Docker技术-恒创新域建站

★ FEATURED ARTICLE

一、Docker简介1、什么是dockerDocker是管理容器的引擎为应用打包、部署平台而非单纯的虚拟化技术重要特点和优势1. 轻量级虚拟化Docker 容器相较于传统的虚拟机更加轻量和高效能够快速启动和停止节省系统资源。2. 一致性确保应用程序在不同的环境中如开发、测试、生产具有一致的运行表现3. 可移植性可以轻松地将 Docker 容器从一个平台迁移到另一个平台无需担心依赖和环境配置的差异。4. 高效的资源利用多个 Docker 容器可以共享主机的操作系统内核从而更有效地利用系统资源。5. 易于部署和扩展能够快速部署新的应用实例并且可以根据需求轻松地进行水平扩展。2、docker在企业中的应用场景在企业中docker作为业务的最小载体而被广泛应用、通过docker企业可以更效率的部署应用并更节省资源。二、Docker的部署1、配置软件仓库[rootdocker ~]# cd /etc/yum.repos.d [rootdocker yum.repos.d]# vim docker.repo [rootdocker yum.repos.d]# cat docker.repo [docker] namedocker-ce baseurlhttps://mirrors.aliyun.com/docker-ce/linux/rhel/9/x86_64/stable gpgcheck02、安装docker-ce并启动服务[rootdocker ~]# dnf install docker-ce --downloadonly --downloaddir /mnt/ [rootdocker ~]# cd /mnt [rootdocker mnt]# ls containerd.io-2.4.2-2.el9.x86_64.rpm docker-buildx-plugin-0.38.0-1.el9.x86_64.rpm docker-ce-29.9.1-1.el9.x86_64.rpm docker-ce-cli-29.9.1-1.el9.x86_64.rpm docker-ce-rootless-extras-29.9.1-1.el9.x86_64.rpm docker-compose-plugin-5.6.0-1.el9.x86_64.rpm [rootdocker mnt]# dnf install *.rpm [rootdocker mnt]# ls docker-ce-29.9.1.tar.gz3 、激活内核网络选项[rootdocker ~]# echo br_netfilter /etc/modules-load.d/docker_mod.conf [rootdocker ~]# modprobe -a br_netfilter [rootdocker ~]# lsmod | grep br_netfilter br_netfilter 36864 0 bridge 405504 1 br_netfilter [rootdocker ~]# vim /etc/sysctl.conf [rootdocker ~]# cat /etc/sysctl.conf net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 [rootdocker ~]# sysctl -p net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 14、编写docker启动文件[rootdocker ~]# vim /lib/systemd/system/docker.service ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue [rootdocker ~]# systemctl enable --now docker Created symlink /etc/systemd/system/multi-user.target.wants/docker.service → /usr/lib/systemd/system/docker.service. [rootdocker ~]# docker --version Docker version 29.9.1, build dfc520d5、配置docker加速器[rootdocker mnt]# vim /etc/docker/daemon.json [rootdocker mnt]# cat /etc/docker/daemon.json { registry-mirrors:[https://docker.m.daocloud.io] } [rootdocker mnt]# systemctl restart docker.service [rootdocker mnt]# docker info Registry Mirrors: https://docker.m.daocloud.io/三、docker的基本操作1、docker镜像的管理1、搜索镜像[rootdocker mnt]# docker search nginx NAME DESCRIPTION STARS OFFICIAL nginx Official build of Nginx. 21408 [OK] nginx/nginx-ingress NGINX and NGINX Plus Ingress Controllers fo… 124 nginx/nginx-prometheus-exporter NGINX Prometheus Exporter for NGINX and NGIN… 532、拉取镜像[rootdocker mnt]# docker pull nginx Using default tag: latest latest: Pulling from library/nginx 6a6757ab48b1: Pull complete b19352c60515: Pull complete ecc510c1e359: Pull complete 113d9139ada2: Pull complete 792a76c59dbd: Pull complete 188e9077f350: Pull complete c9ec797c69ed: Pull complete 3a5a894bf2b2: Download complete 2b7d75aa4652: Download complete Digest: sha256:332d0beea97cff8c0d5d27976c0778a4b00345b9d74c2feaaf8efde548314948 Status: Downloaded newer image for nginx:latest docker.io/library/nginx:latest [rootdocker mnt]# docker images i Info → U In Use IMAGE ID DISK USAGE CONTENT SIZE EXTRA nginx:latest 332d0beea97c 240MB 66.8MB3、查看镜像信息[rootdocker mnt]# docker image inspect nginx [ { Id: sha256:332d0beea97cff8c0d5d27976c0778a4b00345b9d74c2feaaf8efde548314948, RepoTags: [ nginx:latest ], RepoDigests: [ nginxsha256:332d0beea97cff8c0d5d27976c0778a4b00345b9d74c2feaaf8efde548314948 ], Comment: buildkit.dockerfile.v0, Created: 2026-10-14T18:41:41.472959272Z, Config: { ExposedPorts: { 80/tcp: {} }, Env: [ PATH/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin, NGINX_VERSION1.31.7, NJS_VERSION1.0.2, NJS_RELEASE1~trixie, ACME_VERSION0.4.1, PKG_RELEASE1~trixie, DYNPKG_RELEASE1~trixie ], Entrypoint: [ /docker-entrypoint.sh ], Cmd: [ nginx, -g, daemon off; ], Labels: { maintainer: NGINX Docker Maintainers docker-maintnginx.com }, StopSignal: SIGQUIT }, Architecture: amd64, Os: linux, Size: 237535448, RootFS: { Type: layers, Layers: [ sha256:15f1c8eb1ab18eae260c7fb6296434cbe1ff0e1e30fd814ae92a80dd54005e62, sha256:397571c090911d767906912edd5e7a5efc36d9470cbfc758a4abaceb5a712bfb, sha256:2e3db029b46b91157b8b5584f5042685d18eeeaffa0d1fb4f3a9f1a0be8b9d5b, sha256:a488eea137de276f0f36132fb570881d0ef204f91622f3e56124a29083ee697a, sha256:133a2cb760fe7f6facc929e7840d151669a1a1a928218c60abf22716f1a136d1, sha256:96e522d1d691c64f1078b5aaf73ffe395c151027fc654630aa21a21b4d858a6e, sha256:23a7206ab964309d4e1fcc838393579239a96b7d3e3f548ece7f61a03b33488d ] }, Metadata: { LastTagTime: 2026-10-16T07:42:33.731325326Z }, Descriptor: { mediaType: application/vnd.oci.image.index.v1json, digest: sha256:332d0beea97cff8c0d5d27976c0778a4b00345b9d74c2feaaf8efde548314948, size: 10229 }, Identity: { Pull: [ { Repository: docker.io/library/nginx } ] } } ]4、查看对镜像的更改记录[rootdocker mnt]# docker history nginx:latest IMAGE CREATED CREATED BY SIZE COMMENT 332d0beea97c 37 hours ago CMD [nginx -g daemon off;] 0B buildkit.dockerfile.v0 missing 37 hours ago STOPSIGNAL SIGQUIT 0B buildkit.dockerfile.v0 missing 37 hours ago EXPOSE map[80/tcp:{}] 0B buildkit.dockerfile.v05、导出镜像[rootdocker mnt]# docker image save nginx:latest -o nginx-latest.tar.gz [rootdocker mnt]# docker image save nginx:latest nginx -o nginx.tag.gz [rootdocker mnt]# ls nginx-latest.tar.gz nginx.tag.gz6、删除镜像[rootdocker mnt]# docker rmi nginx:latest Untagged: nginx:latest Deleted: sha256:332d0beea97cff8c0d5d27976c0778a4b00345b9d74c2feaaf8efde5483149487、镜像导入[rootdocker ~]# docker load -i centos-7.tar.gz Loaded image: centos:7 [rootdocker ~]# docker run -it --rm centos:7 /bin/bash [rootb399572ad16d /]# ls anaconda-post.log dev home lib64 mnt proc run srv tmp var bin etc lib media opt root sbin sys usr2、容器的常用操作1、启动容器[rootdocker mnt]# docker run -d --name webserver -p 80:80 nginx:latest ec19bad8a94d398a8d55951e15947ee1376752e93a5e5e1fade3b201a2ec7f0d [rootdocker mnt]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES ec19bad8a94d nginx:latest /docker-entrypoint.… 24 seconds ago Up 23 seconds 0.0.0.0:80-80/tcp, [::]:80-80/tcp webserver2、进入容器[rootdocker mnt]# docker exec -it webserver /bin/bash rootec19bad8a94d:/# ls bin dev docker-entrypoint.sh home lib64 mnt proc run srv tmp var boot docker-entrypoint.d etc lib media opt root sbin sys usr rootec19bad8a94d:/# cd /usr/share/nginx rootec19bad8a94d:/usr/share/nginx# ls html rootec19bad8a94d:/usr/share/nginx# cd html/ rootec19bad8a94d:/usr/share/nginx/html# ls 50x.html index.html rootec19bad8a94d:/usr/share/nginx/html# echo rootec19bad8a94d:/usr/share/nginx/html# echo lwz index.html3、退出容器[rootdocker mnt]# docker stop webserver webserver4、删除容器[rootdocker mnt]# docker rm webserver #删除停止的容器 webserver [rootDocker-node1 ~]# docker rm -f webserver #删除运行的容器 [rootDocker-node1 ~]# docker container prune -f #删除所有停止的容器5、查看容器运行信息[rootDocker-node1 ~]# docker ps #查看当前运行容器 [rootDocker-node1 ~]# docker ps -a #查看所有容器 [rootDocker-node1 ~]# docker inspect webserver #查看容器运行的详细信息6、停止与运行容器[rootDocker-node1 ~]# docker stop webserver #停止容器 [rootDocker-node1 ~]# docker kill webserver #杀死容器可以使用信号 [rootDocker-node1 ~]# docker start webserver #开启停止的容器7、容器外编写容器内文件[rootdocker ~]# vim index.html [rootdocker ~]# cat index.html hello lll [rootdocker ~]# docker cp index.html webserver:/usr/share/nginx/html Successfully copied 10B (transferred 2.05kB) to webserver:/usr/share/nginx/html8、容器内文件复制到容器外[rootdocker ~]# rm -fr index.html [rootdocker ~]# ls 公共模板视频图片文档下载音乐桌面 anaconda-ks.cfg initial.sh [rootdocker ~]# docker cp webserver:/usr/share/nginx/html/index.html /mnt Successfully copied 10B (transferred 2.05kB) to /mnt [rootdocker ~]# ls /mnt/ index.html9、查看容器日志[rootdocker ~]# docker logs webserver /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/ /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh 10-listen-on-ipv6-by-default.sh: info: IPv6 listen already enabled /docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh /docker-entrypoint.sh: Configuration complete; ready for start up 2026/10/16 09:02:34 [notice] 1#1: using the epoll event method 2026/10/16 09:02:34 [notice] 1#1: nginx/1.31.7 2026/10/16 09:02:34 [notice] 1#1: built by gcc 14.2.0 (Debian 14.2.0-19) 2026/10/16 09:02:34 [notice] 1#1: OS: Linux 5.14.0-362.8.1.el9_3.x86_64 2026/10/16 09:02:34 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1024:524288 2026/10/16 09:02:34 [notice] 1#1: start worker processes 2026/10/16 09:02:34 [notice] 1#1: start worker process 22 2026/10/16 09:02:34 [notice] 1#1: start worker process 23 2026/10/16 09:02:34 [notice] 1#1: start worker process 24 2026/10/16 09:02:34 [notice] 1#1: start worker process 253、提交容器更改1、保存容器内容的设置[rootdocker ~]# docker rm -f webserver webserver [rootdocker ~]# docker run -d --name webserver -p 80:80 nginx:latest 17d50ca62064275231841b42927bd64bc6f5fce00a1dfd681a8b9b04106ffc02 [rootdocker ~]# docker exec webserver echo hello hello [rootdocker ~]# docker exec -it webserver /bin/bash root17d50ca62064:/# cd /usr/share/nginx/html/ root17d50ca62064:/usr/share/nginx/html# ls 50x.html index.html root17d50ca62064:/usr/share/nginx/html# echo hello lwz index.html root17d50ca62064:/usr/share/nginx/html# exit exit #提交容器的更改 [rootdocker ~]# docker commit -m add index.html webserver nginx_index:latest sha256:691066da534fb275b05fe41db02e7af43458d0190cdc78e6b16b8d7dd934cb41 [rootdocker ~]# docker images i Info → U In Use IMAGE ID DISK USAGE CONTENT SIZE EXTRA nginx:latest 332d0beea97c 240MB 66.8MB U nginx_index:latest 691066da534f 238MB 63.9MB [rootdocker ~]# docker rm -f webserver webserver [rootdocker ~]# docker run -d --name webserver -p 80:80 nginx_index:latest e84c064ced31769579ba2a1d9fce356e91e0a37717315bb5fe5dd4105b84d50c [rootdocker ~]# docker exec webserver cat /usr/share/nginx/html/index.html hello lwz四、docker镜像的构建1、docker镜像结构共享宿主机的kernelbase镜像提供的是最小的Linux发行版同一docker主机支持运行多种Linux发行版采用分层结构的最大好处是共享资源2、镜像运行的基本原理Copy-on-Write 可写容器层容器层以下所有镜像层都是只读的 docker从上往下依次查找文件容器层保存镜像变化的部分并不会对镜像本身进行任何修改一个镜像最多127层3、镜像的构建1、基础构建[rootdocker ~]# mkdir dockerbuild [rootdocker ~]# cd dockerbuild/ [rootdocker dockerbuild]# vim test [rootdocker dockerbuild]# vim index.html [rootdocker dockerbuild]# vim test [rootdocker dockerbuild]# docker build -f test -t nginx:v1 . [] Building 1.5s (7/7) FINISHED2、add用法[rootdocker dockerbuild]# docker run -it --name test --rm nginx:v1 /bin/bash rootef830dc706bb:/# cd /root rootef830dc706bb:~# ls etc3、ENV用法[rootdocker dockerbuild]# docker run -d --name test busybox:v1 env [rootdocker dockerbuild]# docker logs test PATH/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME602d167c2d84 NAMElwz HOME/root4、run用法[rootdocker dockerbuild]# docker run -it --name test busybox:v1 / # ls bin dev etc home lib lib64 lwz proc root sys tmp usr var5、EXPOSE用法[rootdocker dockerbuild]# docker history busybox:v1 IMAGE CREATED CREATED BY SIZE COMMENT 6434b8a0a28f 5 minutes ago EXPOSE [8080/tcp] 0B buildkit.dockerfile.v06、VOLUME[rootdocker dockerbuild]# docker history busybox:v1 IMAGE CREATED CREATED BY SIZE COMMENT 1dcd57bee40b 5 months ago VOLUME [/usr/share/nginx/html] 0B buildkit.dockerfile.v0 [rootdocker dockerbuild]# docker image inspect busybox:v1 Volumes: { /usr/share/nginx/html: {} } [rootdocker dockerbuild]# docker inspect webserver Volumes: { /usr/share/nginx/html: {} }, [rootdocker dockerbuild]# cd /var/lib/docker/ [rootdocker docker]# cd volumes/ [rootdocker volumes]# ls 37070c899c9b47dabfef355bc6e574fe955a880827ff81373f3c3ed92a93200d backingFsBlockDev ad85e71a6aa3bd6bcc00455506d5363becbb5e189933bf3ed36cdf66dd47ac7b metadata.db [rootdocker volumes]# cd 37070c899c9b47dabfef355bc6e574fe955a880827ff81373f3c3ed92a93200d/ [rootdocker 37070c899c9b47dabfef355bc6e574fe955a880827ff81373f3c3ed92a93200d]# ls _data [rootdocker 37070c899c9b47dabfef355bc6e574fe955a880827ff81373f3c3ed92a93200d]# cd _data/ [rootdocker _data]# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 8616823ff24b busybox:v1 sh 4 minutes ago Exited (0) 4 minutes ago webserver [rootdocker _data]# docker volume ls DRIVER VOLUME NAME local 37070c899c9b47dabfef355bc6e574fe955a880827ff81373f3c3ed92a93200d local ad85e71a6aa3bd6bcc00455506d5363becbb5e189933bf3ed36cdf66dd47ac7b7、WORKDIR[rootdocker dockerbuild]# docker build -t busybox:v1 . [rootdocker dockerbuild]# docker run -it --rm busybox:v1 /mnt # pwd /mnt /mnt # ls lwz8、CMD[rootdocker dockerbuild]# docker run -it --rm busybox:v1 lwz [rootdocker dockerbuild]# docker run -it --rm busybox:v1 echo lll lll9、ENTRPOINT[rootdocker dockerbuild]# docker run -it --rm busybox:v1 lwz [rootdocker dockerbuild]# docker run -it --rm busybox:v1 echo lll lwz4、构建centos镜像解决仓库问题[rootdocker ~]# docker run -it --rm centos:7 /bin/bash [rootb399572ad16d /]# ls anaconda-post.log dev home lib64 mnt proc run srv tmp var bin etc lib media opt root sbin sys usr [rootb399572ad16d /]# cat /etc/system-release CentOS Linux release 7.9.2009 (Core) [rootb399572ad16d /]# cd /etc/yum.repos.d [rootb399572ad16d yum.repos.d]# ls CentOS-Base.repo CentOS-Debuginfo.repo CentOS-Sources.repo CentOS-fasttrack.repo CentOS-CR.repo CentOS-Media.repo CentOS-Vault.repo CentOS-x86_64-kernel.repo [rootb399572ad16d yum.repos.d]# vi centos.repo [rootb399572ad16d yum.repos.d]# cat centos.repo [centos] name centos7.9 baseurl https://mirrors.aliyun.com/centos-vault/7.9.2009/os/x86_64/ gpgcheck 0 [rootb399572ad16d yum.repos.d]# yum install gcc[rootdocker ~]# cd dockerbuild/ [rootdocker dockerbuild]# vim centos.repo [rootdocker dockerbuild]# cat centos.repo [centos] name centos7.9 baseurl https://mirrors.aliyun.com/centos-vault/7.9.2009/os/x86_64/ gpgcheck 0 [rootdocker dockerbuild]# vim Dockerfile [rootdocker dockerbuild]# cat Dockerfile FROM centos:7 RUN rm -rf /etc/yum.repos.d/* COPY centos.repo /etc/yum.repos.d/ RUN yum makecache [rootdocker dockerbuild]# docker build -t centos-7.9repo . [rootdocker dockerbuild]# docker run -it --rm centos-7.9repo /bin/bash [root8c5190b4a320 /]# yum install gcc -y五、docker HubDocker Hub 是 Docker 官方提供的一个公共的镜像仓库服务。它是 Docker 生态系统中最知名和广泛使用的镜像仓库之一拥有大量的官方和社区贡献的镜像。以下是 Docker Hub 的一些关键特点和优势1. 丰富的镜像资源涵盖了各种常见的操作系统、编程语言运行时、数据库、Web 服务器等众多应用的镜像。例如您可以轻松找到 Ubuntu、CentOS 等操作系统的镜像以及 MySQL、Redis 等数据库的镜像。2. 官方支持提供了由 Docker 官方维护的一些重要镜像确保其质量和安全性。3. 社区贡献开发者们可以自由上传和分享他们创建的镜像促进了知识和资源的共享。4. 版本管理对于每个镜像通常都有多个版本可供选择方便用户根据需求获取特定版本。5. 便于搜索用户可以通过关键词轻松搜索到所需的镜像。1、使用方法[rootdocker dockerbuild]# docker login -u lwz1437 i Info → A Personal Access Token (PAT) can be used instead. To create a PAT, visit https://app.docker.com/settings Password: WARNING! Your credentials are stored unencrypted in /root/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/go/credential-store/ Login Succeeded [rootdocker dockerbuild]# docker tag centos:7 lwz1437/centos:7 [rootdocker dockerbuild]# docker push lwz1437/centos:7 [rootdocker dockerbuild]# docker pull lwz1437/centos:7 //下载镜像六、部署docker仓库1、docker仓库的工作原理仓库中的三个角色index docker索引服务负责并维护有关用户帐户、镜像的校验以及公共命名空间的信息。registry docker仓库是镜像和图表的仓库它不具有本地数据库以及不提供用户认证通过Index Auth service的Token的方式进行认证Registry Client Docker充当registry客户端来维护推送和拉取以及客户端的授权。2、pull原理镜像拉取分为以下几步1.docker客户端向index发送镜像拉去请求并完成与index的认证2.index发送认证token和镜像位置给dockerclient3.dockerclient携带token和根据index指引的镜像位置取连接registry4.Registry会根据client持有的token跟index核实身份合法性5.index确认此token合法性6.Registry会根据client的请求传递镜像到客户端3、push原理镜像上传的步骤1.client向index发送上传请求并完成用户认证2.index会发方token给client来证明client的合法性3.client携带index提供的token连接Registry4.Registry向index合适token的合法性5.index证实token的合法性6.Registry开始接收客户端上传过来的镜像4、搭建docker的私有仓库1、获取仓库镜像[rootdocker dockerbuild]# cd [rootdocker ~]# ls 公共视频文档音乐 anaconda-ks.cfg centos.repo initial.sh 模板图片下载桌面 centos-7.tar.gz dockerbuild registry-202608.tar [rootdocker ~]# docker load -i registry-202608.tar Loaded image: registry:latest [rootdocker ~]# docker images i Info → U In Use IMAGE ID DISK USAGE CONTENT SIZE EXTRA busybox:latest fd7dc98638c8 6.74MB 2.23MB centos-7.9repo:latest 2d2d0ef10a27 434MB 212MB centos:7 e6dba3b9654d 434MB 212MB lwz1437/centos:7 e6dba3b9654d 434MB 212MB nginx:latest 332d0beea97c 240MB 66.8MB registry:latest 1be55279f18a 83.3MB 20.4MB2.、运行仓库[rootdocker ~]# docker run -d --name registry --restartalways -p 5000:5000 registry:latest be4c2ce2e64db8022e91da49f84d4c9bce2e1d85a85dda476d5837f59355522e [rootdocker ~]# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES be4c2ce2e64d registry:latest /entrypoint.sh /etc… 11 seconds ago Up 10 seconds 0.0.0.0:5000-5000/tcp, [::]:5000-5000/tcp registry3、上传镜像到仓库[rootdocker ~]# docker tag nginx:latest 192.168.168.145:5000/nginx:v1 [rootdocker ~]# vim /etc/docker/daemon.json [rootdocker ~]# cat /etc/docker/daemon.json { insecure-registries : [http://192.168.168.145:5000] } //docker默认使用仓库地址都是https的但仓库是http协议 [rootdocker ~]# systemctl restart docker.service [rootdocker ~]# docker info [rootdocker ~]# docker push 192.168.168.145:5000/nginx:v1 [rootdocker ~]# docker push 192.168.168.145:5000/nginx:v1 The push refers to repository [192.168.168.145:5000/nginx] b19352c60515: Pushed ecc510c1e359: Pushed 792a76c59dbd: Pushed c9ec797c69ed: Pushed 6a6757ab48b1: Pushed 188e9077f350: Pushed 113d9139ada2: Pushed v1: digest: sha256:6c7972b94d62ce93357d1e0d0ef6d3db8a2e9b8b6f3234d943d60ecbc4f4eb31 size: 2290 i Info → Not all multiplatform-content is present and only the available single-platform image was pushed sha256:332d0beea97cff8c0d5d27976c0778a4b00345b9d74c2feaaf8efde548314948 - sha256:6c7972b94d62ce93357d1e0d0ef6d3db8a2e9b8b6f3234d943d60ecbc4f4eb31 [rootdocker ~]# curl http://192.168.168.145:5000/v2/_catalog {repositories:[nginx]} //从一台主机给另一台主机下载docker [rootdocker ~]# scp /etc/modules-load.d/docker_mod.conf [rootdocker ~]# scp /etc/sysctl.conf root192.168.168.148:/etc/sysctl.conf [rootdocker ~]# scp /etc/yum.repos.d/docker.repo root192.168.168.148:/etc/yum/repos.d [rootdocker1 ~]# systemctl restart systemd-modules-load.service [rootdocker1 ~]# sysctl --system [rootdocker1 ~]# dnf install docker-ce -y [rootdocker1 ~]# vim /lib/systemd/system/docker.service ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue [rootdocker1 ~]# systemctl enable --now docker Created symlink /etc/systemd/system/multi-user.target.wants/docker.service → /usr/lib/systemd/system/docker.service. //另一台主机获取镜像 [rootdocker1 ~]# vim /etc/docker/daemon.json [rootdocker1 ~]# cat /etc/docker/daemon.json { insecure-registries : [http://192.168.168.145:5000] } [rootdocker1 ~]# systemctl restart docker.service [rootdocker1 ~]# docker info [rootdocker1 ~]# curl 192.168.168.145:5000/v2/_catalog {repositories:[nginx]} [rootdocker1 ~]# docker pull 192.168.168.145:5000/nginx:v1 v1: Pulling from nginx 6a6757ab48b1: Pull complete b19352c60515: Pull complete ecc510c1e359: Pull complete 113d9139ada2: Pull complete 188e9077f350: Pull complete 792a76c59dbd: Pull complete c9ec797c69ed: Pull complete Digest: sha256:6c7972b94d62ce93357d1e0d0ef6d3db8a2e9b8b6f3234d943d60ecbc4f4eb31 Status: Downloaded newer image for 192.168.168.145:5000/nginx:v1 192.168.168.145:5000/nginx:v15、docker数据传输加密1、生成加密传输时需要的key证书[rootdocker ~]# mkdir certs [rootdocker ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/timinglee.org.key -addext subjectAltName DNS:reg.timinglee.org -x509 -days 365 -out certs/timinglee.org.crt ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Shannxi Locality Name (eg, city) [Default City]:XiAn Organization Name (eg, company) [Default Company Ltd]:lwz Organizational Unit Name (eg, section) []:docker Common Name (eg, your name or your servers hostname) []:reg.timinglee.org Email Address []:admintiminglee.org [rootdocker ~]# cd certs/ [rootdocker certs]# ls timinglee.org.crt timinglee.org.key2、使用key和证书启动仓库[rootdocker ~]# docker image inspect registry:latest [rootdocker ~]# docker history registry:latest #启动registry仓库 [rootdocker ~]# docker run -d -p 443:443 --restartalways --name registry -v /opt/registry:/var/lib/registry -v /root/certs:/certs -e REGISTRY_HTTP_ADDR0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE/certs/timinglee.org.crt -e REGISTRY_HTTP_TLS_KEY/certs/timinglee.org.key registry feb7620e7d66d719ec604047fc16fdec27674950c8f0f6aa5ad9757669a290be [rootdocker ~]# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES feb7620e7d66 registry /entrypoint.sh /etc… 18 seconds ago Up 18 seconds 0.0.0.0:443-443/tcp, [::]:443-443/tcp, 5000/tcp registry3、使用仓库[rootdocker ~]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 192.168.168.145 docker reg.timinglee.org [rootdocker ~]# docker tag busybox:latest reg.timinglee.org/busybox:latest [rootdocker ~]# docker push reg.timinglee.org/busybox:latest //当前docker没有加载仓库的证书 The push refers to repository [reg.timinglee.org/busybox] 37bb94b0940b: Unavailable failed to do request: Head https://reg.timinglee.org/v2/busybox/blobs/sha256:aaef90e065235eb0b2d9938be85d1b81add2902cf89affe2cdfa19be33476ac0: tls: failed to verify certificate: x509: certificate signed by unknown authority #加载仓库证书 [rootdocker ~]# mkdir /etc/docker/certs.d/reg.timinglee.org/ -p [rootdocker ~]# cp /root/certs/timinglee.org.crt /etc/docker/certs.d/reg.timinglee.org/ca.crt [rootdocker ~]# systemctl restart docker [rootdocker ~]# docker push reg.timinglee.org/busybox:latest The push refers to repository [reg.timinglee.org/busybox] 37bb94b0940b: Pushed latest: digest: sha256:f97baa533a26513c453a362be331a43eb60214302f449c16571b23cea141dce4 size: 610 i Info → Not all multiplatform-content is present and only the available single-platform image was pushed sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e - sha256:f97baa533a26513c453a362be331a43eb60214302f449c16571b23cea141dce44、使用仓库下载镜像[rootdocker1 ~]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 192.168.168.145 docker reg.timinglee.org [rootdocker1 ~]# docker pull reg.timinglee.org/busybox:latest Error response from daemon: failed to resolve reference reg.timinglee.org/busybox:latest: failed to do request: Head https://reg.timinglee.org/v2/busybox/manifests/latest: tls: failed to verify certificate: x509: certificate signed by unknown authority [rootdocker ~]# scp -r /etc/docker/certs.d/ root192.168.168.148:/etc/docker/certs.d/ root192.168.168.148s password: ca.crt 100% 2228 3.9MB/s 00:00 ca.crt 100% 2228 3.4MB/s 00:00 [rootdocker1 ~]# systemctl restart docker.service [rootdocker1 ~]# docker pull reg.timinglee.org/busybox:latest latest: Pulling from busybox 37bb94b0940b: Pull complete Digest: sha256:f97baa533a26513c453a362be331a43eb60214302f449c16571b23cea141dce4 Status: Downloaded newer image for reg.timinglee.org/busybox:latest reg.timinglee.org/busybox:latest [rootdocker1 ~]# docker images i Info → U In Use IMAGE ID DISK USAGE CONTENT SIZE EXTRA 192.168.168.145:5000/nginx:v1 6c7972b94d62 238MB 63.9MB reg.timinglee.org/busybox:latest f97baa533a26 6.74MB 2.23MB6、为仓库建立登录认证1、建立认证文件[rootdocker ~]# dnf install httpd-tools -y [rootdocker ~]# mkdir auth [rootdocker ~]# cp htpasswd auth/ [rootdocker ~]# htpasswd -Bc auth/htpasswd timinglee New password: Re-type new password: Adding password for user timinglee [rootdocker ~]# docker run -d -p 443:443 --restartalways --name registry \ -v/opt/registry:/var/lib/registry \ -v /root/certs:/certs \ -e REGISTRY_HTTP_ADDR0.0.0.0:443 \ -e REGISTRY_HTTP_TLS_CERTIFICATE/certs/timinglee.org.crt \ -e REGISTRY_HTTP_TLS_KEY/certs/timinglee.org.key \ -v /root/auth:/auth \ -e REGISTRY_AUTHhtpasswd \ -e REGISTRY_AUTH_HTPASSWD_REALMRegistry Realm \ -e REGISTRY_AUTH_HTPASSWD_PATH/auth/htpasswd \ registry f2bbaccbe6dc71d73058eaebd005dd30892fd6552ebbba8094381090ab6fa45e [rootdocker ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 0bfc0c99a679 registry /entrypoint.sh /etc… 5 seconds ago Up 4 seconds 0.0.0.0:443-443/tcp, [::]:443-443/tcp, 5000/tcp registry2、利用文件启动仓库[rootdocker ~]# docker push reg.timinglee.org/busybox:latest //当前仓库开启了用户认证功能同时也开了加密传输功能所以如果验证仓库的用户认证功能需要做好加密传输的客户端设置 [rootdocker ~]# cd .docker/ [rootdocker .docker]# ls buildx config.json [rootdocker .docker]# vim config.json [rootdocker .docker]# docker logout Removing login credentials for https://index.docker.io/v1/ //登录 [rootdocker .docker]# docker login reg.timinglee.org -u timinglee Password: WARNING! Your credentials are stored unencrypted in /root/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/go/credential-store/ Login Succeeded //注销 [rootdocker ~]# docker logout reg.timinglee.org Removing login credentials for reg.timinglee.org3、验证仓库认证功能//没有登录前不能上传登录后可以上传 [rootdocker ~]# docker push reg.timinglee.org/busybox:latest The push refers to repository [reg.timinglee.org/busybox] 37bb94b0940b: Unavailable push access denied, repository does not exist or may require authorization: authorization failed: no basic auth credentials [rootdocker ~]# docker push reg.timinglee.org/busybox:latest The push refers to repository [reg.timinglee.org/busybox] 37bb94b0940b: Layer already exists latest: digest: sha256:f97baa533a26513c453a362be331a43eb60214302f449c16571b23cea141dce4 size: 610 i Info → Not all multiplatform-content is present and only the available single-platform image was pushed sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e - sha256:f97baa533a26513c453a362be331a43eb60214302f449c16571b23cea141dce4 [rootdocker ~]# curl -k https://reg.timinglee.org/v2/_catalog -utiminglee Enter host password for user timinglee: {repositories:[busybox]} //下载 [rootdocker1 ~]# docker pull reg.timinglee.org/busybox:latest Error response from daemon: failed to resolve reference reg.timinglee.org/busybox:latest: pull access denied, repository does not exist or may require authorization: authorization failed: no basic auth credentials [rootdocker1 ~]# docker login reg.timinglee.org Username: timinglee Password: WARNING! Your credentials are stored unencrypted in /root/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/go/credential-store/ Login Succeeded [rootdocker1 ~]# docker pull reg.timinglee.org/busybox:latest latest: Pulling from busybox 37bb94b0940b: Pull complete Digest: sha256:f97baa533a26513c453a362be331a43eb60214302f449c16571b23cea141dce4 Status: Downloaded newer image for reg.timinglee.org/busybox:latest reg.timinglee.org/busybox:latest

阅读完成 · 觉得有帮助？

咨询建站