构建安全的restful服务docker

说明：本例子基于上一篇构建restful服务的文章：http://danlley.iteye.com/blog/2369553

 

话开两端，我们先说说如何构建基于springboot的普通基于http请求的rest服务，然后在分说如何将其改造为https的rest服务

 

一、构建基于springboot的普通基于http请求的rest服务

 

 

1、获取JDK镜像

root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# docker pull daocloud.io/ld00000/jdk-8:latest
latest: Pulling from ld00000/jdk-8
16da43b30d89: Pull complete
1840843dafed: Pull complete
91246eb75b7d: Pull complete
7faa681b41d7: Pull complete
97b84c64d426: Pull complete
6b1254b9c53d: Pull complete
1e8c843c6844: Pull complete
0ae07ce5d963: Pull complete
4b5ddb6dd051: Pull complete
53e7f455a630: Pull complete
ee6c0b346008: Pull complete
bd4fb9674907: Pull complete
86afde7cb9ea: Pull complete
Digest: sha256:393b7c84efc10a6891902f91ca0c39b9619b27903f3c35eedd00960516dfda44
Status: Downloaded newer image for daocloud.io/ld00000/jdk-8:latest

 

2、制作dockerfile

FROM daocloud.io/ld00000/jdk-8:latest

ADD rest-common-persist-1.0.0.jar app.jar
ENTRYPOINT ["java","-Djava.security.egd=file:/dev/./urandom","-jar","/app.jar"]

 

 

3、制作springboot镜像

root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# docker build .
Sending build context to Docker daemon  13.5 MB
Step 1 : FROM docker pull daocloud.io/ld00000/jdk-8:latest
Error parsing reference: "docker pull daocloud.io/ld00000/jdk-8:latest" is not a valid repository/tag
root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# vi Dockerfile
root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# vi Dockerfile
root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# vi Dockerfile
root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# docker build .
Sending build context to Docker daemon  13.5 MB
Step 1 : FROM daocloud.io/ld00000/jdk-8:latest
 ---> 6244248eff4b
Step 2 : ADD rest-common-persist-1.0.0.jar app.jar
 ---> b5f856f83f53
Removing intermediate container bc112d6003fa
Step 3 : ENTRYPOINT java -Djava.security.egd=file:/dev/./urandom -jar /app.jar
 ---> Running in 270f272cebe9
 ---> 0844d9dce81c
Removing intermediate container 270f272cebe9
Successfully built 0844d9dce81c

 

 

4、为新docker镜像重新命名：docker tag 0844d9dce81c springbootv1

 

 

5、运行springboot应用：  docker run -p 8080:8080 -t springbootv1 看到下面的结果，则说明启动成功

root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# docker run -p 8080:8080 -t springbootv1

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::        (v1.3.5.RELEASE)

………………………………………………

2017-04-18 15:56:32.541  INFO 1 --- [           main] s.b.c.e.t.TomcatEmbeddedServletContainer : Tomcat started on port(s): 8080 (http)
2017-04-18 15:56:32.551  INFO 1 --- [           main] c.m.restful.service.impl.Application     : Started Application in 7.379 seconds (JVM running for 8.294)

 

 

6、通过postman请求访问地址： http://192.168.56.102:8080/greet

推送数据：
{
	"keyModel": {
        "id": "test",
        "content": "danlley----"
    },
    "key":"my",
    "value":"alipay"
}

执行结果：
{
  "keyModel": {
    "id": "test",
    "content": "danlley----"
  },
  "key": "my",
  "value": "alipay"
}

服务端日志：
2017-04-18 15:57:50.947  WARN 1 --- [nio-8080-exec-1] c.m.r.service.impl.RestfulController     : -------------------->model=com.myteay.restful.service.impl.ApplicationModel@6f562f4
2017-04-18 15:58:06.054  WARN 1 --- [nio-8080-exec-2] c.m.r.service.impl.RestfulController     : -------------------->model=com.myteay.restful.service.impl.ApplicationModel@6490f020

 

至此，我们第一个话题完结。

 

 

二、将其改造为https的rest服务

 

1、停止当前docker

root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
2d6abf784855        springbootv1        "java -Djava.security"   5 minutes ago       Up 5 minutes        0.0.0.0:8080->8080/tcp   zen_pasteur
root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# docker stop 2d6abf784855

 

2、准备生产证书：keytool -genkey -alias tomcat  -storetype PKCS12 -keyalg RSA -keysize 2048  -keystore keystore.p12 -validity 3650

 

 

 

3、开始构建https的restful服务，增加配置文件：src/main/resources/application.properties 并重新编译打包

#server.port=8081
#server.session-timeout=1000000
#server.context-path=/index
#
#server.tomcat.uri-encoding=UTF-8
#server.tomcat.compression=on
#-storetype \u9009\u9879\u6307\u5B9A\u5BC6\u94A5\u4ED3\u5E93\u7C7B\u578B
#keytool -genkey -alias tomcat  -storetype PKCS12 -keyalg RSA -keysize 2048  -keystore keystore.p12 -validity 3650
server.ssl.key-store=keystore.p12
server.ssl.key-store-password=111111
server.ssl.keyStoreType=PKCS12
server.ssl.keyAlias:tomcat

 

 

 

4、将生成的证书放入打包的路径当前路径Dockerfile内容如下：

FROM daocloud.io/ld00000/jdk-8:latest
ADD keystore.p12 /keystore.p12
ADD rest-common-persist-1.0.0.jar app.jar
ENTRYPOINT ["java","-Djava.security.egd=file:/dev/./urandom","-jar","/app.jar"]

 

 

5、利用步骤二中的配置重新做镜像，并为镜像重命名

root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# docker build .
Sending build context to Docker daemon  13.5 MB
Step 1 : FROM daocloud.io/ld00000/jdk-8:latest
 ---> 6244248eff4b
Step 2 : ADD rest-common-persist-1.0.0.jar app.jar
 ---> 988090c11d43
Removing intermediate container 52b8d80471ee
Step 3 : ENTRYPOINT java -Djava.security.egd=file:/dev/./urandom -jar /app.jar
 ---> Running in 482560955d3b
 ---> ac71565ee29d
Removing intermediate container 482560955d3b
Successfully built ac71565ee29d
root@danlley-VirtualBox:/home/danlley/dockerfiles/springbootdocker# docker tag ac71565ee29d springbootv3

 

 

6、运行springboot应用：  docker run -p 8080:8080 -t springbootv3

 

 

7、通过postman请求访问地址： https://192.168.56.102:8080/greet

推送数据：
{
	"keyModel": {
        "id": "test",
        "content": "danlley----"
    },
    "key":"my",
    "value":"alipay"
}

执行结果：
{
  "keyModel": {
    "id": "test",
    "content": "danlley----"
  },
  "key": "my",
  "value": "alipay"
}

服务端日志：
2017-04-18 16:17:06.989  WARN 1 --- [nio-8080-exec-4] c.m.r.service.impl.RestfulController     : -------------------->model=com.myteay.restful.service.impl.ApplicationModel@a897c24

 

是不是很简单呢 O(∩_∩)O哈哈~