1. 从image id 到 layer层的映射关系
我们知道，docker镜像一般由一个或多个layer层组成，docker镜像由image id唯一标识. 如何通过image id找到其layer层镜像文件，我们具体看下.
image id 到 layer层的映射关系
以如下nginx镜像为例演示
root@wan:~# docker image ls
REPOSITORY TAG IMAGE ID CREATED SIZE
kylin_ansible v1.0 cda2b369dda7 6 months ago 483MB
busybox latest cabb9f684f8b 6 months ago 1.24MB
kylin-server-10-sp1-x86 b20.05.18.p02 d73e90d2f40e 7 months ago 277MB
nginx 1.19.8 b8cf2cbeabb9 13 months ago 133MB
docker image ls命令可以查看所有镜像列表，其内容是存在repositories.json中，nginx镜像完整image id是b8cf2cbeabb915843204ceb7ef0055fecadd55c2b0c58ac030e01fe75235885a
root@wan:~# cat /home/docker/image/overlay2/repositories.json | python -m json.tool
{
"Repositories": {
"busybox": {
"busybox:latest": "sha256:cabb9f684f8ba3edb303d578bfd7d709d853539ea1b420a3f6c81a08e85bb3d7",
"busybox@sha256:15e927f78df2cc772b70713543d6b651e3cd8370abf86b2ea4644a9fba21107f": "sha256:cabb9f684f8ba3edb303d578bfd7d709d853539ea1b420a3f6c81a08e85bb3d7"
},
"kylin-server-10-sp1-x86": {
"kylin-server-10-sp1-x86:b20.05.18.p02": "sha256:d73e90d2f40efd2b4d36c9a9d463230c8cd60ff770089d4557c3c8bd6eff2a2f"
},
"kylin_ansible": {
"kylin_ansible:v1.0": "sha256:cda2b369dda7535a3da38029ccf6217d1c5c110b45110d3effa1faccb252157a"
},
"nginx": {
"nginx:1.19.8": "sha256:b8cf2cbeabb915843204ceb7ef0055fecadd55c2b0c58ac030e01fe75235885a",
"nginx@sha256:b0ea179ab61c789ce759dbe491cc534e293428ad232d00df83ce44bf86261179": "sha256:b8cf2cbeabb915843204ceb7ef0055fecadd55c2b0c58ac030e01fe75235885a"
}
}
}
在image/overlay2/imagedb/content/目录下，可以找到image id命名的镜像信息描述文件，其中的diff_id指向layer层.
root@wan:~# ll /home/docker/image/overlay2/imagedb/content/sha256/ |grep b8cf2cbeabb915843204ceb7ef0055fecadd55c2b0c58ac030e01fe75235885a
-rw------- 1 root root 7731 Mar 17 09:50 b8cf2cbeabb915843204ceb7ef0055fecadd55c2b0c58ac030e01fe75235885a
"rootfs": {
"diff_ids": [
"sha256:0270c2d5ad7267d4e20b234f5252bae2aa22b5fa0742b35a286d70532106269a",
"sha256:7ddea056b71a35e389d8afbd8644ee6d37db17b2680b4c54a91ce62acfd45522",
"sha256:199e51fa0f590e3bf130548d086fff9ab7beb978da6cec51c34d00f4c73e4b11",
"sha256:0e426deef675f1d2461fba6a82b162bcbb87e1329e56cadc5b60b1979ffede78",
"sha256:9cb4f14884ef94d8ab46910e7361b76abcd8e1fa625360a784f003d22dd2e676",
"sha256:00436d7e1be278738ccab0e1b928cfe5fc77a8d1aa6cedc527da67db03fd5f6d"
],
"type": "layers"
}
通过diff_id并不能直接找到layer层的位置，diff_id首先指向的是/home/docker/image/overlay2/layerdb/下layer层描述文件，以chain id命名.
root@wan:~# ll /home/docker/image/overlay2/layerdb/sha256/
总用量 64
drwxr-xr-x 16 root root 4096 May 6 11:36 ./
drwx------ 5 root root 4096 Nov 8 21:08 ../
drwx------ 2 root root 4096 Mar 17 09:50 0270c2d5ad7267d4e20b234f5252bae2aa22b5fa0742b35a286d70532106269a/
drwx------ 2 root root 4096 Mar 17 09:50 2dc84c7ec5111c4efe0c14e513a2c04b71e4b291371d3501edbdbf8c90d01c4e/
drwx------ 2 root root 4096 Nov 9 16:03 4006f69db8cda9d3eaacea6f65b18946b980f1f74e1ea4eed0045adb64a9b6ef/
drwx------ 2 root root 4096 Mar 17 09:50 44bec70f0d4fb27be00e6fd28fa1332518c2b0daef5876fbbf89d81189a90f79/
drwx------ 2 root root 4096 Mar 17 09:50 84c3d4eca6c8f9ff5b7c1e206fa1de429e6a3780f3d4be1e887a4cdcafbb8c98/
drwx------ 2 root root 4096 Mar 17 09:50 854bb972d0fb6a938505849b81cf5d6eb9a5ea706cbfdd3c84262f6c9d1c0db5/
drwx------ 2 root root 4096 Nov 9 10:05 954010412f074c0307971abd629d74397c5e3e8ec3bccaf2967ca5a7de67322d/
drwx------ 2 root root 4096 Nov 8 21:04 a9ca537752fdf30df0dfe9fcd4ba936db4acbe0e991c9e4704c284bffed54eb5/
drwx------ 2 root root 4096 Mar 17 09:50 b7da9031b6262baa6191d9539601575cda3a24ec373849b473843e419d7714ef/
drwx------ 2 root root 4096 Nov 9 10:04 b9c841015156d52c8e99fdca049421740f48e76efbcbb2566d84d1d3d5cb0ab4/
drwx------ 2 root root 4096 Nov 8 21:36 bf85460d615599f0bb26b6452a53a4ab0bf851546a8a5de34219c0447cc9fe41/
drwx------ 2 root root 4096 Nov 9 10:04 e418f559a0b059476b139c368515fd50dc24594a1df364114dc26b9fb2849ebc/
drwx------ 2 root root 4096 Nov 9 10:05 e56ae449ee465a2d6ee4d62d4d8a6aa7eb08cec4f37f91aa045a6267a662c932/
drwx------ 2 root root 4096 Nov 9 10:05 fbd2bc5d727f3809e61f7ef735fca27dd7dfedb276c214a01d465035dca210e8/
diff_id与chainid转换关系如下：
ChainID = sha256sum(父层chainid + " " + 本层diff_id)
chainid 目录下cache-id即是layer层的文件名，得到diff_id、 chain_id、cache_id三者之间对应关系如下:
image.png
得到cache_id后，就可以在/home/docker/overlay2/目录找到image对应的layer层文件，如下：
root@wan:~# ll /home/docker/overlay2/
总用量 68
drwx--x--- 17 root root 4096 May 8 19:56 ./
drwx--x--- 15 root root 4096 May 8 19:56 ../
drwx--x--- 4 root root 4096 Nov 9 10:05 0f86080e207475d1c421659b7743ebae3324f8b65f00b35e004494633743ff86/
drwx--x--- 4 root root 4096 Mar 17 11:05 3714381273dbb97ed39b0ded7c921ff4683dde6a83f18938e0547245e2934d7d/
drwx--x--- 4 root root 4096 Mar 17 11:05 3b6b3fcbcf817a56477e2f5692376458578f45cc41c06112bbc94902b9f55063/
drwx--x--- 3 root root 4096 Mar 17 09:50 3dd1c747b7ff30be83e291ec7ad45e32e71aeadeacc60236a63d2555b840c157/
drwx--x--- 4 root root 4096 Nov 9 10:05 489a0f6bccafd4c326aa05869eecf90b7b61312be0c7df9f68ad07c53579d5fb/
drwx--x--- 3 root root 4096 Nov 8 21:08 7459c4a284c2a6a3ade8d2f5ca68e823f7d37ee2951f51250ceede7166df37bb/
drwx--x--- 3 root root 4096 Nov 8 21:40 78699e0ca3a9a8b9bf67ac95e849c60060e09180840de5ba2eb10915a44c8b17/
drwx--x--- 4 root root 4096 Mar 17 11:05 8569d0ee2c5b59895000d869b7b544aa5827a8a9c693e7a796a81cbbb621d70b/
drwx--x--- 4 root root 4096 Mar 17 11:05 8a8f5537334d2267953ef08b09e02eeab46412b6687edaa3e4eac9eef1fa0349/
drwx--x--- 4 root root 4096 Nov 9 10:04 9eb262b6fbb0aa5f471562d0bcf8ad5aed169fa9bc91543ac73a4179f870db36/
drwx--x--- 4 root root 4096 Nov 9 16:07 a918ac1de3d396b9de1ab5ae73ab418d5f5abd600e523b00b28ffdf92d587d02/
drwx--x--- 4 root root 4096 Nov 9 10:04 d35bed106f6b56b79cdcecde5289991e32b30addf212d187678fbd2defa787a8/
drwx--x--- 4 root root 4096 Mar 17 11:05 edd9fbb86ee286ed661e1f37e8f24a53551e1973ee8f6b5535fc8cdc7d3ee94a/
drwx--x--- 4 root root 4096 Nov 9 10:05 f5ea1d7d59ef98713dd6d330f17c0c38de4fe01116a5383be00780100fbadb81/
drwx------ 2 root root 4096 May 6 11:36 l/
2. 启动镜像，查看挂载情况
overlay on /home/docker/overlay2/f79c62fb895b9e13b569a0cc0ec9969631311306d5b2c58968d4b128949d1c37/merged type overlay (rw,relatime,
lowerdir=/home/docker/overlay2/l/INJI5DNQKFYSMIFU6NNHIDK2TN:
/home/docker/overlay2/l/B3X6UGP5HZGB5XFH3JVPZYP75E:
/home/docker/overlay2/l/47YTA66GRPD2INKIMP3TEOG5SF:
/home/docker/overlay2/l/42RAGEV5KU25YMO7NCVR3I72FG:
/home/docker/overlay2/l/KAXLB35G7OLKUI5PKOESLZJCL6:
/home/docker/overlay2/l/G2OG2NGARCB4PGN7LN3F2JDZWN:
/home/docker/overlay2/l/NJRSNKLBBOGI7POL36OZS3PPU3,
upperdir=/home/docker/overlay2/f79c62fb895b9e13b569a0cc0ec9969631311306d5b2c58968d4b128949d1c37/diff,workdir=/home/docker/overlay2/f79c62fb895b9e13b569a0cc0ec9969631311306d5b2c58968d4b128949d1c37/work,index=off,xino=off)
可以看到lowdir由6个layer层+1个init层组成，init上面是upperdir + merged层
root@wan:~# ll /home/docker/overlay2/l/INJI5DNQKFYSMIFU6NNHIDK2TN
lrwxrwxrwx 1 root root 77 May 8 21:10 /home/docker/overlay2/l/INJI5DNQKFYSMIFU6NNHIDK2TN -> ../f79c62fb895b9e13b569a0cc0ec9969631311306d5b2c58968d4b128949d1c37-init/diff/
root@wan:~# ll /home/docker/overlay2/l/B3X6UGP5HZGB5XFH3JVPZYP75E
lrwxrwxrwx 1 root root 72 Mar 17 09:50 /home/docker/overlay2/l/B3X6UGP5HZGB5XFH3JVPZYP75E -> ../8a8f5537334d2267953ef08b09e02eeab46412b6687edaa3e4eac9eef1fa0349/diff/
root@wan:~# ll /home/docker/overlay2/l/47YTA66GRPD2INKIMP3TEOG5SF
lrwxrwxrwx 1 root root 72 Mar 17 09:50 /home/docker/overlay2/l/47YTA66GRPD2INKIMP3TEOG5SF -> ../edd9fbb86ee286ed661e1f37e8f24a53551e1973ee8f6b5535fc8cdc7d3ee94a/diff/
root@wan:~# ll /home/docker/overlay2/l/42RAGEV5KU25YMO7NCVR3I72FG
lrwxrwxrwx 1 root root 72 Mar 17 09:50 /home/docker/overlay2/l/42RAGEV5KU25YMO7NCVR3I72FG -> ../3714381273dbb97ed39b0ded7c921ff4683dde6a83f18938e0547245e2934d7d/diff/
root@wan:~# ll /home/docker/overlay2/l/KAXLB35G7OLKUI5PKOESLZJCL6
lrwxrwxrwx 1 root root 72 Mar 17 09:50 /home/docker/overlay2/l/KAXLB35G7OLKUI5PKOESLZJCL6 -> ../3b6b3fcbcf817a56477e2f5692376458578f45cc41c06112bbc94902b9f55063/diff/
root@wan:~# ll /home/docker/overlay2/l/G2OG2NGARCB4PGN7LN3F2JDZWN
lrwxrwxrwx 1 root root 72 Mar 17 09:50 /home/docker/overlay2/l/G2OG2NGARCB4PGN7LN3F2JDZWN -> ../8569d0ee2c5b59895000d869b7b544aa5827a8a9c693e7a796a81cbbb621d70b/diff/
root@wan:~# ll /home/docker/overlay2/l/NJRSNKLBBOGI7POL36OZS3PPU3
lrwxrwxrwx 1 root root 72 Mar 17 09:49 /home/docker/overlay2/l/NJRSNKLBBOGI7POL36OZS3PPU3 -> ../3dd1c747b7ff30be83e291ec7ad45e32e71aeadeacc60236a63d2555b840c157/diff/
root@wan:~# ll /home/docker/overlay2/f79c62fb895b9e13b569a0cc0ec9969631311306d5b2c58968d4b128949d1c37/diff
