docker是一个用了一种新颖方式实现的超轻量虚拟机,在实现的原理和应用上还是和vm有巨大差别,专业的叫法是应用容器(application container)。(我个人还是喜欢称虚拟机)
1. 安装
1.1 在 ubuntu 14.04 上安装 docker
前提要求:
内核版本必须是3.10或者以上
依次执行下面的步骤:
1
2
3
4
5
6
7
8
9
10
|
sudo apt-get update
sudo apt-get install apt-transport-https ca-certificates
sudo apt-key adv --keyserver hkp: //p80 .pool.sks-keyservers.net:80 --recv-keys 58118e89f3a912897c070adbf76221572c52609d
编辑 /etc/apt/sources .list.d /docker .list 文件,添加 deb https: //apt .dockerproject.org /repo ubuntu-trusty main
sudo apt-get update
sudo apt-get purge lxc-docker
apt-cache policy docker-engine
apt-get upgrade
sudo apt-get install linux-image-extra-$( uname -r) linux-image-extra-virtual
sudo apt-get install docker-engine
|
至此,安装过程完成。
运行 sudo service docker start 启动 docker 守护进程。
运行 docker version 查看 docker 版本
1
2
|
root@devstack: /home/sammy # docker --version
docker version 1.12.1, build 23cf638
|
启动第一个容器:
启动第一个docker 容器 docker run hello-world
1
2
3
4
|
root@devstack: /home/sammy # docker run hello-world
hello from docker!
this message shows that your installation appears to be working correctly.
|
它的运行成功也表明前面的安装步骤都运行正确了。
以上内容参考自 docker 官网:https://docs.docker.com/engine/installation/linux/ubuntulinux/
1.2 docker 到目前(2016/09/16)为止的版本历史
2. docker 的基本操作
2.1 docker 容器的状态机
一个容器在某个时刻可能处于以下几种状态之一:
- created:已经被创建 (使用 docker ps -a 命令可以列出)但是还没有被启动 (使用 docker ps 命令还无法列出)
- running:运行中
- paused:容器的进程被暂停了
- restarting:容器的进程正在重启过程中
- exited:上图中的 stopped 状态,表示容器之前运行过但是现在处于停止状态(要区别于 created 状态,它是指一个新创出的尚未运行过的容器)。可以通过 start 命令使其重新进入 running 状态
- destroyed:容器被删除了,再也不存在了
你可以在 docker inspect 命令的输出中查看其详细状态:
1
2
3
4
5
6
7
8
9
10
11
12
13
|
"state" : {
"status" : "running" ,
"running" : true ,
"paused" : false ,
"restarting" : false ,
"oomkilled" : false ,
"dead" : false ,
"pid" : 4597,
"exitcode" : 0,
"error" : "" ,
"startedat" : "2016-09-16t08:09:34.53403504z" ,
"finishedat" : "2016-09-16t08:06:44.365106765z"
}
|
2.2 docker 命令概述
我们可以把docker 的命令大概地分类如下:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
镜像操作:
build build an image from a dockerfile
commit create a new image from a container's changes
images list images
load load an image from a tar archive or stdin
pull pull an image or a repository from a registry
push push an image or a repository to a registry
rmi remove one or more images
search search the docker hub for images
tag tag an image into a repository
save save one or more images to a tar archive (streamed to stdout by default)
history 显示某镜像的历史
inspect 获取镜像的详细信息
容器及其中应用的生命周期操作:
create create a new container (创建一个容器)
kill kill one or more running containers
inspect return low-level information on a container, image or task
pause pause all processes within one or more containers
ps list containers
rm remove one or more containers (删除一个或者多个容器)
rename rename a container
restart restart a container
run run a command in a new container (创建并启动一个容器)
start start one or more stopped containers (启动一个处于停止状态的容器)
stats display a live stream of container(s) resource usage statistics (显示容器实时的资源消耗信息)
stop stop one or more running containers (停止一个处于运行状态的容器)
top display the running processes of a container
unpause unpause all processes within one or more containers
update update configuration of one or more containers
wait block until a container stops, then print its exit code
attach attach to a running container
exec run a command in a running container
port list port mappings or a specific mapping for the container
logs 获取容器的日志
容器文件系统操作:
cp copy files /folders between a container and the local filesystem
diff inspect changes on a container's filesystem
export export a container's filesystem as a tar archive
import import the contents from a tarball to create a filesystem image
docker registry 操作:
login log in to a docker registry.
logout log out from a docker registry.
volume 操作
volume manage docker volumes
网络操作
network manage docker networks
swarm 相关操作
swarm manage docker swarm
service manage docker services
node manage docker swarm nodes
系统操作:
version show the docker version information
events get real time events from the server (持续返回docker 事件)
info display system-wide information (显示docker 主机系统范围内的信息)
|
比较有意思的几个命令:
(1)容器从生到死整个生命周期
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
root@devstack: /home/sammy # docker create --name web31 training/webapp python app.py #创建名字为 web31 的容器
7465f4cb7c49555af32929bd1bc4213f5e72643c0116450e495b71c7ec128502
root@devstack: /home/sammy # docker inspect --format='{{.state.status}}' web31 #其状态为 created
created
root@devstack: /home/sammy # docker start web31 #启动容器
web31
root@devstack: /home/sammy # docker inspect --format='{{.state.status}}' web31 #其状态为 running
running
root@devstack: /home/sammy # docker pause web31 #暂停容器
web31
root@devstack: /home/sammy # docker inspect --format='{{.state.status}}' web31
paused
root@devstack: /home/sammy # docker unpause web31 #继续容器
web31
root@devstack: /home/sammy # docker inspect --format='{{.state.status}}' web31
running
root@devstack: /home/sammy # docker rename web31 newweb31 #重命名
root@devstack: /home/sammy # docker inspect --format='{{.state.status}}' newweb31
running
root@devstack: /home/sammy # docker top newweb31 #在容器中运行 top 命令
uid pid ppid c stime tty time cmd
root 5009 4979 0 16:28 ? 00:00:00 python app.py
root@devstack: /home/sammy # docker logs newweb31 #获取容器的日志
* running on http: //0 .0.0.0:5000/ (press ctrl+c to quit)
root@devstack: /home/sammy # docker stop newweb31 #停止容器
newweb31
root@devstack: /home/sammy # docker inspect --format='{{.state.status}}' newweb31
exited
root@devstack: /home/sammy # docker rm newweb31 #删除容器
newweb31
root@devstack: /home/sammy # docker inspect --format='{{.state.status}}' newweb31
error: no such image, container or task: newweb31
|
(2) docker stop 和 docker kill
在docker stop 命令执行的时候,会先向容器中pid为1的进程发送系统信号 sigterm,然后等待容器中的应用程序终止执行,如果等待时间达到设定的超时时间(默认为 10秒,用户可以指定特定超时时长),会继续发送sigkill的系统信号强行kill掉进程。在容器中的应用程序,可以选择忽略和不处理sigterm信号,不过一旦达到超时时间,程序就会被系统强行kill掉,因为sigkill信号是直接发往系统内核的,应用程序没有机会去处理它。
比如运行 docker stop web5 -t 20 命令后:
2016-09-16t16:01:18.206540853+08:00 container kill b3256ef1400a7f6a6f242e377a77af5e25d3b12237c4ee7c2e9b31a5f6437868 (image=training/webapp, name=web5, signal=15)
2016-09-16t16:01:38.212352224+08:00 container kill b3256ef1400a7f6a6f242e377a77af5e25d3b12237c4ee7c2e9b31a5f6437868 (image=training/webapp, name=web5, signal=9)
2016-09-16t16:01:38.235021315+08:00 container die b3256ef1400a7f6a6f242e377a77af5e25d3b12237c4ee7c2e9b31a5f6437868 (exitcode=137, image=training/webapp, name=web5)
能看到:
- 首先 docker 向容器发出 sigterm 信号(signal=15)
- 等待20秒 (01:18 到 01:38)
- 再发送 sigkill 系统信号 (signal = 9)
- 然后容器被杀掉了 (die)
而 docker kill 命令会直接发出sigkill的系统信号,以强行终止容器中程序的运行。运行 docker kill web5 命令后:
2016-09-16t16:06:44.351086471+08:00 container kill b3256ef1400a7f6a6f242e377a77af5e25d3b12237c4ee7c2e9b31a5f6437868 (image=training/webapp, name=web5, signal=9)
2016-09-16t16:06:44.365116100+08:00 container die b3256ef1400a7f6a6f242e377a77af5e25d3b12237c4ee7c2e9b31a5f6437868 (exitcode=137, image=training/webapp, name=web5)
可见直接发出的是 sigkill 信号,容器立马就被杀掉了。
(3)使用 docker cp 在 host 和 container 之间拷贝文件或者目录
1
2
3
4
5
|
root@devstack: /home/sammy # docker cp /home/sammy/mydockerbuild/dockerfile web5:/webapp #从 host 拷贝文件到 container 里面
root@devstack: /home/sammy #
root@devstack: /home/sammy # docker cp web5:/webapp/dockerfile /home/sammy/dockerfile #从 container 里面拷贝文件到 host 上
root@devstack: /home/sammy # ls /home/sammy
chroot devstack dockerfile mongodbdocker mydockerbuild webapp
|
(4)docker export 和 import
docker export:将一个容器的文件系统打包为一个压缩文件
1
2
3
|
root@devstack:/home/sammy# docker export web5 -o ./web5
root@devstack:/home/sammy# ls
chroot devstack dockerfile mongodbdocker mydockerbuild web5 webapp
|
docker import:从一个压缩文件创建一个镜像
1
2
3
4
5
|
root@devstack: /home/sammy # docker import web5 web5img -m "imported on 0916"
sha256:745bb258be0a69a517367667646148bb2f662565bb3d222b50c0c22e5274a926
root@devstack: /home/sammy # docker history web5img
image created created by size comment
745bb258be0a 6 seconds ago 324 mb imported on 0916
|
2.3 docker run 命令
docker run 命令会创建一个容器并启动它,它也是包含很多的参数,按照用途将它们分类如下:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
cgroups 和 namespace 相关:
--blkio-weight value block io (relative weight), between 10 and 1000
--blkio-weight-device value block io weight (relative device weight) (default [])
--cgroup-parent string optional parent cgroup for the container
--cpu-percent int cpu percent (windows only)
--cpu-period int limit cpu cfs (completely fair scheduler) period
--cpu- quota int limit cpu cfs (completely fair scheduler) quota
-c, --cpu-shares int cpu shares (relative weight)
--cpuset-cpus string cpus in which to allow execution (0-3, 0,1)
--cpuset-mems string mems in which to allow execution (0-3, 0,1)
--device- read -bps value limit read rate (bytes per second) from a device (default [])
--device- read -iops value limit read rate (io per second) from a device (default [])
--device-write-bps value limit write rate (bytes per second) to a device (default [])
--device-write-iops value limit write rate (io per second) to a device (default [])
--ipc string ipc namespace to use
-m, --memory string memory limit
--memory-reservation string memory soft limit
--memory-swap string swap limit equal to memory plus swap: '-1' to enable unlimited swap
--memory-swappiness int tune container memory swappiness (0 to 100) (default -1)
--kernel-memory string kernel memory limit
-u, --user string username or uid ( format : <name|uid>[:<group|gid>])
--userns string user namespace to use
--uts string uts namespace to use
-h, -- hostname string container host name
--pid string pid namespace to use
--pids-limit int tune container pids limit ( set -1 for unlimited)
--isolation string container isolation technology
--io-maxbandwidth string maximum io bandwidth limit for the system drive (windows only)
--io-maxiops uint maximum iops limit for the system drive (windows only)
linux process capabilities 相关参数:
--cap-add value add linux capabilities (default [])
--cap-drop value drop linux capabilities (default [])
容器运行模式和环境相关:
-d, --detach run container in background and print container id
-e, -- env value set environment variables (default [])
-- env - file value read in a file of environment variables (default [])
dns 相关:
--dns value set custom dns servers (default [])
--dns-opt value set dns options (default [])
--dns-search value set custom dns search domains (default [])
健康检查相关:
--health-cmd string command to run to check health
--health-interval duration time between running the check
--health-retries int consecutive failures needed to report unhealthy
--health-timeout duration maximum time to allow one check to run
--no-healthcheck disable any container-specified healthcheck
ip 和端口:
--ip string container ipv4 address (e.g. 172.30.100.104)
--ip6 string container ipv6 address (e.g. 2001:db8::33)
-p, --publish value publish a container's port(s) to the host (default [])
-p, --publish-all publish all exposed ports to random ports
--expose value expose a port or a range of ports (default [])
--mac-address string container mac address (e.g. 92:d0:c6:0a:29:33)
--add-host value add a custom host-to-ip mapping (host:ip) (default [])
volume 相关:
- v , --volume value bind mount a volume (default [])
--volume-driver string optional volume driver for the container
--volumes-from value mount volumes from the specified container(s) (default [])
--storage-opt value storage driver options for the container (default [])
network 有关:
--network string connect a container to a network (default "default" )
--network- alias value add network-scoped alias for the container (default [])
--link value add link to another container (default [])
--link- local -ip value container ipv4 /ipv6 link- local addresses (default [])
日志有关:
--log-driver string logging driver for the container
--log-opt value log driver options (default [])
交互性有关:
-a, --attach value attach to stdin, stdout or stderr (default [])
-i, --interactive keep stdin open even if not attached
oom 有关:
--oom- kill -disable disable oom killer
--oom-score-adj int tune host's oom preferences (-1000 to 1000)
其它(待更进一步分类):
--cidfile string write the container id to the file
--detach-keys string override the key sequence for detaching a container
--device value add a host device to the container (default [])
--disable-content-trust skip image verification (default true )
--entrypoint string overwrite the default entrypoint of the image
--group-add value add additional groups to join (default [])
--help print usage
-l, --label value set meta data on a container (default [])
--label- file value read in a line delimited file of labels (default [])
--name string assign a name to the container
--privileged give extended privileges to this container
-- read -only mount the container's root filesystem as read only
--restart string restart policy to apply when a container exits (default "no" )
-- rm automatically remove the container when it exits
--runtime string runtime to use for this container
--security-opt value security options (default [])
--shm-size string size of /dev/shm , default value is 64mb
--sig-proxy proxy received signals to the process (default true )
--stop-signal string signal to stop a container, sigterm by default (default "sigterm" )
--sysctl value sysctl options (default map[])
--tmpfs value mount a tmpfs directory (default [])
-t, -- tty allocate a pseudo- tty
-- ulimit value ulimit options (default [])
-w, --workdir string working directory inside the container
|
具体的内容以后会有专门文件分析。
3. doker 平台的基本构成
docker 平台基本上由三部分组成:
- 客户端:用户使用 docker 提供的工具(cli 以及 api 等)来构建,上传镜像并发布命令来创建和启动容器
- docker 主机:从 docker registry 上下载镜像并启动容器
- docker registry:docker 镜像仓库,用于保存镜像,并提供镜像上传和下载
后面的文章会具体分析。
以上就是本文的全部内容,希望对大家的学习有所帮助,也希望大家多多支持服务器之家。