资源

docker
docker-machine

https://docs.docker.com/docker-for-mac/release-notes/

常用工具

dive：一款按层分析docker镜像的工具

镜像加速

仓库

https://c.163yun.com/hub#/m/home/

开源镜像服务

https://goharbor.io/

容器tag说明

alpine

表明镜像的操作系统是alpine linux，alpine linux本身很小，alpine镜像的大小是5M

oraclelinux7

表明镜像的操作系统是Oracle Linux 7，从jdk12开始，openjdk官方开始提供基于Oracle Linux 7的jdk镜像

slim（不完整版本）

表明当前的jre并非标准jre版本，而是headless版本，该版本的特点是去掉了UI、键盘、鼠标相关的库，因此更加精简，适合服务端应用使用，官方的建议是除非有明确的体积限制是再考虑使用该版本；
仅安装运行特定工具所需的最少软件包,如果有空间限制并且不需要完整版本，请使用此tag,但是使用前需要经过完整测试，如果没时间测试，就使用上面的完整版本

Jessie（Debian8版本）

stretch（对应Debian9版本-稳定版本推荐使用）

buster（对应Debian稳定的发行版是10.7（2020-12-05））

bullseye（正在开发但尚未稳定的未来版本是Bullseye和Bookworm和Trixie）

操作系统基础镜像

镜像名称 大小 使用场景
busybox 1.15MB 临时测试用
alpine 4.41MB 主要用于测试，也可用于生产环境
centos 200MB 主要用于生产环境，支持CentOS/Red Hat，常用于追求稳定性的企业应用
ubuntu 81.1MB 主要用于生产环境，常用于人工智能计算和企业应用
debian 101MB 主要用于生产环境
rockylinux 84.3MB 替代centos新版本 
  1. docker pull rockylinux/rockylinux:8

busybox

Ubuntu

Mac

https://docs.docker.com/toolbox/

https://github.com/docker/kitematic/releases

启动参数配置文件：

  1. vim ~/Library/Group\ Containers/group.com.docker/settings.json

常用命令

docker build

  1. docker build -t [dockerGroup]/[dokerName]:[dockerTag] .

镜像生成

  1. # 基于已修改的生成镜像
  2. docker commit -m='add nginx' -a='qizai' [dockerId] registry.cn-shenzhen.aliyuncs.com/[groupId]/[dockerName]:[镜像版本号]
  3. # 
  4. docker login --username=username registry.cn-shenzhen.aliyuncs.com
  5. docker tag [ImageId] registry.cn-shenzhen.aliyuncs.com/[groupId]/[dockerName]:[镜像版本号]
  6. docker push registry.cn-shenzhen.aliyuncs.com/[groupId]/[dockerName]:[镜像版本号]

状态监控

  1. # 运行
  2. docker run -it --rm registry.cn-shenzhen.aliyuncs.com/[groupId]/[dockerName]:[镜像版本号]
  3. # 进入容器
  4. docker exec -it [docker_id/docker_name] /bin/bash
  5. # 查看容器地址
  6. docker inspect -f '{{ .NetworkSettings.IPAddress }}' [docker_id/docker_name]
  7. # 应用运行状态：CPU、内存、网络
  8. docker stats $(docker ps --format={{.Names}}) --no-stream
  9. docker stats --no-stream --format "{\"container\":\"{{ .Container }}\",\"name\":\"{{ .Name }}\",\"memory\":{\"raw\":\"{{ .MemUsage }}\",\"percent\":\"{{ .MemPerc }}\"},\"cpu\":\"{{ .CPUPerc }}\"}"
  10. # 获取当前机器所有docker使用的内存总量
  11. docker stats --no-stream --format  "{{ .MemUsage }}" |awk '{if($1 < 10){sum += $1*1024;}else{sum += $1;}};END{print sum}'

常见问题

基于镜像做二次修改

  1. # 在对docker进行修改后通过commit保存，并指定标签
  2. docker commit -m="has update" -a="qizai" [docker ID] qizai/demo:v2
  3. # 推送到仓库
  4. docker push qizai/demo:v2

如何使用root运行dokcer中文件

  1. sudo docker exec -u root  -it {id} bash -c 'bash.sh'
  2. # percona-server-mongodb启用认证
  3. docker exec -u root  -it [ID] bash -c "/usr/bin/percona-server-mongodb-enable-auth.sh"

Dockerfile 运行jar

  1. FROM openjdk:8-jdk-alpine
  2. ENV TIME_ZONE="Asia/Shanghai"
  3. RUN ln -snf /usr/share/zoneinfo/$TIME_ZONE /etc/localtime && echo $TIME_ZONE > /etc/timezone && mkdir -p /www/web/logs
  5. WORKDIR /www/web
  6. ARG JAR_FILE=target/*.jar
  7. COPY ${JAR_FILE} app.jar
  8. ENV PARAMS=""
  9. ENV JAVA_OPTS=""
  10. RUN echo -e "#!/bin/sh \nnohup java \$JAVA_OPTS -jar /www/web/app.jar \$PARAMS > logs/start.out 2>&1 </dev/null" >> /www/web/docker-entrypoint.sh && chmod +x /www/web/docker-entrypoint.sh
  11. ENTRYPOINT ["/www/web/docker-entrypoint.sh"]

Dockerfile springboot分层构建

  1. FROM openjdk:8-jdk-alpine as builder
  2. WORKDIR application
  3. ARG JAR_FILE=target/*.jar
  4. COPY ${JAR_FILE} app.jar
  5. RUN java -Djarmode=layertools -jar app.jar extract
  7. FROM openjdk:8-jdk-alpine
  8. MAINTAINER qizai
  9. ENV PARAMS=""
  10. ENV JAVA_OPTS="-server"
  11. ENV TIME_ZONE="Asia/Shanghai"
  12. RUN ln -snf /usr/share/zoneinfo/$TIME_ZONE /etc/localtime && echo $TIME_ZONE > /etc/timezone && mkdir -p /www/web/logs
  13. WORKDIR /www/web
  15. COPY --from=builder application/dependencies/ ./
  16. COPY --from=builder application/spring-boot-loader/ ./
  17. COPY --from=builder application/snapshot-dependencies/ ./
  18. COPY --from=builder application/application/ ./
  20. RUN echo -e "#!/bin/sh \nnohup java \$JAVA_OPTS org.springframework.boot.loader.JarLauncher \$PARAMS > logs/start.out 2>&1 </dev/null" >> /www/web/docker-entrypoint.sh && chmod +x /www/web/docker-entrypoint.sh
  21. ENTRYPOINT ["/www/web/docker-entrypoint.sh"]

安装常见问题

MacOS 下登陆私有Docker

  1. 方法一：在图形界面打开Docker.app-Preferences-General,取消勾选的Securely store Docker logins in macOS keychain,
  2. 此后的登陆便不会验证证书.
  4. 方法二：在launchpad中搜索Keychain Access并打开,然后在搜索栏中搜索仓库的证书,关键字为仓库的domain.
  6. 搜到后添加信任，并编辑.docker/config.json文件，将其中的"credsStore": "osxkeychain"字段删除,便可登陆.
  8. 可以把证书下载到mac中
  9. sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain domain.crt

时区相关

  1. # 宿主机器修改
  2. timedatectl
  3. timedatectl set-timezone Asia/Shanghai
  4. date
  5. #调整时间
  6. date -s "2016-12-13 21:54:20"
  7. #时间同步，不执行则无法生效
  8. clock -w
  9. timedatectl
  11. # Dockerfile修改
  12. #定义环境变量
  13. ENV TIME_ZONE Asiz/Shanghai

docker安装

  1. yum remove docker docker-common container-selinux docker-selinux docker-engine
  2. yum install -y yum-utils device-mapper-persistent-data lvm2
  3. yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
  4. #yum-config-manager --enable docker-ce-edge
  5. #yum-config-manager --enable docker-ce-test
  6. #yum-config-manager --disable docker-ce-edge
  7. yum makecache fast
  8. # centos8默认使用podman代替docker，所以需要containerd.io
  9. # centos8 特别处理yum install https://download.docker.com/linux/fedora/30/x86_64/stable/Packages/containerd.io-1.2.6-3.3.fc30.x86_64.rpm
  10. yum install docker-ce docker-ce-cli containerd.io
  11. yum list docker-ce --showduplicates | sort -r
  12. systemctl start docker
  13. docker run hello-world
  15. # 阿里云内网安装
  16. curl -sSL http://acs-public-mirror.oss-cn-hangzhou.aliyuncs.com/docker-engine/intranet | sh -

Install Compose

http://get.daocloud.io/

  1. # on Linux systems
  2. sudo curl -L "https://github.com/docker/compose/releases/download/1.25.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
  3. sudo chmod +x /usr/local/bin/docker-compose
  4. sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose

kubernetes集群安装

docker images

docker pull kubeimage/kube-proxy-amd64:v1.18.8 docker pull kubeimage/kube-controller-manager-amd64:v1.18.8 docker pull kubeimage/kube-scheduler-amd64:v1.18.8 docker pull kubeimage/kube-apiserver-amd64:v1.18.8 docker pull kubeimage/kubernetes-dashboard-amd64:v1.8.2 docker pull kubeimage/pause-amd64:3.2 docker pull coredns/coredns:1.7.1 docker pull elcolio/etcd:2.0.10

修改hosts

echo ‘10.0.1.12 k8s-master 10.0.1.12 etcd 10.0.1.12 registry 10.0.1.13 k8s-node-1 10.0.1.14 k8s-node-2’>> /etc/hosts

修改hostname

hostnamectl —static set-hostname k8s-master hostnamectl —static set-hostname k8s-node-1 hostnamectl —static set-hostname k8s-node-2

关闭防火墙

systemctl disable firewalld.service
systemctl stop firewalld.service

部署etcd

集群：http://www.cnblogs.com/zhenyuyaodidiao/p/6237019.html

yum install etcd vim -y

修改配置文件

vi /etc/etcd/etcd.conf

[member]

ETCD_NAME=”master”
ETCD_LISTEN_CLIENT_URLS=”http://0.0.0.0:2379,http://0.0.0.0:4001“

[cluster]
ETCD_ADVERTISE_CLIENT_URLS=”http://etcd:2379,http://etcd:4001“

启动并验证状态

systemctl start etcd etcdctl set testdir/testkey0 0 etcdctl get testdir/testkey0 etcdctl -C http://etcd:4001 cluster-health etcdctl -C http://etcd:2379 cluster-health

部署master

yum install docker kubernetes vim -y

配置文件更新

  1. vim /etc/sysconfig/docker
  3. # Modify these options if you want to change the way the docker daemon runs
  4. OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false'
  5. if [ -z "${DOCKER_CERT_PATH}" ]; then
  6.     DOCKER_CERT_PATH=/etc/docker
  7. fi
  8. # 增加下面
  9. OPTIONS='--insecure-registry registry:5000'
  11. vim /etc/kubernetes/apiserver
  12. # 修改下面
  13. KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"
  14. KUBE_API_PORT="--port=8080"
  15. KUBE_ETCD_SERVERS="--etcd-servers=http://etcd:2379"
  16. KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ResourceQuota"
  18. vim /etc/kubernetes/config
  19. # 修改下面
  20. KUBE_MASTER="--master=http://k8s-master:8080"

启动服务

systemctl enable docker.service systemctl start docker.service systemctl enable kube-apiserver.service systemctl start kube-apiserver.service systemctl enable kube-controller-manager.service systemctl start kube-controller-manager.service systemctl enable kube-scheduler.service systemctl start kube-scheduler.service

以下再部署完node后再启动

systemctl enable kubelet.service systemctl start kubelet.service systemctl enable kube-proxy.service systemctl start kube-proxy.service

部署node

先参照master安装docker和kubernetes
配置文件修改

  1. vim /etc/kubernetes/config
  3. KUBE_MASTER="--master=http://k8s-master:8080"
  5. vim /etc/kubernetes/kubelet
  7. KUBELET_ADDRESS="--address=0.0.0.0"
  8. KUBELET_HOSTNAME="--hostname-override=k8s-node-1"
  9. KUBELET_API_SERVER="--api-servers=http://k8s-master:8080"

集群状态查看

kubectl -s http://k8s-master:8080 get node kubectl get nodes

Flannel-覆盖网络

master和node都安装

yum install flannel -y

配置文件修改

  1. vim /etc/sysconfig/flanneld
  3. FLANNEL_ETCD_ENDPOINTS="http://etcd:2379"
  4. FLANNEL_ETCD_PREFIX="/atomic.io/network"

注意

Flannel使用Etcd进行配置，来保证多个Flannel实例之间的配置一致性，所以需要在etcd上进行如下配置：（‘/atomic.io/network/config’这个key与上文/etc/sysconfig/flannel中的配置项FLANNEL_ETCD_PREFIX是相对应的，错误的话启动就会出错）

设置

etcdctl mk /atomic.io/network/config ‘{ “Network”: “10.0.0.0/16” }’

启动Flannel之后，需要依次重启docker、kubernete

master

systemctl enable flanneld.service systemctl start flanneld.service service docker restart systemctl restart kube-apiserver.service systemctl restart kube-controller-manager.service systemctl restart kube-scheduler.service

node

systemctl enable flanneld.service systemctl start flanneld.service service docker restart systemctl restart kubelet.service systemctl restart kube-proxy.service