一、基本概念：
1.1、Linux名称Namespace
namespace是Linux系统的底层概念，在linux的内核中具体实现，内核中有不同类型的名称空间，Docker容器运行在同一个Docker主进程，且共享同一个宿主机内核，通过名称空间隔离各个容器，但是容器在一个进程内实现运行指定的服务环境，并且还可以保护宿主机内核不受其它进程的干扰和影响，例如：文件系统空间、网络空间、进程空间等，主要的名称孔家如下：
1.2、为了避免容器占用完宿主机的资源，对容器进行资源限制：比如CPU、内存、磁盘、网络带宽等,Linux使用Cgroup实现上述功能，此外，它还能够对进程进行优先级设置，以及讲进程挂起和恢复等操作
二、Docker安装
2.1、系统：ubuntu 20.4
2.2、docker软件版本：docker-ce-19.03.15
2.3、软件安装：
2.3.1、关闭防火墙：
ufw disable
2.3.2、参数优化：
cat >>/etc/security/limits.conf<<EOF
* - nofile 65535
* - nproc 65535
EOF
cat >>/etc/sysctl.conf<<EOF
kernel.pid_max=4194303
fs.file-max=1000000
vm.max_map_count=262144
net.netfilter.nf_conntrack_max=2097152
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.ipv4.tcp_max_orphans = 16384
net.core.netdev_max_backlog = 16384
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.wmem_max = 16777216
net.core.rmem_max = 16777216
net.ipv4.ip_nonlocal_bind=1
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
vm.swappiness = 0
EOF
2.3.3、安装软件
apt-get -y install apt-transport-https ca-certificates curl software-properties-common
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | sudo apt-key add -
apt-get -y update
apt install docker-ce=5:19.03.15~3-0~ubuntu-focal docker-ce-cli=5:19.03.15~3-0~ubuntu-focal
2.3.4、设置docker配置文件
cat<<EOF > /etc/docker/daemon.json
{
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2",
"storage-opts": [
"overlay2.override_kernel_check=true"
],
"registry-mirrors": ["https://2efvplft.mirror.aliyuncs.com"]
}
EOF
systemctl daemon-reload
systemctl restart docker
systemctl enable docker
查看docker设定信息
docker info
Client:
Debug Mode: false
Server:
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 0
Server Version: 19.03.15
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: systemd
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 7b11cfaabd73bb80907dd23182b9347b4245eb5d
runc version: v1.0.2-0-g52b36a2
init version: fec3683
Security Options:
apparmor
seccomp
Profile: default
Kernel Version: 5.11.0-27-generic
Operating System: Ubuntu 20.04.3 LTS
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 3.81GiB
Name: CNCF-K8S-MD
ID: Q6MC:ZVNA:MEUS:RASN:7CYM:HNBX:UKWM:PEY3:ZTVY:GW76:UOU7:XMJF
Docker Root Dir: /var/lib/docker
Debug Mode: false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Registry Mirrors:
https://2efvplft.mirror.aliyuncs.com/
Live Restore Enabled: false
三、Docker常用命令
拉取镜像：docker pull 镜像
docker pull nginx
上传镜像：docker push 镜像
docker push nginx
运行容器：
docker run -d --rm -p 81:80 nginx
-d是后台运行，--rm是容器结束后自动删除，-p 映射端口:8081为主机端口、8080为容器中的服务端口 bash为容器运行的命令
root@CNCF-K8S-MD:~# docker run -d --rm -p 81:80 nginx
ab827b65bdaa002aa8d0a094e3d1bd5110ad7f8668a40b13cb9fe4f62be029d9
root@CNCF-K8S-MD:~# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ab827b65bdaa nginx "/docker-entrypoint.…" 5 seconds ago Up 4 seconds 0.0.0.0:81->80/tcp hopeful_galois
查看主机上的容器：docker ps -a，-a是显示所有容器，不带-a是只显示运行中的容器
显示主机上的镜像：docker images
为镜像打标签： docker tag 源标签 目标标签
root@CNCF-K8S-MD:~# docker tag nginx registry.test.com/nginx:v1
root@CNCF-K8S-MD:~# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest f6987c8d6ed5 5 days ago 141MB
registry.test.com/nginx v1 f6987c8d6ed5 5 days ago 141MB
centos latest 5d0da3dc9764 3 months ago 231MB
镜像删除：docker rmi -f 镜像名称或ID
docker rmi nginx
root@CNCF-K8S-MD:~# docker rmi nginx
Untagged: nginx:latest
Untagged: nginx@sha256:366e9f1ddebdb844044c2fafd13b75271a9f620819370f8971220c2b330a9254
四、HABOR安装
4.1、主机系统：系统：ubuntu 20.4
4.2、docker软件版本：docker-ce-19.03.15
4.3、IP地址：10.0.0.3/24
4.4、软件下载地址：https://github.com/goharbor/harbor/releases
4.5、软件配置
tar xf harbor-offline-installer-v2.3.5.tgz
cd harbor/
cp harbor.yml.tmpl harbor.yml
编辑harbor.yml文件
hostname: reg.mydomain.com 改为hostname: 10.0.0.3；harbor_admin_password: Harbor12345改为arbor_admin_password: 1234567，1234567是登录harbor网页时用户admin的密码；data_volume: /data其中/data改为你需要的目录，本次不更改;注释掉下面的内容，不启用https
#https:
# port: 443
# certificate: /your/certificate/path
#private_key: /your/private/key/path
4.6、下载docker-composer
sudo curl-L"https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname-s)-$(uname-m)" -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
4.7、安装harbor
./install.sh --with-trivy --with-chartmuseum
最后出现✔ ----Harbor has been installed and started successfully.----表示安装成功
ss -lntup |grep 80
tcp LISTEN 0 128 127.0.0.1:6010 0.0.0.0:* users:(("sshd",pid=41680,fd=11))
tcp LISTEN 0 16384 *:80 *:* users:(("docker-proxy",pid=44727,fd=4))
tcp LISTEN 0 128 [::1]:6010 [::]:* users:(("sshd",pid=41680,fd=10))
4.8、harbor使用
登录网页，用户名admin，密码1234567
新建项目
修改client的docker配置（/etc/docker/daemon.json),
在"registry-mirrors": ["https://2efvplft.mirror.aliyuncs.com"]后面加，然后添加： “insecure-registries”: [“10.0.0.3”]
重新加载和重启docker
登录：
docker login 10.0.0.3
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
给要上传的镜像打标签
docker tag nginx 10.0.0.3/test/nginx:v1
上传镜像
root@CNCF-K8S-MD:/opt/harbor# docker pull 10.0.0.3/test/nginx:v1
Error response from daemon: unknown: repository test/nginx not found
root@CNCF-K8S-MD:/opt/harbor# docker push 10.0.0.3/test/nginx:v1
The push refers to repository [10.0.0.3/test/nginx]
51a4ac025eb4: Pushed
4ded77d16e76: Pushed
32359d2cd6cd: Pushed
4270b63061e5: Pushed
5f5f780b24de: Pushed
2edcec3590a4: Pushed
v1: digest: sha256:2e87d9ff130deb0c2d63600390c3f2370e71e71841573990d54579bc35046203 size: 157
下载镜像测试：
root@CNCF-K8S-MD:/opt/harbor# docker rmi 10.0.0.3/test/nginx:v1
Untagged: 10.0.0.3/test/nginx:v1
Untagged: 10.0.0.3/test/nginx@sha256:2e87d9ff130deb0c2d63600390c3f2370e71e71841573990d54579bc35046203
root@CNCF-K8S-MD:/opt/harbor# docker pull 10.0.0.3/test/nginx:v1
v1: Pulling from test/nginx
Digest: sha256:2e87d9ff130deb0c2d63600390c3f2370e71e71841573990d54579bc35046203
Status: Downloaded newer image for 10.0.0.3/test/nginx:v1
10.0.0.3/test/nginx:v1
安装完成
