docker网络,数据挂载,动态资源配置,Dockerfile搭建lnmp网站

刺骨的言语ヽ痛彻心扉 2021-10-20 00:18 346阅读 0赞

# 1,网络 #

参考博客：[使用pipwork,设置容器使用：宿主机的网卡，和宿主机在同一网段][pipwork]

## a, 五种网络类型 ##

<table> 
 <thead> 
  <tr> 
   <th align="left">网络类型</th> 
   <th align="left">含义</th> 
   <th align="left">分配示例</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td align="left">bridge</td> 
   <td align="left">使用docker管理的网卡(docker network list)</td> 
   <td align="left">docker run -it --net=bridge busybox</td> 
  </tr> 
  <tr> 
   <td align="left">host</td> 
   <td align="left">copy宿主机的网络配置</td> 
   <td align="left">docker run -it --net=host busybox</td> 
  </tr> 
  <tr> 
   <td align="left">容器网络</td> 
   <td align="left">copy某个容器的网络配置</td> 
   <td align="left">docker run -itd --name b2 --net=container:容器id/名字 busybox</td> 
  </tr> 
  <tr> 
   <td align="left">none</td> 
   <td align="left">不分配网卡，只有lo</td> 
   <td align="left">docker run -it --net=none busybox</td> 
  </tr> 
  <tr> 
   <td align="left">自定义网络</td> 
   <td align="left">使用docker network create br(自定义的网卡名)</td> 
   <td align="left">docker run -it --net=br busybox</td> 
  </tr> 
 </tbody> 
</table>

注：以上几种类型，只有自定义网络，容器才支持dns(可以通过容器名互相通信)

[root@c7 volumes]# docker run -itd --name b1  --network=br busybox
    6bcea9a4d351a6b5aa74402a3ffa692bc83c6619bb614a80e169ef8ace63d2ec
    [root@c7 volumes]# docker run -itd --name b2  --net=br     busybox
    00565ded61ba42a8d69bcfd238195ebede49b3f031bd6cf264a182012444e123
    [root@c7 volumes]# docker exec -it b1 sh
    / # ping b2
    PING b2 (172.18.0.3): 56 data bytes
    64 bytes from 172.18.0.3: seq=0 ttl=64 time=0.132 ms
    64 bytes from 172.18.0.3: seq=1 ttl=64 time=0.128 ms

注：默认使用bridge网卡（即宿主机上的docker0网卡）， --net 等同于–network

## b, 查看容器端口映射原理 ##

#  1,创建一个容器：映射宿主机的端口
    [root@c7 volumes]# docker run -itd --name b5 -p 90:80  nginx
    25f11fcda6fc7f6e1081546d6edb934016244a4d6c8bddf909a8774c5ae13e29
    [root@c7 volumes]# docker ps
    CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS                NAMES
    25f11fcda6fc        nginx             "sh"                4 seconds ago        Up 3 seconds        0.0.0.0:90->80/tcp   b5
    
    # 2,查看iptables 路由表的变化： 添加了一条记录（ACCEPT tcp -- 0.0.0.0/0  172.17.0.3 tcp dpt:80）
    [root@c7 volumes]# iptables -L -n
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination         
    
    Chain FORWARD (policy DROP)
    target     prot opt source               destination         
    DOCKER-USER  all  --  0.0.0.0/0            0.0.0.0/0           
    DOCKER-ISOLATION-STAGE-1  all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    DOCKER     all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    DOCKER     all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination         
    
    Chain DOCKER (2 references)
    target     prot opt source               destination         
    ACCEPT     tcp  --  0.0.0.0/0            172.17.0.3           tcp dpt:80
    
    Chain DOCKER-ISOLATION-STAGE-1 (1 references)
    target     prot opt source               destination         
    DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0           
    DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0           
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain DOCKER-ISOLATION-STAGE-2 (2 references)
    target     prot opt source               destination         
    DROP       all  --  0.0.0.0/0            0.0.0.0/0           
    DROP       all  --  0.0.0.0/0            0.0.0.0/0           
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
    
    Chain DOCKER-USER (1 references)
    target     prot opt source               destination         
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0

# 2,数据挂载 #

<table> 
 <thead> 
  <tr> 
   <th align="left">挂载方式</th> 
   <th align="left">具体命令</th> 
   <th align="left"></th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td align="left">bind</td> 
   <td align="left">docker run -d --name n1 --mount type=bind,source=/root,target=/usr/share/nginx/html,readonly nginx ; (简写为: docker run -d --name n1 --mount type=bind,src=/root,dst=/usr/share/nginx/html,readonly nginx)</td> 
   <td align="left">docker run --rm -it -v /root/foo:/tmp --name=nginx1 nginx sh</td> 
  </tr> 
  <tr> 
   <td align="left">volume</td> 
   <td align="left">docker run -d --name n2 --mount type=volume,source=wwwroot2,target=/usr/share/nginx/html nginx</td> 
   <td align="left">docker run -d --name n3 -v wwwroot3:/usr/share/nginx/html nginx</td> 
  </tr> 
  <tr> 
   <td align="left">tmpfs</td> 
   <td align="left">docker run -d --name n4 --mount type=tmpfs,destination=/app nginx</td> 
   <td align="left"></td> 
  </tr> 
 </tbody> 
</table>

bind和volume的区别：

*  bind是使用宿主机现有的目录，不会自动创建，没有就会报错，容器本身的目录内容会全部的被宿主机覆盖
 *  volume使用docker管理的目录, 不存在就会自动创建好，容器本身的目录内容会被宿主机选择性覆盖（同名文件的内容，宿主机的数据会覆盖容器的内容）

# 3, 动态修改：容器资源限制 #

# 1, 调整内存大小
    docker update n2 --memory=1g --memory-swap=1.8g
    [root@c7 volumes]# docker stats n2
    CONTAINER ID        NAME                CPU %               MEM USAGE / LIMIT   MEM %               NET I/O             BLOCK I/O           PIDS
    cb9fa1f2f418        n2                  0.00%               1.387MiB / 1GiB     0.14%               656B / 0B           0B / 0B             2
    
    #2, 再次添加网卡： 容器多分配一个ip
    docker network connect br n1 && docker network connect br n1 
    #[root@c7 volumes]# docker inspect n1
    # "Gateway": "172.18.0.1",
    #                    "IPAddress": "172.18.0.2",
    #"Gateway": "172.17.0.1",
    #                    "IPAddress": "172.17.0.2",
    
    #3,修改cpu的分配数： 占宿主机的百分比
    docker update --cpus 0.5 n1
    
    # 4, 设置容器开机启动
    docker update --restart=always n1

# 4, Dockerfile搭建lnmp网站 #

## a, nginx镜像编译 ##

cat >nginx-dockerfile <<EOF
    	FROM centos:7
    	LABEL maintainer eyeofeagle
    	USER root
    
    	#1, 编译nginx
    	# COPY nginx-1.16.1.tar.gz /root
    	RUN yum -y install make  gcc-c++ zlib zlib-devel libtool  openssl openssl-devel pcre    \
    	    && cd /root \
    	    && wget http://nginx.org/download/nginx-1.16.1.tar.gz  \
    		&& tar -zxvf nginx-1.16.1.tar.gz \
    		&& cd nginx-1.16.1 \
    		&& ./configure \
    	    --sbin-path=/usr/local/nginx/nginx \
    	    --conf-path=/usr/local/nginx/nginx.conf \
    	    --pid-path=/usr/local/nginx/nginx.pid \
    	    --with-http_stub_status_module --with-http_ssl_module \
    		&& make -j 4 \
    		&& make install \
    		&& cd /root \
    		&& rm -rf nginx-1.16.1 \
    		&& yum clean all \
    		&& ln -sf /dev/stdout /usr/local/nginx/logs/access.log \
    	    && ln -sf /dev/stderr /usr/local/nginx/logs/error.log \
    		&& ln -sfT /usr/share/zoneinfo/Asia/Shanghai /etc/localtime  #修改时区
    	   
    	#2, 替换自定义配置文件
    	#COPY nginx.conf /usr/local/nginx
    	
    	#3, 启动nginx：前台运行(不能前台运行就用cat ,ping baidu.com 等）
    	WORKDIR /usr/local/nginx
    	ENV PATH=$PATH:/usr/local/nginx/
    	EXPOSE 80
    	CMD ["nginx","-g","daemon off;"]
    EOF

## b, php镜像编译 ##

cat > php-dockerfile <<EOF
    	FROM centos:7
    	MAINTAINER eyeofeagle
    	RUN yum install epel-release -y && \
    	    yum install -y gcc gcc-c++ make gd-devel libxml2-devel \
    	    libcurl-devel libjpeg-devel libpng-devel openssl-devel \
    	    libmcrypt-devel libxslt-devel libtidy-devel autoconf \
    	    iproute net-tools telnet wget curl && \
    	    yum clean all && \
    	    rm -rf /var/cache/yum/*
    	
    	#COPY php-5.6.36.tar.gz /
    	RUN cd / && wget http://cn.php.net/distributions/php-5.6.36.tar.gz && \
    	RUN tar zxf php-5.6.36.tar.gz && \
    	    cd php-5.6.36 && \
    	    ./configure --prefix=/usr/local/php \
    	    --with-config-file-path=/usr/local/php/etc \
    	    --enable-fpm --enable-opcache \
    	    --with-mysql --with-mysqli --with-pdo-mysql \
    	    --with-openssl --with-zlib --with-curl --with-gd \
    	    --with-jpeg-dir --with-png-dir --with-freetype-dir \
    	    --enable-mbstring --with-mcrypt --enable-hash && \
    	    make -j 4 && make install && \
    	    cp php.ini-production /usr/local/php/etc/php.ini && \
    	    cp sapi/fpm/php-fpm.conf /usr/local/php/etc/php-fpm.conf && \
    	    sed -i "90a \daemonize = no" /usr/local/php/etc/php-fpm.conf && \
    	    mkdir /usr/local/php/log && \
    	    cd / && rm -rf php* && \
    	    ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
    	
    	ENV PATH $PATH:/usr/local/php/sbin
    	COPY php.ini /usr/local/php/etc/
    	COPY php-fpm.conf /usr/local/php/etc/
    	WORKDIR /usr/local/php
    	EXPOSE 9000
    	CMD ["php-fpm"]
    EOF

## c, 下载wordpress, 启动各容器 ##

#准备镜像
    wget https://cn.wordpress.org/wordpress-4.9.4-zh_CN.tar.gz
    docker build . -f nginx-dockerfile  -t nginx:v1
    docker build . -f php-dockerfile    -t php:v1
    
    #1, 创建自定义的docker网络
    docker network create lnmp
    
    #2, 配置nginx.conf：
    #a, nginx和php共同使用一个数据卷(wwwroot -->/wwwroot)，实现数据共享
    #b, nginx 转发php页面请求
    cat  > nginx.conf <<EOF
    	user                 nobody;
    	worker_processes     4;
    	worker_rlimit_nofile 65535;
    	error_log  logs/error.log  notice;
    	pid        /var/run/nginx.pid;
    	events {
    	    use epoll;
    	    worker_connections  4096;
    	}
    	
    	http {
    	    include       mime.types;
    	    default_type  application/octet-stream;
    	
    	    server {
    	        listen 80;
    	        server_name localhost;
    	
    	        location / {
    	            root /wwwroot;
    	            index   index.php;
    	        }
    	 
    	        location = /favicon.ico {
    	     	   log_not_found off;
    	           access_log off;
    	        }
    	
    	        location ~* \.php$ {
    	            root /wwwroot;
    	            fastcgi_index  index.php;
    	            fastcgi_pass lnmp_php:9000;
    	            fastcgi_param SCRIPT_FILENAME  \$document_root\$fastcgi_script_name;
    	            include fastcgi_params;
    	        }
    	    }
    	}
    EOF
    
    #3, 定义容器启动参数:  mysql,php,nginx使用相同网络，实现dns互相通信
    cat > docker-start-lnmp.sh <<EOF
    	###### mysql数据库 ###### 
    	docker run -d \
    	  --name lnmp_mysql --net lnmp \
    	  --mount src=mysql-vol,dst=/var/lib/mysql \
    	  -e MYSQL_ROOT_PASSWORD=123456 \
    	  -e MYSQL_DATABASE=wordpress \
    	  mysql:5.7 --character-set-server=utf8
    	  
    	####### php ###### 
    	docker run -d --name lnmp_php  \
    	  --net lnmp --mount src=wwwroot,dst=/wwwroot  php:v1
    	  
    	####### nginx ###### 
    	docker run -d --name lnmp_nginx -p 81:80 \
    	  --net lnmp --mount src=wwwroot,dst=/wwwwroot  nginx:v1
    	  
    	###### 解压wordpress到数据目录(volume :wwwroot ),替换nginx配置文件nginx.conf #######
    	rm -rf /var/lib/docker/volumes/wwwroot/_data/*
    	tar -zxvf wordpress-4.9.4-zh_CN.tar.gz 
    	mv wordpress/* /var/lib/docker/volumes/wwwroot/_data/ 
    	rmdir wordpress
    	docker cp nginx.conf  lnmp_nginx:/usr/local/nginx/ 
    	
    	####### 重启nginx，访问 宿主机ip:81/index.php, 进入wordpress安装界面
    	docker restart lnmp_nginx
    EOF
    
    #4, 准备执行脚本
    chmod +x docker-start-lnmp.sh

[pipwork]: https://blog.51cto.com/13941177/2296529