单机编排&&私有镜像仓库#

[TOC]

docker-compose(单体服务)#

1
docker-compose是Docker公司用来编排docker容器的一款工具
2
允许用户通过一个 YAML 文件 --> 来配置应用程序的"服务"、"网络"和"数据卷"等
3
# 通常称为 docker-compose.yml
4
==================================
5
# 自行清理环境
6
[root@Docker ~]# docker rm -f $(docker ps -aq)
7
[root@Docker ~]# docker network prune -f
8
[root@Docker ~]# docker volume prune -fa
9

10
1)检测是否安装
11
[root@Docker ~]# rpm -qa | grep docker-compose
12
docker-compose-plugin-5.1.3-1.el10.x86_64
13
[root@Docker ~]# docker compose version
14
Docker Compose version v5.1.3
15

16
2)单服务服务编排
17
[root@Docker ~]# rm -rf ./*
18
[root@Docker ~]# mkdir ./docker-compose && cd ./docker-compose
19
# 创建项目名 --> docker-compose
20
[root@Docker docker-compose]# vim myweb.yml
21
'名字随意,可以 -f 指定运行,但必须是yml结尾⚠️'
22
services:
23
# 定义一个服务
24
# 有s
25
  myweb:
26
  # 服务的名称
27
    image: nginx:latest
28
    # 指定镜像的名称
29
    container_name: c1
30
    # 指定容器的名称
31
    ports:
32
    # 指定该端口映射
33
      - "81:80"
34

35
3)启动服务 --> up
36
[root@Docker docker-compose]# docker compose -f myweb.yml up -d
37
✅️ -f 指定compose文件
38
✅️ -d 表示放在后台运行
39
[+] up 2/2
40
 ✔ Network docker-compose_default Created
41
 # 创建网络
42
 ✔ Container c1                   Started
43
 # 启动容器
44
[root@Docker docker-compose]# docker network ls | grep default
45
docker-compose_default    bridge    local
46
📌 先创建了个网络
47
[root@Docker docker-compose]# docker ps
48
nginx:latest   "/docker-entrypoint.…"   3 minutes ago   Up 3 minutes   0.0.0.0:81->80/tcp, [::]:81->80/tcp  c1
49
📌 又跑了一个Nginx容器
50

51
4)查看运行状态
52
[root@Docker docker-compose]# docker-compose ps
53
docker-compose: command not found
54
[root@Docker docker-compose]# docker compose ps
55
no configuration file provided: not found
56
"没有找到配置文件"
57
# 因为我们改了默认的名字,所以得-f指定才能够找到!
58
[root@Docker docker-compose]# docker compose -f myweb.yml ps
59
✅️ ps --> 这个项目运行的"容器状态"
60
# 这个项目只跑了一个容器
61
c1 nginx:latest   "/docker-entrypoint.…"   myweb  9 minutes ago   Up 9 minutes   0.0.0.0:81->80/tcp, [::]:81->80tcp
62
[root@Docker docker-compose]# curl localhost:81
63
<title>Welcome to nginx!</title>
64
[root@Docker docker-compose]# docker compose ls
65
✅️ 列出正在运行的"compose项目"
66
NAME            STATUS      CONFIG FILES
67
docker-compose  running(1)  /root/docker-compose/myweb.yml
68
👆项目目录    👆正在运行的容器  👆主配置文件
69
[root@Docker docker-compose]# docker inspect c1 | grep IPAddress
70
         "IPAddress": "172.22.0.2",
71

72
5)停止并"移除"容器 --> down
73
[root@Docker docker-compose]# docker compose -f myweb.yml down -t 0
74
✅️ -t 0 立即执行
75
[+] down 2/2
76
 ✔ Container c1                   Removed
77
 ✔ Network docker-compose_default Removed
78
[root@Docker docker-compose]# docker network ls | grep default
79
# 刚才自动创建的网络被移除了 ✅️
80
[root@Docker docker-compose]# docker ps -a | grep c1
81
# 自动创建的容器也被移除了 ✅️

1
'mysql单体服务'
2
# 自行清理环境
3

4
1)环境准备
5
[root@Docker ~]# pwd
6
/root
7
[root@Docker ~]# rm -rf ./*
8
[root@Docker ~]# mkdir ./mydb && cd ./mydb
9
[root@Docker mydb]# docker images | grep mysql
10
mysql:8.0.36    a53272402242    833MB
11

12
2)编写主配置文件
13
[root@Docker mydb]# vim db_server.yml
14
services:
15
  db_server:
16
    image: mysql:8.0.36
17
    container_name: db01
18
    ports:
19
      - "3306:3306"
20
    environment:
21
    # 定义环境变量
22
    # 相当于 docker run -e key=value
23
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
24
      MYSQL_DATABASE: "wordpress"
25
      MYSQL_USER: "jiuzhao"
26
      MYSQL_PASSWORD: "passwd"
27
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin", "--default-authentication-plugin=mysql_native_password"]
28
    # 向容器传递参数
29
    # 覆盖原来的CMD指令 --> mysqld

1
# 既然我们学完Dockerfile了
2
# 我们来看一下镜像的详细信息
3
[root@Docker ~]# docker inspect mysql:8.0.36
4
"Config": {
5
            "ExposedPorts": {  <-- 暴漏端口 ✅️
6
                "3306/tcp": {},
7
                "33060/tcp": {}
8
            },
9
            "Env": [   <-- 环境变量 ✅️
10
                "GOSU_VERSION=1.17",
11
                "MYSQL_MAJOR=8.0",
12
                "MYSQL_VERSION=8.0.36-1.el8",
13
                "MYSQL_SHELL_VERSION=8.0.36-1.el8"
14
            ],
15
            "Entrypoint": [   <-- 固定入口 ✅️
16
                "docker-entrypoint.sh"
17
            ],  # 这是一个初始化脚本
18
            # 👇的CMD用来传递参数
19
            "Cmd": [
20
                "mysqld"  <-- 默认参数 ✅️
21
            ], # 默认执行 docker-entrypoint.sh mysqld
22
            --character-set-server=utf8
23
            --collation-server=utf8_bin
24
            # 会覆盖掉原来的CMD指令
25
            "Volumes": {  <-- 数据卷 ✅️
26
                "/var/lib/mysql": {}
27
            }, # 默认创建匿名数据卷

1
3)启动服务
2
[root@Docker mydb]# docker compose -f db_server.yml up -d
3
# 同样是放在后台运行
4
[+] up 2/2
5
 ✔ Network mydb_default Created  --> ✅️ 网络
6
 ✔ Container db01       Started  --> ✅️ 容器
7
[root@Docker mydb]# docker compose ls
8
NAME     STATUS      CONFIG FILES
9
mydb     running(1)  /root/mydb/db_server.yml
10
[root@Docker mydb]# docker network ls | grep mydb
11
a425873c55f1   mydb_default   bridge    local
12
[root@Docker mydb]# docker compose -f db_server.yml ps
13
db01      mysql:8.0.36   "docker-entrypoint.s…"   db_server   46 seconds ago   Up 45 seconds   0.0.0.0:3306->3306/tcp, [::]:3306->3306/tcp, 33060/tcp
14

15
4)测试验证
16
[root@Docker mydb]# docker exec -it db01 mysql
17
Welcome to the MySQL monitor.
18
mysql> show databases;
19
+--------------------+
20
| Database           |
21
+--------------------+
22
| information_schema |
23
| mysql              |
24
| performance_schema |
25
| sys                |
26
| wordpress  ✅️      |
27
+--------------------+
28

29
5)停止&&移除
30
mysql> exit
31
Bye
32
[root@Docker mydb]# docker compose -f db_server.yml down -t 0
33
[+] down 2/2
34
 ✔ Container db01       Removed
35
 ✔ Network mydb_default Removed

数据持久化#

1
1)准备工作
2
[root@Docker ~]# rm -rf ./*
3
[root@Docker ~]# mkdir ./db-volume && cd ./db-volume
4

5
2)编写配置文件
6
[root@Docker db-volume]# vim docker-compose.yml
7
services:
8
  db_server:
9
    image: mysql:8.0.36
10
    container_name: db02
11
    ports:
12
      - "3306:3306"
13
    environment:
14
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
15
      MYSQL_DATABASE: "wordpress"
16
      MYSQL_USER: "jiuzhao"
17
      MYSQL_PASSWORD: "passwd"
18
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin", "--default-authentication-plugin=mysql_native_password"]
19
    volumes:
20
      # 存储卷名称(别名):容器挂载点:读写模式(rw,ro)
21
      - db:/var/lib/mysql:rw
22
      - web:/code:rw
23
# db和 web是内部引用名,方便在 compose 文件中使用
24
# 先引用,后声明
25

26
volumes:
27
  db:
28
    name: mysql-volume
29
    # 自定义 Docker 中实际的卷名称
30
  web:
31
    name: web-server
32
# mysql-volume和web-server是 Docker 实际创建的真实卷名
33
==================================================
34
# ⚠️如果不指定 name: web-server
35
# ⚠️Docker 会自动创建
36
    volumes: <-- "服务引用的数据卷"
37
      - db:/var/lib/mysql:rw
38
      - web:/code:rw
39

40
volumes:<-- "声明数据卷"
41
  db:
42
    name: mysql-volume
43
  web: "web没有指定name"
44
[root@Docker db-volume]# docker compose up -d
45
[+] up 4/4
46
 ✔ Network xxx        👇 项目名+别名
47
 ✔ Volume db-volume_web⚠️ <-- 自动创建的名称 📌
48
 ✔ Volume mysql-volume    <-- 手动指定的名称 ✅️
49
 ✔ Container xxx
50
'都写到这了,不手动指定一下name吗???'
51
==================================================
52
    volumes:
53
      - db:/var/lib/mysql:rw
54
      - web:/code:rw
55
'只有引用卷db和web ,没有声明'
56
[root@Docker db-volume]# docker compose up -d
57
❌️ undefined volume db: invalid compose project
58
==================================================
59
'最后一种匿名数据卷' 🤡 不推荐
60
    volumes:
61
    # 里面只有容器里面的路径
62
    # 不能指定模式(rw/ro)
63
      - /var/lib/mysql
64
      - /code
65
[root@Docker db-volume]# docker volume prune -f
66
[root@Docker db-volume]# docker compose up -d
67
[root@Docker db-volume]# docker volume ls
68
DRIVER    VOLUME NAME
69
local     192fdxxx...
70
local     5037bxxx...
71
'后面是一串神秘的字符'

Note

这样分开定义是为了==提供灵活性==

既可以在 compose 内部使用简短的别名,又可以精确控制实际的卷名称

1
3)启动服务
2
[root@Docker db-volume]# docker compose up -d
3
[+] up 4/4
4
 ✔ Network db-volume_default Created
5
 ✔ Volume web-server         Created
6
 ✔ Volume mysql-volume       Created
7
 ✔ Container db02            Started
8
"两个数据卷都创建成功了"
9
[root@Docker db-volume]# docker volume ls
10
local     mysql-volume
11
local     web-server
12
[root@Docker db-volume]# docker compose ps
13
db02      mysql:8.0.36   "docker-entrypoint.s…"   db_server   58 seconds ago   Up 57 seconds   0.0.0.0:3306->3306/tcp, [::]:3306->3306/tcp, 33060/tcp
14
[root@Docker db-volume]# docker compose ls
15
NAME       STATUS      CONFIG FILES
16
db-volume  running(1)  /root/db-volume/docker-compose.yml
17

18
4)停止容器&&移除网络
19
[root@Docker db-volume]# docker compose down
20
[+] down 2/2
21
 ✔ Container db02            Removed
22
 ✔ Network db-volume_default Removed
23
'创建的时候是4个,移除的时候只移除了两个'
24
✅️ 数据卷没有被移除!
25
[root@Docker db-volume]# docker volume ls
26
local     mysql-volume
27
local     web-server
28

29
5) -v
30
# 移除服务时,同时移除数据卷
31
[root@Docker db-volume]# docker compose down -v
32
[+] down 2/2
33
 ✔ Volume web-server   Removed
34
 ✔ Volume mysql-volume Removed
35
# 重新执行了一遍,把数据卷也移除了!
36

37
6)综合演示
38
[root@Docker db-volume]# docker compose up -d
39
[+] up 4/4
40
 ✔ Network db-volume_default Created
41
 ✔ Volume mysql-volume       Created
42
 ✔ Volume web-server         Created
43
 ✔ Container db02            Started
44
[root@Docker db-volume]# docker compose down -v -t 0
45
[+] down 4/4
46
 ✔ Container db02            Removed
47
 ✔ Volume mysql-volume       Removed
48
 ✔ Volume web-server         Removed
49
 ✔ Network db-volume_default Removed
50
"工作中,用的最多的就是 up down"

自定义网络#

1
1)准备
2
[root@Docker ~]# rm -rf ./*
3
[root@Docker ~]# mkdir db-network && cd db-network
4
[root@Docker db-network]# docker network ls
5
NETWORK ID     NAME      DRIVER    SCOPE
6
66cc72cc26cd   bridge    bridge    local
7
bf4d048e4eed   host      host      local
8
5879c499792c   none      null      local
9
'现在只有3个默认的网络'
10

11
2)配置文件
12
[root@Docker db-network]# vim docker-compose.yml
13
services:
14
  db_server:
15
    image: mysql:8.0.36
16
    container_name: db02
17
    ports:
18
      - "3306:3306"
19
    environment:
20
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
21
      MYSQL_DATABASE: "wordpress"
22
      MYSQL_USER: "jiuzhao"
23
      MYSQL_PASSWORD: "passwd"
24
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin", "--default-authentication-plugin=mysql_native_password"]
25
    networks:
26
    # 只引用网络,没有声明(定义)网络
27
    # 下面的这些只是别名
28
      - db_net
29
      - web_net
30
[root@Docker db-network]# docker compose up -d
31
❌️ undefined network web_net: invalid compose project
32
# 在项目中并没有被定义(声明)
33
'自然是起不来的'
34
=================================
35
    networks:
36
      - db_net
37
      - web_net
38
# 先引用网络(别名),后声明
39

40
networks:
41
# 声明真实的网络
42
# name前面没有 -
43
  db_net:
44
    name: my_db
45
  web_net:
46
    name: my_web
47
  backup:
48
    name: my_backup
49
[root@Docker db-network]# docker compose up -d
50
'上面虽然声明了3个网络,但只创建了2个'
51
# 只有db_net和web_net被服务引用,所以才会被创建
52
[+] up 3/3
53
 ✔ Network my_web Created ✅️
54
 ✔ Network my_db  Created ✅️
55
 ✔ Container db02 Started
56
[root@Docker db-network]# docker network ls
57
NETWORK ID     NAME      DRIVER    SCOPE
58
dc02802cf1a2   my_db     bridge    local
59
88fee2060426   my_web    bridge    local
60
[root@Docker db-network]# docker network inspect my_db | grep -A 4 "Config\"""
61
            "Config": [
62
                {
63
                    "Subnet": "172.19.0.0/16",
64
                    "Gateway": "172.19.0.1"
65
                }
66
# 有这两个配置足以
67
✅️ '容器的网络从.2开始分配IP地址'
68
[root@Docker db-network]# docker network inspect my_web | grep -A 4 "Config\"""
69
            "Config": [
70
                {
71
                    "Subnet": "172.18.0.0/16",
72
                    "Gateway": "172.18.0.1"
73
                }
74
[root@Docker db-network]# docker inspect db02 | grep IPAddress
75
                    "IPAddress": "172.19.0.2",
76
                    "IPAddress": "172.18.0.2",
77
# 对于我们刚创建的容器db02来说
78
# 它是有两个网络的,都是从.2开始分配的IP地址
79

80
3)停止服务
81
[root@Docker db-network]# docker compose down -t 0
82
[+] down 3/3
83
 ✔ Container db02 Removed
84
 ✔ Network my_web Removed
85
 ✔ Network my_db  Removed
86
'在停止服务的同时把网络也移除了!'
87
✅️ 这里只有数据卷特殊,需要加-v才能移除 📌
88

89
4)声明网络的同时,指定驱动、子网、网关
90
'这种是最麻烦的,不推荐' 🤡
91
# 个人感觉,自定义网络名字就可以了
92
[root@Docker db-network]# vim docker-compose.yml
93
...xxxx # 省略
94
    networks:
95
      - db_net
96
      - web_net
97

98
networks:
99
  db_net:
100
    name: my_db
101
    driver: bridge
102
    # 网络驱动,网桥
103
    ipam:
104
      driver: default
105
      # 指定IPAM的驱动,一般使用默认值
106
      config:
107
      # 只有subnet前面有 -
108
        - subnet: 172.28.0.0/16
109
          gateway: 172.28.0.1
110
  web_net:
111
  # 它使用默认的
112
    name: my_web
113
    driver: bridge
114
--------------------------------
115
"IPAM": {
116
            "Driver": "default",
117
            "Options": null,
118
            "Config": [
119
                {
120
                    "Subnet": "172.28.0.0/16",
121
                    "Gateway": "172.28.0.1"
122
                }
123
[root@Docker db-network]# docker compose up -d
124
[+] up 3/3
125
 ✔ Network my_web Created
126
 ✔ Network my_db  Created
127
 ✔ Container db02 Started
128
'我们主要去看具体的网络配置'
129
[root@Docker db-network]# docker network inspect my_db | grep -A 4 "Config\"""
130
            "Config": [
131
                {
132
                    "Subnet": "172.28.0.0/16",
133
                    "Gateway": "172.28.0.1"
134
                }  ✅️ 这个就是我们手动指定的网络
135
[root@Docker db-network]# docker network inspect my_web | grep -A 4 "Config\"""
136
            "Config": [
137
                {
138
                    "Subnet": "172.18.0.0/16",
139
                    "Gateway": "172.18.0.1"
140
                }  📌 自动创建的子网配置
141
              # 它是接着docker 0 --> 172.17.0.1创建
142
[root@Docker db-network]# docker compose down -t 0

docker-compose(多服务编排)#

wordpress部署#

1
1)环境准备
2
[root@Docker ~]# docker volume prune -fa
3
[root@Docker ~]# docker network prune -f
4
[root@Docker ~]# rm -rf ./*
5
[root@Docker ~]# mkdir mul-wordpress && cd mul-wordpress
6

7
2)编写配置
8
[root@Docker mul-wordpress]# vim docker-compose.yml

1
services:
2
  db_server:
3
    image: mysql:8.0.36
4
    container_name: db
5
    ports:
6
      - "3306:3306"
7
    environment:
8
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
9
      MYSQL_DATABASE: "wordpress"
10
      MYSQL_USER: "jiuzhao"
11
      MYSQL_PASSWORD: "passwd"
12
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin", "--default-authentication-plugin=mysql_native_password"]
13
    volumes:
14
      - db:/var/lib/mysql:rw
15
    networks:
16
      - wp-net
17
    # 指定容器的重启策略
18
    restart: unless-stopped
19

20
  wordpress:
21
  # 依赖的服务要优先启动
22
    depends_on:
23
      - db_server
24
    image: wordpress:6.7.1
25
    container_name: wp
26
    restart: unless-stopped
27
    ports:
28
      - "81:80"
29
    environment:
30
      WORDPRESS_DB_HOST: db_server:3306
31
      # 这里目标主机填的是服务名,而并非容器名
32
      WORDPRESS_DB_USER: jiuzhao
33
      WORDPRESS_DB_PASSWORD: passwd
34
      WORDPRESS_DB_NAME: wordpress
35
    volumes:
36
      - wp:/var/www/html
37
    networks:
38
      - wp-net
39

40
networks:
41
# 两个服务使用的是一个网络
42
  wp-net:
43
    name: wordpress-net
44
    driver: bridge
45
    ipam:
46
      driver: default
47
      config:
48
        - subnet: 172.18.0.0/16
49
          gateway: 172.18.0.1
50

51
volumes:
52
# 两个服务分别使用一个数据卷
53
  db:
54
    name: mysql-volume
55
  wp:
56
    name: wordpress-volume

1
3)启动服务
2
[root@Docker mul-wordpress]# docker compose up -d
3
[+] up 5/5
4
 ✔ Network wordpress-net   Created
5
 ✔ Volume mysql-volume     Created
6
 ✔ Volume wordpress-volume Created
7
 ✔ Container db            Started
8
 ✔ Container wp            Started
9
"一个网络,两个数据卷"
10
[root@Docker mul-wordpress]# docker compose ls
11
NAME          STATUS      CONFIG FILES
12
mul-wordpress running(2)  ~/mul-wordpress/docker-compose.yml
13
[root@Docker mul-wordpress]# docker compose ps
14
db        mysql:8.0.36      "docker-entrypoint.s…"   db_server   About a minute ago   Up About a minute   0.0.0.0:3306->3306/tcp, [::]:3306->3306/tcp, 33060/tcp
15
-----------------------------------------------------
16
wp        wordpress:6.7.1   "docker-entrypoint.s…"   wordpress   About a minute ago   Up About a minute   0.0.0.0:81->80/tcp, [::]:81->80/tcp
17
[root@Docker mul-wordpress]# docker network ls
18
efece4192527   wordpress-net   bridge    local
19
[root@Docker mul-wordpress]# docker volume ls
20
DRIVER    VOLUME NAME
21
local     mysql-volume
22
local     wordpress-volume
23

24
4)访问测试
25
http://10.0.0.99:81/
26
"停止"
27
docker compose down -t 0 -v

Zabbix部署#

1
[root@Docker ~]# rm -rf ./*
2
[root@Docker ~]# mkdir zabbix-server && cd zabbix-server
3
[root@Docker zabbix-server]# vim docker-compose.yml

1
services:
2
  mysql:
3
    image: mysql:8.0.36
4
    container_name: db
5
    restart: unless-stopped
6
    # 指定容器的重启策略
7
    environment:
8
      MYSQL_ROOT_PASSWORD: "root_pwd"
9
      MYSQL_DATABASE: "zabbix"
10
      MYSQL_USER: "zabbix"
11
      MYSQL_PASSWORD: "passwd"
12
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin", "--default-authentication-plugin=mysql_native_password"]
13
    volumes:
14
      - db:/var/lib/mysql:rw
15
    networks:
16
      - zabbix-net
17

18
  zabbix-java-gateway:
19
    container_name: zabbix-java-gateway
20
    image: zabbix-java-gateway:alpine-7.2-latest
21
    restart: unless-stopped
22
    networks:
23
      - zabbix-net
24

25
  zabbix-server:
26
    container_name: zabbix-server
27
    # 依赖哪个服务
28
    depends_on:
29
      - mysql
30
    image: zabbix-server-mysql:alpine-7.2-latest
31
    restart: unless-stopped
32
    environment:
33
      DB_SERVER_HOST: mysql
34
       # 服务名
35
      MYSQL_DATABASE: zabbix
36
      MYSQL_USER: zabbix
37
      MYSQL_PASSWORD: passwd
38
      MYSQL_ROOT_PASSWORD: "root_pwd"
39
      ZBX_JAVAGATEWAY: zabbix-java-gateway
40
       # 服务名
41
    networks:
42
      - zabbix-net
43

44
  zabbix-web-nginx-mysql:
45
    container_name: zabbix-web-nginx-mysql
46
    depends_on:
47
      - zabbix-server
48
    image: zabbix-web-nginx-mysql:alpine-7.2-latest
49
    ports:
50
      - "8080:8080"
51
    restart: unless-stopped
52
    environment:
53
      DB_SERVER_HOST: mysql
54
      MYSQL_DATABASE: zabbix
55
      MYSQL_USER: zabbix
56
      MYSQL_PASSWORD: passwd
57
      MYSQL_ROOT_PASSWORD: "root_pwd"
58
    networks:
59
      - zabbix-net
60

61
networks:
62
  zabbix-net:
63
    name: zabbix
64
    driver: bridge
65
    ipam:
66
      driver: default
67
      config:
68
        - subnet: 172.20.0.0/16
69
          gateway: 172.20.0.1
70

71
volumes:
72
  db:
73
    name: zabbix-mysql-volume

1
[root@Docker zabbix-server]# docker network ls
2
[root@Docker zabbix-server]# docker volume ls
3
[root@Docker zabbix-server]# docker compose up -d
4
[+] up 6/6
5
 ✔ Network zabbix                   Created
6
 ✔ Volume zabbix-mysql-volume       Created
7
 ✔ Container zabbix-java-gateway    Started
8
 ✔ Container db                     Started
9
 ✔ Container zabbix-server          Started
10
 ✔ Container zabbix-web-nginx-mysql Started
11
"一个网络,一个数据卷"
12
"4个容器"
13
[root@Docker zabbix-server]# docker network inspect zabbix | grep IPv4Address
14
                "IPv4Address": "172.20.0.4/16",
15
                "IPv4Address": "172.20.0.2/16",
16
                "IPv4Address": "172.20.0.3/16",
17
                "IPv4Address": "172.20.0.5/16",
18
# 4个容器的IP地址!
19

20
http://10.0.0.99:8080/

LB负载#

请自定义3个镜像,要求使用alpine作为基础镜像
然后使用docker-compose一键启动
- 用户访问lb后,轮询方式访问web01和web02
  - 比例为 3:1

🦄 我们使用Dockerfile写三个基础镜像

借鉴之前的笔记

1
1)环境清理
2
docker compose down -t 0 -v
3
[root@Docker ~]# rm -rf ./*
4
[root@Docker ~]# mkdir lb-server && cd lb-server
5
[root@Docker lb-server]# mkdir ./{conf,dockerfile}
6
# 一个放配置文件,一个Dockerfile文件
7

8
2)Nginx配置文件准备
9
[root@Docker lb-server]# vim ./conf/lb.conf
10
# 负载均衡的配置文件
11
    upstream webs {
12
    server web01 weight=3;
13
    server web02 weight=1;
14
}
15
server {
16
    listen 80;
17
    server_name diy.kpyun.com;
18

19
    location / {
20
        proxy_pass http://webs;
21
        proxy_set_header Host $http_host;
22
            proxy_http_version 1.1;
23
    }
24
}
25
[root@Docker lb-server]# vim ./conf/default.conf
26
# 两台web的配置文件
27
server {
28
    listen 80 default_server;
29
    server_name _;
30
    root /code;
31

32
    location / {
33
        index index.html;
34
    }
35
}
36

37
3)Dockerfile文件编写
38
[root@Docker lb-server]# vim ./dockerfile/lb

1
FROM alpine:3.20.2
2
EXPOSE 80
3
RUN apk update && \
4
  apk add nginx && \
5
  rm -rf /var/cache
6
COPY ./lb.conf /etc/nginx/http.d/default.conf
7
CMD ["nginx","-g","daemon off;"]

vim ./dockerfile/web01

1
FROM alpine:3.20.2
2
EXPOSE 80
3
RUN apk update && \
4
  apk add nginx && \
5
  rm -rf /var/cache
6
RUN mkdir /code && \
7
    echo "web01..." > /code/index.html
8
COPY ./default.conf /etc/nginx/http.d/
9
CMD ["nginx","-g","daemon off;"]

vim ./dockerfile/web02

1
FROM alpine:3.20.2
2
EXPOSE 80
3
RUN apk update && \
4
  apk add nginx && \
5
  rm -rf /var/cache
6
RUN mkdir /code && \
7
    echo "web02..." > /code/index.html
8
COPY ./default.conf /etc/nginx/http.d/
9
CMD ["nginx","-g","daemon off;"]

1
4)生成镜像
2
[root@Docker lb-server]# docker build -f ./dockerfile/lb -t my-lb:1.0 ./conf/
3
[root@Docker lb-server]# docker build -f ./dockerfile/web01 -t my-web01:1.0 ./conf/
4
[root@Docker lb-server]# docker build -f ./dockerfile/web02 -t my-web02:1.0 ./conf/
5
[root@Docker lb-server]# docker images
6
my-lb:1.0    3292e8f72107       13.9MB
7
my-web01:1.0 3b28a35f13c7       13.9MB
8
my-web02:1.0 8d0461877ed5       13.9MB
9

10
5)docker-compose文件编写
11
[root@Docker lb-server]# vim docker-compose.yml:

1
services:
2
  lb:
3
    image: my-lb:1.0
4
    container_name: lb
5
    restart: unless-stopped
6
    ports:
7
      - "90:80"
8
    networks:
9
      - webs-net
10

11
  web01:
12
    container_name: web01
13
    image: my-web01:1.0
14
    restart: unless-stopped
15
    networks:
16
      - webs-net
17

18
  web02:
19
    container_name: web02
20
    image: my-web02:1.0
21
    restart: unless-stopped
22
    networks:
23
      - webs-net
24

25
networks:
26
  webs-net:
27
    name: my_net
28
    driver: bridge
29
    ipam:
30
      driver: default
31
      config:
32
        - subnet: 172.21.0.0/16
33
          gateway: 172.21.0.1

1
[root@Docker lb-server]# docker compose up -d
2
[+] up 4/4
3
 ✔ Network my_net  Created
4
 ✔ Container web02 Started
5
 ✔ Container web01 Started
6
 ✔ Container lb    Started
7
[root@Docker lb-server]# docker inspect lb | grep IPAddress
8
                    "IPAddress": "172.21.0.2",
9
[root@Docker lb-server]# tail -1 /etc/hosts
10
172.21.0.2 diy.kpyun.com
11
[root@Docker lb-server]# for i in `seq 10`;do curl diy.kpyun.com;done
12
web01... ❤️
13
web01... ❤️
14
web01... ❤️
15
web02... 💚
16
web01... ❤️
17
web01... ❤️
18
web01... ❤️
19
web02... 💚
20
web01... ❤️
21
web01... ❤️

镜像仓库#

1
什么是私有仓库❓️
2
# 不对全世界开放的镜像仓库
3
# 一般是公司内部使用的私有镜像仓库
4

5
为什么需要私有仓库❓️
6
1)安全性问题
7
# 官方镜像仓库大家都可以访问
8
🌰 若都放在官方,大家都能拿到你们公司的自建镜像
9
2)访问速度:
10
🌰 官方的服务器在国外,访问速度慢
11
==============================
12
🔖私有仓库:
13
1)docker registry:
14
# 轻量级的私有镜像仓库
15
# 基本上不占用内存,很适合学习环境中使用
16
  ✅️ 会对存储的数据进行一定的压缩处理
17
  ✅️ 占用内存不足20MB
18
  ❌️ 没有提供较好的WebUI
19
  ❌️ 维护起来比较麻烦,尤其是删除镜像
20
2)harbor:
21
  🦄 基于官方的"docker registry"进行二次开发
22
  🦄 是一个适合企业级使用的镜像仓库
23
🔖第三方仓库: --> 轩辕镜像站(docker.xuanyuan.run)
24
🔖docker官方仓库:  --> hub.docker.com

docker registry#

1
"清理环境"
2
[root@Docker ~]# rm -rf ./*
3
docker rm -f $(docker ps -aq)
4
docker network prune -f
5
docker volume prune -fa
6

7
1)拉取镜像
8
[root@Docker ~]# docker pull docker.xuanyuan.run/registry:3.0.0
9
# 自行改标签
10
[root@Docker ~]# docker images
11
registry:3.0.0    6c5666b861f3    77.3MB
12

13
2)运行
14
[root@Docker ~]# docker run -d --network host --restart=unless-stopped --name c1 -v img-volume:/var/lib/registry registry:3.0.0
15
# 和宿主机共用一个网络
16
# 用了一个数据卷
17
[root@Docker ~]# docker volume ls
18
DRIVER    VOLUME NAME
19
local     img-volume
20
[root@Docker ~]# docker ps
21
 registry:3.0.0   "/entrypoint.sh /etc…"   c1
22
[root@Docker ~]# ss -lntup | grep 5000
23
"默认监听5000端口"
24
tcp   LISTEN 0  *:5000  users:(("registry",pid=8496,fd=3))
25
# 默认提供了一个web-UI
26

27
浏览器访问:
28
http://10.0.0.99:5000/v2/_catalog

1
[root@Docker ~]# curl http://10.0.0.99:5000/v2/_catalog
2
{"repositories":[]}
3
# 这个仓库没有任何的数据

推送镜像#

1
1)打tag标签🏷️
2
[root@Docker ~]# docker tag alpine:3.20.2 10.0.0.99:5000/base/alpine:3.20.2
3
'服务器地址(IP+端口)/项目名称/镜像'
4
# 三个部分组成
5
[root@Docker ~]# docker push 10.0.0.99:5000/base/alpine:3.20.2
6
'直接推镜像!'
7
Unavailable --> 不可达
8
http: server gave HTTP response to HTTPS client
9
⚠️ 服务端(搭建的私有仓库)响应HTTP给客户端(我们自己)HTTPS
10
# 我们客户端默认使用HTTPS协议
11

12
2)强制客户端走HTTP(不安全的仓库)
13
[root@Docker ~]# vim /etc/docker/daemon.json
14
# 新建的文件
15
{
16
        "insecure-registries": ["10.0.0.99:5000"]
17
}
18
[root@Docker ~]# systemctl restart docker
19
[root@Docker ~]# docker info | grep Registries -A 2
20
"重启服务后,配置生效"
21
 Insecure Registries:
22
  10.0.0.99:5000
23
  ::1/128
24
[root@Docker ~]# docker ps
25
"重启服务后,仍然运行" --> 重启策略 unless-stopped
26
registry:3.0.0   "/entrypoint.sh /etc…"   c1
27
[root@Docker ~]# ss -lntup | grep 5000
28
# 仍然监听5000端口
29
tcp   LISTEN 0  *:5000  users:(("registry",pid=9278,fd=3))
30

31
3)再次推送镜像
32
[root@Docker ~]# docker push 10.0.0.99:5000/base/alpine:3.20.2
33
The push refers to repository [10.0.0.99:5000/base/alpine]
34
c6a83fedfae6: "Pushed"
35
[root@Docker ~]# curl http://10.0.0.99:5000/v2/_catalog
36
✅️ {"repositories":["base/alpine"]}
37
⚠️ 版本号被隐藏了
38

39
4)另一台机器拉取镜像
40
[root@test ~]# docker pull 10.0.0.99:5000/base/alpine:3.20.2
41
Error response from daemon:
42
❌️ http: server gave HTTP response to HTTPS client
43
# 一样的报错
44
# 客户端使用的是HTTPS
45
[root@test ~]# vim /etc/docker/daemon.json
46
{
47
  "insecure-registries": ["10.0.0.99:5000"]
48
}
49
[root@test ~]# systemctl restart docker
50
[root@test ~]# docker info | grep Registries -A 2
51
 Insecure Registries:
52
  10.0.0.99:5000
53
  127.0.0.0/8
54
[root@test ~]# docker pull 10.0.0.99:5000/base/alpine:3.20.2
55
3.20.2: Pulling from base/alpine
56
Digest: sha256:eddxxx... --> 签名✍️
57
Status: Downloaded newer image for 10.0.0.99:5000/base/alpine:3.20.2
58
👆 镜像地址
59
'成功拉取'
60
[root@test ~]# docker images
61
10.0.0.99:5000/base/alpine   3.20.2

删除镜像#

1
[root@Docker ~]# hostname -I
2
10.0.0.99
3
# 切换回来
4
[root@Docker ~]# docker exec -it c1 sh
5
/ # cd /var/lib/registry
6
/var/lib/registry # tree ./
7
./
8
└── docker
9
    └── registry
10
        └── v2
11
            ├── blobs
12
            │
13
            └── repositories
14
/var/lib/registry # cd docker/registry/v2
15
/var/lib/registry/docker/registry/v2 # ls
16
blobs         repositories
17
# 主要就是它俩

Docker Registry ==存储结构==：

/var/lib/registry/docker/registry/v2/ 目录包含：

blobs/ 目录：
- 存放实际的镜像层数据（layers）
- 文件以 SHA256 哈希值命名
- 包含镜像的所有层数据
repositories/ 目录：
- 存放仓库元数据
- 包含标签、清单等信息

1
/var/lib/registry/docker/registry/v2 # du -sh ./*
2
3.5M  ./blobs
3
20.0K  ./repositories
4
📌 alpine镜像原来的大小是 7.8MB --> 3.5M
5
"Docker Registry 会对存储的数据进行一定的压缩处理"
6
/var/lib/registry/docker/registry/v2 # ls repositories/
7
base
8
# 这个base就是我们起的项目名称
9

10
1)删除元数据
11
/var/lib/registry/docker/registry/v2 # rm -rf repositories/base
12
⚠️删除的是它里面的项目,而不是本身的repositories目录⚠️
13
  ❌️ rm -rf repositories/
14
  ✅️ rm -rf repositories/base
15
[root@Docker ~]# curl http://10.0.0.99:5000/v2/_catalog
16
{"repositories":[]}
17
# 已经没有了
18
'但真实的数据并没有删除'
19
/var/lib/registry/docker/registry/v2 # du -sh ./*
20
3.5M  ./blobs
21
0  ./repositories <-- 依旧存在这个目录✅️
22
# 只是少了 20K 而已
23

24
2)回收镜像层数据
25
# 彻底释放存储空间
26
/var/lib/registry/docker/registry/v2 # registry garbage-collect /etc/distribution/config.yml
27
/var/lib/registry/docker/registry/v2 # du -sh ./*
28
0  ./blobs
29
0  ./repositories
30
"这下子就都干净了!"

bug解决#

1
"描述:"
2
  🏷️ 已经推送的镜像无法再次推送(需重启registry容器)
3
  🏷️ 尽管已经删除回收,推送时会有缓存
4
============================================
5
[root@Docker ~]# docker push 10.0.0.99:5000/base/alpine:3.20.2
6
'再次推送刚彻底删除的镜像'
7
The push refers to repository [10.0.0.99:5000/base/alpine]
8
c6a83fedfae6: "Layer already exists" <-- 已经显示出异样了⚠️
9
# 描述的是exists已存在,而不是Pushed已推送
10
✅️ 因为刚删除不久,有缓存
11
[root@Docker ~]# curl http://10.0.0.99:5000/v2/_catalog
12
{"repositories":["base/alpine"]}
13
# 这里尝试拉取一下页面,有它的元数据
14
/var/lib/registry/docker/registry/v2 # du -sh ./*
15
0  ./blobs
16
12.0K  ./repositories
17
'切回去看容器内部数据'
18
# 只有元数据,没有镜像数据

1
"解决方案"
2
  🦄 重启docker-registries容器即可
3
[root@Docker ~]# docker restart c1
4
'再次推送'
5
[root@Docker ~]# docker push 10.0.0.99:5000/base/alpine:3.20.2
6
The push refers to repository [10.0.0.99:5000/base/alpine]
7
c6a83fedfae6: "Pushed"
8
# 已推送
9
[root@Docker ~]# curl http://10.0.0.99:5000/v2/_catalog
10
{"repositories":["base/alpine"]}
11
[root@Docker ~]# docker exec -it c1 sh
12
/ # cd /var/lib/registry/
13
/var/lib/registry # cd docker/registry/v2
14
/var/lib/registry/docker/registry/v2 # du -sh ./*
15
3.5M  ./blobs
16
20.0K  ./repositories
17
✅️ '一切都回来了'
18
[root@Docker ~]# docker pull 10.0.0.99:5000/base/alpine:3.20.2
19
✅️ '拉取自己的镜像仓库'
20
3.20.2: Pulling from base/alpine
21
Digest: sha256:eddxxx
22
Status: Downloaded newer image for 10.0.0.99:5000/base/alpine:3.20.2
23
[root@Docker ~]# docker images
24
10.0.0.99:5000/base/alpine:3.20.2  eddxxx  11.7MB

harbor#

Harbor 是 VMware 公司开源的==企业级镜像仓库==,主要特点如下：

提供安全、可靠的私有镜像存储和分发
底层使用 Docker Compose 来管理 Harbor 服务
提供图形化管理界面(Web UI)

GitHub 地址：https://github.com/goharbor/harbor

离线安装
- 这里==建议用v2.14版本==
- 复制标签没有bug

1
1)上传解压
2
[root@Docker ~]# cd /tmp
3
[root@Docker tmp]# ls
4
harbor-offline-installer-v2.14.3.tgz
5
[root@Docker tmp]# tar xf harbor-offline-installer-v2.14.3.tgz  -C /usr/local/
6

7
2)修改配置文件
8
[root@Docker tmp]# cd /usr/local/harbor/
9
[root@Docker harbor]# ls
10
common.sh  harbor.v2.14.3.tar.gz  harbor.yml.tmpl ...
11
[root@Docker harbor]# cp harbor.yml{.tmpl,}
12
# 把备份文件复制出来
13
"把后缀tmpl去掉"
14
[root@Docker harbor]# ls
15
...xxx harbor.yml.tmpl "harbor.yml"
16
[root@Docker harbor]# vim harbor.yml

1
hostname: 10.0.0.99
2
http:
3
  port: 80
4
# 后面再启用HTTPS
5
harbor_admin_password: passwd
6
# 修改登录密码
7
database:
8
  password: root123
9
  max_idle_conns: 100
10
  max_open_conns: 900
11
  conn_max_lifetime: 5m
12
  conn_max_idle_time: 0
13
data_volume: /var/lib/harbor
14
# 更改数据卷目录
15
# 如果卸载harbor的话,要把这个目录手动删除掉
16
trivy:
17
  ignore_unfixed: false
18
  skip_update: false
19
  skip_java_db_update: false
20
  db_repository: ghcr.io/aquasecurity/trivy-db
21
  java_db_repository: ghcr.io/aquasecurity/trivy-java-db
22
  offline_scan: false
23
  security_check: vuln
24
  insecure: false
25
  timeout: 5m0s
26
jobservice:
27
  max_job_workers: 10
28
  max_job_duration_hours: 24
29
  job_loggers:
30
    - STD_OUTPUT
31
    - FILE
32
  logger_sweeper_duration: 1
33
notification:
34
  webhook_job_max_retry: 3
35
  webhook_job_http_client_timeout: 3
36
log:
37
  level: info
38
  local:
39
    rotate_count: 50
40
    rotate_size: 200M
41
    location: /var/log/harbor
42
_version: 2.15.0
43
proxy:
44
  http_proxy:
45
  https_proxy:
46
  no_proxy:
47
  components:
48
    - core
49
    - jobservice
50
    - trivy
51
upload_purging:
52
  enabled: true
53
  age: 168h
54
  interval: 24h
55
  dryrun: false
56
cache:
57
  enabled: false
58
  expire_hours: 24

1
3)安装harbor服务
2
[root@Docker harbor]# ./install.sh
3
# 底层就是用shell脚本写的
4
[Step 5]: starting Harbor ...
5
[+] up 10/10
6
 ✔ Network harbor_harbor       Created
7
 ✔ Container harbor-log        Started
8
 ✔ Container harbor-db         Started
9
 ✔ Container registryctl       Started
10
 ✔ Container harbor-portal     Started
11
 ✔ Container redis             Started
12
 ✔ Container registry          Started
13
 ✔ Container harbor-core       Started
14
 ✔ Container harbor-jobservice Started
15
 ✔ Container nginx             Started
16
✅️ Harbor has been installed and started successfully.
17
[root@Docker harbor]# docker compose ls
18
NAME    STATUS      CONFIG FILES
19
harbor  running(9)  /usr/local/harbor/docker-compose.yml
20

21
4)测试验证
22
http://10.0.0.99/
23
✅️用户名:   admin
24
✅️密码:  passwd

新建项目#

1
'推送命令'
2
1)先打标记
3
[root@Docker harbor]# docker tag alpine:3.20.2 10.0.0.99/kpyun/alpine:3.20.2
4

5
2)推送
6
[root@Docker harbor]# docker push 10.0.0.99/kpyun/alpine:3.20.2
7
dial tcp 10.0.0.99:443: connect: connection refused
8
'还是老问题'
9
# 客户端默认连接HTTPS:443端口
10

11
3)改配置&重启服务
12
[root@Docker harbor]# vim /etc/docker/daemon.json
13
{
14
    "insecure-registries": ["10.0.0.99:5000","10.0.0.99"]
15
}
16
# 逗号分隔
17
'修改Docker配置文件,需要重启服务'
18
[root@Docker harbor]# systemctl restart docker
19
[root@Docker harbor]# docker compose ps -a
20
Exited (128)
21
........
22
Up
23
Exited (128)
24
Exited (128)
25
'发现很多容器都异常退出了!'
26

27
4)停止再重启
28
✅️ 常见的解决办法!
29
[root@Docker harbor]# docker compose down -t 0
30
'小细节 --> 没有-v --> 保留数据卷'
31
# 刚才创建的项目会保留下来
32
[root@Docker harbor]# docker compose up -d
33
# 再次启动容器
34

35
5)再次推送
36
[root@Docker harbor]# docker push 10.0.0.99/kpyun/alpine:3.20.2
37
authorization failed --> 认证失败,没有权限
38

39
6)需要先进行登录
40
[root@Docker harbor]# docker login 10.0.0.99 -u admin -p passwd
41
# 指定服务器地址,默认是Docker Hub
42
# 我这里同时指定了密码
43
Your credentials are stored unencrypted in '/root/.docker/config.json'.
44
# 被存储在这个文件中
45
[root@Docker harbor]# cat /root/.docker/config.json
46
{
47
  "auths": {
48
    "10.0.0.99": {
49
      "auth": "YWRtaW46cGFzc3dk"
50
    }
51
  }
52
}
53
# 我们可以通过base64把它解码出来
54
[root@Docker harbor]# echo YWRtaW46cGFzc3dk | base64 -d
55
admin:passwd
56
'用户名:密码'
57

58
7)再次推送
59
[root@Docker harbor]# docker push 10.0.0.99/kpyun/alpine:3.20.2
60
The push refers to repository [10.0.0.99/kpyun/alpine]
61
c6a83fedfae6: "Pushed"
62
# 这次就推送上去了

1
8)测试验证
2
'切另一台机器验证!'
3
[root@test ~]# vim /etc/docker/daemon.json
4
{
5
    "insecure-registries": ["10.0.0.99:5000","10.0.0.99"]
6
}
7
[root@test ~]# systemctl restart docker
8
[root@test ~]# docker login 10.0.0.99 -u admin -p passwd
9
Login Succeeded
10
[root@test ~]# docker pull 10.0.0.99/kpyun/alpine:3.20.2
11
'刚才复制的命令 <-- web页面'
12
[root@test ~]# docker images
13
10.0.0.99/kpyun/alpine   3.20.2
14

15
9)密码保护
16
# 在登录的时候,你的密码被保存
17
[root@test ~]# cat /root/.docker/config.json
18
{
19
  "auths": {
20
    "10.0.0.99": {
21
      "auth": "YWRtaW46cGFzc3dk"
22
    }
23
  }
24
}
25
⚠️ 容易被盗窃!
26
# 养成习惯,不用的时候,退出登录状态
27
[root@test ~]#docker logout 10.0.0.99
28
Removing login credentials for 10.0.0.99
29
'后接镜像仓库的网址'
30
[root@test ~]# cat /root/.docker/config.json
31
{
32
  "auths": {}
33
}
34
✅️ 现在里面就没有密码信息了

镜像仓库迁移#

1
项目背景:
2
  早期的docker registry镜像管理不方便
3
  后续将其迁移到harbor仓库
4
项目步骤:
5
  1.配置仓库
6
  2.新建复制规则
7
  3.启动复制规则
8
  4.设置项目为公开
9
  5.测试验证
10
==================================
11
1)环境准备
12
[root@Docker harbor]# docker run -d --network host --restart=unless-stopped --name c1 -v img-volume:/var/lib/registry registry:3.0.0
13
[root@Docker harbor]# ss -lntup | grep 5000
14
4096   *:5000   users:(("registry",pid=76702,fd=6))
15
[root@Docker harbor]# curl localhost:5000/v2/_catalog
16
{"repositories":["base/alpine"]}
17
# 复用的数据卷,所以数据并没有丢
18
'再推几个镜像'
19
[root@Docker harbor]# docker tag nginx:latest 10.0.0.99:5000/base/nginx:latest
20
[root@Docker harbor]# docker tag mysql:8.0.36 10.0.0.99:5000/base/mysql:8.0.36
21
# 打标签,后推送
22
[root@Docker harbor]# docker push 10.0.0.99:5000/base/nginx:latest
23
[root@Docker harbor]# docker push 10.0.0.99:5000/base/mysql:8.0.36
24
[root@Docker harbor]# curl localhost:5000/v2/_catalog
25
{"repositories":["base/alpine","base/mysql","base/nginx"]}
26

27
2)harbor配置仓库

新建复制规则

启动复制规则

设置项目为公开

测试验证

1
[root@test ~]# docker login 10.0.0.99  -u admin -p passwd
2
'先去项目中复制命令'
3
[root@test ~]# docker pull 10.0.0.99/base/mysql:8.0.36
4
# 这样更简便
5
Status: Downloaded newer image for 10.0.0.99/base/mysql:8.0.36
6
✅️ 成功拉取

镜像主从同步#

1
1)在另一个节点安装harbor
2
'test节点'
3
# 过程省略
4
[root@test /usr/local/harbor]# ./install.sh
5
[root@test /usr/local/harbor]# docker compose up -d
6
[+] Running 10/10
7
[root@test /usr/local/harbor]# vim /etc/docker/daemon.json
8
{
9
"insecure-registries": ["10.0.0.99:5000","10.0.0.128"]
10
}
11
⚠️ 指向自己
12
[root@test /usr/local/harbor]# systemctl restart docker
13
[root@test /usr/local/harbor]# docker compose ls
14
NAME     STATUS      CONFIG FILES
15
harbor   running(9)  /usr/local/harbor/docker-compose.yml
16
[root@test /usr/local/harbor]# docker login 10.0.0.128 -u admin -p passwd
17
Login Succeeded
18

19
2)访问测试
20
http://10.0.0.128/

主镜像仓库(.99) —> 备用(.128)
配置仓库

复制规则管理

等一分钟 …
- 验证备用仓库是否同步

✅️ 成功同步

==🤔疑问==: 如果备用仓库也被创建了项目,会同步至主仓库嘛❓️

🌿自然不会 ✅️
- 我们设置的规则是 —> 主同步至从库
  - 每分钟 push推送一次

1
'在从库创建项目,随便推几个镜像'
2
📌 先在web页面中创建项目
3
# 从库中
4
[root@test /usr/local/harbor]# docker push 10.0.0.128/haha/busybox:latest
5
The push refers to repository [10.0.0.128/haha/busybox]
6
068f50152bbc: "Pushed"
7

8
✅️ '主库这个时候是没有这个项目的!'
9
--> 设置新的"复制规则"
10
# 又来一个

等一会主库也有了

基于事件#

相比传统的定时触发, 它实现了近实时、主动推送的同步机制

目前实验 —> 仅在push推送时可供选择
- pull拉取没有这个选项

特性	定时复制（旧方式）	事件驱动复制（新方式）
触发机制	按固定时间间隔（如每分钟）轮询主库变更	主库在发生关键事件时主动通知复制任务（如 push/delete/tag）
延迟	最高可达配置间隔（如 1 分钟）	秒级甚至毫秒级（取决于网络与系统负载）
资源开销	周期性扫描,可能重复检查无变更内容	仅在真实事件发生时触发,更高效

修改复制规则
- 主同步至从库
  - 每分钟 push推送一次 —> ==基于事件触发==

删除测试

==增加镜像测试==

1
[root@Docker harbor]# docker tag  oldboyedu-linux-tools:v0.1 10.0.0.99/kpyun/oldboyedu-linux-tools:v0.1
2
[root@Docker harbor]# docker push 10.0.0.99/kpyun/oldboyedu-linux-tools:v0.1
3
'推送至主库'
4

5
# 很快也会同步至从库
6
✅️ 你主库一推,立马同步至从库

高可用#

把所有的镜像推送至一个地方(NFS)

宿主机之间keepalived

镜像之间互相同步(pull & push) <— 官方推荐

👆就是我们演示的==主从同步==

宿主机之间keepalived

1
1)安装keepalived
2
# 两个节点都安装
3
[root@Docker ~]# dnf -y install keepalived
4
[root@test ~]# yum -y install keepalived
5

6
2)修改配置文件
7
[root@Docker ~]# vim /etc/keepalived/keepalived.conf
8
global_defs {
9
    router_id 10.0.0.99
10
}
11

12
vrrp_instance VI_1 {
13
    interface eth0
14
    virtual_router_id 50
15
    priority 150
16
    advert_int 1
17

18
    authentication {
19
        auth_type PASS
20
        auth_pass 1111
21
    }
22

23
    virtual_ipaddress {
24
        10.0.0.3
25
    }
26
}
27
[root@test ~]# vim /etc/keepalived/keepalived.conf
28
global_defs {
29
    router_id 10.0.0.128
30
}
31

32
vrrp_instance VI_1 {
33
    interface eth0
34
    virtual_router_id 50
35
    priority 100
36
    advert_int 1
37

38
    authentication {
39
        auth_type PASS
40
        auth_pass 1111
41
    }
42

43
    virtual_ipaddress {
44
        10.0.0.3
45
    }
46
}
47
'虚拟Mac地址就先不开了'
48
# 我这里一个Centos,一个Rocky,虚拟Mac地址显示不出来
49

50
3)重启服务
51
[root@Docker ~]# systemctl restart keepalived
52
[root@test ~]# systemctl restart keepalived
53
'10.xxx.99的优先级更高 --> 有虚拟IP'
54
[root@Docker ~]# ip a
55
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
56
    link/ether 00:0c:29:1c:7e:be brd ff:ff:ff:ff:ff:ff
57
    altname enp3s0
58
    altname ens160
59
    altname enx000c291c7ebe
60
    inet 10.0.0.99/24 brd 10.0.0.255 scope global noprefixroute eth0
61
       valid_lft forever preferred_lft forever
62
    inet 10.0.0.3/32 scope global eth0
63
       valid_lft forever preferred_lft forever
64

65
4)测试验证
66
http://10.0.0.3/
67
'此时映射到10.xxx.99'

1
5)推送测试
2
[root@Docker harbor]# docker tag redis:7.2.8 10.0.0.3/kpyun/redis:7.2.8
3
[root@Docker harbor]# vim /etc/docker/daemon.json
4
[root@Docker harbor]# systemctl restart docker
5
[root@Docker harbor]# docker compose down -t 0
6
[root@Docker harbor]# docker compose up -d
7
[root@Docker harbor]# docker login 10.0.0.3 -u admin -p passwd
8
[root@Docker harbor]# docker push 10.0.0.3/kpyun/redis:7.2.8
9
'此时实际是推送至主库中'
10
# 因为有复制规制,也会复制到从库中

1
6)VIP漂移
2
'关闭 stop 主库的keepalived'
3
[root@Docker harbor]# systemctl stop keepalived.service
4
[root@test /usr/local/harbor]# ip a
5
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
6
    link/ether 00:0c:29:ec:ba:7b brd ff:ff:ff:ff:ff:ff
7
    inet 10.0.0.128/24 brd 10.0.0.255 scope global eth0
8
       valid_lft forever preferred_lft forever
9
    inet 10.0.0.3/32 scope global eth0
10
       valid_lft forever preferred_lft forever
11
'漂移至从库中'

1
7)再次推送测试
2
'因为10.xxx.99里有对应的配置,我们还在那里推送'
3
[root@Docker harbor]# docker tag ubuntu:22.04 10.0.0.3/kpyun/ubuntu:22.04
4
[root@Docker harbor]# docker push 10.0.0.3/kpyun/ubuntu:22.04
5
The push refers to repository [10.0.0.3/kpyun/ubuntu]
6
f63eb04151bc: "Pushed"

1
8)启动keepalived
2
[root@Docker harbor]# systemctl start keepalived
3
'优先级不同,抢占回来!'
4
inet 10.0.0.99/24 brd 10.0.0.255
5
   valid_lft forever preferred_lft forever
6
inet 10.0.0.3/32 scope global eth0

HTTPS证书配置#

1
1)上传证书
2
[root@Docker harbor]# pwd
3
/usr/local/harbor
4
[root@Docker harbor]# unzip /tmp/24850683_docker.kpyun.fun_nginx.zip -d /usr/local/harbor/
5
Archive:  /tmp/24850683_docker.kpyun.fun_nginx.zip
6
Aliyun Certificate Download
7
  inflating: /usr/local/harbor/docker.kpyun.fun.pem
8
  inflating: /usr/local/harbor/docker.kpyun.fun.key
9
[root@Docker harbor]# ls | grep docker.kpyun.
10
docker.kpyun.fun.key
11
docker.kpyun.fun.pem
12

13

14
2)修改配置文件
15
'主机名和https'
16
[root@Docker harbor]# vim harbor.yml
17
hostname: docker.kpyun.fun
18
https:
19
  port: 443
20
  certificate: /usr/local/harbor/docker.kpyun.fun.pem
21
  private_key: /usr/local/harbor/docker.kpyun.fun.key
22

23
3)清理环境&重新安装
24
[root@Docker harbor]# docker compose down -t 0
25
[root@Docker harbor]# ./prepare
26
[root@Docker harbor]# ./install.sh
27

28
4)强制走HTTPS
29
[root@Docker harbor]# vim /etc/docker/daemon.json
30
{
31
    "insecure-registries": []
32
}
33
# 都删除掉
34
[root@Docker harbor]# systemctl restart docker
35
[root@Docker harbor]# docker compose down -t 0
36
[root@Docker harbor]# docker compose up -d
37
[root@Docker harbor]# docker login docker.kpyun.fun -u admin -p passwd
38
# 重新登录
39

40
5)映射&打标签
41
[root@Docker harbor]# tail -1 /etc/hosts
42
10.0.0.3 docker.kpyun.fun
43
[root@Docker harbor]# docker tag centos:latest docker.kpyun.fun/kpyun/centos:latest
44
[root@Docker harbor]# docker push docker.kpyun.fun/kpyun/centos:latest
45
The push refers to repository [docker.kpyun.fun/kpyun/centos]
46
174f56854903: "Pushed"
47

48
6)Windows映射
49
10.0.0.3 docker.kpyun.fun
50
# 自动跳转 80 --> 443

脚本优化#

1
[root@Docker harbor]# cd ~
2
[root@Docker ~]# vim build.sh
3
#!/bin/bash
4
# 可以是写好的Dockerfile --> 自动build构建
5
# 如果是Dockerfile,在构建的同时,就要打上自己私有仓库的地址!
6
# 自动打标签,自动推送
7
docker tag oldboyedu-games:v0.6 docker.kpyun.fun/kpyun/oldboyedu-games:v0.6
8
docker login -u admin -p passwd docker.kpyun.fun
9
docker push docker.kpyun.fun/kpyun/oldboyedu-games:v0.6
10
docker logout docker.kpyun.fun
11
[root@Docker ~]# sh build.sh
12
Login Succeeded --> 成功登录
13
The push to repository [docker.kpyun.fun/kpyun/oldboyedu-games] --> 推送镜像
14
5dcfac0f2f9c: "Pushed"
15
.......
16
Removing login credentials for docker.kpyun.fun --> 退出登录

音乐

音乐