`
hanqunfeng
  • 浏览: 1541835 次
  • 性别: Icon_minigender_1
  • 来自: 北京
社区版块
存档分类
最新评论

docker学习笔记之二:进阶实战--制作一个基础容器,基于commit和Dockerfile,支持sshd

阅读更多

以centos7镜像为例

制作一个基础容器,支持sshd,及常用的相关命令
 
一、使用commit命令创建镜像
1.启动一个容器
sudo docker run -it centos:latest /bin/bash
 
注:以下操作均为容器内
2.为了提高yum安装软件的效率,可以修改yum安装源为163的,参考:http://mirrors.163.com/.help/centos.html
 
3.安装常用命令
which:yum install -y which.x86_64 
netstat:yum install -y net-tools.x86_64
其它命令自行安装吧
 
4.安装sshd
 
yum install -y openssh-server.x86_64 
mkdir /var/run/sshd
ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N ""
ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ed25519_key -N ""
ssh-keygen -t rsa -b 2048 -f /etc/ssh/ssh_host_rsa_key
 
 
 
5.启动sshd
/usr/sbin/sshd -D &
 
[root@8490caf7ea23 sshd]# netstat -tunpl     
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      202/sshd            
tcp6       0      0 :::22                   :::*                    LISTEN      202/sshd       
 
 
6.配置sshd
#取消pam限制
sed  -ri 's/session    required     pam_loginuid.so/#session    required     pam_loginuid.so/g' /etc/pam.d/sshd
 
与主机免密登录,其实下面的步骤不设置也可以,只不过登录时需要密码
mkdir /root/.ssh
 
回到主机
ssh-keygen -b 1024 -t rsa
cat id_rsa.pub >> authorized_keys
 
 
复制id_rsa.pub中的内容,回到容器,将复制内容粘贴到如下文件中
vi /root/.ssh/authorized_keys
 
chmod 700 .ssh/
chmod 600 .ssh/authorized_keys
 
 
7.配置sshd启动脚本
vi /run.sh
#!/bin/bash
/usr/sbin/sshd -D
 
chmod +x run.sh
 
 
8.exit退出容器
 
 
9.保存容器镜像
[hanqunfeng@localhost ~]$ sudo docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                     PORTS               NAMES
8490caf7ea23        centos:latest       "/bin/bash"         2 hours ago         Exited (0) 2 minutes ago                       fervent_noether
 
[hanqunfeng@localhost ~]$ sudo docker commit 849 sshd:centos7
sha256:b2387fd4ee2027255cfa90dcae16519ab0ad29b1bacb3fa904494431a2e2bf76
 
[hanqunfeng@localhost ~]$ sudo docker images
REPOSITORY                 TAG                 IMAGE ID            CREATED             SIZE
sshd                           centos7                   b2387fd4ee20        43 seconds ago      1.022 GB
 
 
 
10.使用该镜像启动一个新的容器
sudo docker run -p 10022:22 -d sshd:centos7 /run.sh
 
[hanqunfeng@localhost ~]$ sudo docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                     PORTS                   NAMES
b4f785fb87d4        sshd:centos7        "/run.sh"           53 seconds ago      Up 52 seconds              0.0.0.0:10022->22/tcp   stupefied_wilson
 
 
11.ssh登录容器
[hanqunfeng@localhost ~]$ ssh root@192.168.65.158 -p 10022
[root@b4f785fb87d4 ~]# 
 
说明:主机上可以免密登录,其它机器上需要输入容器的root密码,同时需要开通主机的10022端口
 
容器中设置root密码:登录容器后passwd root
主机设置iptablse规则
sudo iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 10022 -j ACCEPT
sudo service iptables save
 
二、使用Dockerfile创建镜像
1.基于刚刚创建好的sshd:centos7镜像,使用Dockerfile创建镜像,将run.sh内置为容器启动时执行的命令
 
[hanqunfeng@localhost ~]$ mkdir DockerFileDir
[hanqunfeng@localhost ~]$ cd DockerFileDir/
[hanqunfeng@localhost DockerFileDir]$ vi Dockerfile
 
FROM sshd:centos7
 
MAINTAINER from hanqunfeng hanqf2008@163.com
 
EXPOSE 22
 
CMD ["/run.sh"]
 
[hanqunfeng@localhost DockerFileDir]$ sudo docker build -t sshd_run:centos7 .     :注意最后有一个点
[sudo] password for hanqunfeng: 
Sending build context to Docker daemon 2.048 kB
Step 1 : FROM sshd:centos7
 ---> 4f5d1b8378ce
Step 2 : MAINTAINER from hanqunfeng hanqf2008@163.com
 ---> Running in 0d942195d4fa
 ---> 5debebcb6742
Removing intermediate container 0d942195d4fa
Step 3 : EXPOSE 22
 ---> Running in 2493baf053fc
 ---> a4e2ff8dcdab
Removing intermediate container 2493baf053fc
Step 4 : CMD /run.sh
 ---> Running in 666bb0236615
 ---> 770fc142d3c9
Removing intermediate container 666bb0236615
Successfully built 770fc142d3c9
 
[hanqunfeng@localhost DockerFileDir]$ sudo docker images
REPOSITORY                 TAG                 IMAGE ID            CREATED             SIZE
sshd_run                   centos7             770fc142d3c9        2 minutes ago       1.022 GB
sshd                       centos7             4f5d1b8378ce        About an hour ago   1.022 GB
 
[hanqunfeng@localhost DockerFileDir]$ sudo docker run -p 10122:22 -d sshd_run:centos7    :此时启动容器时不需要执行/run.sh命令
c9e1524ceb3baa6d7ea2735b45349916149ad4053cfb86398a44477cfbb6e021
[hanqunfeng@localhost DockerFileDir]$ sudo docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                         PORTS                   NAMES
c9e1524ceb3b        sshd_run:centos7    "/run.sh"           11 seconds ago      Up 9 seconds                   0.0.0.0:10122->22/tcp   ecstatic_heyrovsky
b4f785fb87d4        sshd:centos7        "/run.sh"           About an hour ago   Up About an hour               0.0.0.0:10022->22/tcp   stupefied_wilson
 
 
[hanqunfeng@localhost DockerFileDir]$ ssh root@192.168.65.158 -p 10122
The authenticity of host '[192.168.65.158]:10122 ([192.168.65.158]:10122)' can't be established.
ECDSA key fingerprint is 28:22:d1:17:d6:57:b8:e5:bf:9a:28:3a:c5:06:79:bd.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[192.168.65.158]:10122' (ECDSA) to the list of known hosts.
[root@c9e1524ceb3b ~]# 
 
 
2.Dockerfile说明

Dockerfile是docker构建镜像的基础,也是docker区别于其他容器的重要特征,正是有了Dockerfile,docker的自动化和可移植性才成为可能。

不论是开发还是运维,学会编写Dockerfile几乎是必备的,这有助于你理解整个容器的运行。

FROM <image name>, 从一个基础镜像构建新的镜像

FROM ubuntu 

MAINTAINER <author name>, 维护者信息

MAINTAINER William <wlj@nicescale.com>

ENV <key> <value>, 设置环境变量

ENV TEST 1

RUN <command>, 非交互式运行shell命令

RUN apt-get -y update 
RUN apt-get -y install nginx

ADD <src> <dst>, 将外部文件拷贝到镜像里,src可以为url

ADD http://nicescale.com/  /data/nicescale.tgz

WORKDIR /path/to/workdir, 设置工作目录

WORKDIR /var/www

USER <uid>, 设置用户ID

USER nginx

VULUME <#dir>, 设置volume

VOLUME [‘/data’]

EXPOSE <port>, 暴露哪些端口

EXPOSE 80 443 

ENTRYPOINT [‘executable’, ‘param1’,’param2’]执行命令

ENTRYPOINT ["/usr/sbin/nginx"]

CMD [“param1","param2"]

CMD ["start"]

docker创建、启动container时执行的命令,如果设置了ENTRYPOINT,则CMD将作为参数</usr/sbin/nginx start>

Dockerfile最佳实践

  • 尽量将一些常用不变的指令放到前面
  • CMD和ENTRYPOINT尽量使用json数组方式

通过Dockerfile构建image

docker build csphere/nginx:1.7 .
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
分享到:
评论

相关推荐

Global site tag (gtag.js) - Google Analytics