• 轻量级虚拟化Docker
  • 一、Docker基本介绍
  • 二、docker 安装配置
    • 2.1、Docker install
  • 三、Docker images
    • 3.1、Search index images
    • 3.2、Pull images
    • 3.3、Running an interactive shell
    • 3.4、相关快捷键
  • 四、docker常用命令
    • 4.1、docker help
      • 4.1.1、docker search
      • 4.1.2、docker info
      • 4.1.3、docker pull && docker push
      • 4.1.4、docker images
      • 4.1.5、docker rmi
      • 4.1.6、docker run
      • 4.1.7、docker start|stop|kill... ...
    • 4.2、参考文档
  • 五、docker端口映射
    • 5.1、自动映射端口
    • 5.2、绑定端口到指定接口
      • 5.2.1、绑定TCP端口
      • 5.2.2、绑定UDP端口
  • 六、配置网络
    • 6.1、列出当前主机网桥
    • 6.2、查看当前docker0 ip
    • 6.3、运行一个容器
      • 6.3.1、使用特定范围的IP
    • 6.4、不同主机间容器通信
      • 6.4.1、安装相应依赖软件
      • 6.4.2、桥接网络
        • 启动br0，使桥接生效
    • 6.5、参考文档
  • 七、构建docker私有库
    • 7.1、快速构建
    • 7.2、传统构建方式
      • 7.2.1、启动
      • 7.2.2、提交指定容器到私有库
    • 7.3、参考
  • 八、容器数据管理
    • 8.1、数据卷
      • 8.1.2、添加一个数据卷
      • 8.1.3、挂载宿主机目录为一个数据卷
    • 8.2、创建和挂载一个数据卷容器
    • 8.3、备份、恢复或迁移数据卷
    • 8.4、参考
  • 九、链接容器
    • 9.1 容器命名
    • 9.2 链接容器

web应用的自动化打包和发布；自动化测试和持续集成、发布；在服务型环境中部署和调整数据库或其他的后台应用；从头编译或者扩展现有的OpenShift或CloudFoundry平台来搭建自己的PaaS环境。

$sudo apt-get update$sudo apt-get install docker.io$sudo ln -sf /usr/bin/docker.io /usr/local/bin/docker

$sudo docker versionClient version: 1.1.1Client API version: 1.13Go version(client): go1.2.1Git commit(client): bd609d2Server version: 1.1.1Server API version: 1.13Go version(server): go1.2.1Git commit(server): bd609d2

$sudo docker search ubuntu

$sudo docker pull ubuntu# remote index 获取ubuntu官方镜像$sudo docker images# 查看当前镜像列表REPOSITORY          TAG                 IMAGE ID            CREATED             VIRTUAL SIZEubuntu              13.10               5e019ab7bf6d        3 weeks ago         180 MBubuntu              saucy               5e019ab7bf6d        3 weeks ago         180 MBubuntu              12.04               74fe38d11401        3 weeks ago         209.6 MB... ...

$sudo docker run -i -t ubuntu:14.04 /bin/bash

$sudo docker ps# 查看当前运行的容器, ps -a列出当前系统所有的容器CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES6c9129e9df10        ubuntu:14.04        /bin/bash           6 minutes ago       Up 6 minutes                            cranky_babbage

$sudo docker# docker命令帮助Usage: docker[OPTIONS] COMMAND[arg...] -H=[unix:///var/run/docker.sock]: tcp://host:port tobind/connect to or unix://path/to/socket to useA self-sufficient runtimeforlinux containers.Commands:    attach    Attach to a running container# 当前shell下attach连接指定运行镜像    build     Build an image from a Dockerfile# 通过Dockerfile定制镜像    commit    Create a new image from a container's changes # 提交当前容器为新的镜像    cp        Copy files/folders from the containers filesystem to the host path              # 从容器中拷贝指定文件或者目录到宿主机中    diff      Inspect changes on a container's filesystem# 查看docker容器变化    events    Get realtimeevents from the server# 从docker服务获取容器实时事件exportStream the contents of a container as a tar archive# 导出容器的内容流作为一个tar归档文件[对应import]historyShow thehistoryof an image# 展示一个镜像形成历史    images    List images# 列出系统当前镜像    import    Create a new filesystem image from the contents of a tarball# 从tar包中的内容创建一个新的文件系统映像[对应export]    info      Display system-wide information# 显示系统相关信息    inspect   Return low-level information on a container# 查看容器详细信息killKill a running container# kill指定docker容器    load      Load an image from a tar archive# 从一个tar包中加载一个镜像[对应save]    login     Register or Login to the docker registry server# 注册或者登陆一个docker源服务器    logs      Fetch the logs of a container# 输出当前容器日志信息    port      Lookup the public-facing port which is NAT-ed to PRIVATE_PORT# 查看映射端口对应的容器内部源端口    pause     Pause all processes within a container# 暂停容器    ps        List containers# 列出容器列表    pull      Pull an image or a repository from the docker registry server# 从docker镜像源服务器拉取指定镜像或者库镜像    push      Push an image or a repository to the docker registry server# 推送指定镜像或者库镜像至docker源服务器    restart   Restart a running container# 重启运行的容器    rm        Remove one or more containers# 移除一个或者多个容器    rmi       Remove one or more images# 移除一个或多个镜像[无容器使用该镜像才可删除，否则需删除相关容器才可继续或-f强制删除]    run       Run acommandin a new container# 在一个新的容器中运行一个命令    save      Save an image to a tar archive# 保存一个镜像为一个tar包[对应load]    search    Searchforan image in the docker index# 在docker index中搜索镜像    start     Start a stopped containers# 启动容器    stop      Stop a running containers# 停止容器    tag       Tag an image into a repository# 给源中镜像打标签    top       Lookup the running processes of a container# 查看容器中运行的进程信息    unpause   Unpause a paused container# 取消暂停容器    version   Show the docker version information# 查看docker版本号waitBlockuntila container stops,thenprint itsexitcode# 截取容器停止时的退出状态值

$sudo docker --helpUsage of docker:  --api-enable-cors=falseEnable CORS headers in the remote API# 远程API中开启CORS头  -b, --bridge=""                        Attach containers to a pre-existing network bridge# 桥接网络                                           use'none' to disable container networking  --bip=""                               Use this CIDR notation addressforthe network bridge's IP, not compatible with -b                                         # 和-b选项不兼容，具体没有测试过  -d, --daemon=false                     Enable daemon mode                                         # daemon模式  -D, --debug=false                      Enable debug mode                                          # debug模式  --dns=[]                               Force docker to use specific DNS servers                   # 强制docker使用指定dns服务器  --dns-search=[]                        Force Docker to use specific DNS search domains            # 强制docker使用指定dns搜索域  -e, --exec-driver="native"             Force the docker runtime to use a specific exec driver     # 强制docker运行时使用指定执行驱动器  -G, --group="docker"                   Group to assign the unix socket specified by -H when running in daemon mode                                           use '' (the empty string) to disable setting of a group  -g, --graph="/var/lib/docker"          Path to use as the root of the docker runtime              # 容器运行的根目录路径  -H, --host=[]                          The socket(s) to bind to in daemon mode                    # daemon模式下docker指定绑定方式[tcp or 本地socket]                                           specified using one or more tcp://host:port, unix:///path/to/socket, fd://* or fd://socketfd.  --icc=true                             Enable inter-container communication                       # 跨容器通信  --ip="0.0.0.0"                         Default IP address to use when binding container ports     # 指定监听地址，默认所有ip  --ip-forward=true                      Enable net.ipv4.ip_forward                                 # 开启转发  --iptables=true                        Enable Docker's addition of iptables rules# 添加对应iptables规则  --mtu=0                                Set the containers network MTU# 设置网络mtuifno value is provided: default to the default route MTU or 1500ifno default route is available  -p, --pidfile="/var/run/docker.pid"    Path to usefordaemon PID file# 指定pid文件位置  -r, --restart=trueRestart previously running containers# 重新启动以前运行的容器  -s, --storage-driver=""                Force the docker runtime to use a specific storage driver# 强制docker运行时使用指定存储驱动  --selinux-enabled=falseEnable selinux support# 开启selinux支持  --storage-opt=[]                       Set storage driver options# 设置存储驱动选项  --tls=falseUse TLS; implied by tls-verify flags# 开启tls  --tlscacert="/root/.docker/ca.pem"     Trust only remotes providing a certificate signed by the CA given here  --tlscert="/root/.docker/cert.pem"     Path to TLS certificate file# tls证书文件位置  --tlskey="/root/.docker/key.pem"       Path to TLS key file# tls key文件位置  --tlsverify=falseUse TLS and verify the remote(daemon: verify client, client: verify daemon)# 使用tls并确认远程控制主机  -v, --version=falsePrint version information and quit# 输出docker版本信息

$sudo docker searchUsage: docker search TERMSearch the docker indexforimages# 从docker镜像主页搜索镜像  --automated=falseOnly show automated builds  --no-trunc=falseDon't truncate output  -s, --stars=0        Only displays with at least xxx stars

$sudo docker search -s 100 ubuntu# 查找star数至少为100的镜像，找出只有官方镜像start数超过100，默认不加s选项找出所有相关ubuntu镜像NAME      DESCRIPTION                  STARS     OFFICIAL   AUTOMATEDubuntu    Official Ubuntu base image   425[OK]

$sudo docker info Containers: 7# 容器个数Images: 102# 镜像个数Storage Driver: aufs# 存储驱动，默认aufs Root Dir: /var/lib/docker/aufs# 根目录 Dirs: 116Execution Driver: native-0.2# 执行驱动Kernel Version: 3.13.0-24-genericWARNING: No swap limit support

$sudo docker pull# pull拉取镜像Usage: docker pull NAME[:TAG]Pull an image or a repository from the registry$sudo docker push# push推送指定镜像Usage: docker push NAME[:TAG]Push an image or a repository to the registry

$sudo docker pull ubuntu# 下载官方ubuntu docker镜像，默认下载所有ubuntu官方库镜像$sudo docker pull ubuntu:14.04# 下载指定版本ubuntu官方镜像

$sudo docker push 192.168.0.100:5000/ubuntu# 推送镜像库到私有源[可注册docker官方账户，推送到官方自有账户]$sudo docker push 192.168.0.100:5000/ubuntu:14.04# 推送指定镜像到私有源

$sudo docker images -hUsage: docker images[OPTIONS][NAME]List images  -a, --all=falseShow all images(by default filter out the intermediate image layers)# -a显示当前系统的所有镜像，包括过渡层镜像，默认docker images显示最终镜像，不包括过渡层镜像  -f, --filter=[]      Provide filter values(i.e.'dangling=true')  --no-trunc=falseDon't truncate output  -q, --quiet=falseOnly show numeric IDs

$sudo docker images# 显示当前系统镜像，不包括过渡层镜像$sudo docker images -a# 显示当前系统所有镜像，包括过渡层镜像$sudo docker images ubuntu# 显示当前系统docker ubuntu库中的所有镜像REPOSITORY                 TAG                 IMAGE ID            CREATED             VIRTUAL SIZEubuntu                     12.04               ebe4be4dd427        4 weeks ago         210.6 MBubuntu                     14.04               e54ca5efa2e9        4 weeks ago         276.5 MBubuntu                     14.04-ssh           6334d3ac099a        7 weeks ago         383.2 MB

$sudo docker rmiUsage: docker rmi IMAGE[IMAGE...]Remove one or more images  -f, --force=falseForce removal of the image# 强制移除镜像不管是否有容器使用该镜像  --no-prune=falseDo not delete untagged parents# 不要删除未标记的父镜像

$sudo docker run Usage: docker run[OPTIONS] IMAGE[COMMAND][ARG...]Run acommandin a new container  -a, --attach=[]            Attach to stdin, stdout or stderr.  -c, --cpu-shares=0         CPU shares(relative weight)# 设置cpu使用权重  --cidfile=""               Write the container ID to the file# 把容器id写入到指定文件  --cpuset=""                CPUs in which to allow execution(0-3, 0,1)# cpu绑定  -d, --detach=falseDetached mode: Run container in the background, print new container id# 后台运行容器  --dns=[]                   Set custom dns servers# 设置dns  --dns-search=[]            Set custom dns search domains# 设置dns域搜索  -e, --env=[]               Set environment variables# 定义环境变量  --entrypoint=""            Overwrite the default entrypoint of the image# ？  --env-file=[]              Read in a line delimited file of ENV variables# 从指定文件读取变量值  --expose=[]                Expose a port from the container without publishing it to your host# 指定对外提供服务端口  -h, --hostname=""          Container host name# 设置容器主机名  -i, --interactive=falseKeep stdin open evenifnot attached# 保持标准输出开启即使没有attached  --link=[]                  Add link to another container(name:alias)# 添加链接到另外一个容器[这个会专门章节讲解]  --lxc-conf=[](lxcexec-driver only) Add custom lxc options --lxc-conf="lxc.cgroup.cpuset.cpus = 0,1"  -m, --memory=""            Memory limit(format: <number><optional unit>, whereunit= b, k, m or g)# 内存限制  --name=""                  Assign a name to the container# 设置容器名  --net="bridge"             Set the Network modeforthe container# 设置容器网络模式'bridge': creates a new network stackforthe container on the docker bridge'none': no networkingforthis container'container:<name|id>': reuses another container network stack'host': use the host network stack inside the container.  Note: the host mode gives the container full access tolocalsystem services such as D-bus and is therefore considered insecure.  -P, --publish-all=falsePublish all exposed ports to the host interfaces# 自动映射容器对外提供服务的端口  -p, --publish=[]           Publish a container's port to the host             # 指定端口映射                               format: ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort                               (use 'docker port' to see the actual mapping)  --privileged=falseGive extended privileges to this container# 提供更多的权限给容器  --rm=falseAutomatically remove the container when it exits(incompatible with -d)# 如果容器退出自动移除和-d选项冲突  --sig-proxy=trueProxify received signals to the process(even in non-tty mode). SIGCHLD is not proxied.# ？  -t, --tty=falseAllocate a pseudo-tty# 分配伪终端  -u, --user=""              Username or UID# 指定运行容器的用户uid或者用户名  -v, --volume=[]            Bind mount a volume(e.g., from the host: -v /host:/container, from docker: -v /container)# 挂载卷[这个会专门章节讲解]  --volumes-from=[]          Mount volumes from the specified container(s)# 从指定容器挂载卷  -w, --workdir=""           Working directory inside the container# 指定容器工作目录

$sudo docker images ubuntuREPOSITORY          TAG                 IMAGE ID            CREATED             VIRTUAL SIZEubuntu              14.04               e54ca5efa2e9        4 weeks ago         276.5 MB... ...$sudo docker run -t -i -c 100 -m 512MB -h test1 -d --name="docker_test1" ubuntu /bin/bash# 创建一个cpu优先级为100，内存限制512MB，主机名为test1，名为docker_test1后台运行bash的容器a424ca613c9f2247cd3ede95adfbaf8d28400cbcb1d5f9b69a7b56f97b2b52e5$sudo docker ps CONTAINER ID        IMAGE           COMMAND         CREATED             STATUS              PORTS       NAMESa424ca613c9f        ubuntu:14.04    /bin/bash       6 seconds ago       Up 5 seconds                    docker_test1$sudo docker attach docker_test1root@test1:/#pwd/root@test1:/#exitexit

# Find IP address of container with ID <container_id> 通过容器id获取ip$sudo docker inspect <container_id> | grep IPAddress | cut -d ’"’ -f 4

$sudo docker run -t -P --expose 22 --name server  ubuntu:14.04

$sudo docker run -p[([<host_interface>:[host_port]])|(<host_port>):]<container_port>[/udp] <image> <cmd>

# Bind TCP port 8080 of the container to TCP port 80 on 127.0.0.1 of the host machine.$sudo docker run -p 127.0.0.1:80:8080 <image> <cmd># Bind TCP port 8080 of the container to a dynamically allocated TCP port on 127.0.0.1 of the host machine.$sudo docker run -p 127.0.0.1::8080 <image> <cmd># Bind TCP port 8080 of the container to TCP port 80 on all available interfaces of the host machine.$sudo docker run -p 80:8080 <image> <cmd># Bind TCP port 8080 of the container to a dynamically allocated TCP port on all available interfaces$sudo docker run -p 8080 <image> <cmd>

# Bind UDP port 5353 of the container to UDP port 53 on 127.0.0.1 of the host machine.$sudo docker run -p 127.0.0.1:53:5353/udp <image> <cmd>

$sudo brctl show# brctl工具依赖bridge-utils软件包bridge name bridge id STP enabled interfacesdocker0 8000.000000000000 no

$sudo ifconfig docker0docker0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xxinet addr:172.17.42.1 Bcast:0.0.0.0 Mask:255.255.0.0

$sudo docker run -t -i -d ubuntu /bin/bash52f811c5d3d69edddefc75aff5a4525fc8ba8bcfa1818132f9dc7d4f7c7e78b4$sudo brctl showbridge name bridge id STP enabled interfacesdocker0 8000.fef213db5a66 no vethQCDY1N

# Stop Docker$sudo service docker stop# Clean docker0 bridge and# add your very own bridge0$sudo ifconfig docker0 down$sudo brctl addbr bridge0$sudo ifconfig bridge0 192.168.227.1 netmask 255.255.255.0# Edit your Docker startup file$echo"DOCKER_OPTS=\"-b=bridge0\"" >> /etc/default/docker# Start Docker$sudo service docker start# Ensure bridge0 IP is not changed by Docker$sudo ifconfig bridge0bridge0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xxinet addr:192.168.227.1 Bcast:192.168.227.255 Mask:255.255.255.0# Run a container$docker run -i -t ubuntu /bin/bash# Container IP in the 192.168.227/24 rangeroot@261c272cd7d5:/# ifconfig eth0eth0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xxinet addr:192.168.227.5 Bcast:192.168.227.255 Mask:255.255.255.0# bridge0 IP as the default gatewayroot@261c272cd7d5:/# route -nKernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface0.0.0.0 192.168.227.1 0.0.0.0 UG 0 0 0 eth0192.168.227.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

$git clone https://github.com/jpetazzo/pipework.git$sudo cp -rp pipework/pipework /usr/local/bin/

$sudo apt-get install arping bridge-utils -y

# cat /etc/network/interfacesauto loiface lo inet loopbackauto eth0iface eth0 inet manualauto br0iface br0 inet staticaddress 10.0.128.219netmask 255.255.255.192gateway 10.0.128.254bridge_ports eth0bridge_stp offbridge_fd 0bridge_maxwait 0dns-nameservers 10.0.127.110dns-search intranet.123u.com

# ifup br0# Bash=$(docker run -i -d -t 10.0.128.219:5000/ubuntu:14.04 /bin/bash)# pipework br0 $Bash 10.0.128.223/26

$sudo apt-get install build-essential python-dev libevent-dev python-pip liblzma-dev$git clone https://github.com/dotcloud/docker-registry.git$cddocker-registry/$cp config/config_sample.yml config/config.yml$mkdir /data/registry -p$pip install .

$sudo gunicorn --access-logfile - --debug -k gevent -b 0.0.0.0:5000\-w 1 docker_registry.wsgi:application

$sudo gunicorn -k gevent --max-requests 100 --graceful-timeout 3600\-t 3600 -b localhost:5000 -w 8 docker_registry.wsgi:application

$docker tag 74fe38d11401 192.168.0.219:5000/ubuntu:12.04$docker push 192.168.0.219:5000/ubuntu

$sudo docker run --name data -v /data -t -i centos:6.4 /bin/bash# 创建数据卷绑定到到新建容器，新建容器中会创建/data数据卷bash-4.1# ls -ld /data/drwxr-xr-x 2 root root 4096 Jul 23 06:59 /data/bash-4.1# df -ThFilesystem    Type    Size  Used Avail Use% Mounted on... ...              ext4     91G  4.6G   82G   6% /data

$sudo docker inspect data... ..."Volumes":{"/data":"/var/lib/docker/vfs/dir/151de401d268226f96d824fdf444e77a4500aed74c495de5980c807a2ffb7ea9"},# 可以看到创建的数据卷宿主机路径"VolumesRW":{"/data1":true}... ...

$sudo docker run --name web -v /source/:/web -t -i centos:6.4 /bin/bashbash-4.1# ls -ld /web/drwxr-xr-x 2 root root 4096 Jul 23 06:59 /web/bash-4.1# df -Th... ...              ext4     91G  4.6G   82G   6% /webbash-4.1#exit

$sudo docker run --rm --nametest -v /source/:/test:ro -t -i centos:6.4 /bin/bash

$sudo docker run -t -i -d -v /test --nametestcentos:6.4 /bin/bash

$sudo docker run -t -i -d --volumes-fromtest --name test1 centos:6.4 /bin/bash

$sudo docker run -t -i -d --volumes-fromtest --name test2 centos:6.4 /bin/bash

$sudo docker run -t -i -d --volumes-from test1 --name test3 centos:6.4 /bin/bash

$sudo docker run --volumes-fromtest -v$(pwd):/backup centos:6.4 tar cvf /backup/test.tar /testtar: Removing leading`/' from member namestar: /test/test.tar: file is the archive; not dumped/test//test/b/test/d/test/c/test/a

$ls# 当前目录下产生了test卷的备份文件test.tartest.tar

$sudo docker run -t -i -d -v /test --name test2 centos:6.4  /bin/bash$sudo docker run --volumes-from test2 -v$(pwd):/backup centos:6.4 tar xvf /backup/test.tar# 恢复之前的文件到新建卷中test/test/btest/dtest/ctest/a

$sudo docker run -d -t -i --name bash centos:6.4 bash$sudo docker ps -lCONTAINER ID    IMAGE           COMMAND     CREATED              STATUS             PORTS   NAMES70be821b7804    centos:6.4      bash        About a minute ago   Up About a minute          bash

$sudo docker inspect -f"{{ .Name }}" 70be821b7804/bash

注：容器名称必须是唯一，意思是你只能命名一个叫`web`的容器。如果你想复用容器名，则必须在创建新的容器前通过`dockerrm`删除旧的容器。

$sudo docker run -d -t -i --name test1 centos:6.4 bash

$sudo docker run -d -t -i --name test2 --link test1:test1 centos:6.4 bash

$sudo docker psCONTAINER ID    IMAGE       COMMAND CREATED         STATUS      PORTS   NAMES1966fe2a909c    centos:6.4  bash    2 minutes ago   Up 2 minutes        test220f7f53b61df    centos:6.4  bash    4 minutes ago   Up 4 minutes        test1,test2/test1