服务器运维笔记：Docker 容器化部署与代理配置

┌──────────┐     REST API     ┌──────────────┐
│  docker  │ ──────────────── │   dockerd     │
│  (CLI)   │                  │  (Daemon)     │
└──────────┘                  └──────┬───────┘
                                     │ gRPC
                              ┌──────▼───────┐
                              │  containerd  │
                              └──────┬───────┘
                                     │
                              ┌──────▼───────┐
                              │    runc      │
                              └──────┬───────┘
                                     │
                              ┌──────▼───────┐
                              │ Linux Kernel │
                              │ namespace    │
                              │ cgroup       │
                              └──────────────┘

# 卸载旧版本
sudo apt remove docker docker-engine docker.io containerd runc

# 安装依赖
sudo apt update
sudo apt install -y ca-certificates curl gnupg lsb-release

# 添加 Docker 官方 GPG Key
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

# 添加仓库
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# 安装 Docker Engine
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# 验证安装
sudo docker run hello-world

# 卸载旧版本
sudo yum remove docker docker-client docker-client-latest docker-common \
  docker-latest docker-latest-logrotate docker-logrotate docker-engine

# 安装 yum-utils
sudo yum install -y yum-utils

# 添加仓库（国内建议用阿里云镜像）
sudo yum-config-manager --add-repo \
  https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

# 安装 Docker Engine
sudo yum install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# 启动并设置开机自启
sudo systemctl start docker
sudo systemctl enable docker

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": [
    "https://mirror.ccs.tencentyun.com",
    "https://hub-mirror.c.163.com",
    "https://mirror.aliyuncs.com"
  ]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

docker info | grep -A 5 "Registry Mirrors"

{
  "registry-mirrors": ["https://mirror.ccs.tencentyun.com"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  },
  "storage-driver": "overlay2",
  "default-address-pools": [
    {"base": "172.20.0.0/16", "size": 24}
  ],
  "live-restore": true,
  "max-concurrent-downloads": 10,
  "max-concurrent-uploads": 5,
  "default-ulimits": {
    "nofile": { "Name": "nofile", "Hard": 65535, "Soft": 65535 }
  }
}

# 基础镜像
FROM node:24-alpine

# 维护者信息
LABEL maintainer="ops@example.com"

# 设置工作目录
WORKDIR /app

# 复制依赖文件（利用层缓存）
COPY package.json package-lock.json ./

# 安装依赖
RUN npm ci --only=production

# 复制应用代码
COPY . .

# 暴露端口
EXPOSE 3000

# 设置环境变量
ENV NODE_ENV=production

# 启动命令
CMD ["node", "server.js"]

# ===== 第一阶段：构建 =====
FROM golang:1.21-alpine AS builder

WORKDIR /build
COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o app .

# ===== 第二阶段：运行 =====
FROM alpine:3.19

RUN apk --no-cache add ca-certificates tzdata
WORKDIR /app
COPY --from=builder /build/app .

EXPOSE 8080
CMD ["./app"]

#  正确做法：先复制依赖描述文件，再复制源码
COPY package.json package-lock.json ./
RUN npm ci
COPY . .

#  错误做法：每次代码改动都要重新安装依赖
COPY . .
RUN npm ci

# 使用 BuildKit 的缓存挂载，避免重复下载
RUN --mount=type=cache,target=/root/.npm npm ci --only=production

# 使用缓存挂载加速 apt
RUN --mount=type=cache,target=/var/cache/apt \
    --mount=type=cache,target=/var/lib/apt/lists \
    apt-get update && apt-get install -y curl

# 使用最小基础镜像
FROM alpine:3.19

# 不以 root 运行
RUN addgroup -g 1001 appgroup && \
    adduser -u 1001 -G appgroup -s /bin/sh -D appuser

# 安装依赖后清理缓存
RUN apk --no-cache add curl ca-certificates && \
    rm -rf /tmp/* /var/cache/apk/*

# 设置只读文件系统（配合 --read-only 运行）
WORKDIR /app
COPY --chown=appuser:appgroup . .

# 切换到非 root 用户
USER appuser

# 使用 exec 格式，信号正确传递
CMD ["./app"]

# .dockerignore
.git
.gitignore
node_modules
npm-debug.log
Dockerfile
docker-compose*.yml
.env
.env.*
*.md
.vscode
.idea
coverage
test
tests
__pycache__
*.pyc
.dockerignore

# docker-compose.yml

services:
  web:
    build:
      context: ./web
      dockerfile: Dockerfile
    ports:
      - "8080:80"
    environment:
      - NODE_ENV=production
    depends_on:
      api:
        condition: service_healthy
    networks:
      - frontend
    restart: unless-stopped

  api:
    image: myapp/api:latest
    ports:
      - "3000:3000"
    env_file:
      - .env
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - frontend
      - backend
    restart: unless-stopped

  db:
    image: mysql:8.0
    volumes:
      - mysql_data:/var/lib/mysql
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    environment:
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
      MYSQL_DATABASE: myapp
    secrets:
      - db_root_password
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    networks:
      - backend
    restart: unless-stopped

volumes:
  mysql_data:
    driver: local
  redis_data:
    driver: local

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge
    internal: true  # 不对外暴露

secrets:
  db_root_password:
    file: ./secrets/db_root_password.txt

services:
  api:
    # 方式1：直接定义（优先级最高）
    environment:
      NODE_ENV: production
      LOG_LEVEL: info

    # 方式2：从文件加载
    env_file:
      - .env
      - .env.production

    # 方式3：引用宿主机变量（在 .env 中定义 COMPOSE_PROJECT_NAME 等）

# .env
DB_HOST=db
DB_PORT=3306
DB_NAME=myapp
DB_USER=admin
DB_PASSWORD=secret123
REDIS_PASSWORD=redis_secret

services:
  api:
    depends_on:
      db:
        condition: service_healthy    # 等待健康检查通过
      redis:
        condition: service_started    # 等待容器启动
      migration:
        condition: service_completed_successfully  # 等待任务完成

  migration:
    image: myapp/migrate:latest
    command: ["./migrate", "up"]
    depends_on:
      db:
        condition: service_healthy

# 启动所有服务（后台）
docker compose up -d

# 查看服务状态
docker compose ps

# 查看日志
docker compose logs -f api
docker compose logs --tail=100

# 重新构建并启动
docker compose up -d --build

# 停止并移除容器、网络
docker compose down

# 停止并移除，同时删除数据卷
docker compose down -v

# 扩缩容
docker compose up -d --scale api=3

# 进入容器
docker compose exec api sh

# 只启动指定服务及其依赖
docker compose up -d api

# 基本构建
docker build -t myapp:1.0 .

# 指定 Dockerfile
docker build -f Dockerfile.prod -t myapp:1.0-prod .

# 构建时传入参数
docker build --build-arg VERSION=1.0 --build-arg ENV=prod -t myapp:1.0 .

# 使用 BuildKit（更快，功能更多）
DOCKER_BUILDKIT=1 docker build -t myapp:1.0 .

# 多平台构建
docker buildx build --platform linux/amd64,linux/arm64 -t myapp:1.0 .

# 语义化版本
docker tag myapp:latest harbor.example.com/prod/myapp:1.2.3
docker tag myapp:latest harbor.example.com/prod/myapp:1.2
docker tag myapp:latest harbor.example.com/prod/myapp:1

# Git commit hash（方便追溯）
docker tag myapp:latest harbor.example.com/prod/myapp:abc1234

# 环境标签
docker tag myapp:1.2.3 harbor.example.com/prod/myapp:stable
docker tag myapp:1.2.3-rc1 harbor.example.com/prod/myapp:canary

# 登录私有仓库
docker login harbor.example.com -u admin -p <password>

# 打标签并推送
docker tag nginx:1.25 harbor.example.com/prod/nginx:1.25
docker push harbor.example.com/prod/nginx:1.25

# 拉取镜像
docker pull harbor.example.com/prod/nginx:1.25

# 导出镜像为文件（离线传输）
docker save -o nginx-1.25.tar harbor.example.com/prod/nginx:1.25

# 从文件导入镜像
docker load -i nginx-1.25.tar

# 查看磁盘使用情况
docker system df

# 清理悬空镜像（dangling）
docker image prune

# 清理所有未使用的镜像
docker image prune -a

# 清理所有未使用的资源（容器、网络、镜像、构建缓存）
docker system prune -a --volumes

# 清理构建缓存
docker builder prune

# 删除指定镜像
docker rmi harbor.example.com/prod/nginx:1.25

# 下载 Harbor 离线安装包
wget https://github.com/goharbor/harbor/releases/download/v2.10.0/harbor-offline-installer-v2.10.0.tgz
tar xzf harbor-offline-installer-v2.10.0.tgz
cd harbor

# 复制并编辑配置文件
cp harbor.yml.tmpl harbor.yml

hostname: harbor.example.com
http:
  port: 80
https:
  port: 443
  certificate: /data/cert/server.crt
  private_key: /data/cert/server.key
harbor_admin_password: Harbor12345
database:
  password: root123
data_volume: /data/harbor

sudo ./install.sh --with-trivy  # 启用漏洞扫描
docker compose ps                # 验证所有组件运行正常

# 创建自定义 bridge 网络
docker network create --driver bridge \
  --subnet 172.20.0.0/16 \
  --gateway 172.20.0.1 \
  mynetwork

# 查看网络详情
docker network inspect mynetwork

# 将容器加入网络
docker run -d --name web --network mynetwork nginx

# 运行时连接到多个网络
docker network connect mynetwork existing_container
docker network connect another_network existing_container

# 断开网络
docker network disconnect mynetwork existing_container

# 清理未使用的网络
docker network prune

# docker-compose.yml
services:
  api:
    networks:
      - backend
  db:
    networks:
      - backend

networks:
  backend:

# 在 api 容器内
mysql -h db -u root -p  # "db" 自动解析为 db 容器的 IP

# 映射单个端口
docker run -d -p 8080:80 nginx

# 映射多个端口
docker run -d -p 8080:80 -p 8443:443 nginx

# 指定绑定地址（仅监听本机）
docker run -d -p 127.0.0.1:8080:80 nginx

# 随机端口映射
docker run -d -P nginx

# 查看端口映射
docker port <container_name>

sudo mkdir -p /etc/systemd/system/docker.service.d
sudo vim /etc/systemd/system/docker.service.d/proxy.conf

[Service]
Environment="HTTP_PROXY=http://127.0.0.1:7890"
Environment="HTTPS_PROXY=http://127.0.0.1:7890"
Environment="NO_PROXY=localhost,127.0.0.1,::1,*.aliyun.com,*.tencentyun.com"

sudo systemctl daemon-reload
sudo systemctl restart docker

# 验证代理变量已注入
sudo systemctl show docker | grep -i proxy

docker run -d \
  -e HTTP_PROXY=http://172.17.0.1:7890 \
  -e HTTPS_PROXY=http://172.17.0.1:7890 \
  -e NO_PROXY=localhost,127.0.0.1,::1 \
  myimage

services:
  myapp:
    image: myimage
    environment:
      HTTP_PROXY: http://172.17.0.1:7890
      HTTPS_PROXY: http://172.17.0.1:7890
      NO_PROXY: localhost,127.0.0.1,::1

{
  "proxies": {
    "default": {
      "httpProxy": "http://172.17.0.1:7890",
      "httpsProxy": "http://172.17.0.1:7890",
      "noProxy": "localhost,127.0.0.1,::1"
    }
  }
}

docker network inspect $(docker network ls -q) \
  --format '{{.Name}}: Subnet={{(index .IPAM.Config 0).Subnet}} Gateway={{(index .IPAM.Config 0).Gateway}}'

services:
  myapp:
    image: myimage
    extra_hosts:
      - "host.docker.internal:172.30.0.1"
    environment:
      HTTP_PROXY: http://host.docker.internal:7890
      HTTPS_PROXY: http://host.docker.internal:7890

networks:
  default:
    ipam:
      config:
        - subnet: 172.30.0.0/16
          gateway: 172.30.0.1

sudo ufw allow from 172.30.0.0/16
sudo ufw reload

docker exec -it myapp sh
getent ahosts host.docker.internal
# 应显示 172.30.0.1
nc -zv host.docker.internal 7890

docker run -d --network host myimage

services:
  myapp:
    image: myimage
    network_mode: host
    environment:
      HTTP_PROXY: http://127.0.0.1:7890
      HTTPS_PROXY: http://127.0.0.1:7890

# daemon 代理是否注入
sudo systemctl show docker | grep -i proxy

# 镜像能否通过代理拉取
docker pull hello-world

# 容器能否访问宿主机代理
docker run --rm -it alpine sh
apk add curl
curl -v http://172.17.0.1:7890

# 容器内程序是否读到代理变量
docker exec myapp env | grep -i proxy

# 程序请求是否真的走代理
docker exec myapp curl -v https://www.google.com
# 如果走代理，会看到 Proxy-Connection 之类的请求头

# 创建命名数据卷
docker volume create mysql_data

# 使用数据卷运行容器
docker run -d --name db \
  -v mysql_data:/var/lib/mysql \
  -e MYSQL_ROOT_PASSWORD=secret \
  mysql:8.0

# 使用 bind mount
docker run -d --name web \
  -v /opt/nginx/conf:/etc/nginx/conf.d:ro \
  -v /opt/nginx/html:/usr/share/nginx/html \
  nginx

# Docker Compose 中使用

services:
  db:
    volumes:
      - mysql_data:/var/lib/mysql           # 命名卷
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro  # 绑定挂载
      - /etc/localtime:/etc/localtime:ro    # 同步时区

volumes:
  mysql_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /data/mysql  # 指定宿主机存储路径

# 备份数据卷
docker run --rm \
  -v mysql_data:/source:ro \
  -v /opt/backup:/backup \
  alpine tar czf /backup/mysql_data_$(date +%Y%m%d).tar.gz -C /source .

# 恢复数据卷
docker run --rm \
  -v mysql_data:/target \
  -v /opt/backup:/backup:ro \
  alpine sh -c "tar xzf /backup/mysql_data_20240101.tar.gz -C /target"

# 直接备份 MySQL（推荐）
docker exec db mysqldump -u root -p --all-databases > /opt/backup/all_databases_$(date +%Y%m%d).sql

# 恢复 MySQL
docker exec -i db mysql -u root -p < /opt/backup/all_databases_20240101.sql

# 限制使用 1.5 个 CPU 核心
docker run -d --cpus="1.5" myapp

# 设置 CPU 份额（相对权重，默认 1024）
docker run -d --cpu-shares=512 myapp

# 绑定到特定 CPU 核心
docker run -d --cpuset-cpus="0,1" myapp

# Docker Compose 中配置

services:
  api:
    deploy:
      resources:
        limits:
          cpus: "1.5"
        reservations:
          cpus: "0.5"

# 限制内存 512MB，swap 最大 1GB
docker run -d --memory=512m --memory-swap=1g myapp

# 仅限制内存（不限 swap）
docker run -d --memory=512m myapp

# 内存软限制
docker run -d --memory=512m --memory-reservation=256m myapp

# Docker Compose 中配置

services:
  api:
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 256M

# 限制磁盘写入速度（10MB/s）
docker run -d --device-write-bps /dev/sda:10mb myapp

# 限制磁盘读取速度
docker run -d --device-read-bps /dev/sda:10mb myapp

# 限制 IOPS
docker run -d --device-write-iops /dev/sda:1000 myapp

# 禁止 OOM Killer 杀死该容器（慎用）
docker run -d --oom-kill-disable --memory=512m myapp

# 设置 OOM 优先级调整
docker run -d --oom-score-adj=-500 myapp

# 查看容器是否因 OOM 被杀死
docker inspect <container> --format='{{.State.OOMKilled}}'

# 查看 cgroup 版本
stat -fc %T /sys/fs/cgroup/
# 输出 "cgroup2fs" 表示 v2，"tmpfs" 表示 v1

# 查看容器的 cgroup 配置
docker inspect <container> --format='{{.HostConfig.CgroupParent}}'

# 查看容器日志
docker logs -f --tail=100 <container>

# 查看日志文件大小
docker inspect <container> --format='{{.LogPath}}'
ls -lh /var/lib/docker/containers/<id>/<id>-json.log

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3",
    "labels": "service,env",
    "tag": "{{.Name}}/{{.ID}}"
  }
}

# docker-compose.yml
services:
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.47.0
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    ports:
      - "8080:8080"
    restart: unless-stopped

  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"

  grafana:
    image: grafana/grafana:latest
    volumes:
      - grafana_data:/var/lib/grafana
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin123

# Dockerfile 中定义
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
  CMD curl -f http://localhost:8080/health || exit 1

services:
  api:
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3000/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  db:
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 10s
      timeout: 5s
      retries: 5

docker inspect --format='{{.State.Health.Status}}' <container>
# healthy / unhealthy / starting

# Dockerfile 中创建非 root 用户
RUN groupadd -r appuser && useradd -r -g appuser -d /app -s /sbin/nologin appuser
WORKDIR /app
COPY --chown=appuser:appuser . .
USER appuser

docker run --user 1001:1001 myapp

# 只读文件系统 + 临时可写目录
docker run --read-only --tmpfs /tmp:rw,noexec,nosuid myapp

# Docker Compose

services:
  api:
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid
      - /var/run:rw,noexec,nosuid

# 移除所有能力，只添加需要的
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE myapp

# 常见能力说明
# NET_BIND_SERVICE  — 绑定 1024 以下端口
# SYS_PTRACE       — 调试进程
# NET_ADMIN         — 网络管理（修改路由表等）
# NET_RAW           — 使用 raw socket（ping 等）

# 安装 Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# 扫描镜像漏洞
trivy image nginx:1.25

# 只显示高危和严重漏洞
trivy image --severity HIGH,CRITICAL nginx:1.25

# 扫描并输出 JSON 报告
trivy image --format json --output report.json nginx:1.25

# 扫描 Dockerfile（配置问题）
trivy config Dockerfile

# 扫描文件系统
trivy fs --security-checks vuln,config .

image_scan:
  stage: test
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

# 1. 不使用 --privileged（除非绝对必要）
# 2. 只读文件系统
docker run --read-only --tmpfs /tmp myapp

# 3. 限制能力
docker run --cap-drop=ALL myapp

# 4. 禁止提权
docker run --security-opt=no-new-privileges myapp

# 5. 使用 seccomp 配置文件
docker run --security-opt seccomp=custom-seccomp.json myapp

# 6. 限制 PID 数量
docker run --pids-limit=100 myapp

# 7. 设置资源限制
docker run --memory=512m --cpus="1.0" myapp

docker run -d --name myapp -p 8080:80 nginx    # 后台运行
docker start myapp                                # 启动
docker stop myapp                                 # 优雅停止（SIGTERM + SIGKILL）
docker restart myapp                              # 重启
docker rm myapp                                   # 删除容器
docker rm -f myapp                                # 强制删除
docker update --restart=always myapp              # 更新重启策略

docker ps                                        # 运行中容器
docker ps -a                                     # 所有容器
docker inspect myapp                             # 详细信息
docker stats                                     # 实时资源使用
docker top myapp                                 # 容器内进程
docker diff myapp                                # 文件系统变更
docker port myapp                                # 端口映射
docker logs -f --tail=100 myapp                  # 查看日志

docker exec -it myapp sh                         # 进入容器
docker exec -it myapp bash                       # 进入容器（bash）
docker cp myapp:/app/config.yaml ./config.yaml   # 从容器复制文件
docker cp ./file.txt myapp:/app/                 # 复制文件到容器
docker commit myapp myapp:snapshot                # 从容器创建镜像

docker images                                    # 列出镜像
docker pull nginx:1.25                           # 拉取镜像
docker push harbor.example.com/prod/nginx:1.25   # 推送镜像
docker build -t myapp:1.0 .                      # 构建镜像
docker tag myapp:1.0 myapp:latest                # 打标签
docker rmi myapp:1.0                             # 删除镜像
docker image prune -a                            # 清理未使用镜像
docker save -o myapp.tar myapp:1.0               # 导出镜像
docker load -i myapp.tar                         # 导入镜像

docker network ls                                # 列出网络
docker network create mynet                      # 创建网络
docker network inspect mynet                     # 网络详情
docker network connect mynet myapp               # 连接网络
docker network disconnect mynet myapp            # 断开网络
docker network prune                             # 清理未使用网络

docker volume ls                                 # 列出数据卷
docker volume create mydata                      # 创建数据卷
docker volume inspect mydata                     # 数据卷详情
docker volume rm mydata                          # 删除数据卷
docker volume prune                              # 清理未使用数据卷

docker info                                      # 系统信息
docker version                                   # 版本信息
docker system df                                 # 磁盘使用
docker system prune -a --volumes                 # 全面清理
docker system events                             # 实时事件