Docker容器技术-第一个容器

一、第一个容器

1.Docker版本
A.community-edition社区版
Docker CE是免费的Docker产品的新名称，Docker CE包含了完整的Docker平台，非常适合开发人员和运维团队构建容器APP。

B.enterprise-edition企业版
Docker EE由公司支持，可在经过认证的操作系统和云提供商中使用，并可运行来自Docker Store的、经过认证的容器和插件。
Docker EE提供三个服务层次：

• Basic 包含用于认证基础设施的Docker平台，Docker公司的支持，经过认证的、来自Docker Store的容器与插件
• Standard 添加高级镜像与容器管理，LDAP/AD用户集成，基于角色的访问控制(Docker Datacenter)
• Advanced 添加Docker安全扫描，连续漏洞监控

2.Centos 7 安装并启动Docker

yum remove docker docker-common docker-selinux docker-engine
yum -y update
yum install -y yum-utils   device-mapper-persistent-data   lvm2
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum makecache fast
yum -y install docker-ce
systemctl start docker

3.Docker信息

[root@bogon ~]# docker version
Client:
 Version:      17.09.0-ce
 API version:  1.32
 Go version:   go1.8.3
 Git commit:   afdb6d4
 Built:        Tue Sep 26 22:41:23 2017
 OS/Arch:      linux/amd64

Server:
 Version:      17.09.0-ce
 API version:  1.32 (minimum version 1.12)
 Go version:   go1.8.3
 Git commit:   afdb6d4
 Built:        Tue Sep 26 22:42:49 2017
 OS/Arch:      linux/amd64
 Experimental: false


[root@bogon ~]# docker info
Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
Images: 0
Server Version: 17.09.0-ce
Storage Driver: overlay
 Backing Filesystem: xfs
 Supports d_type: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 06b9cb35161009dcb7123345749fef02f7cea8e0
runc version: 3f2f8b84a77f73d38244dd690525642a72156c64
init version: 949e6fa
Security Options:
 seccomp
  Profile: default
Kernel Version: 3.10.0-514.el7.x86_64
Operating System: CentOS Linux 7 (Core)
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 1.796GiB
Name: bogon
ID: XW37:75N5:RGMZ:624K:TEC4:ONHO:6ACS:NM5W:VF32:NHTR:6AUJ:XT7W
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

二、Docker镜像

1.编译Docker镜像
克隆webapp的GIT仓库

[root@bogon ~]# git clone https://github.com/docker-training/webapp.git
Cloning into 'webapp'...
remote: Counting objects: 45, done.
remote: Total 45 (delta 0), reused 0 (delta 0), pack-reused 45
Unpacking objects: 100% (45/45), done.

使用docker build来编译镜像
-t 用于给镜像做标签
/ 给容器做标签

[root@bogon webapp]# docker build -t hubuser/webapp .
Sending build context to Docker daemon  121.3kB
Step 1/10 : FROM ubuntu:14.04
14.04: Pulling from library/ubuntu
bae382666908: Pull complete 
29ede3c02ff2: Pull complete 
da4e69f33106: Pull complete 
8d43e5f5d27f: Pull complete 
b0de1abb17d6: Pull complete 
Digest: sha256:6e3e3f3c5c36a91ba17ea002f63e5607ed6a8c8e5fbbddb31ad3e15638b51ebc
Status: Downloaded newer image for ubuntu:14.04
 ---> dea1945146b9
Step 2/10 : MAINTAINER Docker Education Team <education@docker.com>
 ---> Running in c70ce7fad85e
 ---> 06e621d6b0f2
Removing intermediate container c70ce7fad85e
Step 3/10 : RUN apt-get update
 ---> Running in a72a6899c375
...省略部分
Get:22 http://archive.ubuntu.com trusty/restricted amd64 Packages [16.0 kB]
Get:23 http://archive.ubuntu.com trusty/universe amd64 Packages [7589 kB]
Get:24 http://archive.ubuntu.com trusty/multiverse amd64 Packages [169 kB]
Fetched 21.1 MB in 1min 31s (229 kB/s)
Reading package lists...
 ---> 9cf5900247f6
Removing intermediate container a72a6899c375
Step 4/10 : RUN DEBIAN_FRONTEND=noninteractive apt-get install -y -q python-all python-pip
 ---> Running in be2a1c692bfc
Reading package lists...
Building dependency tree...
Reading state information...
The following extra packages will be installed:
  binutils build-essential ca-certificates cpp cpp-4.8 dpkg-dev fakeroot g++
  g++-4.8 gcc gcc-4.8 libalgorithm-diff-perl libalgorithm-diff-xs-perl
  libalgorithm-merge-perl libasan0 libatomic1 libc-dev-bin libc6-dev
  libcloog-isl4 libdpkg-perl libfakeroot libfile-fcntllock-perl libgcc-4.8-dev
  libgmp10 libgomp1 libisl10 libitm1 libmpc3 libmpfr4 libpython-stdlib
  libpython2.7-minimal libpython2.7-stdlib libquadmath0 libstdc++-4.8-dev
  libtimedate-perl libtsan0 linux-libc-dev make manpages manpages-dev openssl
  patch python python-chardet python-chardet-whl python-colorama
  python-colorama-whl python-distlib python-distlib-whl python-html5lib
  python-html5lib-whl python-minimal python-pip-whl python-pkg-resources
  python-requests python-requests-whl python-setuptools python-setuptools-whl
  python-six python-six-whl python-urllib3 python-urllib3-whl python-wheel
  python2.7 python2.7-minimal python3-pkg-resources xz-utils
Suggested packages:
  binutils-doc cpp-doc gcc-4.8-locales debian-keyring g++-multilib
  g++-4.8-multilib gcc-4.8-doc libstdc++6-4.8-dbg gcc-multilib autoconf
  automake1.9 libtool flex bison gdb gcc-doc gcc-4.8-multilib libgcc1-dbg
  libgomp1-dbg libitm1-dbg libatomic1-dbg libasan0-dbg libtsan0-dbg
  libquadmath0-dbg glibc-doc libstdc++-4.8-doc make-doc man-browser ed
  diffutils-doc python-doc python-tk python-genshi python-lxml
  python-distribute python-distribute-doc python2.7-doc binfmt-support
  python3-setuptools
Recommended packages:
  python-dev-all
The following NEW packages will be installed:
  binutils build-essential ca-certificates cpp cpp-4.8 dpkg-dev fakeroot g++
  g++-4.8 gcc gcc-4.8 libalgorithm-diff-perl libalgorithm-diff-xs-perl
  libalgorithm-merge-perl libasan0 libatomic1 libc-dev-bin libc6-dev
  libcloog-isl4 libdpkg-perl libfakeroot libfile-fcntllock-perl libgcc-4.8-dev
  libgmp10 libgomp1 libisl10 libitm1 libmpc3 libmpfr4 libpython-stdlib
  libpython2.7-minimal libpython2.7-stdlib libquadmath0 libstdc++-4.8-dev
  libtimedate-perl libtsan0 linux-libc-dev make manpages manpages-dev openssl
  patch python python-all python-chardet python-chardet-whl python-colorama
  python-colorama-whl python-distlib python-distlib-whl python-html5lib
  python-html5lib-whl python-minimal python-pip python-pip-whl
  python-pkg-resources python-requests python-requests-whl python-setuptools
  python-setuptools-whl python-six python-six-whl python-urllib3
  python-urllib3-whl python-wheel python2.7 python2.7-minimal
  python3-pkg-resources xz-utils
0 upgraded, 69 newly installed, 0 to remove and 5 not upgraded.
Need to get 46.9 MB of archives.
After this operation, 140 MB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu/ trusty-updates/main libasan0 amd64 4.8.4-2ubuntu1~14.04.3 [63.1 kB]
...省略部分
Message from syslogd@bogon at Oct 23 16:17:23 ...
 kernel:unregister_netdevice: waiting for lo to become free. Usage count = 1
...省略部分
Extracting templates from packages: 100%
Preconfiguring packages ...
Fetched 46.9 MB in 5min 6s (153 kB/s)
...省略部分
Processing triggers for libc-bin (2.19-0ubuntu6.13) ...
Processing triggers for ca-certificates (20170717~14.04.1) ...
Updating certificates in /etc/ssl/certs... 148 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....done.
 ---> b8c56991b833
Removing intermediate container be2a1c692bfc
Step 5/10 : ADD ./webapp/requirements.txt /tmp/requirements.txt
 ---> 8170b67cfebc
Step 6/10 : RUN pip install -qr /tmp/requirements.txt
 ---> Running in 4884119a0ab4
Compiling /tmp/pip_build_root/Jinja2/jinja2/asyncfilters.py ...
  File "/tmp/pip_build_root/Jinja2/jinja2/asyncfilters.py", line 7
    async def auto_to_seq(value):
            ^
SyntaxError: invalid syntax

Compiling /tmp/pip_build_root/Jinja2/jinja2/asyncsupport.py ...
  File "/tmp/pip_build_root/Jinja2/jinja2/asyncsupport.py", line 22
    async def concat_async(async_gen):
            ^
SyntaxError: invalid syntax

 ---> 9010ec5b7e5f
Removing intermediate container 4884119a0ab4
Step 7/10 : ADD ./webapp /opt/webapp/
 ---> 6416bfb827c1
Step 8/10 : WORKDIR /opt/webapp
 ---> 20e91a8bc5e2
Removing intermediate container 5e2e80b5a18f
Step 9/10 : EXPOSE 5000
 ---> Running in 9d8baa35a4da
 ---> 7be117cd2934
Removing intermediate container 9d8baa35a4da
Step 10/10 : CMD python app.py
 ---> Running in 1f97d2626adb
 ---> cbe52807fcad
Removing intermediate container 1f97d2626adb
Successfully built cbe52807fcad
Successfully tagged hubuser/webapp:latest

[root@bogon webapp]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
hubuser/webapp      latest              cbe52807fcad        20 minutes ago      362MB
ubuntu              14.04               dea1945146b9        5 weeks ago         188MB

2.推送Docker镜像到资源库
默认配置是将镜像推送到Docker Hub（开放资源库）

登录https://hub.docker.com创建一个私有库

[root@bogon ~]# docker login
Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https://hub.docker.com to create one.
Username: hdlptz
Password: 
Login Succeeded

推送镜像到Docker Hub

[root@bogon ~]# docker push hubuser/webapp
The push refers to a repository [docker.io/hubuser/webapp]
03540df98ba0: Preparing 
905b70fe5239: Preparing 
d01de91709c6: Preparing 
256c1ee6192f: Preparing 
d0807f9f7656: Preparing 
7fb9ba64f896: Waiting 
4e1e6ac5b9d6: Waiting 
48daf661d621: Waiting 
bf59e7acf5c4: Waiting 
c47d9b229ca4: Waiting 
denied: requested access to the resource is denied

上面提示访问拒绝，因为tag的名字斜线前面部分learn不是本人的用户名，所以修改成Hub用户名即可。

[root@bogon ~]# docker tag cbe52807fcad hdlptz/webapp:latest
[root@bogon ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
hdlptz/webapp       latest              cbe52807fcad        31 minutes ago      362MB
hubuser/webapp      latest              cbe52807fcad        31 minutes ago      362MB
ubuntu              14.04               dea1945146b9        5 weeks ago         188MB
[root@bogon ~]# docker push hdlptz/webapp
The push refers to a repository [docker.io/hdlptz/webapp]
03540df98ba0: Pushed 
905b70fe5239: Pushed 
d01de91709c6: Pushed 
256c1ee6192f: Pushing [=>                                                 ]   4.92MB/148MB
d0807f9f7656: Pushing [=====>                                             ]  2.286MB/21.07MB
7fb9ba64f896: Pushed 
4e1e6ac5b9d6: Pushed 
48daf661d621: Pushed 
bf59e7acf5c4: Pushed 
c47d9b229ca4: Pushing [>                                                  ]  525.3kB/187.8MB

3.从Hub中拉取Docker镜像
用于从Hub获取其他现有Docker镜像来构建自己的镜像。

docker rmi hdlptz/webapp
docker pull hdlptz/webapp
docker images

4.运行Docker容器
A.暴露容器端口
为了使容器外的用户可访问；

[root@bogon webapp]# vim Dockerfile 

FROM ubuntu:14.04
MAINTAINER Docker Education Team <education@docker.com>
RUN apt-get update
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y -q python-all python-pip
ADD ./webapp/requirements.txt /tmp/requirements.txt
RUN pip install -qr /tmp/requirements.txt
ADD ./webapp /opt/webapp/
WORKDIR /opt/webapp
EXPOSE 5000
CMD ["python", "app.py"]

[root@bogon webapp]# docker run --name webapp -d hdlptz/webapp
Unable to find image 'hdlptz/webapp:latest' locally
docker: Error response from daemon: Get https://registry-1.docker.io/v2/: dial tcp: lookup registry-1.docker.io on 202.106.0.20:53: read udp 10.0.2.4:47876->202.106.0.20:53: i/o timeout.
See 'docker run --help'

该错误解决方法（改用iptables）：

[root@bogon webapp]# systemctl stop firewalld.service
[root@bogon webapp]# systemctl disable firewalld.service
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
Removed symlink /etc/systemd/system/basic.target.wants/firewalld.service.
[root@bogon webapp]# firewall-cmd --state
not running

[root@bogon webapp]# yum update iptables
[root@localhost ~]# systemctl restart iptables.service

启动镜像

[root@localhost ~]# docker run -d --expose=4000-4500 --name webapp hubuser/webapp
e0294c4a650afa27564d341ca6f31e46ccb4dfbd767c39d0ae866dfc32f6f79f
[root@localhost ~]# docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS               NAMES
e0294c4a650a        hubuser/webapp      "python app.py"     About a minute ago   Up About a minute   5000/tcp            webapp

B.发布容器端口
-P或--publish-all标签发布容器内所有已暴露的端口到Docker宿主机上随机高位端口（/proc/sys/net/ipv4/ip_local_port_range）

[root@localhost ~]# docker run -P -d --name exposed hubuser/webapp
944c67e9d101405a9bb7a55650ca87e62d590d4a388f38345136ec9d6f0b68da
[root@localhost ~]# docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS                     NAMES
944c67e9d101        hubuser/webapp      "python app.py"     5 seconds ago       Up 4 seconds        0.0.0.0:32768->5000/tcp   exposed
e0294c4a650a        hubuser/webapp      "python app.py"     6 minutes ago       Up 6 minutes        5000/tcp                  webapp
[root@localhost ~]# cat /proc/sys
sys/           sysrq-trigger  sysvipc/       
[root@localhost ~]# cat /proc/sys/net/ipv4/ip_local_port_range 
32768	60999

[root@localhost ~]# ss -lt 'sport = *:32768'
State      Recv-Q Send-Q           Local Address:Port                            Peer Address:Port                
LISTEN     0      128                          *:ssh                                        *:*                    
LISTEN     0      100                  127.0.0.1:smtp                                       *:*                    
LISTEN     0      128                         :::ssh                                       :::*                    
LISTEN     0      100                        ::1:smtp                                      :::*                    
LISTEN     0      128                         :::32768                                     :::*                    
[root@localhost ~]# curl http://192.168.56.102:32768
Hello world!

-p或者--publish标签发布容器内没有主动暴露的端口

• containerPort
• hostPort:containerPort
• ip:containerPort
• ip:hostPort:containerPort

通过指明hostPort，可以指定映射到Docker宿主机上的某个端口而不是随机分配；
通过指明IP，可以限定从某个Docker宿主机的网络接口接收连接并返回相应数据包给映射的Docker容器端口。

[root@localhost ~]# docker run -d -p 127.0.0.1:80:5000 hubuser/webapp
5a1754f8433fafba4f9bcc0a24a1fa1743df72a0f045de486b47b7734a774df6
[root@localhost ~]# curl http://localhost
Hello world!

5.连接容器
容器链接在一起后，可以使源容器向目标容器发送消息，并且使通信中的容器以一种更安全的方式进行相互发现。

[root@localhost ~]# docker run --name source -d hubuser/webapp
74ef7227163a9cca05df9e61857214ccaf5e0929bff9c5c601475e1d57c007de
[root@localhost ~]# docker run --link source:webapp --name destination busybox /bin/ping webapp
[root@localhost ~]# docker inspect -f "{{ .HostConfig.Links }}" destination
[/source:/destination/webapp]

Docker宿主机在两个容器间创建一个安全通道，并通过以下两种方式暴露源容器信息。

• 环境变量
• /etc/hosts中的条目

[root@localhost ~]# docker inspect -f "{{ .NetworkSettings.IPAddress }}" source
172.17.0.5
[root@localhost ~]# docker inspect -f "{{ .NetworkSettings.IPAddress }}" destination


[root@localhost ~]# iptables -L DOCKER
Chain DOCKER (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             172.17.0.3           tcp dpt:commplex-main
ACCEPT     tcp  --  anywhere             172.17.0.4           tcp dpt:commplex-main

6.交互式容器
-i标签使一个容器在前台运行，并接到标准输入流上；
-t标签可以给容器添加一个虚拟终端，与-i联合使用。

[root@localhost ~]# docker run -i -t --link source:webapp --name interactive_container busybox /bin/sh

检查暴露给目标容器的环境变量
env |grep WEBAPP

在相互链接的容器中，目标容器的发现特性是/etc/hosts文件。

通过建立HTTP请求到源容器的别名，实现访问源容器中运行的Web应用
nc webapp 5000

相互链接的容器间会创建如下环境变量：

• 对每个容器均有：_NAME=/container_name/alias_name
• 对每个已暴露端口的URL都有：POST_
  作为唯一前缀被添加到如下环境变量中
  _ADDR：源容器的IP地址
  _PORT：已暴露的端口
  _PROTO：已暴露的端口采用的协议，TCP或UDP
• _PORT：源容器暴露的第一个端口

总结：
使用docker build命令，并用版本控制工具来管理Dockerfile。