# 容器生态系统组件
– 容器镜像：应用程序及其依赖的打包格式
– 容器运行时：执行容器的软件，如Docker、Podman
– 容器编排：管理容器集群的工具，如Kubernetes、Docker Swarm
– 容器镜像仓库：存储容器镜像的地方，如Docker Hub、Harbor
– 容器监控：监控容器运行状态的工具，如Prometheus、Grafana

# 应用容器化评估
– 应用类型：Web应用、数据库、缓存等
– 依赖项：库、配置文件、环境变量
– 数据存储：持久化需求、存储方案
– 网络需求：端口暴露、网络策略

# 容器镜像规划
– 基础镜像选择：官方镜像、自定义镜像
– 镜像版本管理：标签策略、版本控制
– 镜像安全：扫描、漏洞修复

# 部署策略
– 滚动更新：零停机部署
– 蓝绿部署：快速回滚
– 金丝雀发布：逐步上线

# 硬件需求
– CPU：根据应用需求确定核心数
– 内存：根据容器数量和内存需求确定
– 存储：高速存储，支持容器镜像和持久化数据
– 网络：高带宽、低延迟

# 操作系统选择
– 主要系统：RHEL 9.3、Ubuntu 22.04
– 内核版本：4.19+，支持容器特性
– 系统优化：关闭不必要服务，优化内核参数

# 容器运行时选择
– Docker：成熟稳定，生态丰富
– Podman：无守护进程，更安全
– containerd：轻量级，适合Kubernetes

# 容器镜像安全
– 使用官方镜像或可信镜像源
– 定期扫描镜像漏洞
– 最小化镜像大小，减少攻击面

# 容器运行安全
– 限制容器权限：使用非root用户
– 限制资源使用：CPU、内存、网络
– 启用容器安全上下文

# 网络安全
– 网络隔离：使用网络策略
– 加密通信：使用TLS
– 限制网络访问：防火墙规则

# 数据安全
– 加密存储：敏感数据加密
– 数据备份：定期备份持久化数据
– 访问控制：限制数据访问权限

# 在RHEL 9.3上安装Docker
# 1. 安装依赖包
$ sudo dnf install -y dnf-utils device-mapper-persistent-data lvm2

# 2. 添加Docker存储库
$ sudo dnf config-manager –add-repo=https://download.docker.com/linux/centos/docker-ce.repo

# 3. 安装Docker
$ sudo dnf install -y docker-ce docker-ce-cli containerd.io

# 4. 启动Docker服务
$ sudo systemctl start docker
$ sudo systemctl enable docker

# 5. 验证Docker安装
$ sudo docker –version
Docker version 20.10.24, build 297e128

# 6. 测试Docker
$ sudo docker run hello-world
Hello from Docker!
This message shows that your installation appears to be working correctly.
…

# 配置Docker守护进程
$ sudo vi /etc/docker/daemon.json
{
“registry-mirrors”: [“https://registry.docker-cn.com”],
“insecure-registries”: [“registry.fgedu.net.cn:5000”],
“data-root”: “/var/lib/docker”,
“max-concurrent-downloads”: 10,
“max-concurrent-uploads”: 10,
“log-driver”: “json-file”,
“log-opts”: {
“max-size”: “10m”,
“max-file”: “3”
}
}

# 重启Docker服务
$ sudo systemctl restart docker

# 验证配置
$ sudo docker info | grep Registry
Registry Mirrors:
https://registry.docker-cn.com/
Insecure Registries:
registry.fgedu.net.cn:5000
127.0.0.0/8

# 创建Dockerfile
$ cat > Dockerfile << 'EOF' FROM nginx:1.24 # 安装依赖 RUN apt-get update && apt-get install -y curl # 复制应用文件 COPY index.html /usr/share/nginx/html/ COPY nginx.conf /etc/nginx/nginx.conf # 暴露端口 EXPOSE 80 # 启动命令 CMD ["nginx", "-g", "daemon off;"] EOF # 创建应用文件 $ cat > index.html << 'EOF'

Hello from FGEDU Web App!

This is a containerized web application.

EOF

# 创建nginx配置文件
$ cat > nginx.conf << 'EOF' user nginx; worker_processes auto; events { worker_connections 1024; } http { include /etc/nginx/mime.types; default_type application/octet-stream; server { listen 80; server_name localhost; location / { root /更多学习教程公众号风哥教程itpux_comusr/share/nginx/html; index index.html; } } } EOF # 构建镜像 $ sudo docker build -t fgedu/webapp:v1 . Sending build context to Docker daemon 4.096kB Step 1/6 : FROM nginx:1.24 ---> a1523e859360
Step 2/6 : RUN apt-get update && apt-get install -y curl
—> Running in 7c8a1b2c3d4e
…
Successfully built 5a6b7c8d9e0f
Successfully tagged fgedu/webapp:v1

# 查看镜像
$ sudo docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
fgedu/webapp v1 5a6b7c8d9e0f 2 minutes ago 187MB
nginx 1.24 a1523e859360 2 weeks ago 142MB

# 运行容器
$ sudo docker run -d –name webapp -p 8080:80 fgedu/webapp:v1
1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t

# 查看容器状态
$ sudo docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1a2b3c4d5e6f fgedu/webapp:v1 “nginx -g ‘daemon of…” 1 minute ago Up 1 minute 0.0.0.0:8080->80/tcp webapp

# 测试访问
$ curl http://localhost:8080

Hello from FGEDU Web App!

This is a containerized web application.

# 安装Docker Compose
$ sudo curl -L “https://github.com/docker/compose/releases/download/v2.17.3/docker-compose-$(uname -s)-$(uname -m)” -o /usr/local/bin/docker-compose
$ sudo chmod +x /usr/local/bin/docker-compose
$ sudo docker-compose –version
docker-compose version 2.17.3, build 1f32b2f

# 创建docker-compose.yml文件
$ cat > docker-compose.yml << 'EOF' version: '3' services: web: image: fgedu/webapp:v1 ports: - "8080:80" restart: always db: image: mysql:8.0 environment: MYSQL_ROOT_PASSWORD: fgedu123 MYSQL_DATABASE: fgedudb MYSQL_USER: fgedu MYSQL_PASSWORD: fgedu123 volumes: - db_data:/var/lib/mysql restart: always volumes: db_data: EOF # 启动服务 $ sudo docker-compose up -d Creating network "webapp_default" with the default driver Creating volume "webapp_db_data" with default driver Creating webapp_web_1 ... done Creating webapp_db_1 ... done # 查看服务状态 $ sudo docker-compose ps Name Command State Ports -------------------------------------------------------------------------------- webapp_db_1 docker-entrypoint.sh mysqld Up 3306/tcp, 33060/tcp webapp_web_1 nginx -g daemon off; Up 0.0.0.0:8080->80/tcp

# 案例：Nginx容器化部署
# 环境：RHEL 9.3
# 目标：部署Nginx作为Web服务器

# 1. 创建Dockerfile
$ cat > Dockerfile << 'EOF' FROM nginx:1.24 # 安装依赖 RUN apt-get update && apt-get install -y curl wget # 复制配置文件 COPY nginx.conf /etc/nginx/nginx.conf COPY default.conf /etc/nginx/conf.d/default.conf # 复制网站文件 COPY html/ /usr/share/nginx/html/ # 暴露端口 EXPOSE 80 # 健康检查 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ CMD curl -f http://localhost/ || exit 1 EOF # 2. 创建配置文件 $ mkdir -p html $ cat > html/index.html << 'EOF'

Welcome to FGEDU Nginx Server!

This is a containerized Nginx server.

EOF

$ cat > nginx.conf << 'EOF' user nginx; worker_processes auto; events { worker_connections 1024; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; error_log /var/log/nginx/error.log warn; sendfile on; keepalive_timeout 65; include /etc/nginx/conf.d/*.conf; } EOF $ cat > default.conf << 'EOF' server { listen 80; server_name localhost; location / { root /usr/share/nginx/html; index index.html; } error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } } EOF # 3. 构建镜像 $ sudo docker build -t fgedu/nginx:v1 . # 4. 运行容器 $ sudo docker run -d --name nginx -p 80:80 -v /data/nginx/logs:/var/log/nginx fgedu/nginx:v1 # 5. 验证部署 $ curl http://localhost

Welcome to FGEDU Nginx Server!

This is a containerized Nginx server.

# 案例：MySQL容器化部署
# 环境：RHEL 9.3
# 目标：部署MySQL 8.0

# 1. 创建docker-compose.yml文件
$ cat > docker-compose.yml << 'EOF' version: '3' services: mysql: image: mysql:8.0 container_name: mysql environment: MYSQL_ROOT_PASSWORD: fgedu123 MYSQL_DATABASE: fgedudb MYSQL_USER: fgedu MYSQL_PASSWORD: fgedu123 ports: - "3306:3306" volumes: - mysql_data:/var/lib/mysql - mysql_config:/etc/mysql/conf.d restart: always healthcheck: test: ["CMD", "mysqladmin", "ping", "-h", "localhost"] interval: 30s timeout: 10s retries: 3 volumes: mysql_data: mysql_config: EOF # 2. 创建MySQL配置文件 $ mkdir -p mysql/conf.d $ cat > mysql/conf.d/my.cnf << 'EOF' [mysqld] max_connections = 1000 innodb_buffer_pool_size = 512M innodb_log_file_size = 128M innodb_file_per_table = 1 character-set-server = utf8mb4 collation-server = utf8mb4_unicode_ci EOF # 3. 启动服务 $ sudo docker-compose up -d # 4. 验证部署 $ sudo docker-compose ps Name Command State Ports -------------------------------------------------------------------------------- mysql docker-entrypoint.sh mysqld Up 0.0.0.0:3306->3306/tcp, 33060/tcp

# 5. 测试MySQL
$ mysql -h localhost -u fgedu -p
Enter password: fgedu123
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 8.0.33 MySQL Community Server – GPL

mysql> SHOW DATABASES;
+——————–+
| Database |
+——————–+
| fgedudb |
| information_schema |
| performance_schema |
| sys |
+——————–+
4 rows in set (0.00 sec)

# 案例：容器监控系统部署
# 环境：RHEL 9.3
# 目标：使用Prometheus + Grafana监控容器

# 1. 创建docker-compose.yml文件
$ cat > docker-compose.yml << 'EOF' version: '3' services: prometheus: image: prom/prometheus:v2.45.0 container_name: prometheus ports: - "9090:9090" volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml restart: always grafana: image: grafana/grafana:9.5.0 container_name: grafana ports: - "3000:3000" volumes: - grafana_data:/var/lib/grafana restart: always environment: - GF_SECURITY_ADMIN_PASSWORD=fgedu123 node_exporter: image: prom/node-exporter:v1.6.0 container_name: node_exporter ports: - "9100:9100" restart: always cadvisor: image: gcr.io/cadvisor/cadvisor:v0.47.0 container_name: cadvisor ports: - "8080:8080" volumes: - /:/rootfs:ro - /var/run:/var/run:ro - /sys:/sys:ro - /var/lib/docker/:/var/lib/docker:ro restart: always volumes: grafana_data: EOF # 2. 创建Prometheus配置文件 $ cat > prometheus.yml << 'EOF' global: scrape_interval: 15s scrape_configs: - job_name: 'prometheus' static_configs: - targets: ['localhost:9090'] - job_name: 'node_exporter' static_configs: - targets: ['node_exporter:9100'] - job_name: 'cadvisor' static_configs: - targets: ['cadvisor:8080'] - job_name: 'docker' static_configs: - targets: ['localhost:9323'] EOF # 3. 启动服务 $ sudo docker-compose up -d # 4. 验证部署 $ sudo docker-compose ps Name Command State Ports -------------------------------------------------------------------------------- cadvisor /usr/bin/cadvisor -logtostderr Up 0.0.0.0:8080->8080/tcp
grafana /run.sh Up 0.0.0.0:3000->3000/tcp
node_exporter /bin/node_exporter Up 0.0.0.0:9100->9100/tcp
prometheus /bin/prometheus –config.f… Up 0.0.0.0:9090->9090/tcp

# 5. 访问Grafana
# 打开浏览器访问 http://localhost:3000
# 用户名：admin
# 密码：fgedu123

# 常见问题与解决方案

## 1. 容器启动失败
– 原因：端口冲突、配置错误、资源不足
– 解决方案：检查端口占用、检查配置文件、增加资源

## 2.更多视频教程www.fgedu.net.cn 容器网络问题
– 原因：网络配置错误、防火墙规则、DNS解析
– 解决方案：检查网络配置、调整防火墙规则、配置DNS

## 3. 容器存储问题
– 原因：存储空间不足、权限问题、挂载失败
– 解决方案：清理空间、检查权限、重新挂载

## 4. 容器性能问题
– 原因：资源限制学习交流加群风哥QQ113257174、应用优化、容器数量过多
– 解决方案：调整资源限制、优化应用、水平扩展

## 5. 容器安全问题
– 原因：镜像漏洞、权限过大、网络暴露
– 解决方案：扫描镜像、限制权限、配置网络策略