docker学习笔记之二：进阶实战--制作一个基础容器，基于commit和Dockerfile，支持sshd

以centos7镜像为例

制作一个基础容器，支持sshd，及常用的相关命令

 

一、使用commit命令创建镜像

1.启动一个容器

sudo docker run -it centos:latest /bin/bash

 

注：以下操作均为容器内

2.为了提高yum安装软件的效率，可以修改yum安装源为163的，参考：http://mirrors.163.com/.help/centos.html

 

3.安装常用命令

which：yum install -y which.x86_64 

netstat：yum install -y net-tools.x86_64

其它命令自行安装吧

 

4.安装sshd

 

yum install -y openssh-server.x86_64 
mkdir /var/run/sshd
ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N ""
ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ed25519_key -N ""
ssh-keygen -t rsa -b 2048 -f /etc/ssh/ssh_host_rsa_key

 

 

 

5.启动sshd

/usr/sbin/sshd -D &

 

[root@8490caf7ea23 sshd]# netstat -tunpl     
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      202/sshd            
tcp6       0      0 :::22                   :::*                    LISTEN      202/sshd       
 

 

6.配置sshd

#取消pam限制

sed  -ri 's/session    required     pam_loginuid.so/#session    required     pam_loginuid.so/g' /etc/pam.d/sshd

 

与主机免密登录，其实下面的步骤不设置也可以，只不过登录时需要密码

mkdir /root/.ssh

 

回到主机

ssh-keygen -b 1024 -t rsa
cat id_rsa.pub >> authorized_keys

 

 

复制id_rsa.pub中的内容，回到容器，将复制内容粘贴到如下文件中

vi /root/.ssh/authorized_keys
 
chmod 700 .ssh/
chmod 600 .ssh/authorized_keys

 

 

7.配置sshd启动脚本

vi /run.sh
#!/bin/bash
/usr/sbin/sshd -D
 
chmod +x run.sh

 

 

8.exit退出容器

 

 

9.保存容器镜像

[hanqunfeng@localhost ~]$ sudo docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                     PORTS               NAMES
8490caf7ea23        centos:latest       "/bin/bash"         2 hours ago         Exited (0) 2 minutes ago                       fervent_noether
 
[hanqunfeng@localhost ~]$ sudo docker commit 849 sshd:centos7
sha256:b2387fd4ee2027255cfa90dcae16519ab0ad29b1bacb3fa904494431a2e2bf76
 
[hanqunfeng@localhost ~]$ sudo docker images
REPOSITORY                 TAG                 IMAGE ID            CREATED             SIZE
sshd                           centos7                   b2387fd4ee20        43 seconds ago      1.022 GB
 

 

 

10.使用该镜像启动一个新的容器

sudo docker run -p 10022:22 -d sshd:centos7 /run.sh
 
[hanqunfeng@localhost ~]$ sudo docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                     PORTS                   NAMES
b4f785fb87d4        sshd:centos7        "/run.sh"           53 seconds ago      Up 52 seconds              0.0.0.0:10022->22/tcp   stupefied_wilson
 

 

11.ssh登录容器

[hanqunfeng@localhost ~]$ ssh root@192.168.65.158 -p 10022

[root@b4f785fb87d4 ~]# 

 

说明：主机上可以免密登录，其它机器上需要输入容器的root密码，同时需要开通主机的10022端口

 

容器中设置root密码：登录容器后passwd root

主机设置iptablse规则：

sudo iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 10022 -j ACCEPT

sudo service iptables save

 

二、使用Dockerfile创建镜像

1.基于刚刚创建好的sshd:centos7镜像，使用Dockerfile创建镜像，将run.sh内置为容器启动时执行的命令

 

[hanqunfeng@localhost ~]$ mkdir DockerFileDir
[hanqunfeng@localhost ~]$ cd DockerFileDir/
[hanqunfeng@localhost DockerFileDir]$ vi Dockerfile
 
FROM sshd:centos7
 
MAINTAINER from hanqunfeng [e-mail]
 
EXPOSE 22
 
CMD ["/run.sh"]
 
[hanqunfeng@localhost DockerFileDir]$ sudo docker build -t sshd_run:centos7 .     ：注意最后有一个点
[sudo] password for hanqunfeng: 
Sending build context to Docker daemon 2.048 kB
Step 1 : FROM sshd:centos7
 ---> 4f5d1b8378ce
Step 2 : MAINTAINER from hanqunfeng [e-mail]
 ---> Running in 0d942195d4fa
 ---> 5debebcb6742
Removing intermediate container 0d942195d4fa
Step 3 : EXPOSE 22
 ---> Running in 2493baf053fc
 ---> a4e2ff8dcdab
Removing intermediate container 2493baf053fc
Step 4 : CMD /run.sh
 ---> Running in 666bb0236615
 ---> 770fc142d3c9
Removing intermediate container 666bb0236615
Successfully built 770fc142d3c9
 
[hanqunfeng@localhost DockerFileDir]$ sudo docker images
REPOSITORY                 TAG                 IMAGE ID            CREATED             SIZE
sshd_run                   centos7             770fc142d3c9        2 minutes ago       1.022 GB
sshd                       centos7             4f5d1b8378ce        About an hour ago   1.022 GB
 
[hanqunfeng@localhost DockerFileDir]$ sudo docker run -p 10122:22 -d sshd_run:centos7    ：此时启动容器时不需要执行/run.sh命令
c9e1524ceb3baa6d7ea2735b45349916149ad4053cfb86398a44477cfbb6e021
[hanqunfeng@localhost DockerFileDir]$ sudo docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                         PORTS                   NAMES
c9e1524ceb3b        sshd_run:centos7    "/run.sh"           11 seconds ago      Up 9 seconds                   0.0.0.0:10122->22/tcp   ecstatic_heyrovsky
b4f785fb87d4        sshd:centos7        "/run.sh"           About an hour ago   Up About an hour               0.0.0.0:10022->22/tcp   stupefied_wilson
 
 
[hanqunfeng@localhost DockerFileDir]$ ssh root@192.168.65.158 -p 10122
The authenticity of host '[192.168.65.158]:10122 ([192.168.65.158]:10122)' can't be established.
ECDSA key fingerprint is 28:22:d1:17:d6:57:b8:e5:bf:9a:28:3a:c5:06:79:bd.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[192.168.65.158]:10122' (ECDSA) to the list of known hosts.
[root@c9e1524ceb3b ~]# 

 

 

2.Dockerfile说明

Dockerfile是docker构建镜像的基础，也是docker区别于其他容器的重要特征，正是有了Dockerfile，docker的自动化和可移植性才成为可能。

不论是开发还是运维，学会编写Dockerfile几乎是必备的，这有助于你理解整个容器的运行。

FROM <image name>, 从一个基础镜像构建新的镜像

FROM ubuntu 

MAINTAINER <author name>, 维护者信息

MAINTAINER William <[e-mail]>

ENV <key> <value>, 设置环境变量

ENV TEST 1

RUN <command>, 非交互式运行shell命令

RUN apt-get -y update 
RUN apt-get -y install nginx

ADD <src> <dst>, 将外部文件拷贝到镜像里,src可以为url

ADD http://nicescale.com/  /data/nicescale.tgz

WORKDIR /path/to/workdir, 设置工作目录

WORKDIR /var/www

USER <uid>, 设置用户ID

USER nginx

VULUME <#dir>, 设置volume

VOLUME [‘/data’]

EXPOSE <port>, 暴露哪些端口

EXPOSE 80 443 

ENTRYPOINT [‘executable’, ‘param1’,’param2’]执行命令

ENTRYPOINT ["/usr/sbin/nginx"]

CMD [“param1","param2"]

CMD ["start"]

docker创建、启动container时执行的命令，如果设置了ENTRYPOINT，则CMD将作为参数</usr/sbin/nginx start>

Dockerfile最佳实践

• 尽量将一些常用不变的指令放到前面
• CMD和ENTRYPOINT尽量使用json数组方式

通过Dockerfile构建image

docker build csphere/nginx:1.7 .