个子网，无法通过 “服务名” 互通，只能通过 ip 地址。。。

自定义bridge网络

自带服务发现机制

# 创建桥接网络
docker network create my-net 
# 创建容器
docker run -it --network my-net --name some-redis alpine ash
docker run -it --network my-net --name some-redis2 alpine ash
# 在some-redis中ping容器some-redis2
ping some-redis2

容器网络发布

如果让宿主机之外的程序能能够访问host上的bridge内的container:-p 发布端口

# 运行容器进行端口转发
docker run -it --network my-net -p 80:80 --name some-redis-1 alpine ash
# 查看网络转发详情
iptables -t nat -L -n

Chain DOCKER (2 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:172.18.0.4:80

多机网络

overlay网络

可实现多机访问

使用docker swarm init 实现docker 集群网络

# 192.168.103.240
docker swarm init
# 192.168.103.226
docker swarm join --token SWMTKN-1-0g4cs8fcatshczn5koupqx7lulak20fbvu99uzjb5asaddblny-bio99e9kktn023k527y3tjgyv 192.168.103.240:2377

实现自定义的可独立添加容器的 overlay网络
```
docker network create --driver=overlay --attachable test-net
```
TCP 2377 集群 manage 节点交流的
TCP 的 7946 和 UDP 的 7946 nodes 之间交流的
UDP 4789 是用于overlay network 流量传输的。

演示

192.168.103.226 redis启动

docker run --network test-net --name some-redis -d redis

192.168.103.240 python

mkdir /app
vim /app/app.py
vim /app/Dockerfile
vim /app/requirements.txt

app.pv

from flask import Flask
from redis import Redis, RedisError
import os
import socket

# Connect to Redis
redis = Redis(host="some-redis", db=0, socket_connect_timeout=2, socket_timeout=2)

app = Flask(__name__)

@app.route("/")
def hello():
    try:
        visits = redis.incr("counter")
    except RedisError:
        visits = "<i>cannot connect to Redis, counter disabled</i>"

    html = "<b>Hostname:</b> {hostname}<br/>" \
           "<b>Visits:</b> {visits}"
    return html.format(hostname=socket.gethostname(), visits=visits)

if __name__ == "__main__":
    app.run(host='0.0.0.0', port=80)

from flask import Flask
from redis import Redis, RedisError
import os
import socket

# Connect to Redis
redis = Redis(host="some-redis", db=0, socket_connect_timeout=2, socket_timeout=2)

app = Flask(__name__)

@app.route("/")
def hello():
    try:
        visits = redis.incr("counter")
    except RedisError:
        visits = "<i>cannot connect to Redis, counter disabled</i>"

    html = "<b>Hostname:</b> {hostname}<br/>" \
           "<b>Visits:</b> {visits}"
    return html.format(hostname=socket.gethostname(), visits=visits)

if __name__ == "__main__":
    app.run(host='0.0.0.0', port=80)

Dockerfile

FROM python:2.7-slim

WORKDIR /app

COPY . .

EXPOSE 80

RUN pip install --trusted-host pypi.python.org -r requirements.txt

VOLUME [ "/app" ]

CMD [ "python", "app.py" ]

FROM python:2.7-slim

WORKDIR /app

COPY . .

EXPOSE 80

RUN pip install --trusted-host pypi.python.org -r requirements.txt

VOLUME [ "/app" ]

CMD [ "python", "app.py" ]

requirements.txt

Flask
Redis

Flask
Redis

# 构建镜像
docker build -t pyweb:v1 .
# 运行容器
docker run -d --network test-net -p 80:80 -v /app:/app --name pyapp pyweb:v1

访问结果

host 模式

这种模式不和宿主机进行网络隔离，直接使用宿主机网络

最简单最粗暴的方式

overlay虽然复杂，但是强大，不好控制。

docker-compose

什么是docker-compose？应用程序栈一键部署，（独立程序一键部署），docker-compose 可以管理你的整个应用程序栈的生命周期。

下载

官方地址：https://docs.docker.com/compose/install/

# 下载Docker Compose的当前稳定版本
sudo curl -L "https://github.com/docker/compose/releases/download/1.24.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
# https://github.com/docker/compose/releases/download/1.24.1/docker-compose-Linux-x86_64
# 建议迅雷下载后进行重命名，这样速度快
# 对二进制文件应用可执行权限
sudo chmod +x /usr/local/bin/docker-compose
# 测试安装
docker-compose --version

简单示例

新建项目 WebApplication1 空网站项目添加NLog、Redis包支持

Install-Package NLog.Targets.ElasticSearch
Install-Package StackExchange.Redis

修改 Program.cs 使用80端口

public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
    WebHost.CreateDefaultBuilder(args)
        .UseUrls("http://*:80")
        .UseStartup<Startup>();

修改 Startup.cs 添加日志和redis

public Logger logger = LogManager.GetCurrentClassLogger();
public ConnectionMultiplexer redis = ConnectionMultiplexer.Connect("redis");

// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    app.Run(async (context) =>
    {
        var count = await redis.GetDatabase(0).StringIncrementAsync("counter");
        var info= $"you have been seen {count} times !";
        logger.Info(info);

        await context.Response.WriteAsync(info);
    });
}

添加 nlog.config 配置文件

<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      autoReload="true"
      internalLogLevel="Warn">

    <extensions>
        <add assembly="NLog.Targets.ElasticSearch"/>
    </extensions>

    <targets>
        <target name="ElasticSearch" xsi:type="BufferingWrapper" flushTimeout="5000" >
            <target xsi:type="ElasticSearch" uri="http://elasticsearch:9200" documentType="web.app"/>
        </target>
    </targets>

    <rules>
        <logger name="*" minlevel="Trace" writeTo="ElasticSearch" />
    </rules>
</nlog>

添加 Dockerfile 文件

FROM mcr.microsoft.com/dotnet/core/aspnet:2.2-stretch-slim AS base

WORKDIR /data
COPY . .

EXPOSE 80

ENTRYPOINT ["dotnet", "WebApplication1.dll"]

添加 docker-compose.yml 文件

version: '3.0'

services:

  webapp: 
    build: 
      context: .
      dockerfile: Dockerfile
    ports: 
      - 80:80
    depends_on: 
      - redis
    networks: 
      - netapp

  redis: 
    image: redis
    networks: 
      - netapp

  elasticsearch: 
    image: elasticsearch:5.6.14
    networks: 
      - netapp

  kibana: 
    image: kibana:5.6.14
    ports: 
      - 5601:5601
    networks: 
      - netapp

networks: 
  netapp:

发布项目文件，并拷贝到远程服务器/app文件夹内
运行 docker-compose
```
cd /app
docker-compose up --build
```
查看效果
访问网站http://192.168.103.240/

访问Kibana查看日志http://192.168.103.240:5601

docker-compose 常见命令

操控命令

docker-compose ps
docker-compose images
docker-compose kill webapp
docker-compose build
docker-compose run      -> docker exec
docker-compose scale
docker-compose up       -> docker run
docker-compose down

状态命令

docker-compose logs
docker-compose ps
docker-compose top
docker-compose port 
docker-compose config

compose命令讲解

官方地址：https://docs.docker.com/compose/compose-file/

yml常用命令分析

version      3.7 
services
config    （swarm）
secret    （swarm）
volume     
networks

appstack 补充

修改 WebApplication1 项目中的 docker-compose.yml

version: '3.0'

services:

  webapp: 
    build: 
      context: .
      dockerfile: Dockerfile
    image: wyt/webapp
    container_name: webapplication
    restart: always
    ports: 
      - 80:80
    depends_on: 
      - redis
    networks: 
      - netapp

  redis: 
    image: redis
    networks: 
      - netapp

  elasticsearch: 
    image: elasticsearch:5.6.14
    networks: 
      - netapp
    volumes:
      - "esdata:/usr/share/elasticsearch/data"

  kibana: 
    image: kibana:5.6.14
    ports: 
      - 5601:5601
    networks: 
      - netapp

volumes:
  esdata:

networks: 
  netapp:

version: '3.0'

services:

  webapp: 
    build: 
      context: .
      dockerfile: Dockerfile
    image: wyt/webapp
    container_name: webapplication
    restart: always
    ports: 
      - 80:80
    depends_on: 
      - redis
    networks: 
      - netapp

  redis: 
    image: redis
    networks: 
      - netapp

  elasticsearch: 
    image: elasticsearch:5.6.14
    networks: 
      - netapp
    volumes:
      - "esdata:/usr/share/elasticsearch/data"

  kibana: 
    image: kibana:5.6.14
    ports: 
      - 5601:5601
    networks: 
      - netapp

volumes:
  esdata:

networks: 
  netapp:

部分docker-compose脚本：https://download.csdn.net/download/qq_25153485/11324352

docker-compose 一些使用原则

使用多文件部署

生产环境代码直接放在容器中，test环境实现代码挂载

test:   docker-compose -f  docker-compose.yml  -f test.yml   up 
prd:   docker-compose -f  docker-compose.yml  -f prd.yml   up

生产环境中绑定程序默认端口，测试机防冲突绑定其他端口。
生产环境配置 restart: always , 可以容器就可以挂掉之后重启。
添加日志聚合,对接es

按需编译，按需构建

# 只构建service名称为webapp的镜像，也会构建其依赖
docker-compose build webapp
# 只构建service名称为webapp的镜像，不构建其依赖
docker-compose up --no-deps --build -d webapp

变量插值

设置宿主机环境变量

# 设置环境变量
export ASPNETCORE_ENVIRONMENT=Production
# 获取环境变量
echo $ASPNETCORE_ENVIRONMENT
# hostip 网卡ip 埋进去，方便获取
# image的版本号

修改 docker-compose.yml 读取环境变量

environment:
  ASPNETCORE_ENVIRONMENT: ${ASPNETCORE_ENVIRONMENT}

docker可视化portainer

安装教程参考：https://www.cnblogs.com/wyt007/p/11104253.html

yml文件

protainer:
  image: portainer/portainer
  ports:
    - 9000:9000
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock
  restart: always
  networks: 
    - netapp

使用python 和 C# 远程访问 docker

开放tcp端口，方便远程访问
修改 docker.service ,修改掉ExecStart

vim /usr/lib/systemd/system/docker.service

# ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.soc
ExecStart=/usr/bin/dockerd --containerd=/run/containerd/containerd.soc

配置 daemon.json

vim /etc/docker/daemon.json

"hosts": ["192.168.103.240:18080","unix:///var/run/docker.sock"]

刷新配置文件，重启docker

systemctl daemon-reload
systemctl restart docker

查看docker进程是否监听

netstat -ano | grep 18080

tcp        0      0 192.168.103.240:18080   0.0.0.0:*               LISTEN      off (0.00/0/0)

python访问docker

官方地址：https://docs.docker.com/develop/sdk/examples/

c#访问docker

社区地址：https://github.com/microsoft/Docker.DotNet

class Program
{
    static  async Task Main(string[] args)
    {
        DockerClient client = new DockerClientConfiguration(
                new Uri("http://192.168.103.240:18080"))
            .CreateClient();
        IList<ContainerListResponse> containers = await client.Containers.ListContainersAsync(
            new ContainersListParameters()
            {
                Limit = 10,
            });
        Console.WriteLine("Hello World!");
    }
}

cluster volumes

开源分布式文件系统：https://www.gluster.org/

部署前准备，修改 /etc/hosts 文件，增加如下信息
2台机器
```
vim /etc/hosts

192.168.103.240 fs1
192.168.103.226 fs2
```

安装GlusterFS 【两个node】

yum install -y centos-release-gluster
yum install -y glusterfs-server
systemctl start glusterd
systemctl enable glusterd

将fs2加入到集群中

# 在fs1中执行
# 将fs2加入集群节点中
gluster peer probe fs2
# 查看集群状态
gluster peer status
# 查看集群列表
gluster pool list
# 查看所有命令
gluster help global

创建volume

# 创建文件夹（两个都要创建）
mkdir -p /data/glusterfs/glustervolume
# 创建同步副本数据卷 replica集群 2复制分发 force强制（fs1）
gluster volume create glusterfsvolumne replica 2 fs1:/data/glusterfs/glustervolume fs2:/data/glusterfs/glustervolume force
# 启动卷使用
gluster volume start glusterfsvolumne

相当于两台机器都拥有了glusterfsvolumne

创建本地文件夹挂载 volume 即可

# 分别创建
mkdir /app
# 【交叉挂载】
# fs1
mount -t glusterfs fs2:/glusterfsvolumne /app
# fs2
mount -t glusterfs fs1:/glusterfsvolumne /app

[root@localhost app]# df -h
文件系统                 容量  已用  可用 已用% 挂载点
/dev/mapper/centos-root   17G   12G  5.8G   67% /
devtmpfs                 903M     0  903M    0% /dev
tmpfs                    920M     0  920M    0% /dev/shm
tmpfs                    920M   90M  830M   10% /run
tmpfs                    920M     0  920M    0% /sys/fs/cgroup
/dev/sda1               1014M  232M  783M   23% /boot
tmpfs                    184M   12K  184M    1% /run/user/42
tmpfs                    184M     0  184M    0% /run/user/0
overlay                   17G   12G  5.8G   67% /data/docker/overlay2/46ed811c8b335a3a59cae93a77133599390c4a6bf2767a690b01b8b2999eb1e3/merged
shm                       64M     0   64M    0% /data/docker/containers/f7044f3d2b744f97f60a2fd004402300a8f4d1c1494f86dfd0852a89d4626efd/mounts/shm
fs2:/glusterfsvolumne     17G   12G  5.7G   68% /app
overlay                   17G   12G  5.8G   67% /data/docker/overlay2/b681972965562fe4f608f0724430906078130a65d3dbe9031cb9ab40ce29698f/merged
shm                       64M     0   64M    0% /data/docker/containers/d43a7653a61a9a6d6ad89cb178b9567d99b5b0c6976ece90bd7b92f8cc2ebcaf/mounts/shm

[root@localhost app]# df -h
文件系统                 容量  已用  可用 已用% 挂载点
/dev/mapper/centos-root   17G  8.2G  8.9G   48% /
devtmpfs                 903M     0  903M    0% /dev
tmpfs                    920M     0  920M    0% /dev/shm
tmpfs                    920M   90M  830M   10% /run
tmpfs                    920M     0  920M    0% /sys/fs/cgroup
/dev/sda1               1014M  232M  783M   23% /boot
tmpfs                    184M  4.0K  184M    1% /run/user/42
tmpfs                    184M   36K  184M    1% /run/user/0
overlay                   17G  8.2G  8.9G   48% /data/docker/overlay2/20ae619da7d4578d9571a5ab9598478bce496423254833c110c67641e9f2d817/merged
shm                       64M     0   64M    0% /data/docker/containers/fc31990633d41fd4bf21a8b0601db1cfb7cf9b2d5920bf1a13cf696e111d91e2/mounts/shm
fs1:/glusterfsvolumne     17G   12G  5.7G   67% /app

在fs1新建文件

在fs2中查看

容器部署

# fs1 fs2
# 数据是共享的
docker run --name some-redis -p 6379:6379 -v /app/data:/data -d  redis

搭建自己的docker swarm集群

集群的搭建

准备三台服务器

192.168.103.240 manager1
192.168.103.226 node1
192.168.103.227 node2

初始化swarm

# 192.168.103.240 manager1
docker swarm init

[root@localhost ~]# docker swarm init
Swarm initialized: current node (ryi7o7xcww2c9e4j1lotygfbu) is now a manager.

To add a worker to this swarm, run the following command:

    docker swarm join --token SWMTKN-1-10bndgdxqph4nqmjn0g4oqse83tdgx9cbb50pcgmf0tn7yhlno-6mako3nf0a0504tiopu9jefxc 192.168.103.240:2377

To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.

[root@localhost ~]# docker swarm init
Swarm initialized: current node (ryi7o7xcww2c9e4j1lotygfbu) is now a manager.

To add a worker to this swarm, run the following command:

    docker swarm join --token SWMTKN-1-10bndgdxqph4nqmjn0g4oqse83tdgx9cbb50pcgmf0tn7yhlno-6mako3nf0a0504tiopu9jefxc 192.168.103.240:2377

To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.

加入节点

# 192.168.103.226 node1
# 192.168.103.227 node2
docker swarm join --token SWMTKN-1-10bndgdxqph4nqmjn0g4oqse83tdgx9cbb50pcgmf0tn7yhlno-6mako3nf0a0504tiopu9jefxc 192.168.103.240:2377

关键词解释

managernode

用于管理这个集群。（manager + work ）
用于分发task 给 worknode 去执行。
worknode
用于执行 manager 给过来的 task。
给manager report task的执行情况或者一些统计信息。
service 服务
task 容器
overlay 网络

swarm操作的基本命令

docker swarm

docker swarm init
docker swarm join
docker swarm join-token
docker swarm leave

docker node

docker node demote / promote 
docker node ls / ps

docker service

docker service create
docker service update
docker service scale
docker service ls
docker service ps
docker service rm

# 在随机节点上创建一个副本
docker service create --name redis redis:3.0.6
# 创建每个节点都有的redis实例
docker service create --mode global --name redis redis:3.0.6
# 创建随机节点的5个随机的redis实例
docker service create --name redis --replicas=5 redis:3.0.6
# 创建端口映射3个节点的redis实例
docker service create --name my_web --replicas 3 -p 6379:6379 redis:3.0.6
# 更新服务，副本集提高成5个
docker service update --replicas=5 redis
# 更新服务，副本集提高成2个
docker service scale redis=2
# 删除副本集
docker service rm redis

compose.yml自定义swarm集群

官方文档：https://docs.docker.com/compose/compose-file/#deploy

所有分布式部署都使用compose中的 deploy 进行节点部署

使用compose中的 deploy 进行节点部署

准备4台服务器

192.168.103.240 manager1
192.168.103.228 manager2
192.168.103.226 node1
192.168.103.227 node2

编写 docker-compose.yml 文件

vim /app/docker-compose.yml

version: '3.7'
services:
  webapp:
    image: nginx
    ports:
      - 80:80
    deploy:
      replicas: 5

运行yml文件

# 与docker-compose不同，这里是基于stack deploy的概念
docker stack deploy -c ./docker-compose.yml nginx

查看stack

# 查看所有栈
docker stack ls
# 查看名称为nginx的栈
docker stack ps nginx

带状态的容器进行约束

placement:
  constraints:
    - xxxxxx

借助node的自带信息
https://docs.docker.com/engine/reference/commandline/service_create/#specify-service-constraints---constraint
node.id / node.hostname / node.role

`node.id`	Node ID	`node.id==2ivku8v2gvtg4`
`node.hostname`	Node hostname	`node.hostname!=node-2`
`node.role`	Node role	`node.role==manager`
`node.labels`	user defined node labels	`node.labels.security==high`
`engine.labels`	Docker Engine's labels

借助node的自定义标签信息 [更大的灵活性]
node.labels / node.labels.country==china

让 5个task 分配在 node1节点上

编写 docker-compose.yml 文件|

vim /app/docker-compose.yml

version: '3.7'
services:
  webapp:
    image: nginx
    ports:
      - 80:80
    deploy:
      replicas: 5
      placement:
        constraints:
          - node.id == icyia3s2mavepwebkyr0tqxly

运行yml文件

# 先删除，发布，延迟5秒、查看详情
docker stack rm nginx &&  docker stack deploy -c ./docker-compose.yml nginx && sleep 5 && docker stack ps nginx

让 5 个 task 在东部地区运行

给node打标签

docker node update --label-add region=east --label-add country=china  0pbg8ynn3wfimr3q631t4b01s
docker node update --label-add region=west --label-add country=china  icyia3s2mavepwebkyr0tqxly
docker node update --label-add region=east --label-add country=usa  27vlmifw8bwyc19tpo0tbgt3e

编写 docker-compose.yml 文件

vim /app/docker-compose.yml

version: '3.7'
services:
  webapp:
    image: nginx
    ports:
      - 80:80
    deploy:
      replicas: 5
      placement:
        constraints:
          - node.labels.region == east

运行yml文件

# 先删除，发布，延迟5秒、查看详情
docker stack rm nginx &&  docker stack deploy -c ./docker-compose.yml nginx && sleep 5 && docker stack ps nginx

让 5 个 task 在中国东部地区运行

deploy:
  replicas: 5
  placement:
    constraints:
      - node.labels.region == east
      - node.labels.country == china

均匀分布

目前只有 spread 这种策略，用于让task在指定的node标签上均衡的分布。

placement:
  preferences:
    - spread: node.labels.zone

让 8 个task 在 region 均匀分布

编写 docker-compose.yml 文件

vim /app/docker-compose.yml

version: '3.7'
services:
  webapp:
    image: nginx
    ports:
      - 80:80
    deploy:
      replicas: 8
      placement:
        constraints:
          - node.id != ryi7o7xcww2c9e4j1lotygfbu
        preferences:
          - spread: node.labels.region

运行yml文件

# 先删除，发布，延迟5秒、查看详情
docker stack rm nginx &&  docker stack deploy -c ./docker-compose.yml nginx && sleep 5 && docker stack ps nginx

重启策略

deploy:
  restart_policy:
    condition: on-failure
    delay: 5s
    max_attempts: 3
    window: 120s

默认是any，(always) 单要知道和 on-failure, 前者如果我stop 容器，一样重启，后者则不是

version: '3.7'
services:
  webapp:
    image: nginx
    ports:
      - 80:80
    deploy:
      replicas: 2
      restart_policy:
        condition: on-failure
        delay: 5s
      placement:
        constraints:
          - node.role == worker

其他属性

endpoint_mode vip -> keepalive 【路由器的一个协议】
labels：标签信息
mode：分发还是全局模式
resources：限制可用资源
update_config 【覆盖的一个策略】

把之前的单机版程序修改放到分布式环境中

修改 docker-compose.yml 文件

version: '3.0'

services:

  webapp:
    image: registry.cn-hangzhou.aliyuncs.com/wyt_registry/wyt_registry
    ports:
      - 80:80
    depends_on:
      - redis
    networks:
      - netapp
    deploy:
      replicas: 3
      placement:
        constraints:
          - node.id == ryi7o7xcww2c9e4j1lotygfbu

  redis:
    image: redis
    networks:
      - netapp
    deploy:
      placement:
        constraints:
          - node.role == worker

  elasticsearch:
    image: elasticsearch:5.6.14
    networks:
      - netapp
    deploy:
      placement:
        constraints:
          - node.role == worker

  kibana:
    image: kibana:5.6.14
    ports:
      - 5601:5601
    networks:
      - netapp
    deploy:
      placement:
        constraints:
          - node.role == worker
networks:
  netapp:

在私有仓库拉取的时候记得带上这个参数，，否则会 no such image 这样的报错的。

docker stack deploy -c ./docker-compose.yml nginx --with-registry-auth

docker新特性

使用config实现全局挂载

创建config配置

vim /app/nlog.config

<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      autoReload="true"
      internalLogLevel="Warn">

    <extensions>
        <add assembly="NLog.Targets.ElasticSearch"/>
    </extensions>

    <targets>
        <target name="ElasticSearch" xsi:type="BufferingWrapper" flushTimeout="5000" >
            <target xsi:type="ElasticSearch" uri="http://elasticsearch:9200" documentType="web.app"/>
        </target>
    </targets>

    <rules>
        <logger name="*" minlevel="Trace" writeTo="ElasticSearch" />
    </rules>
</nlog>

# 创建名称为nlog的配置
docker config create nlog /app/nlog.config

查看config内容，默认是base64编码

docker config inspect nlog

[
    {
        "ID": "1zwa2o8f71i6zm6ie47ws987n",
        "Version": {
            "Index": 393
        },
        "CreatedAt": "2019-07-11T10:30:58.255006156Z",
        "UpdatedAt": "2019-07-11T10:30:58.255006156Z",
        "Spec": {
            "Name": "nlog",
            "Labels": {},
            "Data": "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiID8+CjxubG9nIHhtbG5zPSJodHRwOi8vd3d3Lm5sb2ctcHJvamVjdC5vcmcvc2NoZW1hcy9OTG9nLnhzZCIKICAgICAgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIKICAgICAgYXV0b1JlbG9hZD0idHJ1ZSIKICAgICAgaW50ZXJuYWxMb2dMZXZlbD0iV2FybiI+CgogICAgPGV4dGVuc2lvbnM+CiAgICAgICAgPGFkZCBhc3NlbWJseT0iTkxvZy5UYXJnZXRzLkVsYXN0aWNTZWFyY2giLz4KICAgIDwvZXh0ZW5zaW9ucz4KCiAgICA8dGFyZ2V0cz4KICAgICAgICA8dGFyZ2V0IG5hbWU9IkVsYXN0aWNTZWFyY2giIHhzaTp0eXBlPSJCdWZmZXJpbmdXcmFwcGVyIiBmbHVzaFRpbWVvdXQ9IjUwMDAiID4KICAgICAgICAgICAgPHRhcmdldCB4c2k6dHlwZT0iRWxhc3RpY1NlYXJjaCIgdXJpPSJodHRwOi8vZWxhc3RpY3NlYXJjaDo5MjAwIiBkb2N1bWVudFR5cGU9IndlYi5hcHAiLz4KICAgICAgICA8L3RhcmdldD4KICAgIDwvdGFyZ2V0cz4KCiAgICA8cnVsZXM+CiAgICAgICAgPGxvZ2dlciBuYW1lPSIqIiBtaW5sZXZlbD0iVHJhY2UiIHdyaXRlVG89IkVsYXN0aWNTZWFyY2giIC8+CiAgICA8L3J1bGVzPgo8L25sb2c+Cg=="
        }
    }
]


#解密
<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      autoReload="true"
      internalLogLevel="Warn">

    <extensions>
        <add assembly="NLog.Targets.ElasticSearch"/>
    </extensions>

    <targets>
        <target name="ElasticSearch" xsi:type="BufferingWrapper" flushTimeout="5000" >
            <target xsi:type="ElasticSearch" uri="http://elasticsearch:9200" documentType="web.app"/>
        </target>
    </targets>

    <rules>
        <logger name="*" minlevel="Trace" writeTo="ElasticSearch" />
    </rules>
</nlog>

给servcie作用域加上 config 文件, 根目录有一个 nlog 文件

docker service create --name redis --replicas 3 --config nlog redis

[root@localhost app]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED              STATUS              PORTS               NAMES
e5f7b18e8377        redis:latest        "docker-entrypoint.s…"   About a minute ago   Up About a minute   6379/tcp            redis.3.usqs8c5mucee16mokib7143aa
[root@localhost app]# docker exec -it e5f7b18e8377 bash
root@e5f7b18e8377:/data# cd /
root@e5f7b18e8377:/# ls
bin  boot  data  dev  etc  home  lib  lib64  media  mnt  nlog  opt  proc  root    run  sbin  srv    sys  tmp  usr  var
root@e5f7b18e8377:/# cd nlog 
bash: cd: nlog: Not a directory
root@e5f7b18e8377:/# cat nlog 
<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      autoReload="true"
      internalLogLevel="Warn">

    <extensions>
        <add assembly="NLog.Targets.ElasticSearch"/>
    </extensions>

    <targets>
        <target name="ElasticSearch" xsi:type="BufferingWrapper" flushTimeout="5000" >
            <target xsi:type="ElasticSearch" uri="http://elasticsearch:9200" documentType="web.app"/>
        </target>
    </targets>

    <rules>
        <logger name="*" minlevel="Trace" writeTo="ElasticSearch" />
    </rules>
</nlog>

使用docker-compose实现

vim /app/docker-compose.yml

version: "3.7"
services:
  redis:
    image: redis:latest
    deploy:
      replicas: 3
    configs:
      - nlog2
configs:
  nlog2:
    file: ./nlog.config

运行

docker stack deploy -c docker-compose.yml redis --with-registry-auth

挂载到指定目录（这里的意思是挂在到容器内的/root文件夹内）

vim /app/docker-compose.yml

version: "3.7"
services:
  redis:
    image: redis:latest
    deploy:
      replicas: 1
    configs:
      - source: nlog2
        target: /root/nlog2
configs:
  nlog2:
    file: ./nlog.config

serect挂载明文和密文

如果你有敏感的配置需要挂载在swarm的service中，可以考虑使用 serect

用户名和密码
生产的数据库连接串

使用方式与config一致,挂在目录在：/run/secrets/<secret_name>

posted @ 2020-03-12 17:38 LXMZQ 阅读(1075) 评论(0) 编辑收藏举报

刷新页面返回顶部

LXMZQ

Dokcer使用总结（Dockerfile、Compose、Swarm）

Dokcer基础

centos上安装docker

Docker安装位置

解读dockerd配置文件

硬盘挂载

修改docker存储位置

镜像加速器

查看系统日志

远程连接docker deamon

容器基础

docker container 中常用操控命令

docker run,docker exec

docker start,docker stop, docker kill

batch delete 容器

docker container 状态监控命令

查看容器日志

容器性能指标

容器 -> 宿主机端口

查看容器内运行的进程

容器的详细信息

容器的导入导出

docker images命令详解

镜像的获取，删除，查看

镜像的导入导出，迁移

docker tag

手工构建

dockerfile

docker build自己动手构建镜像

dockerfile参数

Dockerfile优化策略

使用 .dockerignore 忽略文件

使用多阶段构建

及时移除不必须的包

最小化层的个数

搭建自己的私有registry仓库

搭建自己内网仓库，可以加速

使用阿里云镜像存储服务

volume数据挂载

volume 管理

bind 管理 （文件，文件夹）

tmpfs 容器内目录挂载到宿主机内存中

network网络

单机网络

默认的 bridge 的大概原理

默认的bridge缺陷

自定义bridge网络

容器网络发布

多机网络

overlay网络

演示

host 模式

docker-compose

下载

简单示例

docker-compose 常见命令

compose命令讲解

yml常用命令分析

appstack 补充

docker-compose 一些使用原则

使用多文件部署

按需编译，按需构建

变量插值

docker可视化portainer

使用python 和 C# 远程访问 docker

python访问docker

c#访问docker

cluster volumes

搭建自己的docker swarm集群

集群的搭建

关键词解释

swarm操作的基本命令

compose.yml自定义swarm集群

使用compose中的 deploy 进行节点部署

带状态的容器进行约束

让 5个task 分配在 node1节点上

让 5 个 task 在东部地区运行

让 5 个 task 在中国东部地区运行

均匀分布

bind 管理（文件，文件夹）