Linux 容器技术 - Docker、Kubernetes 与容器生态系统详解

# 更新apt包索引
sudo apt-get update

# 安装必要的依赖包
sudo apt-get install apt-transport-https ca-certificates curl gnupg-agent software-properties-common

# 添加Docker官方GPG密钥
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

# 添加Docker稳定版仓库
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

# 再次更新apt包索引
sudo apt-get update

# 安装最新版Docker Engine和容器运行时
sudo apt-get install docker-ce docker-ce-cli containerd.io

# 验证Docker是否成功安装
sudo docker run hello-world

# 安装必要的依赖包
sudo yum install -y yum-utils device-mapper-persistent-data lvm2

# 设置Docker仓库
sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

# 安装Docker Engine和容器运行时
sudo yum install docker-ce docker-ce-cli containerd.io

# 启动Docker服务
sudo systemctl start docker

# 设置Docker开机自启
sudo systemctl enable docker

# 验证Docker是否成功安装
sudo docker run hello-world

# 拉取镜像
docker pull ubuntu:20.04

# 列出本地镜像
docker images

# 构建镜像
docker build -t myapp:latest .

# 标记镜像
docker tag myapp:latest username/myapp:latest

# 推送镜像到仓库
docker push username/myapp:latest

# 删除镜像
docker rmi myapp:latest

# 导出镜像为tar文件
docker save -o myapp.tar myapp:latest

# 从tar文件导入镜像
docker load -i myapp.tar

# 运行容器
docker run -d --name mycontainer -p 80:80 nginx

# 列出运行中的容器
docker ps

# 列出所有容器（包括已停止的）
docker ps -a

# 启动容器
docker start mycontainer

# 停止容器
docker stop mycontainer

# 重启容器
docker restart mycontainer

# 查看容器日志
docker logs mycontainer

# 进入容器内部
docker exec -it mycontainer bash

# 复制文件到容器
docker cp file.txt mycontainer:/path/to/destination

# 从容器复制文件
docker cp mycontainer:/path/to/file.txt .

# 删除容器
docker rm mycontainer

# 删除所有已停止的容器
docker container prune

# 列出网络
docker network ls

# 创建网络
docker network create mynetwork

# 连接容器到网络
docker network connect mynetwork mycontainer

# 断开容器与网络的连接
docker network disconnect mynetwork mycontainer

# 删除网络
docker network rm mynetwork

# 创建数据卷
docker volume create myvolume

# 列出数据卷
docker volume ls

# 查看数据卷详情
docker volume inspect myvolume

# 删除数据卷
docker volume rm myvolume

# 删除未使用的数据卷
docker volume prune

# 指定基础镜像
FROM node:14-alpine

# 设置工作目录
WORKDIR /app

# 复制package.json和package-lock.json文件
COPY package*.json ./

# 安装依赖
RUN npm install

# 复制应用代码
COPY . .

# 暴露应用端口
EXPOSE 3000

# 设置环境变量
ENV NODE_ENV=production

# 定义启动命令
CMD ["node", "server.js"]

docker build -t mynodeapp:latest .

# 运行容器使用bridge网络
docker run --network bridge nginx

# 运行容器使用host网络
docker run --network host nginx

# 运行容器使用none网络
docker run --network none nginx

# 先运行一个容器
container_id=$(docker run -d nginx)

# 运行第二个容器，共享第一个容器的网络
docker run --network container:$container_id busybox ping localhost

# 创建自定义bridge网络
docker network create mynetwork

# 运行容器使用自定义网络
docker run --network mynetwork nginx

# 创建数据卷
docker volume create myvolume

# 挂载数据卷到容器
docker run -d -v myvolume:/data nginx

# 挂载宿主机目录到容器
docker run -d -v /host/path:/container/path nginx

# 使用tmpfs挂载
docker run -d --tmpfs /data nginx

version: '3'
services:
  web:
    image: nginx
    ports:
      - "80:80"
    networks:
      - frontend
      - backend
  db:
    image: postgres
    environment:
      - POSTGRES_PASSWORD=password
    volumes:
      - db_data:/var/lib/postgresql/data
    networks:
      - backend
networks:
  frontend:
  backend:
volumes:
  db_data:

docker-compose up -d

# 在管理节点上初始化Swarm
docker swarm init --advertise-addr <MANAGER-IP>

# 在工作节点上运行（命令从管理节点获取）
docker swarm join --token <TOKEN> <MANAGER-IP>:2377

# 在管理节点上查看所有节点
docker node ls

# 创建服务并设置副本数为3
docker service create --name web --replicas 3 -p 80:80 nginx

# 查看服务状态
docker service ls
docker service ps web

# 扩展服务
docker service scale web=5

# 更新服务
docker service update --image nginx:latest web

# 删除服务
docker service rm web

version: '3'
services:
  web:
    image: nginx:latest
    deploy:
      replicas: 3
      restart_policy:
        condition: on-failure
    ports:
      - "80:80"
    networks:
      - webnet
  visualizer:
    image: dockersamples/visualizer:stable
    ports:
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    deploy:
      placement:
        constraints: [node.role == manager]
    networks:
      - webnet
networks:
  webnet:

# 部署Stack
docker stack deploy -c docker-compose.yml myapp

# 查看Stack中的服务
docker stack services myapp

# 查看Stack中运行的任务
docker stack ps myapp

# 删除Stack
docker stack rm myapp

# 安装Minikube（单节点Kubernetes集群，用于开发测试）
# 参考官方文档：https://minikube.sigs.k8s.io/docs/start/

# 启动Minikube集群
minikube start

# 检查集群状态
minikube status

# 查看集群信息
kubectl cluster-info

# 查看节点
kubectl get nodes

# 部署应用
kubectl apply -f deployment.yaml

# 查看部署
kubectl get deployments

# 查看Pod
kubectl get pods

# 查看服务
kubectl get services

# 查看日志
kubectl logs <pod-name>

# 进入Pod
kubectl exec -it <pod-name> -- bash

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
        resources:
          limits:
            cpu: "1"
            memory: "1Gi"
          requests:
            cpu: "500m"
            memory: "512Mi"

apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 80
  type: LoadBalancer

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  config.json: |
    {
      "api_url": "https://api.example.com",
      "debug": "false",
      "timeout": "30s"
    }
  loglevel: "info"

apiVersion: v1
kind: Secret
metadata:
  name: app-secret
type: Opaque
data:
  username: dXNlcm5hbWU=
  password: cGFzc3dvcmQ=

# 例如，使用kubectl安装Calico
kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

apiVersion: v1
kind: PersistentVolume
metadata:
  name: my-pv
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  hostPath:
    path: "/mnt/data"

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - mountPath: "/data"
      name: my-storage
  volumes:
  - name: my-storage
    persistentVolumeClaim:
      claimName: my-pvc

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nginx-policy
spec:
  podSelector:
    matchLabels:
      app: nginx
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 80
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: nginx-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: nginx-deployment
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  # ...其余配置

# 安装Trivy
sudo apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy

# 扫描镜像
trivy image nginx:latest

# 生成HTML报告
trivy image --format html --output report.html nginx:latest

# 使用Docker Compose启动Clair
wget https://raw.githubusercontent.com/quay/clair/master/docker-compose.yaml
docker-compose up -d

# 使用clairctl客户端扫描镜像
clairctl report nginx:latest

# 使用特定版本标签而非latest
FROM node:14.17.3-alpine

# 创建非root用户
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

# 设置工作目录
WORKDIR /app

# 复制必要文件并安装依赖
COPY package*.json ./
RUN npm ci --only=production

# 复制应用代码
COPY --chown=appuser:appgroup . .

# 以非root用户运行
USER appuser

# 限制容器能力
CAP_DROP: ["ALL"]

# 设置只读文件系统
VOLUME ["/app/data"]

# 暴露应用端口
EXPOSE 3000

# 设置启动命令
CMD ["node", "server.js"]

# 以非特权模式运行
docker run --user 1000:1000 nginx

# 限制容器能力
docker run --cap-drop ALL --cap-add NET_BIND_SERVICE nginx

# 使用只读文件系统
docker run --read-only -v /tmp nginx

# 限制资源使用
docker run --memory="512m" --cpus="0.5" nginx

# 启用内容信任
export DOCKER_CONTENT_TRUST=1

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  containers:
  - name: nginx
    image: nginx:1.19.10
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
        add: ["NET_BIND_SERVICE"]
    resources:
      limits:
        cpu: "500m"
        memory: "512Mi"
      requests:
        cpu: "200m"
        memory: "256Mi"
  securityContext:
    fsGroup: 1000
    supplementalGroups: [1001]

# 使用Helm安装Prometheus和Grafana（在Kubernetes中）
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update
helm install prometheus prometheus-community/kube-prometheus-stack

# 在Docker中，cAdvisor已集成到Docker Engine中
# 访问 http://localhost:8080/metrics 获取监控指标

# 在独立模式下运行cAdvisor
docker run --volume=/:/rootfs:ro \
  --volume=/var/run:/var/run:ro \
  --volume=/sys:/sys:ro \
  --volume=/var/lib/docker/:/var/lib/docker:ro \
  --publish=8080:8080 \
  --detach=true \
  --name=cadvisor \
  gcr.io/cadvisor/cadvisor:latest

# 安装Metrics Server
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

# 查看节点和Pod的资源使用情况
kubectl top nodes
kubectl top pods

# 查看容器日志
docker logs mycontainer

# 跟踪日志输出
docker logs -f mycontainer

# 限制日志大小和文件数量（编辑docker daemon.json）
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

# 查看Pod日志
kubectl logs mypod

# 查看Pod中特定容器的日志
kubectl logs mypod -c mycontainer

# 跟踪日志输出
kubectl logs -f mypod

# 使用Helm安装ELK Stack（在Kubernetes中）
helm repo add elastic https://helm.elastic.co
helm repo update
helm install elasticsearch elastic/elasticsearch --set replicas=1
helm install kibana elastic/kibana --set elasticsearchHosts=http://elasticsearch-master:9200
helm install filebeat elastic/filebeat --set kubernetes.enabled=true

groups:
- name: container_alerts
  rules:
  - alert: ContainerHighCpuUsage
    expr: sum(rate(container_cpu_usage_seconds_total{container!=""}[5m])) by (pod, container) > 0.8
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "High CPU usage ({{ $labels.pod }}/{{ $labels.container }})"
      description: "Container CPU usage is above 80% for 5 minutes.\n  VALUE = {{ $value }}\n  LABELS: {{ $labels }}"
  
  - alert: ContainerHighMemoryUsage
    expr: container_memory_usage_bytes{container!=""} / container_spec_memory_limit_bytes{container!=""} > 0.9
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "High memory usage ({{ $labels.pod }}/{{ $labels.container }})"
      description: "Container memory usage is above 90% of limit for 5 minutes.\n  VALUE = {{ $value | humanizePercentage }}\n  LABELS: {{ $labels }}"

# 构建阶段
FROM node:14-alpine as builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# 运行阶段
FROM nginx:alpine
COPY --from=builder /app/build /usr/share/nginx/html
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

FROM node:14-alpine
WORKDIR /app

# 先复制依赖文件并安装，利用缓存
COPY package*.json ./
RUN npm ci

# 再复制代码，这样修改代码不会导致依赖重新安装
COPY . .

# 构建应用
RUN npm run build

EXPOSE 3000
CMD ["npm", "start"]

FROM alpine:3.14

# 合并多个RUN命令减少层数
RUN apk --no-cache add nginx php php-fpm && \
    mkdir -p /run/nginx && \
    rm -f /etc/nginx/conf.d/default.conf

COPY nginx.conf /etc/nginx/conf.d/
COPY index.php /var/www/html/

EXPOSE 80
CMD ["sh", "-c", "php-fpm & nginx -g 'daemon off;'\