离线安装Docker镜像

思路：

利用Docker可以将服务打包成tar文件的能力，可以在一台可以联网的节点上拉取docker镜像(当然如果可以自己打包镜像的话也行)，
有了镜像文件后，将镜像文件同步到对应的内网机器上，然后load镜像文件，就可以使用了。

这里使用elastalert2来验证和记录全过程。

1.在可以联网的节点上拉取 elastalert2 镜像文件

如果没有配置国内docker镜像加速源的话，建议参考这个笔记

在仓库中选择版本进行拉取，这里选择的是 2.8.0 版本：
[root@node108 ~]# docker pull jertel/elastalert2:latest latest: Pulling from jertel/elastalert2 f6e04ba65310: Pull complete b87859229fd4: Pull complete de47f81eafde: Pull complete efaf2ea83b66: Pull complete dc50668abde8: Pull complete 6fb1fe2327ba: Pull complete 5ed918d41e4f: Pull complete 4f4fb700ef54: Pull complete Digest: sha256:219b0d14d6f14f7cf73bb2a94f244b202d6f119a294cc3cd042cce741bb40268 Status: Downloaded newer image for jertel/elastalert2:latest docker.io/jertel/elastalert2:latest [root@node108 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE jertel/elastalert2 latest 373715f93363 45 hours ago 354MB

2.对拉下来的docker镜像归档，并输出到文件

```
[root@node108 ~]# docker save -o elastalert2-latest.tar jertel/elastalert2
[root@node108 ~]# ll
total 871304
-rw-------. 1 root root 367958528 Oct 23 08:58 elastalert2-latest.tar

```

3.将归档的tar 文件放到内网(不可以上外网)的机器上

```
[root@node108 ~]# scp elastalert2-latest.tar node110:/opt/
elastalert2-latest.tar 100% 351MB 33.4MB/s 00:10

```

4.在断网的机器上加载刚收到的镜像文件

```
[root@node110 opt]# docker load -i elastalert2-latest.tar
f362f5e58c99: Loading layer [>] 72.54MB/72.54MB
da1083ea5389: Loading layer [>] 7.394MB/7.394MB
c62653db3cc7: Loading layer [>] 31.21MB/31.21MB
57ca33789ef7: Loading layer [>] 4.608kB/4.608kB
434e8dac79e1: Loading layer [>] 12.7MB/12.7MB
e29fc50b6aa9: Loading layer [>] 140.8kB/140.8kB
95432c424a86: Loading layer [>] 243.9MB/243.9MB
5f70bf18a086: Loading layer [>] 1.024kB/1.024kB
Loaded image: jertel/elastalert2:latest

[root@node110 rules]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
jertel/elastalert2 latest 373715f93363 46 hours ago 354MB
```

5.参考这个地址启动刚才加载的镜像文件

```
创建docker bridge
[root@node110 rules]# docker network create -d bridge bridge_net
840fd02a2fa00b5a0bf6ea3169a6c761b3f7a8eba375e7a1364646564d8dfec8
[root@node110 rules]# docker network ls
NETWORK ID NAME DRIVER SCOPE
ff2b37ea013d bridge bridge local
840fd02a2fa0 bridge_net bridge local
60cdcc774b6a host host local
8949b4ab6f1a none null local

[root@node110 opt]# mkdir -p /opt/elastalert/rules
[root@node110 opt]# cd elastalert
[root@node110 elastalert]# ll
total 0
drwxr-xr-x. 2 root root 6 Oct 23 09:30 rules
[root@node110 elastalert]# vim elastalert.yaml
[root@node110 elastalert]# more elastalert.yaml
rules_folder: /opt/elastalert/rules

run_every:
seconds: 10

buffer_time:
minutes: 15

es_host: elasticsearch
es_port: 9200

writeback_index: elastalert_status

alert_time_limit:
days: 2

[root@node110 elastalert]# cd rules/
[root@node110 rules]# ll
total 0
[root@node110 rules]# vim a.yaml
name: "a"
type: "frequency"
index: "mariadblog-"
is_enabled: true
num_events: 2
realert:
minutes: 5
terms_size: 50
timeframe:
minutes: 5
timestamp_field: "@timestamp"
timestamp_type: "iso"
use_strftime_index: false
alert_subject: "Test {} 123 aa☃"
alert_subject_args:
- "message"
- "@log_name"
alert_text: "Test {} 123 bb☃"
alert_text_args:
- "message"
filter:
- query:
query_string:
query: "@timestamp:"
alert:
- "slack"
slack_webhook_url: 'https://hooks.slack.com/services/xxxxxxxxx'
slack_channel_override: "#abc"
slack_emoji_override: "😽"
slack_msg_color: "warning"
slack_parse_override: "none"
slack_username_override: "elastalert"

[root@node110 elastalert]# cd ..
[root@node110 elastalert]# ll
total 4
-rw-r--r--. 1 root root 193 Oct 23 09:33 elastalert.yaml
drwxr-xr-x. 4 root root 56 Oct 23 10:08 rules

[root@node110 elastalert]# docker run --net=bridge_net -d --name elastalert --restart=always -v $(pwd)/elastalert.yaml:/opt/elastalert/config.yaml -v $(pwd)/rules:/opt/elastalert/rules jertel/elastalert2 --verbose
[root@node110 elastalert]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c8b48d1f4a8d jertel/elastalert2 "/opt/elastalert/run…" 2 minutes ago Up 10 seconds elastalert
```