1
Q1: 基于同一个镜像启动的两个容器,各自修改根目录结构为啥互不影响❓️
2
A1: 底层用到了chroot技术来实现资源的隔离
3
✅️所谓的chroot就是改变根目录
4
✅️各自"容器"识别宿主机的某个特定目录为根目录
5

6
1)创建虚拟根目录
7
[root@Docker ~]# mkdir /boke
8
[root@Docker ~]# ls -la /boke
9
total 4
10
drwxr-xr-x   2 root root    6 Apr 23 11:05 .
11
dr-xr-xr-x. 22 root root 4096 Apr 23 11:05 ..
12
# 里面什么都没有
13
--help    # 帮助信息
14
--version  # 版本信息
15
[root@Docker ~]# chroot --help
16
Usage: chroot [选项] NEWROOT [命令...]
17
# 用 新根 运行命令
18
✅️ 如果没有命令,默认'/bin/bash -i'
19
# 以交互式的终端进入
20

21
2)初尝试
22
[root@Docker ~]# chroot /boke
23
chroot: failed to run command ‘/bin/bash’: No such file or directory
24
# 没有这个/bin/bash
25
[root@Docker ~]# /bin/bash
26
root@Docker:~# exit
27
exit
28
'可是我们宿主机有呀!'
29
✅️ 是我们的虚拟根目录没有
30
[root@Docker ~]# ls -lh /bin/bash
31
-rwxr-xr-x. 1 root root 1.4M Oct 29  2024 /bin/bash
32
# 它是一个文件
33
[root@Docker ~]# mkdir /boke/bin
34
# 在虚拟根目录下创建bin目录
35
[root@Docker ~]# cp  /bin/bash /boke/bin
36
# 把这个文件拷贝过去
37
[root@Docker ~]# tree /boke
38
/boke
39
└── bin
40
    └── bash
41

42
3)再次尝试
43
[root@Docker ~]# chroot /boke
44
chroot: failed to run command ‘/bin/bash’: No such file or directory
45
# 还是不行!
46
'缺少依赖'
47
[root@Docker ~]# ldd /bin/bash
48
✅️ ldd: 查看所依赖的库文件
49
  linux-vdso.so.1 (0x00007f0ad9b47000)
50
  libtinfo.so.6 => /lib64/libtinfo.so.6 (0x00007f0ad99ae000)
51
  libc.so.6 => /lib64/libc.so.6 (0x00007f0ad97d6000)
52
  /lib64/ld-linux-x86-64.so.2 (0x00007f0ad9b49000)
53
[root@Docker ~]# mkdir -p /boke/lib64/
54
# 先创建对应目录
55
[root@Docker ~]# cp /lib64/libtinfo.so.6 /boke/lib64/
56
[root@Docker ~]# cp /lib64/libc.so.6 /boke/lib64/
57
[root@Docker ~]# cp /lib64/ld-linux-x86-64.so.2 /boke/lib64/
58
'都拷贝至虚拟目录中'
59
[root@Docker ~]# tree /boke
60
/boke
61
├── bin
62
│   └── bash
63
└── lib64
64
    ├── ld-linux-x86-64.so.2
65
    ├── libc.so.6
66
    └── libtinfo.so.6
67

68
4)再次尝试
69
[root@Docker ~]# chroot /boke
70
# 成功进去
71
bash-5.2#
72
"两次Tab键"
73
if   pwd   test  unset   false  in  then ...xxx
74
bash-5.2# pwd
75
/
76
'这就是虚拟根目录-->/boke'
77
bash-5.2# ls
78
bash: ls: command not found
79
✅️ 只能执行bash相关命令
80

81
5)添加ls命令
82
[root@Docker ~]# which ls
83
/usr/bin/ls
84
[root@Docker ~]# ls -lh /usr/bin/ls
85
-rwxr-xr-x. 1 root root 138K Nov 26  2024 /usr/bin/ls
86
# 一个目录
87
[root@Docker ~]# mkdir -p /boke/usr/bin
88
[root@Docker ~]# cp /usr/bin/ls /boke/usr/bin
89
[root@Docker ~]# ldd /usr/bin/ls
90
# 查看依赖
91
  linux-vdso.so.1 (0x00007fe9ea791000)
92
  libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fe9ea72e000)
93
  libcap.so.2 => /lib64/libcap.so.2 (0x00007fe9ea721000)
94
  libc.so.6 => /lib64/libc.so.6 (0x00007fe9ea549000)
95
  libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 (0x00007fe9ea4a7000)
96
  /lib64/ld-linux-x86-64.so.2 (0x00007fe9ea793000)
97
"把没有的依赖复制进去"
98
[root@Docker ~]# cp /lib64/libselinux.so.1 /boke/lib64/
99
[root@Docker ~]# cp /lib64/libpcre2-8.so.0 /boke/lib64/
100
[root@Docker ~]# cp /lib64/libcap.so.2 /boke/lib64/
101
[root@Docker ~]# chroot /boke
102
bash-5.2# ls -lh
103
drwxr-xr-x 2 0 0  18 Apr 23 03:18 bin
104
drwxr-xr-x 2 0 0 137 Apr 23 03:39 lib64
105
drwxr-xr-x 3 0 0  17 Apr 23 03:35 usr
106
bash-5.2# exit
107
exit
108
[root@Docker ~]# chroot /boke ls -lh /
109
# 改变根目录的同时执行命令
110
ls -lh /
111
✅️ 等价于上面的操作
112

113
6)添加ifconfig命令
114
[root@Docker ~]# chroot /boke ifconfig
115
chroot: failed to run command ‘ifconfig’: No such file or directory
116
'因为我们假根中没有这个命令,也没有它的依赖文件'
117
[root@Docker ~]# which ifconfig
118
/usr/sbin/ifconfig
119
[root@Docker ~]# ls -lh /usr/sbin/ifconfig
120
-rwxr-xr-x. 1 root root 76K Oct 29  2024 /usr/sbin/ifconfig
121
[root@Docker ~]# mkdir /boke/usr/sbin
122
[root@Docker ~]# cp /usr/sbin/ifconfig /boke/usr/sbin
123
# 复制命令文件
124
[root@Docker ~]# ldd /usr/sbin/ifconfig
125
# 把没有的依赖拷贝过去!
126
[root@Docker ~]# chroot /boke ifconfig
127
'直接执行'
128
Warning: cannot open /proc/net/dev (No such file or directory). Limited output.
129
# 因为我们假根里面没有对应的进程信息
130
✅️ 查看到的是我们宿主机的网络信息
131
lo: xxx
132
        inet 127.0.0.1  netmask 255.0.0.0
133
eth0: xxx
134
        inet 10.0.0.99  netmask 255.255.255.0
135
docker0: xxx
136
        inet 172.17.0.1  netmask 255.255.0.0
137

138
7)添加其他命令
139
# 简略
140
[root@Docker ~]# cp /usr/bin/echo /boke/usr/bin/
141
[root@Docker ~]# cp /usr/bin/cat /boke/usr/bin/
142

143
8)echo重定向📍位置
144
[root@Docker ~]# chroot /boke echo test > /hh.md
145
[root@Docker ~]# chroot /boke cat /hh.md
146
cat: /hh.md: No such file or directory
147
# 这里查看的是假根中的hh.md
148
'为什么查看不到!'
149
✅️ 命令行中输出重定向到/hh.md
150
[root@Docker ~]# cat /hh.md
151
test
152
# 输出到我们宿主机的根里面了
153
'我们是在宿主机中的bash执行的'
154
[root@Docker ~]# chroot /boke
155
bash-5.2# echo test > /hh.md
156
bash-5.2# cat /hh.md
157
test
158
bash-5.2# exit
159
exit
160
[root@Docker ~]# chroot /boke cat /hh.md
161
test
162
=========================
163
echo 输出重定向
164
✅️ 在宿主机内执行会被重定向到 --> 真实的根/
165
✅️ 在假根内重定向 --> 假根/boke
166
=========================
167
上面是假根,那么真实的容器有这样的情况吗❓️
168
[root@test ~]# docker run -d -it --name v1 alpine:3.20.2
169
[root@test ~]# docker exec v1 echo "This My web" > /boke.md
170
[root@test ~]# docker exec v1 ls | grep boke
171
⚠️'实际上什么也没有过滤到'
172
✅️ 并没有写入到容器中
173
[root@test ~]# ll /boke.md
174
-rw-r--r-- 1 root root 12 4月  23 21:08 /boke.md
175
[root@test ~]# cat /boke.md
176
This My web
177

178
9)输出环境变量
179
[root@Docker ~]# chroot /boke echo $PATH
180
'查看的是假根中的环境变量'
181
xxx:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
182
# 只有后面的/usr/sbin:/usr/bin生效了
183
✅️ 前面的我们假根就没有对应的目录
184
[root@Docker ~]# tree /boke
185
/boke
186
├── bin
187
│   └── bash
188
├── hh.md
189
├── lib64
190
│   ├── ld-linux-x86-64.so.2
191
│   ├── libcap.so.2
192
│   ├── libc.so.6
193
│   ├── libpcre2-8.so.0
194
│   ├── libselinux.so.1
195
│   └── libtinfo.so.6
196
└── usr
197
    ├── bin
198
    │   ├── cat
199
    │   ├── echo
200
    │   └── ls
201
    └── sbin
202
        └── ifconfig
203

204
10)容器的真实位置📍
205
[root@Docker ~]# docker run -d -it --name v1 alpine:3.20.2
206
[root@Docker ~]# docker exec v1 mkdir /boke
207
[root@Docker ~]# docker exec -it v1 sh
208
/ # cat /etc/hosts | tail -1
209
172.17.0.2  903b08594f0a
210
/ # ls
211
bin    dev    home   media  opt    root   sbin   sys    usr
212
"boke"   etc    lib    mnt    proc   run    srv    tmp    var
213
/ # exit
214
'/var/lib/docker/rootfs/overlayfs/903b08594f0a'
215
[root@Docker 903b08594f0a]# ls
216
bin   dev  home  media  opt   root  sbin  sys  usr
217
"boke"  etc  lib   mnt    proc  run   srv   tmp  var
218
✅️ 目录结构一模一样!
219
# 都有刚创建的boke目录

1
'在容器中验证'
2
# 有些docker版本可能显示不出效果
3
  👆 inspect信息没有那么详细
4
[root@test ~]# docker info
5
Client: Docker Engine - Community
6
 Version:    26.1.4
7
 .........
8
  Storage Driver: overlay2
9
  Backing Filesystem: xfs
10
  📌 重点上面这俩
11
  Operating System: CentOS Linux 7 (Core)
12

13
1)inspect详细信息
14
[root@test ~]# docker run -d -it --name v1 alpine:3.20.2
15
[root@test ~]# docker exec -it v1 sh
16
/ # echo "This My web" > /boke.md
17
/ # cat /boke.md
18
This My web
19
/ # ls / | grep boke
20
boke.md
21
/ # exit
22
[root@test ~]# docker inspect v1 | grep -A 5 Data
23
            "Data": {
24
                "LowerDir": "/var/lib/docker/overlay2/e77f7bbcb968b93917e8863bb506969e046d26e270d6cd0260db7f036719932a-init/diff:/var/lib/docker/overlay2/8438a61d278166d8383628b5c496c63f9eaf287851c1e05049711f9688f13268/diff",
25
                "MergedDir": "/var/lib/docker/overlay2/e77f7bbcb968b93917e8863bb506969e046d26e270d6cd0260db7f036719932a/merged",
26
                "UpperDir": "/var/lib/docker/overlay2/e77f7bbcb968b93917e8863bb506969e046d26e270d6cd0260db7f036719932a/diff",
27
                "WorkDir": "/var/lib/docker/overlay2/e77f7bbcb968b93917e8863bb506969e046d26e270d6cd0260db7f036719932a/work"
28
            },
29
[root@test ~]# ls /var/lib/docker/overlay2/e77f7bbcb968b93917e8863bb506969e046d26e270d6cd0260db7f036719932a/merged
30
✅️ 查看 "统一联合视图"(MergedDir)
31
bin  "boke.md"  dev  etc  home  lib  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
32
[root@test ~]# df -h |grep  9932a/merged
33
overlay                   26G   13G   14G   50% /var/lib/docker/overlay2/e77f7bbcb968b93917e8863bb506969e046d26e270d6cd0260db7f036719932a/merged
34
⚠️"每一个正在运行的容器,将该容器独有的读写层UpperDir和只读层LowerDir以及工作层WorkDir联合挂载到这个 merged 目录上(完整的文件系统视图)"⚠️
35
[root@test ~]# docker stop -t 0 v1
36
⚠️停止后,就过滤不到了
37
[root@test ~]# df -h |grep  9932a/merged
38
# 什么都没有
39

40
[root@test ~]# ls /var/lib/docker/overlay2/e77f7bbcb968b93917e8863bb506969e046d26e270d6cd0260db7f036719932a/diff
41
✅️ 查看读写层
42
"boke.md"  root
43

44
[root@test ~]# cat /var/lib/docker/overlay2/e77f7bbcb968b93917e8863bb506969e046d26e270d6cd0260db7f036719932a/diff/boke.md
45
This My web
46
# 里面的内容依旧是它
47

48
'我们甚至可以直接在宿主机中进行改写!'
49
⚠️ 这里改的是"读写层(容器层)"
50
[root@test ~]# echo Hello > /var/lib/docker/overlay2/e77f7bbcb968b93917e8863bb506969e046d26e270d6cd0260db7f036719932a/diff/boke.md
51
📌 覆盖写入Hello
52
[root@test ~]# docker exec v1 cat /boke.md
53
Hello
54
✅️ 容器里面的内容也会发生改变
55

56
2)直接修改"镜像层(只读层)"
57
# 这里只做简单的演示,工作中不要改
58
[root@test ~]# docker run -d -it --name v2 alpine:3.20.2
59
# 再跑一个容器
60
[root@test ~]# docker exec v2 ls / | grep test.md
61
# 现在没有test.md文件
62
[root@test ~]# docker inspect v2 | grep LowerDir
63
          📌镜像层 ---> "LowerDir": "/var/lib/docker/overlay2/759df0fdd3a84541c49647994fdacbdc32994ce86984f164bf3158bd83e6644c-init/diff:/var/lib/docker/overlay2/8438a61d278166d8383628b5c496c63f9eaf287851c1e05049711f9688f13268/diff",
64
[root@test ~]# echo 到此一游 > /var/lib/docker/overlay2/8438a61d278166d8383628b5c496c63f9eaf287851c1e05049711f9688f13268/diff/test.md
65
[root@test ~]# docker exec v2 ls / | grep test.md
66
test.md
67
[root@test ~]# docker exec v2 cat /test.md
68
到此一游
69
'不仅v2可以查看到,v1也可以查看到'
70
[root@test ~]# docker exec v1 cat /test.md
71
到此一游
72
✅️ "镜像层"两个容器都可以读取到

1
所谓的cgroup本质上是Linux用做资源限制,可以限制Linux的cpu、memory、disk、I/O
2

3
1)环境准备!
4
[root@Docker ~]# docker info | grep Cgroup
5
 Cgroup Driver: systemd ✅️
6
 Cgroup Version: 2 ✅️
7
⚠️ 如果你是Centos-7 👇需要进行修改!
8
[root@test ~]# docker info | grep Cgroup
9
 Cgroup Driver: cgroupfs
10
 Cgroup Version: 1
11

12
2)拉取镜像
13
[root@Docker ~]# docker pull docker.xuanyuan.run/jasonyin2020/oldboyedu-linux-tools:v0.1
14
# 下载一个工具包镜像
15
'里面的镜像,有我们所需要的工具(命令)'
16
[root@Docker ~]# docker tag docker.xuanyuan.run/jasonyin2020/oldboyedu-linux-tools:v0.1 oldboyedu-linux-tools:v0.1
17
[root@Docker ~]# docker rmi docker.xuanyuan.run/jasonyin2020/oldboyedu-linux-tools:v0.1
18
[root@Docker ~]# docker images
19
oldboyedu-linux-tools:v0.1    eac6c50d80c7
20

21
3)运行容器-->资源限制
22
[root@Docker ~]# docker run -d --name stress --cpu-quota 30000 -m 209715200 oldboyedu-linux-tools:v0.1 tail -f /etc/hosts
23
--cpu-quota 30000  # 后面000不要看
24
"这个容器最多可以使用 30% 的一个 CPU 核心"
25
-m 209715200    # 单位是字节
26
"相当于 200 MB, 限制容器可以使用的最大内存"
27
tail -f /etc/hosts  # 阻塞住
28

29
4)测试
30
[root@Docker ~]# docker  ps
31
87200c436fdf   oldboyedu-linux-tools:v0.1   "tail -f /etc/hosts"   23 seconds ago   Up 22 seconds
32
[root@Docker ~]# docker stats stress
33
'查看容器的使用状态'
34
CONTAINER ID  NAME    CPU %   MEM USAGE / LIMIT   MEM %
35
87200c436fdf  stress  0.00%   396KiB / 200MiB     0.19%
36
✅️ 内存这里最大限制200 MB        👆
37
🌰 可以让它只输出一次⬇️,而不是持续输出⬆️
38
[root@Docker ~]# docker stats stress --no-stream
39
'输出完退出'
40

41
5)CPU压测
42
'新开一个终端'
43
[root@Docker ~]# docker exec -it stress sh
44
/usr/local/stress # stress --help
45
/usr/local/stress # stress -c 4 --timeout 10m
46
# 启动4个CPU进程
47
'容器CPU核心的使用率30%上下浮动, 不会超过太多!'
48
CONTAINER ID   NAME      CPU %
49
87200c436fdf   stress    31.85%
50

51
6)内存压测
52
[root@Docker ~]# docker exec -it stress sh
53
/usr/local/stress # stress  -m 5 --vm-bytes 52428800 --vm-keep
54
-m 5    # 启动5个内存工作进程
55
--vm-bytes  # 每个工作进程,分配使用50 MB内存
56
--vm-keep  # 保持已分配的内存不释放
57
✅️ 5 × 50 = 250 MB
58
'内存不会超过200 MB'
59
CONTAINER ID   NAME    MEM USAGE / LIMIT
60
87200c436fdf   stress  199.8MiB / 200MiB
61

62
7)不做资源限制
63
'先查看宿主机的资源'
64
[root@Docker ~]# lscpu | grep 'CPU(s)'
65
CPU(s):  2
66
'2个CPU核心最高可以达到200%'
67
[root@Docker ~]# free -h
68
               total
69
Mem:           1.9Gi
70
[root@Docker ~]# docker rm -f $(docker ps -aq)
71
[root@Docker ~]# docker run -d -it --name v1 oldboyedu-linux-tools:v0.1
72
# 正常运行一个容器
73
[root@Docker ~]# docker ps
74
82daf8cf0ca7   oldboyedu-linux-tools:v0.1   "/bin/sh"
75
[root@Docker ~]# docker exec -it v1 sh
76
/usr/local/stress # stress -c 8 -m 12 --vm-bytes 250M --vm-keep --timeout 10m
77
# 把CPU和内存拉起来
78
8个CPU进程
79
12×250M
80
[root@Docker ~]# docker stats v1
81
NAME  CPU %    MEM USAGE / LIMIT     MEM %
82
v1    142.90%  1.531GiB / 1.884GiB   81.29%
83
'CPU和内存都被消耗了很多'
84
✅️ 一个容器如果你不做资源限制,它默认会吃掉你整个宿主机的内存
85

86
8)对已经运行的容器做资源限制
87
"docker update"
88
# 我们就对👆的v1容器做资源限制
89
[root@Docker ~]# docker update --cpu-quota 50000 -m 209715200 --memory-swap 262144000 v1
90
0.5个 --> CPU核心
91
200 MB --> 内存
92
250 MB --> 交换分区
93
🌰压测
94
/usr/local/stress # stress  -m 4 --vm-bytes 52428800 --vm-keep
95
CONTAINER ID  NAME  CPU %   MEM USAGE / LIMIT
96
82daf8cf0ca7  v1    52.58%  199.9MiB / 200MiB

1
在"/proc"目录可以查看当前 Shell 进程的"命名空间"：
2
[root@Docker ~]# ls -l /proc/$$/ns/
3
lrwxrwxrwx 1 root xxx cgroup -> 'cgroup:[4026531835]'
4
lrwxrwxrwx 1 root xxx ipc -> 'ipc:[4026531839]'
5
lrwxrwxrwx 1 root xxx mnt -> 'mnt:[4026531841]'
6
lrwxrwxrwx 1 root xxx net -> 'net:[4026531840]'
7
lrwxrwxrwx 1 root xxx pid -> 'pid:[4026531836]'
8
lrwxrwxrwx 1 root xxx pid_for_children -> 'pid:[4026531836]'
9
lrwxrwxrwx 1 root xxx time -> 'time:[4026531834]'
10
lrwxrwxrwx 1 root xxx time_for_children -> 'time:[4026531834]'
11
lrwxrwxrwx 1 root xxx user -> 'user:[4026531837]'
12
lrwxrwxrwx 1 root xxx uts -> 'uts:[4026531838]'
13
✅️ 如果两个进程的数字编号相同,说明它们在同一个 Namespace 里
14
     pid 和 pid_for_children
15
     time 和 time_for_children
16
✅️ 如果不同,说明它们是隔离的
17
    ⭐我们下面主要讲"网络net"的隔离
18

19
1)跑三个容器
20
[root@Docker ~]# docker rm -f $(docker ps -aq)
21
[root@Docker ~]# docker run -d --name v1 -it alpine:3.20.2
22
[root@Docker ~]# docker run -d --name v2 -it alpine:3.20.2
23
[root@Docker ~]# docker run -d --name v3 -it --network container:v1 alpine:3.20.2
24
'这里v3和v1使用共同的网络🌐'
25
[root@Docker ~]# docker ps
26
6584caee7c91   alpine:3.20.2   "/bin/sh"  v3
27
02137433079f   alpine:3.20.2   "/bin/sh"  v2
28
95a16db3fef6   alpine:3.20.2   "/bin/sh"  v1
29

30
2)查看进程信息
31
[root@Docker ~]# docker top v1 | awk 'NR==2{print $2}'
32
46848
33
# 👆是用 docker top 配合awk取
34
[root@Docker ~]# docker inspect v1 -f "{{.State.Pid}}"
35
46848
36
# 👆是用inspect取
37
[root@Docker ~]# ll /proc/46848/ns/ | grep net
38
lrwxrwxrwx 1 root xxx net -> net:[4026532716]
39

40
🌰v2
41
[root@Docker ~]# docker inspect v2 -f "{{.State.Pid}}"
42
46922
43
[root@Docker ~]# ll /proc/46922/ns/ | grep net
44
lrwxrwxrwx 1 root xxx net -> net:[4026532928]
45

46
🌰v3
47
[root@Docker ~]# docker inspect v3 -f "{{.State.Pid}}"
48
47152
49
[root@Docker ~]# ll /proc/47152/ns/ | grep net
50
lrwxrwxrwx 1 root xxx0 net -> net:[4026532716]
51
✅️ 你会发现v3和v1的网络的"命名空间"一致都是4026532716
52
# 因为v3的网络类型是container:v1 --> 和v1保持一致
53

54
3)查看具体的IP地址
55
[root@Docker ~]# docker exec v1 cat /etc/hosts | tail -1
56
172.17.0.2
57
[root@Docker ~]# docker exec v3 cat /etc/hosts | tail -1
58
172.17.0.2
59
'保持一致'
60
===================================
61
✅️ 进程pid的命名空间不同,自然相互隔离
62
📌 我们通常对 网络🌐 和 存储💾 进行共享

1
"准备镜像"
2
[root@Docker ~]# docker images
3
IMAGE            DISK USAGE
4
alpine:3.20.2    11.7MB
5
ubuntu:22.04    117MB
6
📌 光基础镜像就已经相差10倍了
7

8
1)Ubuntu基础镜像
9
[root@Docker ~]# docker run -d -it --name v1 ubuntu:22.04
10
[root@Docker ~]# docker exec -it v1 /bin/bash
11
root@c9a1469fa0b7:/# nginx
12
bash: nginx: command not found
13
'里面并没有nginx'
14
root@c9a1469fa0b7:/# apt -y install nginx
15
Reading package lists... Done
16
'不能直接下载'
17
root@c9a1469fa0b7:/# apt -y update
18
'先升级一下软件包'
19
root@c9a1469fa0b7:/# apt -y install nginx
20
# 现在就可以下载了
21
root@c9a1469fa0b7:/# ss -lnt | grep 80
22
root@c9a1469fa0b7:/# nginx -t
23
nginx: the configuration xxx is ok
24
nginx: xxx is successful
25
root@c9a1469fa0b7:/# nginx
26
✅️ 直接敲nginx就可以启动服务
27
root@c9a1469fa0b7:/# ss -lnt | grep 80
28
0.0.0.0:80        0.0.0.0:*
29
[::]:80           [::]:*
30
root@c9a1469fa0b7:/# curl localhost
31
bash: curl: command not found
32
root@c9a1469fa0b7:/# ip a
33
2: eth0@if300:xxx
34
    inet 172.17.0.2/16
35
# 里面既然没有这个命令,我们去外面curl
36
[root@Docker ~]# curl 172.17.0.2
37
<title>Welcome to nginx!</title>
38
root@c9a1469fa0b7:/# tail -1 /var/log/nginx/access.log
39
172.17.0.1 - - [24/Apr/2026:04:51:57 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/8.12.1"
40
root@c9a1469fa0b7:/# cd /etc/nginx/
41
root@c9a1469fa0b7:/etc/nginx# grep -E -v '^$|^.*#' nginx.conf
42
# 看了眼主配置文件 ---> 没有找到默认index页面在哪
43
user www-data;
44
worker_processes auto;
45
pid /run/nginx.pid;
46
include /etc/nginx/modules-enabled/*.conf;
47
events {
48
  worker_connections 768;
49
}
50
http {
51
  sendfile on;
52
  tcp_nopush on;
53
  types_hash_max_size 2048;
54
  include /etc/nginx/mime.types;
55
  default_type application/octet-stream;
56
  ssl_prefer_server_ciphers on;
57
  access_log /var/log/nginx/access.log;
58
  error_log /var/log/nginx/error.log;
59
  gzip on;
60
  include /etc/nginx/conf.d/*.conf;
61
  include /etc/nginx/sites-enabled/*;
62
}
63
root@c9a1469fa0b7:/etc/nginx# grep -r root ./
64
'于是我在里面递归过滤了一下root根'
65
./sites-available/default:  root /var/www/html;
66
root@c9a1469fa0b7:/etc/nginx# cd sites-available/
67
root@c9a1469fa0b7:/etc/nginx/sites-available# ls
68
default
69
root@c9a1469fa0b7:/etc/nginx/sites-available# grep -E -v '^$|^.*#' default
70
server {
71
  listen 80 default_server;
72
  listen [::]:80 default_server;
73
  root /var/www/html;
74
  index index.html index.htm index.nginx-debian.html;
75
  server_name _;
76
  location / {
77
    try_files $uri $uri/ =404;
78
  }
79
}
80
root@c9a1469fa0b7:/etc/nginx/sites-available# echo "Hello World" > /var/www/html/index.nginx-debian.html
81
'更改一下主页,去宿主机中拉取试一下!'
82
[root@Docker ~]# curl 172.17.0.2
83
Hello World
84
⚠️ 因为我们后面要提交为镜像
85
nginx -g 'daemon off;'
86
# 把nginx放在前台运行 ---> 不用每次都手动启动nginx
87
root@c9a1469fa0b7:/etc/nginx/sites-available# nginx -g 'daemon off;'
88
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Unknown error)
89
nginx: [emerg] bind() to [::]:80 failed (98: Unknown error)
90
'这里报错是因为,我的Nginx已经启动着呢!'
91
root@c9a1469fa0b7:/etc/nginx/sites-available# nginx -s stop
92
'关闭后,再放到前台运行即可!'
93
root@c9a1469fa0b7:/etc/nginx/sites-available# nginx -g 'daemon off;'
94
'会被阻塞住'
95
[root@Docker ~]# curl 172.17.0.2
96
Hello World
97
⚠️ ^C把启动命令服务暂停后
98
'我们就拉取不到页面了'
99
[root@Docker ~]# curl 172.17.0.2
100
curl: (7) Failed to connect to 172.17.0.2 port 80
101
'开另一个终端,把它提交为镜像'
102
[root@Docker ~]# docker commit v1 ubuntu-web:1.0
103
[root@Docker ~]# docker run -d --name web01 ubuntu-web:1.0
104
# 基于这个镜像跑一个容器
105
[root@Docker ~]# docker ps -a
106
ubuntu-web:1.0   "/bin/bash"   Exited (0)
107
# 执行完就退出了!
108
[root@Docker ~]# docker run -d -it --name web01 ubuntu-web:1.0
109
# 以交互式终端运行并放在后台
110
[root@Docker ~]# docker ps
111
ubuntu-web:1.0   "/bin/bash"   Up 2 seconds
112
[root@Docker ~]# docker exec -it web01 /bin/bash
113
root@e239dd68b192:/# ss -lnt | grep 80
114
'默认Nginx并没有起来'
115
root@e239dd68b192:/# nginx
116
root@e239dd68b192:/# ss -lnt | grep 80
117
0.0.0.0:80        0.0.0.0:*
118
   [::]:80           [::]:*
119
'需要手动启动!'
120
root@e239dd68b192:/# tail -1 /etc/hosts
121
172.17.0.3  e239dd68b192
122
[root@Docker ~]# curl 172.17.0.3
123
Hello World
124
# 在宿主机中成功拉取到页面
125
'每次手动起来比较麻烦!'
126
[root@Docker ~]# docker run -d --name web02 ubuntu-web:1.0 nginx -g 'daemon off;'
127
'手动指定运行命令'
128
[root@Docker ~]# docker exec web02 tail -1 /etc/hosts
129
172.17.0.4  184aaecd2296
130
[root@Docker ~]# curl 172.17.0.4
131
Hello World
132
# 这样直接就可以运行起来了
133
'再次提交为镜像'
134
👆这次是web02 ---> 有启动命令 nginx -g 'daemon off;'
135
[root@Docker ~]# docker commit web02 ubuntu-web:2.0
136
[root@Docker ~]# docker inspect ubuntu-web:2.0 | grep -A 3 Cmd
137
            "Cmd": [
138
                "nginx",
139
                "-g",
140
                "daemon off;"
141
✅️ 这次有默认的启动命令了
142
[root@Docker ~]# docker run -d --name web03 ubuntu-web:2.0
143
# 后面直接省略了
144
[root@Docker ~]# docker exec -it web03 tail -1 /etc/hosts
145
172.17.0.5  c7cf8a9fab44
146
[root@Docker ~]# curl 172.17.0.5
147
Hello World
148

149
2)镜像优化
150
[root@Docker ~]# docker image ls ubuntu*
151
IMAGE            ID             DISK USAGE
152
ubuntu-web:1.0   d5d82cb7eb39        322MB
153
ubuntu-web:2.0   9c9c78c06809        322MB
154
ubuntu:22.04     962f6cadeae0        117MB
155
'我们自己做的镜像好大呀!明明只下载了个Nginx'
156
# 我们在执行完 atp update 后,就升级了许多的安装包
157
# 安装 Nginx 后,也下载了好多的依赖
158
[root@Docker ~]# docker exec -it web03 /bin/bash
159
root@c7cf8a9fab44:/# du -sh /var/cache/
160
1.1M  /var/cache/
161
# 能随便删除的也就只有缓存 --> 杯水车薪

1
# 基于alpine:3.20.2做镜像
2
[root@Docker ~]# docker run -d -it --name a1 alpine:3.20.2
3
/ # apk update
4
✅️ 升级软件包
5
'这里是apk'
6
/ # apk add nginx
7
✅️ 下载nginx
8
'切终端'
9
[root@Docker ~]# docker ps -s
10
-s 等价 --size
11
# 查看容器大小
12
alpine:3.20.2  Up 5 minutes  a1  3.85MB (virtual 12MB)
13
# 升级&&下载完
14
'也就增加了3.85MB的空间大小'
15
'再切回来-->容器中'
16
/ # nginx
17
'启动Nginx'
18
/ # netstat -lntup | grep 80
19
0.0.0.0:80              0.0.0.0:*
20
:::80                   :::*
21
/ # cd /etc/nginx/
22
/etc/nginx # ls
23
fastcgi.conf    fastcgi_params  http.d          mime.types      modules         nginx.conf      scgi_params     uwsgi_param
24
/etc/nginx # grep -E -v '^$|^.*#' nginx.conf
25
'主配置文件'
26
user nginx;
27
worker_processes auto;
28
pcre_jit on;
29
error_log /var/log/nginx/error.log warn;
30
include /etc/nginx/modules/*.conf;✅️
31
include /etc/nginx/conf.d/*.conf;✅️
32
events {
33
  worker_connections 1024;
34
}
35
http {
36
  include /etc/nginx/mime.types;
37
  default_type application/octet-stream;
38
  server_tokens off;
39
  client_max_body_size 1m;
40
  sendfile on;
41
  tcp_nopush on;
42
  ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
43
  ssl_prefer_server_ciphers on;
44
  ssl_session_cache shared:SSL:2m;
45
  ssl_session_timeout 1h;
46
  ssl_session_tickets off;
47
  gzip_vary on;
48
  map $http_upgrade $connection_upgrade {
49
    default upgrade;
50
    '' close;
51
  }
52
  log_format main '$remote_addr - $remote_user [$time_local] "$request" '
53
      '$status $body_bytes_sent "$http_referer" '
54
      '"$http_user_agent" "$http_x_forwarded_for"';
55
  access_log /var/log/nginx/access.log main;
56
  include /etc/nginx/http.d/*.conf;✅️
57
}
58
/etc/nginx # cd http.d/
59
/etc/nginx/http.d # ls
60
default.conf
61
/etc/nginx/http.d # grep -E -v '^$|^.*#' default.conf
62
'子配置文件在这里'
63
server {
64
  listen 80 default_server;
65
  listen [::]:80 default_server;
66
  location / {
67
    return 404;
68
  }
69
  location = /404.html {
70
    internal;
71
  }
72
}
73
/etc/nginx/http.d # vi default.conf
74
   .....
75
   location / {
76
           root /code;
77
           index index.html;
78
   }......
79
'把location里面的东西更改一下!'
80
/etc/nginx/http.d # mkdir /code
81
/etc/nginx/http.d # echo Hello World > /code/index.html
82
/etc/nginx/http.d # nginx -s reload
83
# 重载使服务生效
84
/etc/nginx/http.d # tail -1 /etc/hosts
85
172.17.0.6  a66a72ed9ceb
86
'切终端'
87
[root@Docker ~]# curl 172.17.0.6
88
Hello World
89
成功拉取到了
90
/etc/nginx/http.d # exit
91
[root@Docker ~]# docker commit -c 'CMD ["nginx", "-g", "daemon off;"]' a1  alpine-web:1.0
92
'提交为镜像的同时指定启动命令'
93
[root@Docker ~]# docker inspect alpine-web:1.0 | grep -A 3 Cmd
94
            "Cmd": [
95
                "nginx",
96
                "-g",
97
                "daemon off;"
98
✅️ 查看镜像的详细信息 ---> 有启动命令
99
[root@Docker ~]# docker run -d --name v2 alpine-web:1.0
100
[root@Docker ~]# docker ps | grep v2
101
alpine-web:1.0   "nginx -g 'daemon of…"   18 seconds ago'
102
[root@Docker ~]# docker exec v2 tail -1 /etc/hosts
103
172.17.0.7  0ead74ff13ee
104
[root@Docker ~]# curl 172.17.0.7
105
Hello World
106
'运行后,直接就可以启动起来了'
107
[root@Docker ~]# docker ps -s | grep v2
108
alpine-web:1.0  v2  12.3kB (virtual 12MB)
109
✅️ commit提交之前可以把/var/cache/缓存删除,更轻量

1
"构造Nginx镜像"
2

3
1)创建dockerfile文件
4
[root@Docker ~]# touch dockerfile-01
5
✅️ 这个文件的名字自定义即可!
6
# 官方命名 Dockerfile --> 构建镜像时无需-f指定,自动识别
7
'自定义的名称需要 -f 指定' ⚠️ 相对或绝对路径
8

9
FROM ubuntu:22.04
10
# 指定基础镜像
11
MAINTAINER Oldboy
12
# 只能指定维护者信息,功能单一(可省略)
13
# 推荐使用 LABEL (标签,支持键值对元数据)
14
LABEL maintainer="Jiuzhao"
15
LABEL version="1.0"
16
LABEL description="This is my page"
17
ENV MYPATH=/home/
18
# 自定义一个变量
19
WORKDIR $MYPATH
20
# 手动指定工作目录
21
RUN apt update && apt -y install nginx
22
RUN echo "This is my page" > /var/www/html/index.html
23
# 在容器中运行命令
24
EXPOSE 80
25
# 暴露80端口,仅做声明
26
# 暴露后,可以-P(大写)随机映射端口
27
CMD ["nginx","-g","daemon off;"]
28
# 启动命令
29

30
2)build构建镜像
31
[root@Docker ~]# docker image build -f dockerfile-01 -t my-web:1.0 $(pwd)
32
-f     # 指定Dockerfile文件
33
-t    # 构建的镜像+版本(分号:分割)
34
$(pwd)  # Dockerfile文件所在的路径,可简写为.点(当前路径)
35
⚠️ 有一条警告信息
36
文件中第3行使用了 MAINTAINER 指令,而 Docker 已经不推荐使用它了
37
'推荐使用LABEL'
38
[root@Docker ~]# docker images my-web:1.0
39
my-web:1.0   996dbea28097        322MB
40
[root@Docker ~]# docker history my-web:1.0
41
# 通过history可以非常清晰的看到元数据信息
42
CMD ["nginx" "-g" "daemon off;"]                0B
43
EXPOSE [80/tcp]                                 0B
44
RUN /bin/sh -c echo "This is my page" > /var…   "4.1KB"
45
RUN /bin/sh -c apt update && apt -y install …   "133MB"
46
WORKDIR /home/                                  0B
47
ENV MYPATH=/home/                               0B
48
LABEL description=This is my page               0B
49
LABEL version=1.0                               0B
50
LABEL maintainer=Jiuzhao                        0B
51
MAINTAINER Oldboy                               0B
52

53
3)运行容器
54
[root@Docker ~]# docker run -d --name myweb my-web:1.0
55
[root@Docker ~]# docker ps
56
my-web:1.0   "nginx -g 'daemon of…"  80/tcp    myweb'
57
[root@Docker ~]# docker exec myweb tail -1 /etc/hosts
58
172.17.0.2  8c5f3ff5b2fe
59
[root@Docker ~]# curl 172.17.0.2
60
This is my page
61
'成功拉取到自定义页面'

1
1)创建对应的网络
2
[root@Docker ~]# docker network ls
3
5297e0639824   mynet     bridge    local
4
# 我这里有,就不创建了
5
[root@Docker ~]# docker network inspect mynet | grep -A 4 Config\""
6
            "Config": [
7
                {
8
                    "Subnet": "172.20.0.0/16",
9
                    "Gateway": "172.20.0.1"
10
                }
11

12
2)上传Tomcat的相关软件包
13
[root@Docker ~]# ls
14
[root@Docker ~]# rz -E
15
rz waiting to receive.
16
[root@Docker ~]# ls
17
apache-tomcat-9.0.113.tar.gz  jdk-8u181-linux-x64.rpm
18
[root@Docker ~]# pwd
19
/root
20

21
3)tomacat相关业务部署
22
# 这里jdk是rpm包,所以它的基础镜像我选择Centos
23
[root@Docker ~]# docker run -d -it --name c1 centos:latest
24
[root@Docker ~]# docker cp jdk-8u181-linux-x64.rpm c1:/tmp
25
[root@Docker ~]# docker cp apache-tomcat-9.0.113.tar.gz c1:/tmp
26
[root@Docker ~]# docker exec -it c1 /bin/bash
27
[root@038dc7309131 /]# cd /tmp/
28
[root@038dc7309131 tmp]# ls
29
jdk-8u181-linux-x64.rpm  apache-tomcat-9.0.113.tar.gz
30
[root@038dc7309131 tmp]# rpm -ivh jdk-8u181-linux-x64.rpm
31
[root@038dc7309131 tmp]# java -version
32
java version "1.8.0_181"
33
[root@038dc7309131 tmp]# mkdir /soft
34
[root@038dc7309131 tmp]# tar xf apache-tomcat-9.0.113.tar.gz -C /soft
35
[root@038dc7309131 tmp]# ls /soft/
36
apache-tomcat-9.0.113
37
[root@038dc7309131 tmp]# cd /soft/
38
[root@038dc7309131 soft]# ln -s apache-tomcat-9.0.113/ tomcat
39
[root@038dc7309131 soft]# ls -lh
40
total 4.0K
41
drwxr-xr-x 9 root root 4.0K Apr 26 11:14 apache-tomcat-9.0.113
42
lrwxrwxrwx 1 root root   22 Apr 26 11:15 tomcat -> apache-tomcat-9.0.113/
43
[root@038dc7309131 soft]# /soft/tomcat/bin/startup.sh
44
[root@038dc7309131 soft]# ps -ef | grep tomcat
45
root         258       1  4 11:21 pts/2    00:00:02 /usr/bin/java -Djava.util.logging.config.file=/soft/tomcat...
46
[root@038dc7309131 soft]# cd tomcat/logs/
47
[root@038dc7309131 logs]# tail catalina.2026-04-26.log
48
Starting ProtocolHandler ["http-nio-8080"]
49
Server startup in [548] milliseconds
50
'服务成功启动'
51
[root@038dc7309131 logs]# curl localhost:8080
52
<!DOCTYPE html>
53
<html lang="en">
54
        ✅️<title>Apache Tomcat/9.0.113</title>
55

56
4)简单页面修改
57
[root@038dc7309131 logs]# cd ../conf/
58
[root@038dc7309131 conf]# vi server.xml
59
...
60
<!--复制一份Host自定义为diy.kpyun.com 代码目录指向/code/diy-->
61
      <Host name="diy.kpyun.com"  appBase="/code/diy/"
62
            unpackWARs="true" autoDeploy="true">
63
            <!--修改了域名和代码目录-->
64
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
65
               prefix="diy.kpyun.com" suffix=".log"
66
               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
67
       </Host>
68
       <!--日志修改了位置和后缀-->
69

70
    </Engine>
71
  </Service>
72
</Server>
73
[root@038dc7309131 conf]# ../bin/shutdown.sh && ../bin/startup.sh
74
# 重启
75
[root@038dc7309131 conf]# tail -2 ../logs/catalina.2026-04-26.log
76
Starting ProtocolHandler ["http-nio-8080"]
77
Server startup in [566] milliseconds
78
[root@038dc7309131 conf]# mkdir /code/diy/ROOT
79
'这里只需要创建ROOT目录即可'
80
[root@038dc7309131 conf]# echo Hello > /code/diy/ROOT/index.html
81
[root@038dc7309131 conf]# echo 127.0.0.1  diy.kpyun.com > /etc/hosts
82
[root@038dc7309131 conf]# curl diy.kpyun.com:8080
83
Hello
84

85
5)Nginx业务部署
86
[root@038dc7309131 ~]# cd /etc/yum.repos.d/
87
[root@038dc7309131 yum.repos.d]# vi nginx.repo
88
[nginx-stable]
89
name=nginx stable repo
90
baseurl=http://nginx.org/packages/centos/7/$basearch/
91
gpgcheck=0
92
enabled=1
93
[root@038dc7309131 yum.repos.d]# ls | grep -v nginx.repo | xargs rm -rf
94
[root@038dc7309131 yum.repos.d]# vi CentOS-Base.repo
95
[base]
96
name=CentOS-$releasever - Base - Aliyun
97
baseurl=http://mirrors.aliyun.com/centos/$releasever/os/$basearch/
98
gpgcheck=1
99
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
100

101
#released updates
102
[updates]
103
name=CentOS-$releasever - Updates - Aliyun
104
baseurl=http://mirrors.aliyun.com/centos/$releasever/updates/$basearch/
105
gpgcheck=1
106
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
107

108
#additional packages that may be useful
109
[extras]
110
name=CentOS-$releasever - Extras - Aliyun
111
baseurl=http://mirrors.aliyun.com/centos/$releasever/extras/$basearch/
112
gpgcheck=1
113
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
114

115
#additional packages that extend functionality of existing packages
116
[centosplus]
117
name=CentOS-$releasever - Plus - Aliyun
118
baseurl=http://mirrors.aliyun.com/centos/$releasever/centosplus/$basearch/
119
gpgcheck=1
120
enabled=0
121
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
122
[root@038dc7309131 yum.repos.d]# yum makecache
123
[root@038dc7309131 yum.repos.d]# /usr/bin/yum -y install nginx
124
 nginx        1:1.26.1-2.el7.ngx    nginx-stable
125
 make         1:3.82-24.el7         base
126
 openssl      1:1.0.2k-26.el7_9     updates
127
 pcre2        10.23-2.el7           base
128
 openssl-libs   1:1.0.2k-26.el7_9     updates
129
[root@038dc7309131 yum.repos.d]# cd /etc/nginx/conf.d/
130
[root@038dc7309131 conf.d]# ls
131
default.conf
132
[root@038dc7309131 conf.d]# rm -rf default.conf
133
[root@038dc7309131 conf.d]# vi kpyun.conf
134
server{
135
    listen 80;
136
    server_name diy.kpyun.com;
137

138
    location / {
139
        proxy_pass http://127.0.0.1:8080;
140
        # 请求本地的8080,同时带上请求头,版本号
141
      proxy_set_header Host $http_host;
142
      proxy_http_version 1.1;
143
    }
144
}
145
[root@038dc7309131 conf.d]# nginx -s reload
146
[root@038dc7309131 conf.d]# curl diy.kpyun.com
147
Hello