Docker images

About Docker Images

Docker镜像含有启动容器所需要的文件系统及其内容,因此,其用于创建并启动docker容器

  采用分层构建机制,最底层bootfs,其之为rootfs

    bootfs:用于系统引导文件系统,包括bootloader和kernel,容器启动完成后会被卸载以节约内存资源;

    rootfs:位于bootfs之上,表现为docker容器的根文件系统;

      传统模式中,系统启动之时,内核挂载rootfs时会首先将其挂载为"只读"模式,完整性自检完成后将其重新挂载为读写模式;

      docker中,rootfs由内核挂载为"只读"模式,而后通过"联合挂载"技术额外挂载一个"可写"层;

Docker Image Layer

位于下层的镜像称为父镜像(parent image),最底层的称为基础镜像(base image)

最上层为"可读写"层,其下的均为"只读"层

Aufs

advanced multi-layered unification filesystem:高级多层统一文件系统

用于为Linux文件系统实现"联合挂载"

aufs是之前的UnionFS的重新实现,2006年由Junjiro Okajima开发;

Docker最初使用aufs作为容器文件系统层,它目前仍作为存储后端之一来支持;

aufs的竞争产品是overlayfs,后者自从3.18版本开始被合并到Linux内核;

docker的分层镜像,除了aufs,docker还支持btrfs,devicemapper和vfs等

  在Ubuntu系统下,docker默认Ubuntu的aufs;而在CentOS7上,用的是devicemapper;

Devicemapper

Device Mapper是Linux2.6内核中支持逻辑卷管理的通用设备映射机制,它为实现用于存储资源管理的块设备驱动提供了一个高度模块化的内核架构

Devicemapper

在内核中它通过一个一个模块化的targe driver插件实现对IO请求的过滤或者重新定向工作,当前已经实现的target driver插件包括软raid、软加密、逻辑卷条带、多路径、镜像、快照等

  前一页图中linear、mirror、snapshot、multipath表示的就是这些target driver

  在这诸多"插件"中,有一种叫Thine Provisioning Snapshot,Docker正是使用了Thin Provisioning的Snapshot的技术实现了类似auFS的分层镜像

Docker Registry

启动容器时,docker daemon会试图从古本地获取相关的镜像;本地镜像不存在时,其将从Registry中下载该镜像并保存到本地;

  The Registry is a stateless,highly scalable server side application that stores and lets-you distribute Docker images.

Docker Registry分类

Registry用于保存docker镜像,包括镜像的层次结构和元数据

用户可自建Registry,也可使用官方的Docker Hub

分类

  Sponsor Registry:第三方的registry,供客户和Docker社区使用

  Mirror Registry:第三方的registry,只让客户使用

  Vendor Registry:由发布Docker镜像的供应商提供的registry

  Private Registry:通过没有防火墙和额外的安全层的私有实体提供的registry

Registry(repository and index)

Repository

  由某特定的docker镜像的所有迭代版本组成的镜像仓库

  一个Registry中可以存在多个Repository

    Repository可分为"顶层仓库"和"用户仓库"

    用户仓库名称格式为"用户名/仓库名"

  每个仓库可以包含多个Tag(标签),每个标签对应一个镜像

Index

  维护用户账号、镜像的校验以及公共命名空间的信息

  相当于为Registry提供了一个完成用户认证等功能的检索接口

Docker Registry

Docker Registry中的镜像通常由开发人员制作,而后推送至"公共"或"私有"Registry上保存,供他人员使用,例如"部署"到生产环境;

Docker Hub

Docker Hub is a cloud-based registry service which allows you to link to code repositories,build your images and test them,stores manually pushed images,and links to Docker Cloud so you can deploy images to your hosts.

It provides a centralized resource for container image discovery,distribution and change management,user and team collaboration,and workflows automation throughout the development pipeline.

Docker Hub

Docker Hub provides the following major features

  image Repositories

    Find and pull images from community and offcial libraries,and manage,push to,and pull from private image libraries to which you have access.

  Automated Builds

    Automatically create new images when you make changes to a source code repository

  Webhooks

    A feature of Automated Builds,Webhooks let you trigger actions after a successful push to a repository.

  Organizations

    Create work groups to manage access to image repositories

  GitHub and Bitbucket Integration

    Add the Hub and your Docker Images to your current workflows.

Getting images from remote Docker registries

To get Docker images from a remote registry(such as your own Docker registry)and add them to your local system,use the docker pull command:

#docker pull <registry>[:<port>]/[<namespace>/]<name>:<tag>

  The <registry> is a host that provides the docker-distribution service on TCP <port> (default:5000)

  Together, <namespace> and <name> identify a particular image controlled by <namespace> at that registry

    Some registries also support raw <name>; for those, <namespace> provides is useful to distinguish between images with the same <name>

 

镜像服务器:

https://quay.io/search?q=flannel

 

The additional level of hierarchy of <namespace>

镜像相关的操作

镜像的生成途径

  Dockerfile

  基于容器制作

  Docker Hub automated builds

 基于容器制作镜像

Create a new image from a container's changes

Usage

  docker commit [OPTIONS] CONTAINER [REPOSITORY [:TAG]]

基于容器制作镜像

使用示例

  启动容器,执行需要的修改操作

    ~]# docker run --rm -it --name bbox1 busybox

  查看修改

    ~]# docker logs bbox1

    

  提交镜像

    ~]# docker commit bbox1 smoke584520/busybox/httpd:latest

  提交镜像,修改默认运行命令

    ~]# docker commit --change='CMD ["httpd","-h /data/httpd/htdocs","-f"]' -c "EXPOST 80" bbox1 smoke584520/busybox/httpd:v0.1

为镜像设定标签

docker tag

  Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE

  Syntax

    docker tag SOURCE_IMAGE[:TAG] TARGET_IMAGE[:TAG]

  示例

    基于ID打标

      ~]# docker tag 9133dae37bd8 smoke584520/busybox/httpd:latest

    基于名称和标签打标

      ~]# docker tag smoke584520/busybox/httpd:v0.1 smoke584520/busybox/httpd:version0.1

    为私有Registry打标

      ~]# docker tag 9133dae37bd8 myregistry:5000/busybox/httpd:v0.1

将镜像push到Docker Hub

docker push

  Push images to Docker Cloud or private registry

  推送镜像到Docker Hub的前提是于Docker Hub有用账号,且镜像标签格式为"$DOCKER_USER_ID/IMAGE"

  使用docker login命令登录成功后,即可使用docker push命令进行推送

  示例

    ~]# docker push smoke584520/busybox/httpd:version0.1

镜像导入和导出

docker save

  Save on or more images to a tor archive (streamed to STDOUT by default)

  Usage: docker save [OPTIONS] IMAGE [IMAGE...]

    --output, -o: Write to a file, instead of STDOUT

docker load

  Load an image from a tar archive or STDIN

  Usage: docker load [OPTIONS]

    --input, -i: Read from tar archive file,instead of STDIN

    --quiet, -q: Suppress the load output

 

Docker Hub:

  docker login

  docker logout

  docker push

  docker pull

镜像制作:

  基于容器制作

    在容器中完成操作后制作;

  基于镜像制作

    编辑一个Dockerfile,而后根据此文件制作;

  基于容器制作:
    docker commit

      docker commit [OPTIONS] CONTAINER [REPOSITORY[:TAG]]

        --author, -a

        --pause, -p

        --message, -m

        --change, -c

  将镜像文件导出为tar文件:

    docker save

      Save one or more images to a tar archive (streamed to STDOUT by default)

      docker save [OPTIONS] IMAGE [IMAGE...]

  从tar文件导入镜像 :

    docker load

      Load an image from a tar archive or STDIN

      docker load [OPTIONS]

        --input, -i Read from tar archive file, instead of STDIN

        --quiet, -q false Suppress the load output

 

 node1:

[root@node1 ~]# docker image ls
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
redis               4-alpine            c59f425529b7        2 days ago          20.4MB
busybox             latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx               1.14-alpine         8a2fb25a19f5        11 months ago       16MB
[root@node1 ~]# docker container ls
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
e163c9c2aa7e        redis:4-alpine      "docker-entrypoint.s…"   42 minutes ago      Up 42 minutes       6379/tcp            kvstor1
728e6866b8bb        nginx:1.14-alpine   "nginx -g 'daemon of…"   About an hour ago   Up About an hour    80/tcp              web1
[root@node1 ~]# docker exec -it kvstor1 /bin/sh
/data # ls /
bin    data   dev    etc    home   lib    media  mnt    opt    proc   root   run    sbin   srv    sys    tmp    usr    var
/data # exit
[root@node1 ~]# docker image ls
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
redis               4-alpine            c59f425529b7        2 days ago          20.4MB
busybox             latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx               1.14-alpine         8a2fb25a19f5        11 months ago       16MB
[root@node1 ~]# docker exec -it web1 /bin/sh
/ # ls
bin    dev    etc    home   lib    media  mnt    opt    proc   root   run    sbin   srv    sys    tmp    usr    var
/ # exit
[root@node1 ~]# docker info
Storage Driver: overlay2

到https://quay.io/repository/coreos/flannel下载镜像

[root@node1 ~]# docker pull quay.io/coreos/flannel:v0.10.0-amd64    #quay.io站点、coreos、用户名、flannel镜像名、v0.10.0-amd64版本

基于容器制作镜像

[root@node1 ~]# docker run --name b1 -it busybox
/ # ls /
bin   dev   etc   home  proc  root  sys   tmp   usr   var
/ # mkdir -p /data/html
/ # vi /data/html/index.html
<h1>Busybox httpd server.</h1>
[root@node1 ~]# docker commit -p b1    #-p制作镜像过程暂停容器
[root@node1 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
<none>                   <none>              80bef960860d        23 seconds ago      1.22MB
redis                    4-alpine            c59f425529b7        3 days ago          20.4MB
busybox                  latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                    1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        2 years ago         44.6MB
[root@node1 ~]# docker tag 80bef960860d smoke584520/httpd:v0.1-1    #打标签
[root@node1 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd        v0.1-1              80bef960860d        7 minutes ago       1.22MB
redis                    4-alpine            c59f425529b7        3 days ago          20.4MB
busybox                  latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                    1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        2 years ago         44.6MB
[root@node1 ~]# docker tag smoke584520/httpd:v0.1-1 smoke584520/httpd:latest    #可以给一个镜像打多个标签
[root@node1 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd        latest              80bef960860d        9 minutes ago       1.22MB
smoke584520/httpd        v0.1-1              80bef960860d        9 minutes ago       1.22MB
redis                    4-alpine            c59f425529b7        3 days ago          20.4MB
busybox                  latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                    1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        2 years ago         44.6MB
[root@node1 ~]# docker image rm smoke584520/httpd:latest    #一个镜像存在多个标签,删除这个镜像只是删除标签
Untagged: smoke584520/httpd:latest
[root@node1 ~]# docker tag smoke584520/httpd:v0.1-1 smoke584520/httpd:latest
[root@node1 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd        latest              80bef960860d        15 minutes ago      1.22MB
smoke584520/httpd        v0.1-1              80bef960860d        15 minutes ago      1.22MB
redis                    4-alpine            c59f425529b7        3 days ago          20.4MB
busybox                  latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                    1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        2 years ago         44.6MB
[root@node1 ~]# docker inspect busybox
"Cmd": [
    "/bin/sh",
    "-c",
    "#(nop) ",
    "CMD [\"sh\"]"
[root@node1 ~]# docker inspect nginx:1.14-alpine
"Cmd": [
    "nginx",
    "-g",
    "daemon off;"
],
[root@node1 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd        latest              80bef960860d        31 minutes ago      1.22MB
smoke584520/httpd        v0.1-1              80bef960860d        31 minutes ago      1.22MB
redis                    4-alpine            c59f425529b7        3 days ago          20.4MB
busybox                  latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                    1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        2 years ago         44.6MB
[root@node1 ~]# docker inspect smoke584520/httpd:v0.1-1
"Cmd": [
    "sh"
],
[root@node1 ~]# docker run --name t1 -it smoke584520/httpd:v0.1-1
/ # ls /
bin   data  dev   etc   home  proc  root  sys   tmp   usr   var
/ # ls /data/html/
index.html
/ # cat /data/html/index.html
<h1>Busybox httpd server.</h1>
/ # exit
/ # which httpd
/bin/httpd
[root@node1 ~]# docker commit -a "Smoke <smoke@smoke.com>" -c 'CMD ["/bin/httpd","-f","-h","/data/html"]' -p b1 smoke584520/httpd:v0.2
    #-a指定作者,-c指定镜像启动的命令
[root@node1 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd        v0.2                8128e6c4341f        36 seconds ago      1.22MB
smoke584520/httpd        latest              80bef960860d        41 minutes ago      1.22MB
smoke584520/httpd        v0.1-1              80bef960860d        41 minutes ago      1.22MB
redis                    4-alpine            c59f425529b7        3 days ago          20.4MB
busybox                  latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                    1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        2 years ago         44.6MB
[root@node1 ~]# docker run --name t2 smoke584520/httpd:v0.2
[root@node1 ~]# docker container ls
CONTAINER ID        IMAGE                    COMMAND                  CREATED             STATUS              PORTS               NAMES
b7dd3077e6fd        smoke584520/httpd:v0.2   "/bin/httpd -f -h /d…"   57 seconds ago      Up 55 seconds                           t2
56fa207d1c0a        busybox                  "sh"                     About an hour ago   Up About an hour                        b1
e163c9c2aa7e        redis:4-alpine           "docker-entrypoint.s…"   26 hours ago        Up 26 hours         6379/tcp            kvstor1
728e6866b8bb        nginx:1.14-alpine        "nginx -g 'daemon of…"   26 hours ago        Up 26 hours         80/tcp              web1
[root@node1 ~]# docker inspect t2
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "5204d69975e4ae844e5e1e3c091fc1fb70165e265262d01e72c24455876cf85d",
                    "EndpointID": "44dbb5ad389c3eebdd42a212d3c939fa3ad86bef164148748ef68690acb76cc1",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.5",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:05",
                    "DriverOpts": null
                }
            }
[root@node1 ~]# curl 172.17.0.5
<h1>Busybox httpd server.</h1>

登录https://hub.docker.com/repositories,账号smoke584520,密码smoke@5201314,创建仓库,点击Create Repository,完成点击Create

向docker-hub上传镜像

[root@node1 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd        v0.2                8128e6c4341f        22 hours ago        1.22MB
smoke584520/httpd        latest              80bef960860d        22 hours ago        1.22MB
smoke584520/httpd        v0.1-1              80bef960860d        22 hours ago        1.22MB
redis                    4-alpine            c59f425529b7        4 days ago          20.4MB
busybox                  latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                    1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        2 years ago         44.6MB
[root@node1 ~]# docker login -u smoke584520    #docker-hub账号密码登录
Password:
[root@node1 ~]# docker push smoke584520/httpd

查看docker-hub上传的镜像

登录阿里云镜像仓库https://cr.console.aliyun.com/cn-hangzhou/instances/repositories,账号smoke17791325971,点击命名空间-创建命名空间,创建创建镜像仓库,填写完成选择本地仓库。

将创建的镜像上传到阿里云镜像仓库,需要设置登录登录密码,访问https://cr.console.aliyun.com/cn-hangzhou/instances/repositories,点击访问凭证-设置固定密码;

[root@node1 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd        v0.2                8128e6c4341f        22 hours ago        1.22MB
smoke584520/httpd        latest              80bef960860d        23 hours ago        1.22MB
smoke584520/httpd        v0.1-1              80bef960860d        23 hours ago        1.22MB
redis                    4-alpine            c59f425529b7        4 days ago          20.4MB
busybox                  latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                    1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        2 years ago         44.6MB
[root@node1 ~]# docker tag smoke584520/httpd:v0.2 registry.cn-hangzhou.aliyuncs.com/smoke584520/httpd:v0.2
[root@node1 ~]# docker image ls
REPOSITORY                                            TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd                                     v0.2                8128e6c4341f        22 hours ago        1.22MB
registry.cn-hangzhou.aliyuncs.com/smoke584520/httpd   v0.2                8128e6c4341f        22 hours ago        1.22MB
smoke584520/httpd                                     latest              80bef960860d        23 hours ago        1.22MB
smoke584520/httpd                                     v0.1-1              80bef960860d        23 hours ago        1.22MB
redis                                                 4-alpine            c59f425529b7        4 days ago          20.4MB
busybox                                               latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                                                 1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel                                v0.10.0-amd64       f0fad859c909        2 years ago    
[root@node1 ~]# docker logout
[root@node1 ~]# docker login --username=smoke17791325971 registry.cn-hangzhou.aliyuncs.com    #登录使用访问凭证设置的密码
[root@node1 ~]# docker push registry.cn-hangzhou.aliyuncs.com/smoke584520/httpd:v0.2

点击阿里云镜像服务--镜像仓库--管理--镜像版本,查看上传的镜像;

镜像导入和导出

[root@node1 ~]# docker images
REPOSITORY                                            TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd                                     v0.2                8128e6c4341f        23 hours ago        1.22MB
registry.cn-hangzhou.aliyuncs.com/smoke584520/httpd   v0.2                8128e6c4341f        23 hours ago        1.22MB
smoke584520/httpd                                     latest              80bef960860d        23 hours ago        1.22MB
smoke584520/httpd                                     v0.1-1              80bef960860d        23 hours ago        1.22MB
redis                                                 4-alpine            c59f425529b7        4 days ago          20.4MB
busybox                                               latest              83aa35aa1c79        2 weeks ago         1.22MB
nginx                                                 1.14-alpine         8a2fb25a19f5        11 months ago       16MB
quay.io/coreos/flannel                                v0.10.0-amd64       f0fad859c909        2 years ago 
[root@node1 ~]# docker save -o myimages.gz smoke584520/httpd:v0.1-1 smoke584520/httpd:v0.2    #打包镜像,-o指定保存地方
[root@node1 ~]# ls
anaconda-ks.cfg  myimages.gz
[root@node1 ~]# scp myimages.gz node2:/root/

node2:

[root@node2 ~]# cd /etc/yum.repos.d/
[root@node2 yum.repos.d]# mkdir OldMirrorFile
[root@node2 yum.repos.d]# mv CentOS-* OldMirrorFile/
[root@node2 yum.repos.d]# curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
[root@node2 yum.repos.d]# curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
[root@node2 yum.repos.d]# yum install -y yum-utils device-mapper-persistent-data lvm2

下载docker-ce的yum源报错如下:

[root@node2 yum.repos.d]# yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
Loaded plugins: fastestmirror
adding repo from: https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
grabbing file https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo to /etc/yum.repos.d/docker-ce.repo
Could not fetch/save url https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo to file /etc/yum.repos.d/docker-ce.repo: [Errno 14]
 curl#60 - "Peer's Certificate has expired."

由于系统时间问题导致:

[root@node2 yum.repos.d]# hwclock -s
[root@node2 yum.repos.d]# date
[root@node2 yum.repos.d]# yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
[root@node2 yum.repos.d]# yum repolist
[root@node2 yum.repos.d]# yum list docker-ce.x86_64 --showduplicates | sort -r
[root@node2 yum.repos.d]# yum -y install docker-ce-18.06.0.ce-3.el7

注册阿里云账号密码https://cr.console.aliyun.com,登录后点击镜像加速器,复制加速器地址(https://bhzjdbej.mirror.aliyuncs.com)

[root@node2 ~]# mkdir /etc/docker
[root@node2 ~]# vim /etc/docker/daemon.json
{
  "registry-mirrors": ["https://bhzjdbej.mirror.aliyuncs.com"]
}
[root@node2 ~]# systemctl start docker.service

导入镜像

[root@node2 ~]# ls
anaconda-ks.cfg  myimages.gz
[root@node2 ~]# docker load -i myimages.gz
[root@node2 ~]# docker image ls
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
smoke584520/httpd   v0.2                8128e6c4341f        35 hours ago        1.22MB
smoke584520/httpd   v0.1-1              80bef960860d        36 hours ago        1.22MB