Take centos7 image as an example
Make a basic container, support sshd, and commonly used related commands
1. Use the commit command to create an image
1. Start a container
sudo docker run -it centos:latest /bin/bash
Note: The following operations are all in the container
2. In order to improve the efficiency of yum installation software, you can modify the yum installation source to 163
, refer to:
http://mirrors.163.com/.help/centos.html
3. Install common commands
which：yum install -y which.x86_64
netstat：yum install -y net-tools.x86_64
Install it with other commands
4. Install sshd
yum install -y openssh-server.x86_64 mkdir /var/run/sshd ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N "" ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ed25519_key -N "" ssh-keygen -t rsa -b 2048 -f /etc/ssh/ssh_host_rsa_key
5. Start sshd
/usr/sbin/sshd -D &
[root@8490caf7ea23 sshd]# netstat -tunpl Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 202/sshd tcp6 0 0 :::22 :::* LISTEN 202/sshd
6. Configure sshd
#Cancel pam restriction
sed -ri 's/session required pam_loginuid.so/#session required pam_loginuid.so/g' /etc/pam.d/sshd
Password-free login with the host, in fact, the following steps can be set without setting, but a password is required when logging in
mkdir /root/.ssh
back to host
ssh-keygen -b 1024 -t rsa cat id_rsa.pub >> authorized_keys
Copy the content in id_rsa.pub, go back to the container, and paste the copied content into the following file
vi /root/.ssh/authorized_keys chmod 700 .ssh/ chmod 600 .ssh/authorized_keys
7. Configure the sshd startup script
vi /run.sh #!/bin/bash /usr/sbin/sshd -D chmod +x run.sh
8.exit to exit the container
9. Save the container image
[hanqunfeng@localhost ~]$ sudo docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 8490caf7ea23 centos:latest "/bin/bash" 2 hours ago Exited (0) 2 minutes ago fervent_noether [hanqunfeng@localhost ~]$ sudo docker commit 849 sshd:centos7 sha256:b2387fd4ee2027255cfa90dcae16519ab0ad29b1bacb3fa904494431a2e2bf76 [hanqunfeng@localhost ~]$ sudo docker images REPOSITORY TAG IMAGE ID CREATED SIZE sshd centos7 b2387fd4ee20 43 seconds ago 1.022 GB
10.使用该镜像启动一个新的容器
sudo docker run -p 10022:22 -d sshd:centos7 /run.sh [hanqunfeng@localhost ~]$ sudo docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES b4f785fb87d4 sshd:centos7 "/run.sh" 53 seconds ago Up 52 seconds 0.0.0.0:10022->22/tcp stupefied_wilson
11.ssh登录容器
[hanqunfeng@localhost ~]$ ssh [email protected] -p 10022
[root@b4f785fb87d4 ~]#
说明：主机上可以免密登录，其它机器上需要输入容器的root密码，同时需要开通主机的10022端口
容器中设置root密码：登录容器后passwd root
主机设置iptablse规则：
sudo iptables
-A INPUT -p tcp -m state --state NEW -m tcp --dport 10022 -j ACCEPT
sudo service iptables save
二、使用Dockerfile创建镜像
1.基于刚刚创建好的sshd:centos7镜像，使用Dockerfile创建镜像，将run.sh内置为容器
启动时执行
的命令
[hanqunfeng@localhost ~]$ mkdir DockerFileDir [hanqunfeng@localhost ~]$ cd DockerFileDir/ [hanqunfeng@localhost DockerFileDir]$ vi Dockerfile FROM sshd:centos7 MAINTAINER from hanqunfeng [email protected] EXPOSE 22 CMD ["/run.sh"] [hanqunfeng@localhost DockerFileDir]$ sudo docker build -t sshd_run:centos7 . ：注意最后有一个点 [sudo] password for hanqunfeng: Sending build context to Docker daemon 2.048 kB Step 1 : FROM sshd:centos7 ---> 4f5d1b8378ce Step 2 : MAINTAINER from hanqunfeng [email protected] ---> Running in 0d942195d4fa ---> 5debebcb6742 Removing intermediate container 0d942195d4fa Step 3 : EXPOSE 22 ---> Running in 2493baf053fc ---> a4e2ff8dcdab Removing intermediate container 2493baf053fc Step 4 : CMD /run.sh ---> Running in 666bb0236615 ---> 770fc142d3c9 Removing intermediate container 666bb0236615 Successfully built 770fc142d3c9 [hanqunfeng@localhost DockerFileDir]$ sudo docker images REPOSITORY TAG IMAGE ID CREATED SIZE sshd_run centos7 770fc142d3c9 2 minutes ago 1.022 GB sshd centos7 4f5d1b8378ce About an hour ago 1.022 GB [hanqunfeng@localhost DockerFileDir]$ sudo docker run -p 10122:22 -d sshd_run:centos7 ：此时启动容器时不需要执行/run.sh命令 c9e1524ceb3baa6d7ea2735b45349916149ad4053cfb86398a44477cfbb6e021 [hanqunfeng@localhost DockerFileDir]$ sudo docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES c9e1524ceb3b sshd_run:centos7 "/run.sh" 11 seconds ago Up 9 seconds 0.0.0.0:10122->22/tcp ecstatic_heyrovsky b4f785fb87d4 sshd:centos7 "/run.sh" About an hour ago Up About an hour 0.0.0.0:10022->22/tcp stupefied_wilson [hanqunfeng@localhost DockerFileDir]$ ssh [email protected] -p 10122 The authenticity of host '[192.168.65.158]:10122 ([192.168.65.158]:10122)' can't be established. ECDSA key fingerprint is 28:22:d1:17:d6:57:b8:e5:bf:9a:28:3a:c5:06:79:bd. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '[192.168.65.158]:10122' (ECDSA) to the list of known hosts. [root@c9e1524ceb3b ~]#
2.Dockerfile说明
Dockerfile是docker构建镜像的基础，也是docker区别于其他容器的重要特征，正是有了Dockerfile，docker的自动化和可移植性才成为可能。
不论是开发还是运维，学会编写Dockerfile几乎是必备的，这有助于你理解整个容器的运行。
FROM <image name>, 从一个基础镜像构建新的镜像
FROM ubuntu MAINTAINER <author name>, 维护者信息
MAINTAINER William <wlj@nicescale.com>ENV <key> <value>, 设置环境变量
ENV TEST 1RUN <command>, 非交互式运行shell命令
RUN apt-get -y update
RUN apt-get -y install nginxADD <src> <dst>, 将外部文件拷贝到镜像里,src可以为url
ADD http://nicescale.com/ /data/nicescale.tgzWORKDIR /path/to/workdir, 设置工作目录
WORKDIR /var/wwwUSER <uid>, 设置用户ID
USER nginxVULUME <#dir>, 设置volume
VOLUME [‘/data’]EXPOSE <port>, 暴露哪些端口
EXPOSE 80 443 ENTRYPOINT [‘executable’, ‘param1’,’param2’]执行命令
ENTRYPOINT ["/usr/sbin/nginx"]CMD [“param1","param2"]
CMD ["start"]docker创建、启动container时执行的命令，如果设置了ENTRYPOINT，则CMD将作为参数</usr/sbin/nginx start>
Dockerfile最佳实践
- 尽量将一些常用不变的指令放到前面
- CMD和ENTRYPOINT尽量使用json数组方式
通过Dockerfile构建image
docker build csphere/nginx:1.7 .