docker学习（三）—— docker镜像概念，镜像的基本操作

docker参考手册：https://docs.docker.com/engine/reference/commandline/dockerd/

daemon.json参考：https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file

docker网络的参考：https://docs.docker.com/network/

容器构建实例：https://github.com/mysql/mysql-docker

限制容器的资源：https://docs.docker.com/config/containers/resource_constraints/#memory

docker-distribution配置：https://docs.docker.com/registry/configuration/#list-of-configuration-options

本文讲述了以下内容：

docker常用命令

docker镜像的一些概念

docker hub的类型

拉取镜像的命令

基于容器制作镜像

把镜像推到docker hub

把镜像推到aliyun镜像仓库

本地打包镜像

docker常用命令

docker search：Search the Docker Hub for images.

docker pull：Pull an image or a repository from a registry. docker image pull

docker images：List images. docker image ls

docker create：Create a container. docker container create

docker start：Start one or more stopped containers. docker container start

docker run：Run a command in a new container. docker container run

docker attach：Attach to a running container. docker container attach

docker ps：List containers. docker container ls

docker logs：Fetch the logs of a container. docker container logs

docker restart：restart Restart one or more containers. docker container restart

docker stop：Stop one or more running containers. docker container stop

docker kill：Kill one or more running containers. docker container kill

docker rm：Remove one or more containers. docker container rm

About Docker images

Docker镜像含有启动容器所需要的文件系统及其内容，因此，其用于创建并启动docker容器

Docker image 采用分层构建机制，最底层为bootfs，其之为rootfs

bootfs：用于系统引导的文件系统，包括bootloader和kernel，容器启动完成会被卸载以节约内存资源；
rootfs：位于bootfs之上，表现为docker容器的根文件系统；传统模式中，系统启动时，内核挂载rootfs时会首先将其挂载为“只读”模式，完整性自检完成后将其重新挂载为读写模式；docker中，rootfs由内核挂载为“只读”模式，而后通过“联合挂载”技术额外挂载一个“可写”层。

Docker Image Layer

位于下层的镜像称为父镜像（parent image），最底层的镜像成为基础镜像（base image）。
最上层为“可读写层”，其下的均为“只读”层

Aufs

advanced multi-layered unifaction filesystem ：高级多层统一文件系统。
用于为Linux文件系统实现“联合挂载”
aufs是之前的UnionFS的重新实现，2006年由Junjiro Okajima开发
Docker最初使用aufs作为容器文件系统层，它目前仍作为存储后端之一来支持
aufs的竞争产品是overlayfs，后者自从3.18版本开始被合并到Linux内核
Docker的分层镜像，除了aufs，docker还支持btrfs，devicemapper和vfs等
在Ubuntu系统下，docker默认ubuntu的aufs；而在centos7上，用的是devicemapper

Docker registry

启动容器时，docker daemon 会试图从本地获取相关的镜像；本地镜像不存在时，其将从Registry中下载镜像到本地。

Docker Registry 分为Public Docker Registry（Docker Hub）和Private Docker Registry

Registry用于保存docker镜像，包括镜像的层结构与元数据

用户可以自建Registry，也可以使用官方的Docker Hub

分类：

Sponsor Registry：第三方的registry，供客户和Docker社区使用
Mirrors Registry：第三方的Registry，只让客户使用
Vendor Registry：由发布Docker镜像的供应商提供的registry
Private Registry：通过设有防火墙和额外安全层的私有实体提供的registry

Repository and index：

Repository：

由某个特定的docker镜像的所有迭代版本组成的镜像仓库
一个Registory中可以存在多个Repository；Repository分为“顶层仓库”和用户仓库；每个仓库可以包含多个tag，每个tag对应一个image

index：

维护用户账户、镜像的校验以及公共命名空间的信息
相当于为Registry提供了一个完成用户认证等功能的检索接口

Docker Registry中的镜像通常由开发人员制作，而后推送到“公共”或“私有”registry上保存，供其他人员使用，利润部署到生产环境。

Docker Hub

Docker Hub provides the following major features：

Image Repositories
Automated Builds
WebHooks
Organitions
Github and Bitbucket Integration

Getting images from remote Docker registires.

[root@docker2 ~]# docker pull <registry>:[:<port>]/[namespace/]<name>:<tag>

[root@docker2 ~]# docker pull quay.io/coreos/flannel
Using default tag: latest
Error response from daemon: manifest for quay.io/coreos/flannel:latest not found
[root@docker2 ~]# docker pull quay.io/coreos/flannel:v0.10.0-amd64
v0.10.0-amd64: Pulling from coreos/flannel
ff3a5c916c92: Pull complete 
8a8433d1d437: Pull complete 
306dc0ee491a: Pull complete 
856cbd0b7b9c: Pull complete 
af6d1e4decc6: Pull complete 
Digest: sha256:88f2b4d96fae34bfff3d46293f7f18d1f9f3ca026b4a4d288f28347fcb6580ac
Status: Downloaded newer image for quay.io/coreos/flannel:v0.10.0-amd64

镜像的生成途径：

Dockerfile
基于容器制作
Docker Hub automated builds

基于容器制作镜像：

创建一个基于busybox镜像，名字为b2的容器：

创建个目录和文件

[root@docker2 ~]# docker container run --name b2 -it busybox
/ # 
/ # ls /
bin   dev   etc   home  proc  root  sys   tmp   usr   var
/ # mkdir -p /data/html
/ # echo "<h1>Welcome to busybox!<h1>" > /data/html/index.html
/ #

新开终端，创建镜像：

[root@docker2 ~]# docker commit --help

Usage:	docker commit [OPTIONS] CONTAINER [REPOSITORY[:TAG]]

Create a new image from a container's changes

Options:
  -a, --author string    Author (e.g., "John Hannibal Smith <[email protected]>")
  -c, --change list      Apply Dockerfile instruction to the created image
  -m, --message string   Commit message
  -p, --pause            Pause container during commit (default true)
[root@docker2 ~]# docker commit -p b2
sha256:71e8e2f3a3a5154940dbb3a7926d2a084bb253eb90b4f1759f9a420610b5a7ca
[root@docker2 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
<none>                   <none>              71e8e2f3a3a5        5 seconds ago       1.15MB
redis                    5                   5d2989ac9711        32 hours ago        95MB
nginx                    1.15-alpine         315798907716        3 days ago          17.8MB
busybox                  latest              758ec7f3a1ee        4 days ago          1.15MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        11 months ago       44.6MB

打标签：

[root@docker2 ~]# docker tag --help

Usage:	docker tag SOURCE_IMAGE[:TAG] TARGET_IMAGE[:TAG]

Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE
[root@docker2 ~]# docker tag 71e8e2f3a3a5 uscwifi/httpd:v0.1-1
[root@docker2 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
uscwifi/httpd            v0.1-1              71e8e2f3a3a5        3 minutes ago       1.15MB
redis                    5                   5d2989ac9711        32 hours ago        95MB
nginx                    1.15-alpine         315798907716        3 days ago          17.8MB
busybox                  latest              758ec7f3a1ee        4 days ago          1.15MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        11 months ago       44.6MB

[root@docker2 ~]# docker tag uscwifi/httpd:v0.1-1 uscwifi/httpd:latest
[root@docker2 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
uscwifi/httpd            latest              71e8e2f3a3a5        4 minutes ago       1.15MB
uscwifi/httpd            v0.1-1              71e8e2f3a3a5        4 minutes ago       1.15MB
redis                    5                   5d2989ac9711        32 hours ago        95MB
nginx                    1.15-alpine         315798907716        3 days ago          17.8MB
busybox                  latest              758ec7f3a1ee        4 days ago          1.15MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        11 months ago       44.6MB

查看镜像详情：

[root@docker2 ~]# docker inspect uscwifi/httpd:latest

用此镜像创建容器测试：

[root@docker2 ~]# docker container run --name t1 -it uscwifi/httpd:latest 
/ # ls /
bin   data  dev   etc   home  proc  root  sys   tmp   usr   var
/ # cat /data/html/index.html 
<h1>Welcome to busybox!<h1>
/ #

基于容器制作第二个镜像：

-a指定作者为uscwifi.cn，-c指定了启动容器运行的命令为/bin/httpd -f -h /data/html，-p指定创建镜像时暂停容器，指定容器b2，镜像标签为uscwifi/httpd:v0.2

[root@docker2 ~]# docker commit --help

Usage:	docker commit [OPTIONS] CONTAINER [REPOSITORY[:TAG]]

Create a new image from a container's changes

Options:
  -a, --author string    Author (e.g., "John Hannibal Smith <[email protected]>")
  -c, --change list      Apply Dockerfile instruction to the created image
  -m, --message string   Commit message
  -p, --pause            Pause container during commit (default true)
[root@docker2 ~]# docker commit -a "uscwifi.cn" -c 'CMD ["/bin/httpd","-f","-h","/data/html"]' -p b2 uscwifi/httpd:v0.2
sha256:a83a2c1ac8b323164e6143d302ee9c9d2e380956181390c67d38b5454ba4883c
[root@docker2 ~]# docker image ls
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
uscwifi/httpd            v0.2                a83a2c1ac8b3        5 seconds ago       1.15MB
uscwifi/httpd            latest              71e8e2f3a3a5        21 minutes ago      1.15MB
uscwifi/httpd            v0.1-1              71e8e2f3a3a5        21 minutes ago      1.15MB
redis                    5                   5d2989ac9711        32 hours ago        95MB
nginx                    1.15-alpine         315798907716        3 days ago          17.8MB
busybox                  latest              758ec7f3a1ee        4 days ago          1.15MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        11 months ago       44.6MB

利用该镜像创建一个容器：

[root@docker2 ~]# docker run --name t2 uscwifi/httpd:v0.2

新开shell查看：

[root@docker2 ~]# docker ps
CONTAINER ID        IMAGE                COMMAND                  CREATED             STATUS              PORTS               NAMES
b4c9c77e60c0        uscwifi/httpd:v0.2   "/bin/httpd -f -h /d…"   56 seconds ago      Up 53 seconds                           t2
8ab7e978debc        busybox              "sh"                     29 minutes ago      Up 29 minutes                           b2
b2a481f1fde0        redis:5              "docker-entrypoint.s…"   3 hours ago         Up 3 hours          6379/tcp            kvstor1
aa7f935730ed        nginx:1.15-alpine    "nginx -g 'daemon of…"   3 hours ago         Up 3 hours          80/tcp              web1
[root@docker2 ~]# docker inspect t2 | grep -i ipaddress
            "SecondaryIPAddresses": null,
            "IPAddress": "172.17.0.5",
                    "IPAddress": "172.17.0.5",
[root@docker2 ~]# curl 172.17.0.5
<h1>Welcome to busybox!<h1>

推镜像到dockerhub：

得先在dockerhub注册账号并创建仓库

登陆docker：

[root@docker2 ~]# docker login --help

Usage:	docker login [OPTIONS] [SERVER]

Log in to a Docker registry

Options:
  -p, --password string   Password
      --password-stdin    Take the password from stdin
  -u, --username string   Username
[root@docker2 ~]# docker login -u uscwifi
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

开始推镜像：

[root@docker2 ~]# docker push uscwifi/httpd
The push refers to repository [docker.io/uscwifi/httpd]
07e1846f60c6: Pushed 
23bc2b70b201: Mounted from library/busybox 
latest: digest: sha256:7a97db1f2b88d5a4ac5d873f91ef33284f6ea1f49538ce20fe2168b586a79b11 size: 734
07e1846f60c6: Layer already exists 
23bc2b70b201: Layer already exists 
v0.1-1: digest: sha256:7a97db1f2b88d5a4ac5d873f91ef33284f6ea1f49538ce20fe2168b586a79b11 size: 734
c8afcb5503d3: Pushed 
23bc2b70b201: Layer already exists 
v0.2: digest: sha256:7bc2e3c0bca86a692501522ff7adf637c1fcda87fca23a754e7db68f00c80f54 size: 734

web界面查看：

阿里云镜像仓库：

创建仓库：

登陆docker

[root@docker2 ~]# docker logout 
Removing login credentials for https://index.docker.io/v1/
[root@docker2 ~]# docker login --username=156****8129 registry.cn-shanghai.aliyuncs.com
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

打tag，并push：

[root@docker2 ~]# docker images
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
uscwifi/httpd            v0.2                a83a2c1ac8b3        37 minutes ago      1.15MB
uscwifi/httpd            latest              71e8e2f3a3a5        About an hour ago   1.15MB
uscwifi/httpd            v0.1-1              71e8e2f3a3a5        About an hour ago   1.15MB
redis                    5                   5d2989ac9711        33 hours ago        95MB
nginx                    1.15-alpine         315798907716        3 days ago          17.8MB
busybox                  latest              758ec7f3a1ee        4 days ago          1.15MB
quay.io/coreos/flannel   v0.10.0-amd64       f0fad859c909        11 months ago       44.6MB
[root@docker2 ~]# docker tag uscwifi/httpd:v0.2 registry.cn-shanghai.aliyuncs.com/uscwifi/httpd:v0.2
[root@docker2 ~]# docker images
REPOSITORY                                        TAG                 IMAGE ID            CREATED             SIZE
uscwifi/httpd                                     v0.2                a83a2c1ac8b3        38 minutes ago      1.15MB
registry.cn-shanghai.aliyuncs.com/uscwifi/httpd   v0.2                a83a2c1ac8b3        38 minutes ago      1.15MB
uscwifi/httpd                                     latest              71e8e2f3a3a5        About an hour ago   1.15MB
uscwifi/httpd                                     v0.1-1              71e8e2f3a3a5        About an hour ago   1.15MB
redis                                             5                   5d2989ac9711        33 hours ago        95MB
nginx                                             1.15-alpine         315798907716        3 days ago          17.8MB
busybox                                           latest              758ec7f3a1ee        4 days ago          1.15MB
quay.io/coreos/flannel                            v0.10.0-amd64       f0fad859c909        11 months ago       44.6MB
[root@docker2 ~]# docker push registry.cn-shanghai.aliyuncs.com/uscwifi/httpd
The push refers to repository [registry.cn-shanghai.aliyuncs.com/uscwifi/httpd]
c8afcb5503d3: Pushed 
23bc2b70b201: Pushed 
v0.2: digest: sha256:7bc2e3c0bca86a692501522ff7adf637c1fcda87fca23a754e7db68f00c80f54 size: 734

web界面查看：

本地打包镜像传到另一机器测试

docker save -o

[root@docker2 ~]# docker image ls
REPOSITORY                                        TAG                 IMAGE ID            CREATED             SIZE
uscwifi/httpd                                     v0.2                a83a2c1ac8b3        About an hour ago   1.15MB
registry.cn-shanghai.aliyuncs.com/uscwifi/httpd   v0.2                a83a2c1ac8b3        About an hour ago   1.15MB
uscwifi/httpd                                     latest              71e8e2f3a3a5        About an hour ago   1.15MB
uscwifi/httpd                                     v0.1-1              71e8e2f3a3a5        About an hour ago   1.15MB
redis                                             5                   5d2989ac9711        33 hours ago        95MB
nginx                                             1.15-alpine         315798907716        3 days ago          17.8MB
busybox                                           latest              758ec7f3a1ee        4 days ago          1.15MB
quay.io/coreos/flannel                            v0.10.0-amd64       f0fad859c909        11 months ago       44.6MB
[root@docker2 ~]# docker save -o myimages.gz uscwifi/httpd:v0.1-1 uscwifi/httpd:v0.2
[root@docker2 ~]# ls
anaconda-ks.cfg  myimages.gz
[root@docker2 ~]# scp myimages.gz [email protected]:/root
The authenticity of host '192.168.2.163 (192.168.2.163)' can't be established.
ECDSA key fingerprint is SHA256:zPzQZA1fX/6pjipdAJc7Q4dPC6kHUTXdsf39ACWl1Ho.
ECDSA key fingerprint is MD5:44:99:bb:dc:09:65:2f:34:53:32:f6:77:c1:7d:7e:dd.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.2.163' (ECDSA) to the list of known hosts.
[email protected]'s password: 
myimages.gz

load镜像：

[root@docker1 ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
[root@docker1 ~]# ls
anaconda-ks.cfg  myimages.gz
[root@docker1 ~]# docker load --help

Usage:	docker load [OPTIONS]

Load an image from a tar archive or STDIN

Options:
  -i, --input string   Read from tar archive file, instead of STDIN
  -q, --quiet          Suppress the load output
[root@docker1 ~]# docker load -i myimages.gz 
23bc2b70b201: Loading layer [==================================================>]   1.37MB/1.37MB
07e1846f60c6: Loading layer [==================================================>]   5.12kB/5.12kB
Loaded image: uscwifi/httpd:v0.1-1
c8afcb5503d3: Loading layer [==================================================>]   5.12kB/5.12kB
Loaded image: uscwifi/httpd:v0.2
[root@docker1 ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
uscwifi/httpd       v0.2                a83a2c1ac8b3        About an hour ago   1.15MB
uscwifi/httpd       v0.1-1              71e8e2f3a3a5        About an hour ago   1.15MB