# Docker
# 【上課筆記】【hiskio】Docker 完全實作！結合 3 大語言掌握容器實務應用
##### 上課講義
[Docker 完全實作 – Dropbox Paper](https://paper.dropbox.com/doc/Docker--BaNWxS3HDfry~X6QJb7Ze4plAg-pcGbQoyLtmiPPoIlkkK2r)
---
[](https://bookstack.treemanou.com/uploads/images/gallery/2022-01/0giARnkNtAdZy4q4-image-1642476831997.png)
nocopy : 存在檔案不覆蓋
# Docker 完全實作
#  讓我們先複習一下 Docker 的安裝
## Windows 上的 Docker 環境建置
[https://docs.docker.com/desktop/windows/install/](https://docs.docker.com/desktop/windows/install/)
- 什麼是WSL？
- 適用於 Linux 的 Windows 子系統可讓開發人員執行 GNU/Linux 環境 (包括大部分的命令列工具、公用程式和應用程式)，直接在 Windows 上執行，不需進行修改，不會造成傳統虛擬機器或 dualboot 設定的額外負荷。
- [https://docs.microsoft.com/zh-tw/windows/wsl/about](https://docs.microsoft.com/zh-tw/windows/wsl/about)
[https://www.youtube.com/watch?v=lIkxbE\_We1I&](https://www.youtube.com/watch?v=lIkxbE_We1I&)
[https://youtu.be/lIkxbE\_We1I](https://youtu.be/lIkxbE_We1I)
## Mac 上的 Docker 環境建置
[https://docs.docker.com/desktop/mac/install/](https://docs.docker.com/desktop/mac/install/)
- 如果您的筆電是Apple M1 (Silicon) CPU的話，請參考此處的安裝方式：
- [https://docs.docker.com/desktop/mac/apple-silicon/](https://docs.docker.com/desktop/mac/apple-silicon/)
 **Apple M1的限制**
- 非所有映像檔都可用於 ARM64 架構。可以使用 --platform linux/amd64 模擬運行。但 mysql 不適用於 ARM64，不過可以使用 mariadb 解決此問題。
- 模擬Intel的容器可能會有不穩定的狀況出現，除了速度比較慢之外，也會使用更多的記憶體。
- 無法從容器內部 ping 到 Internet。要測試網絡，我們建議使用 curl 或 wget。
- 當 TCP half-close時，數據可能偶爾會丟失。
-
## Linux 上的 Docker 環境建置
[https://docs.docker.com/engine/install/ubuntu/](https://docs.docker.com/engine/install/ubuntu/)
## 實務上需要注意的事
-  在大型組織（超過 250 名員工或超過 1000 萬美元的收入）中使用 Docker Desktop 需要付費訂閱 Docker。 雖然此條款的生效日期是 2021 年 8 月 31 日，但對於需要付費訂閱的用戶，寬限期到 2022 年 1 月 31 日。
**CPU/Memory資源**
**掛載目錄**
**Buildkit**
**回復初始設定**
#  工欲善其事，必先利其器：Docker 技術快覽
## Docker 常用指令
**執行容器**
`# 跑一個新的apache容器`
`docker run httpd:alpine`
`# 跑一個背景執行的apache容器，並取名為apache`
`docker run -d --name apache httpd:alpine `
`# 跑一個redis容器，啟動虛擬終端機，進入互動模式，在容器中執行sh`
`docker run -it --rm redis:alpine sh`
- -it : i指的就是互動模式，而 t就是指terminal的意示
- --rm :指的是當容器結束後，將容器從系統移除
**列出容器**
`# 列出所有執行中容器`
`docker ps`
`# 列出所有容器`
`docker ps -a`
**停止容器**
`# 停止apache 容器`
`docker stop `
**重新啟動容器**
`# 重新啟動apache`
`docker restart `
**Kill容器**
`#強制停止容器`
`docker kill apache`
**移除容器**
`#移除apache`
`docker rm apache`
`#檢查所有容器`
`docker ps -a`
`#移除所有容器`
`docker rm -f $(docker ps -a -q)`
**複製檔案**
`# 建立一個hello.html`
`echo "hello" > hello.html`
`# 建立apache`
`docker run -d --name apache httpd:alpine `
`# 複製檔案至apache 容器中`
`docker cp hello.html apache:/usr/local/apache2/htdocs/`
`# 複製apache 容器中的檔案至本機`
`docker cp apache:/usr/local/apache2/htdocs/index.html ./index.html`
**在容器內執行程式**
`#在容器中執行shell`
`docker exec -it apache sh`
**掛載目錄**
`#把hello.html掛成index.html`
`docker run -d --name apache2 -v $PWD/hello.html:/usr/local/apache2/htdocs/index.html httpd:alpine`
`# copy出來驗證內容是否一樣`
`docker cp apache2:/usr/local/apache2/htdocs/index.html ./index.html`
`diff index.html hello.html`
**建立外部連線**
`#把「本機的80埠」對應到「容器中的80埠」`
`docker run -d -v $PWD/hello.html:/usr/local/apache2/htdocs/index.html -p 80:80 httpd:alpine`
[http://127.0.0.1:80](http://127.0.0.1:80)
-  [如何從容器中，連到本機上的服務呢](https://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach)？
- 可以在容器中使用 host.docker.internal 來連接本機上的服務喔！
**查看容器狀態**
`# 查看 CPU、記憶體與網路用量`
`docker stats`
**查看容器內的行程**
`# 查看容器內部的行程`
`docker top apache`
`docker top apache2`
**查看容器Logs**
`#查看log`
`docker logs apache`
`#持續查看`
`docker logs -f apache2`
**建立映像檔**
`# 於當前目錄，按Dockerfile.test中的指令，建立test:v1的映像檔`
`docker build . -f Dockerfile.test -t test:v1`
**拉取與推送映像檔**
`#從docker hub下載 node的image`
`docker pull node:alpine`
`#將下來的image，再給於新的標籤`
`docker tag node:alpine macchiang/node:alpine`
`#推送新的標籤至私人倉庫`
`docker push macchiang/node:alpine`
**清除映像檔與容器**
`#停掉全部container`
`docker stop $(docker ps -a -q)`
`#刪除所有沒有使用的container與image`
`docker system prune`
`#刪除所有映像檔`
`docker rmi $(docker images -a -q)`
`#清除volume`
`docker volume rm $(docker volume ls)`
`#刪除所有沒有使用的container、image及所有volume`
`docker system prune -a -f --volumes`
## Dockerfile 起手式
**基本組成**
`# Base Image - Official Alpine`
`FROM alpine`
` `
`LABEL "maintainer"="macchiang@gmail.com"`
` `
`# Upgrade existing packages in the base image`
`RUN apk --no-cache upgrade`
` `
`# Install apache from packages with out caching install files`
`RUN apk add --no-cache apache2`
` `
`# Open port for httpd access`
`EXPOSE 80`
` `
`# Run httpd in foreground`
`CMD ["-D","FOREGROUND"]`
` `
`# Start httpd when container runs`
`ENTRYPOINT ["/usr/sbin/httpd"]`
-  **CMD** vs. **ENTRYPOINT**
- CMD配置的是預設命令，是可以被複寫掉的。而ENTRYPOINT是一定會執行的命令。
- 兩者共用的話，完整的命令會是ENTRYPOINT + CMD
建立docker image
`docker build . -t apache:v1`
複寫CMD
`#直接複寫CMD，改為顯示版號`
`docker run --rm apache:v1 -v`
**ENV環境變數**
`FROM alpine`
`ENV NODE_ENV="development"`
**ARG傳入參數**
`FROM alpine`
`ARG NODE_ARG`
`ENV NODE_ENV="${NODE_ARG:-development}"`
`RUN echo "ARG=${NODE_ARG}, ENV=${NODE_ENV}"`
`CMD echo "ARG=${NODE_ARG}, ENV=${NODE_ENV}"`
`# 傳入NODE_ARG`
`docker build --build-arg NODE_ARG=staging .`
`# 傳入NODE_ARG`
`DOCKER_BUILDKIT=0 docker build .`
**COPY與ADD 複製文件**
- 功能：將檔案複製到image中
- 差異：
- COPY只能複製本機端的檔案或目錄
- ADD可增加url的檔案到docker image (建議改用RUN curl/wget)
- ADD可將本機端認可的壓縮格式tar解開後複製進去(要小心)
- 最佳實踐： 盡量使用COPY而不是ADD
`#複製package.json到/app下`
`COPY package.json /app/`
`#複製所有file開頭的檔案到/app下，並改變檔案所屬用戶與群組`
`COPY --chown=user:group file* /app/`
-  若有些檔案不需要加入到image中， 可以建立 .dockerignore 來忽略喔！
**WORKDIR工作目錄**
`# hi.txt會在/目錄下`
`RUN echo "say hi" > hi.txt`
`WORKDIR /app`
`# world.txt會在/app的目錄下`
`RUN echo "hello" > world.txt`
**USER指定當前用戶**
`#新增group與user`
`RUN groupadd -r redis && useradd -r -g redis redis`
`#指定當前的user為redis`
`USER redis`
`#以redis的身份執行redis-server`
`RUN [ "redis-server" ]`
**HEALTHCHECK 健康檢查**
`FROM nginx`
`RUN apt-get update && apt-get install -y curl && `
`HEALTHCHECK --interval=5s --timeout=3s \`
` CMD curl -fs http://localhost/ || exit 1`
## 打造最小的Docker映像檔
**多階段建置Multi-stage Build**
`# Stage 1 建置環境`
`FROM alpine build`
`RUN echo "hello" > mytest`
` `
`# Stage 2 執行環境`
`FROM alpine `
` /mytest .`
`RUN cat /mytest`
**Distroless**
[https://github.com/GoogleContainerTools/distroless](https://github.com/GoogleContainerTools/distroless)
[https://github.com/GoogleContainerTools/distroless/tree/main/examples/go](https://github.com/GoogleContainerTools/distroless/tree/main/examples/go)
main.go
`package main`
` `
`import "fmt"`
` `
`func main() {`
` fmt.Println("Hello, world!")`
`}`
Dockerfile
`FROM golang:1.12 as build-env`
`WORKDIR /go/src/app`
`COPY . /go/src/app`
`RUN go get -d -v ./...`
`RUN go build -o /go/bin/app`
` `
`FROM gcr.io/distroless/base`
`COPY --from=build-env /go/bin/app /`
`CMD ["/app"]`
## 建立多重系統架構的映像檔
**不同執行環境的問題**
**使用Buildx建構多重系統架構的映像檔**
[https://docs.docker.com/desktop/multi-arch/](https://docs.docker.com/desktop/multi-arch/)
`#確認目前的builder為何`
`docker buildx ls`
`#建立新的builder並切換過去`
`docker buildx create --name multiarch --use`
 若在linux環境中建立builder的話，需要額外跑qemu-user-static容器，並將driver設為docker-container
`docker run --rm --privileged multiarch/qemu-user-static --reset -p yes`
`docker buildx create --name multiarch --driver docker-container --use`
`#檢查目前的builder`
`docker buildx inspect --bootstrap`
`#建立支援amd64與arm64的image，並且推送至registry`
`docker buildx build . --platform linux/amd64,linux/arm64 --push -t hello:v1`
#  一次控制多個容器：Docker Compose
## Docker Compose 的概念
- 定義和運行多個容器應用。
- 使用 YAML 文件來配置應用服務
- 使用單一命令從配置中創建和啟動所有服務
- 適用於所有環境：生產、Staging、開發、測試以及 CI 工作流
## Docker Compose 文件格式
**基本格式**
預設文件名稱為 docker-compose.yml
`version: "3"`
`services:`
` webapp:`
` #指定image`
` image: httpd:alpine `
` ports:`
` - "80:80"`
` volumes:`
` - "/data"`
**build 建立映像檔**
`version: '3'`
`services:`
` webapp:`
` #從Dockerfile-alternate建立映像檔`
` build:`
` context: .`
` dockerfile: Dockerfile-alternate`
` args:`
` buildno: 1`
[https://docs.microsoft.com/zh-tw/visualstudio/docker/tutorials/use-docker-compose](https://docs.microsoft.com/zh-tw/visualstudio/docker/tutorials/use-docker-compose)
[https://docs.docker.com/compose/compose-file/compose-file-v3/](https://docs.docker.com/compose/compose-file/compose-file-v3/)
## Docker Compose 命令參考
[https://docs.docker.com/compose/reference/](https://docs.docker.com/compose/reference/)
**執行docker compose**
`#前景執行`
`docker-compose up`
`#背景執行`
`docker-compose up -d`
**停止/啟動docker compose**
`docker-compose stop`
**移除docker compose**
`docker-compose down`
`#也同步移除volume`
`docker-compose down -v`
**列出containers**
`docker-compose ps`
**監看logs**
`docker-compose logs`
`#follow logs`
`docker-compose logs -f`
**執行程式**
`docker-compose exec webapp sh`
**顯示執行程序**
`docker-compose top`
## Docker Compose 環境變數
**environment**
`environment:`
` RACK_ENV: development`
` SHOW: 'true'`
` SESSION_SECRET:`
`environment:`
` - RACK_ENV=development`
` - SHOW=true`
` - SESSION_SECRET`
**env\_file**
.env
`VAR=hello`
`MYENV=development`
`env_file: .env`
`env_file:`
` - ./common.env`
` - ./apps/web.env`
` - /opt/runtime_opts.env`
## Docker Compose 健康檢查
`healthcheck:`
` test: ["CMD", "curl", "-f", "http://localhost"]`
` interval: 1m30s`
` timeout: 10s`
` retries: 3`
` start_period: 40s`
## Docker Compose 起動順序
`version: "3"`
`services:`
` web:`
` build: .`
` ports:`
` - "80:8000"`
` depends_on:`
` - "db"`
` command: ["./wait-for-it.sh", "db:5432", "--", "python", "app.py"]`
` db:`
` image: postgres`
**** **小工具**
- [wait-for-it](https://github.com/vishnubob/wait-for-it)
- [wait-for](https://github.com/Eficode/wait-for)
## Docker Compose 磁碟掛載
Long syntax
`version: "3.9"`
`services:`
` web:`
` image: nginx:alpine`
` volumes:`
` - type: volume`
` source: mydata`
` target: /data`
` volume:`
` nocopy: true`
` - type: bind`
` source: ./static`
` target: /opt/app/static`
` `
` db:`
` image: postgres:latest`
` volumes:`
` - "/var/run/postgres/postgres.sock:/var/run/postgres/postgres.sock"`
` - "dbdata:/var/lib/postgresql/data"`
` `
`volumes:`
` mydata:`
` dbdata:`
Short syntax
`volumes:`
` # Just specify a path and let the Engine create a volume`
` - /var/lib/mysql`
` `
` # Specify an absolute path mapping`
` - /opt/data:/var/lib/mysql`
` `
` # Path on the host, relative to the Compose file`
` - ./cache:/tmp/cache`
` `
` # User-relative path`
` - ~/configs:/etc/configs/:ro`
` `
` # Named volume`
` - datavolume:/var/lib/mysql`
#  如何導入Docker
## Docker導入流程
1. 確認應用程式使用的程式語言與版本
2. 參考相同程式語言的Dockerfile寫法
3. 列出應用程式相依的套件(包含系統、語言、字型等等)
4. 列出應用程式的設定(環境變數、設定檔)
5. 撰寫Dockerfile並測試
6. 檢查是否有檔案不該加入映像檔中( .dockerignore)
7. 列出應用程式相依的服務(Database、Redis)
8. 確認服務啟動順序並撰寫Docker Compose yaml
## 實作：Node.js + MongoDB打造API服務
[https://github.com/macchiang/node-express-mongo-example](https://github.com/macchiang/node-express-mongo-example)
**透過 Dockerfile 部署 Node.js 環境**
`# Base image`
`FROM node:16-alpine`
` `
`RUN apk upgrade --no-cache`
` `
`# Create app directory`
`RUN mkdir -p /app`
`WORKDIR /app`
` `
`# Install app dependencies`
`COPY package.json package-lock.json ./`
`RUN npm install`
` `
`# copy app source`
`COPY . /app`
` `
`# service port`
`EXPOSE 3000`
` `
`CMD [ "node", "index.js"]`
**Docker Compose YAML**
`version: "3.9"`
`services:`
` express:`
` build:`
` context: ./`
` dockerfile: Dockerfile`
` image: express:latest`
` ports:`
` - 3000:3000`
` depends_on:`
` - mongo`
` mongo:`
` image: mongo:5`
` ports:`
` - 27017:27017`
` `
`volumes:`
` mongo_data:`
##  作業-health check的妙用
- 請在Node.js + MongoDB的 Docker Compose YAML中加入health check，以確保當MongoDB啟動後，才啟動express
#  Docker X Python實作：快速打造 LINE Bot
## 透過 Dockerfile 建立 Python 環境
**確認python的image與版本**
[https://hub.docker.com/\_/python](https://hub.docker.com/_/python)
**了解Dockerfile**
` `
`WORKDIR /usr/src/app`
` `
`COPY requirements.txt ./`
`RUN pip install --no-cache-dir -r requirements.txt`
` `
`COPY . .`
` `
`CMD [ "python", "./your-daemon-or-script.py" ]`
` `
## Flask + Redis 打造計數器
[https://github.com/macchiang/hit-counter](https://github.com/macchiang/hit-counter)
docker-compose.yml
`version: '2'`
`services:`
` myapp:`
` build: .`
` ports:`
` - "80:5000"`
` redis-lb:`
` image: "redis:alpine"`
## 構建 Django Web server
[https://github.com/macchiang/django-todolist](https://github.com/macchiang/django-todolist)
[https://developer.mozilla.org/zh-TW/docs/Learn/Server-side/Django/Introduction](https://developer.mozilla.org/zh-TW/docs/Learn/Server-side/Django/Introduction)
**先了解專案的安裝方式**
**Dockerfile**
` `
`WORKDIR /app`
` `
`COPY requirements.txt ./`
`RUN pip install --no-cache-dir -r requirements.txt`
` `
`COPY todo/* .`
`RUN python manage.py migrate`
`CMD [ "python", "manage.py", "runserver" ]`
**docker-compose.yaml**
`version: '3.9'`
`services:`
` myweb:`
` build: .`
` ports:`
` - "8000:8000"`
## 部署 LINE Bot 應用
[https://github.com/macchiang/line-bot-tutorial](https://github.com/macchiang/line-bot-tutorial)
[https://github.com/line/line-bot-sdk-python/tree/master/examples/simple-server-echo](https://github.com/line/line-bot-sdk-python/tree/master/examples/simple-server-echo)
**在你開始之前**
確保您具有以下內容：
- 擁有 Line 帳號
- 擁有 [Heroku](https://www.heroku.com/) 帳戶（您可以免費創建一個）
**建立LINE Bot 頻道**
- [Messaging API 介紹](https://developers.line.biz/zh-hant/docs/messaging-api/overview/)
- [開始使用 Messaging API](https://developers.line.biz/zh-hant/docs/messaging-api/getting-started/)
- 取得 **Channel access token** 與 **Channel secret**
- 關閉預設罐頭回覆訊息
**建立Docker Image**
`FROM python:3-slim-bullseye`
`WORKDIR /app`
`COPY requirements.txt ./`
`RUN pip install --no-cache-dir -r requirements.txt`
`COPY app.py .`
`CMD [ "python", "app.py"]`
`docker build . -t line-bot:latest`
**安裝Heroku CLI**
[https://devcenter.heroku.com/articles/heroku-cli#download-and-install](https://devcenter.heroku.com/articles/heroku-cli#download-and-install)
**建立Heroku App**
`#登入heroku`
`heroku login`
`#登入heroku registry`
`heroku container:login`
`#建立app`
`heroku create`
` `
`#Creating app... done, ⬢ morning-journey-43865`
`#https://morning-journey-43865.herokuapp.com/ | https://git.heroku.com/morning-journey-43865.git`
` `
`#推送docker image至heroku registry`
`docker tag line-bot:latest registry.heroku.com/morning-journey-43865/web`
`docker push registry.heroku.com/morning-journey-43865/web`
` `
` `
`#設定環境變數`
`heroku config:set CHANNEL_ACCESS_TOKEN=xxxxxxxxx`
`heroku config:set CHANNEL_SECRET=xxxxxxxxx`
` `
`#deploy docker image`
`heroku container:release web`
**設定Webhook**
[https://devcenter.heroku.com/articles/container-registry-and-runtime](https://devcenter.heroku.com/articles/container-registry-and-runtime)
**加入好友與測試**
**Debug**
`❯ heroku logs --tail`
`2021-11-09T15:17:06.932541+00:00 app[api]: Release v1 created by user macchiang@gmail.com`
`2021-11-09T15:17:06.932541+00:00 app[api]: Initial release by user macchiang@gmail.com`
`2021-11-09T15:17:07.532399+00:00 app[api]: Release v2 created by user macchiang@gmail.com`
`2021-11-09T15:17:07.532399+00:00 app[api]: Enable Logplex by user macchiang@gmail.com`
`2021-11-09T15:22:12.485507+00:00 app[api]: Deployed web (1be43e5135d6) by user macchiang@gmail.com`
`2021-11-09T15:22:12.485507+00:00 app[api]: Release v3 created by user macchiang@gmail.com`
`2021-11-09T15:22:12.503987+00:00 app[api]: Scaled to web@1:Free by user macchiang@gmail.com`
`2021-11-09T15:22:15.916499+00:00 heroku[web.1]: Starting process with command `python app.py``
`2021-11-09T15:22:18.365293+00:00 app[web.1]: Traceback (most recent call last):`
`2021-11-09T15:22:18.365308+00:00 app[web.1]: File "/app/app.py", line 15, in `
`2021-11-09T15:22:18.365410+00:00 app[web.1]: line_bot_api = LineBotApi(os.getenv('CHANNEL_ACCESS_TOKEN'))`
`2021-11-09T15:22:18.365411+00:00 app[web.1]: File "/usr/local/lib/python3.10/site-packages/linebot/api.py", line 63, in __init__`
`2021-11-09T15:22:18.365516+00:00 app[web.1]: 'Authorization': 'Bearer ' + channel_access_token,`
`2021-11-09T15:22:18.374292+00:00 app[web.1]: TypeError: can only concatenate str (not "NoneType") to str`
`2021-11-09T15:22:18.660220+00:00 heroku[web.1]: Process exited with status 1`
`2021-11-09T15:22:19.074969+00:00 heroku[web.1]: State changed from starting to crashed`
`2021-11-09T15:22:19.218365+00:00 heroku[web.1]: State changed from crashed to starting`
`2021-11-09T15:22:22.107500+00:00 heroku[web.1]: Starting process with command `python app.py``
`2021-11-09T15:22:23.219784+00:00 app[web.1]: Traceback (most recent call last):`
`2021-11-09T15:22:23.219806+00:00 app[web.1]: File "/app/app.py", line 15, in `
`2021-11-09T15:22:23.219930+00:00 app[web.1]: line_bot_api = LineBotApi(os.getenv('CHANNEL_ACCESS_TOKEN'))`
`2021-11-09T15:22:23.219934+00:00 app[web.1]: File "/usr/local/lib/python3.10/site-packages/linebot/api.py", line 63, in __init__`
`2021-11-09T15:22:23.219959+00:00 app[web.1]: 'Authorization': 'Bearer ' + channel_access_token,`
`2021-11-09T15:22:23.219961+00:00 app[web.1]: TypeError: can only concatenate str (not "NoneType") to str`
`2021-11-09T15:22:23.417290+00:00 heroku[web.1]: Process exited with status 1`
`2021-11-09T15:22:23.492672+00:00 heroku[web.1]: State changed from starting to crashed`
`2021-11-09T15:22:38.443725+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path="/" host=morning-journey-43865.herokuapp.com request_id=b91dba06-950e-4887-840e-60fc5986866f fwd="36.227.157.168" dyno= connect= service= status=503 bytes= protocol=https`
`2021-11-09T15:22:39.424038+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path="/favicon.ico" host=morning-journey-43865.herokuapp.com request_id=becc5a52-35a7-4557-b751-02d382a2b67e fwd="36.227.157.168" dyno= connect= service= status=503 bytes= protocol=https`
#  Docker X PHP實作：架設一個 WordPress 網站
## 透過 Dockerfile 部署 PHP 環境
**先從**[**Php官方**](https://hub.docker.com/_/php)**Dockerfile學起**
[https://github.com/macchiang/php-hello-world](https://github.com/macchiang/php-hello-world)
Dockerfile
`FROM php:7.3-apache`
`COPY index.php /var/www/html/`
建立Docker image與Container
`docker build . -t hello:latest`
`docker run -it --rm -p 8080:80 hello:latest`
[https://www.astralweb.com.tw/what-is-differences-between-fastcgi-php-fpm/](https://www.astralweb.com.tw/what-is-differences-between-fastcgi-php-fpm/)
## 將 MySQL 加入部署行列
[https://github.com/macchiang/php-docker-simple](https://github.com/macchiang/php-docker-simple)
docker-compose.yml
`# Use root/example user/password credentials`
`version: '3.1'`
` `
`services:`
` php:`
` build:`
` context: .`
` dockerfile: Dockerfile`
` ports:`
` - 80:80`
` volumes:`
` - ./src:/var/www/html/`
` `
` db:`
` image: mysql`
` command: --default-authentication-plugin=mysql_native_password`
` restart: always`
` environment:`
` MYSQL_ROOT_PASSWORD: example`
` volumes:`
` - mysql-data:/var/lib/mysql`
` `
` adminer:`
` image: adminer`
` restart: always`
` ports:`
` - 8080:8080`
` `
`volumes:`
` mysql-data:`
## 建立WordPress 網站
**再由**[**WordPresss官方Dockerfile學起**](https://github.com/docker-library/wordpress/blob/master/latest/php7.3/apache/Dockerfile)
` #`
`# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"`
`#`
`# PLEASE DO NOT EDIT IT DIRECTLY.`
`#`
` `
`FROM php:7.3-apache`
` `
`# persistent dependencies`
`RUN set -eux; \`
` apt-get update; \`
` apt-get install -y --no-install-recommends \`
`# Ghostscript is required for rendering PDF previews`
` ghostscript \`
` ; \`
` rm -rf /var/lib/apt/lists/*`
` `
`# install the PHP extensions we need (https://make.wordpress.org/hosting/handbook/handbook/server-environment/#php-extensions)`
`RUN set -ex; \`
` \`
` savedAptMark="$(apt-mark showmanual)"; \`
` \`
` apt-get update; \`
` apt-get install -y --no-install-recommends \`
` libfreetype6-dev \`
` libjpeg-dev \`
` libmagickwand-dev \`
` libpng-dev \`
` libwebp-dev \`
` libzip-dev \`
` ; \`
` \`
` docker-php-ext-configure gd \`
` --with-freetype-dir=/usr \`
` --with-jpeg-dir=/usr \`
` --with-png-dir=/usr \`
` --with-webp-dir=/usr \`
` ; \`
` docker-php-ext-install -j "$(nproc)" \`
` bcmath \`
` exif \`
` gd \`
` mysqli \`
` zip \`
` ; \`
`# https://pecl.php.net/package/imagick`
` pecl install imagick-3.5.0; \`
` docker-php-ext-enable imagick; \`
` rm -r /tmp/pear; \`
` \`
`# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies`
` apt-mark auto '.*' > /dev/null; \`
` apt-mark manual $savedAptMark; \`
` ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \`
` | awk '/=>/ { print $3 }' \`
` | sort -u \`
` | xargs -r dpkg-query -S \`
` | cut -d: -f1 \`
` | sort -u \`
` | xargs -rt apt-mark manual; \`
` \`
` apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \`
` rm -rf /var/lib/apt/lists/*`
` `
`# set recommended PHP.ini settings`
`# see https://secure.php.net/manual/en/opcache.installation.php`
`RUN set -eux; \`
` docker-php-ext-enable opcache; \`
` { \`
` echo 'opcache.memory_consumption=128'; \`
` echo 'opcache.interned_strings_buffer=8'; \`
` echo 'opcache.max_accelerated_files=4000'; \`
` echo 'opcache.revalidate_freq=2'; \`
` echo 'opcache.fast_shutdown=1'; \`
` } > /usr/local/etc/php/conf.d/opcache-recommended.ini`
`# https://wordpress.org/support/article/editing-wp-config-php/#configure-error-logging`
`RUN { \`
`# https://www.php.net/manual/en/errorfunc.constants.php`
`# https://github.com/docker-library/wordpress/issues/420#issuecomment-517839670`
` echo 'error_reporting = E_ERROR | E_WARNING | E_PARSE | E_CORE_ERROR | E_CORE_WARNING | E_COMPILE_ERROR | E_COMPILE_WARNING | E_RECOVERABLE_ERROR'; \`
` echo 'display_errors = Off'; \`
` echo 'display_startup_errors = Off'; \`
` echo 'log_errors = On'; \`
` echo 'error_log = /dev/stderr'; \`
` echo 'log_errors_max_len = 1024'; \`
` echo 'ignore_repeated_errors = On'; \`
` echo 'ignore_repeated_source = Off'; \`
` echo 'html_errors = Off'; \`
` } > /usr/local/etc/php/conf.d/error-logging.ini`
` `
`RUN set -eux; \`
` a2enmod rewrite expires; \`
` \`
`# https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html`
` a2enmod remoteip; \`
` { \`
` echo 'RemoteIPHeader X-Forwarded-For'; \`
`# these IP ranges are reserved for "private" use and should thus *usually* be safe inside Docker`
` echo 'RemoteIPTrustedProxy 10.0.0.0/8'; \`
` echo 'RemoteIPTrustedProxy 172.16.0.0/12'; \`
` echo 'RemoteIPTrustedProxy 192.168.0.0/16'; \`
` echo 'RemoteIPTrustedProxy 169.254.0.0/16'; \`
` echo 'RemoteIPTrustedProxy 127.0.0.0/8'; \`
` } > /etc/apache2/conf-available/remoteip.conf; \`
` a2enconf remoteip; \`
`# https://github.com/docker-library/wordpress/issues/383#issuecomment-507886512`
`# (replace all instances of "%h" with "%a" in LogFormat)`
` find /etc/apache2 -type f -name '*.conf' -exec sed -ri 's/([[:space:]]*LogFormat[[:space:]]+"[^"]*)%h([^"]*")/\1%a\2/g' '{}' +`
` `
`RUN set -eux; \`
` version='5.8.2'; \`
` sha1='c3b1b59553eafbf301c83b14c5eeae4cf1c86044'; \`
` \`
` curl -o wordpress.tar.gz -fL "https://wordpress.org/wordpress-$version.tar.gz"; \`
` echo "$sha1 *wordpress.tar.gz" | sha1sum -c -; \`
` \`
`# upstream tarballs include ./wordpress/ so this gives us /usr/src/wordpress`
` tar -xzf wordpress.tar.gz -C /usr/src/; \`
` rm wordpress.tar.gz; \`
` \`
`# https://wordpress.org/support/article/htaccess/`
` [ ! -e /usr/src/wordpress/.htaccess ]; \`
` { \`
` echo '# BEGIN WordPress'; \`
` echo ''; \`
` echo 'RewriteEngine On'; \`
` echo 'RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]'; \`
` echo 'RewriteBase /'; \`
` echo 'RewriteRule ^index\.php$ - [L]'; \`
` echo 'RewriteCond %{REQUEST_FILENAME} !-f'; \`
` echo 'RewriteCond %{REQUEST_FILENAME} !-d'; \`
` echo 'RewriteRule . /index.php [L]'; \`
` echo ''; \`
` echo '# END WordPress'; \`
` } > /usr/src/wordpress/.htaccess; \`
` \`
` chown -R www-data:www-data /usr/src/wordpress; \`
`# pre-create wp-content (and single-level children) for folks who want to bind-mount themes, etc so permissions are pre-created properly instead of root:root`
`# wp-content/cache: https://github.com/docker-library/wordpress/issues/534#issuecomment-705733507`
` mkdir wp-content; \`
` for dir in /usr/src/wordpress/wp-content/*/ cache; do \`
` dir="$(basename "${dir%/}")"; \`
` mkdir "wp-content/$dir"; \`
` done; \`
` chown -R www-data:www-data wp-content; \`
` chmod -R 777 wp-content`
` `
`VOLUME /var/www/html`
` `
`COPY --chown=www-data:www-data wp-config-docker.php /usr/src/wordpress/`
`COPY docker-entrypoint.sh /usr/local/bin/`
` `
`ENTRYPOINT ["docker-entrypoint.sh"]`
`CMD ["apache2-foreground"]`
[https://github.com/macchiang/wordpress-demo](https://github.com/macchiang/wordpress-demo)
docker-compose.yaml
`version: "3.3"`
`services:`
` db:`
` image: mysql`
` volumes:`
` - db_data:/var/lib/mysql`
` restart: always`
` environment:`
` MYSQL_ROOT_PASSWORD: somewordpress`
` MYSQL_DATABASE: wordpress`
` MYSQL_USER: wordpress`
` MYSQL_PASSWORD: wordpress`
` wordpress:`
` depends_on:`
` - db`
` image: wordpress`
` ports:`
` - "8000:80"`
` restart: always`
` environment:`
` WORDPRESS_DB_HOST: db:3306`
` WORDPRESS_DB_USER: wordpress`
` WORDPRESS_DB_PASSWORD: wordpress`
`volumes:`
` db_data:`
` `
#  Docker X Node.js實作：打造前後端具備的 To-Do List
## 建立Express + Nginx組合
[https://github.com/macchiang/express-nginx](https://github.com/macchiang/express-nginx)
**Nginx config**
`server {`
` listen 80 default_server;`
` listen [::]:80 default_server;`
` server_tokens off;`
` client_max_body_size 15M;`
` if ($http_x_forwarded_proto = "http") {`
` return 301 https://$host$request_uri;`
` }`
` location / {`
` proxy_set_header X-Real-IP $remote_addr;`
` proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`
` proxy_set_header Host $http_host;`
` proxy_set_header X-NginX-Proxy true;`
` proxy_pass http://node:3000;`
` proxy_redirect off;`
` }`
`}`
docker-compose.yml
`version: "3"`
`services:`
` nginx:`
` image: nginx:alpine`
` volumes:`
` - ./nginx:/etc/nginx/conf.d`
` links:`
` - node`
` ports:`
` - 80:80`
` node:`
` build:`
` context: .`
` image: express-nginx:latest`
` `
## 打造To-Do List
[https://github.com/macchiang/express-mongoDB-TodoList](https://github.com/macchiang/express-mongoDB-TodoList)
Ddockerfile
`# Base image`
`FROM node:16-alpine`
`RUN apk upgrade --no-cache`
`# Create app directory`
`RUN mkdir -p /app`
`WORKDIR /app`
`# Install app dependencies`
`COPY package.json package-lock.json ./`
`RUN npm install`
`# copy app source`
`COPY . /app`
`# service port`
`EXPOSE 3000`
`CMD [ "node", "app.js"]`
docker-compose.yml
`version: "3"`
`services:`
` nginx:`
` image: nginx:alpine`
` volumes:`
` - ./nginx:/etc/nginx/conf.d`
` links:`
` - node`
` ports:`
` - 80:80`
` node:`
` build:`
` context: .`
` depends_on:`
` - mongo`
` mongo:`
` image: mongo:5`
` ports:`
` - 27017:27017`
` volumes:`
` - mongo_data:/data/db`
`volumes:`
` mongo_data:`
#  參考資料
- [https://blog.gtwang.org/linux/docker-commands-and-container-management-tutorial/](https://blog.gtwang.org/linux/docker-commands-and-container-management-tutorial/)
- [https://hub.docker.com/r/broadtech/alpine-apache2/dockerfile](https://hub.docker.com/r/broadtech/alpine-apache2/dockerfile)
- [https://ithelp.ithome.com.tw/articles/10251549](https://ithelp.ithome.com.tw/articles/10251549)
- [https://www.tpisoftware.com/tpu/articleDetails/1216](https://www.tpisoftware.com/tpu/articleDetails/1216)
- [https://yeasy.gitbook.io/docker\_practice](https://yeasy.gitbook.io/docker_practice)
- [https://blog.techbridge.cc/2018/09/07/docker-compose-tutorial-intro/](https://blog.techbridge.cc/2018/09/07/docker-compose-tutorial-intro/)
- [https://yeasy.gitbook.io/docker\_practice/compose/usage](https://yeasy.gitbook.io/docker_practice/compose/usage)
- [https://dev.to/truthseekers/setup-a-basic-local-php-development-environment-in-docker-kod](https://dev.to/truthseekers/setup-a-basic-local-php-development-environment-in-docker-kod)
- [https://dotblogs.com.tw/explooosion/2018/09/15/194754#2](https://dotblogs.com.tw/explooosion/2018/09/15/194754#2)
- [https://dca.gitbooks.io/nodejs-tw-wiki-book/content/book/todo\_list/todo\_list.html](https://dca.gitbooks.io/nodejs-tw-wiki-book/content/book/todo_list/todo_list.html)
# 推薦學習
[https://dev.to/ankit01oss/7-github-projects-to-supercharge-your-docker-practices-2i80](https://dev.to/ankit01oss/7-github-projects-to-supercharge-your-docker-practices-2i80)
# 【上課筆記】【udemy】 Docker容器技术从入门到精通
### 上課講義
- [ https://www.docker.tips](https://www.docker.tips " https://www.docker.tips")
---
### 原始碼
- [Oh My Docker · GitHub](https://github.com/oh-my-docker)
- [GitHub - dockersamples/example-voting-app: Example Docker Compose app](https://github.com/dockersamples/example-voting-app)
# 【Demo】Python Flask + Redis 練習
### 準備一個python文件 app.py
```Python
from flask import Flask
from redis import Redis
import os
import socket
app = Flask(__name__)
redis = Redis(host=os.environ.get('REDIS_HOST', '127.0.0.1'), port=6379)
@app.route('/')
def hello():
redis.incr('hits')
return f"Hello Container World! I have been seen {redis.get('hits').decode('utf-8')} times and my hostname is {socket.gethostname()}.\n"
```
### 準備一個Dockerfile
```INI
FROM python:3.9.5-slim
RUN pip install flask redis && \
groupadd -r flask && useradd -r -g flask flask && \
mkdir /src && \
chown -R flask:flask /src
USER flask
COPY app.py /src/app.py
WORKDIR /src
ENV FLASK_APP=app.py REDIS_HOST=redis
EXPOSE 5000
CMD ["flask", "run", "-h", "0.0.0.0"]
```
### 準備一個Redis image
###
```shell
$ docker image pull redis
$ docker image build -t flask-demo .
$ docker image ls
REPOSITORY TAG IMAGE ID CREATED SIZE
flask-demo latest 4778411a24c5 About a minute ago 126MB
python 3.9.5-slim c71955050276 8 days ago 115MB
redis latest 08502081bff6 2 weeks ago 105MB
```
### 建立一Bridage
```shell
$ docker network create -d bridge demo-network
8005f4348c44ffe3cdcbbda165beea2b0cb520179d3745b24e8f9e05a3e6456d
$ docker network ls
NETWORK ID NAME DRIVER SCOPE
2a464c0b8ec7 bridge bridge local
8005f4348c44 demo-network bridge local
80b63f711a37 host host local
fae746a75be1 none null local
```
### 創建container
創建一個叫 `redis-server` 的container，連到 demo-network上
```shell
$ docker container run -d --name redis-server --network demo-network redis
002800c265020310231d689e6fd35bc084a0fa015e8b0a3174aa2c5e29824c0e
$ docker container ls
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
002800c26502 redis "docker-entrypoint.s…" 4 seconds ago Up 3 seconds 6379/tcp redis-server
```
創建 flask container，連到 demo-network上
```shell
$ docker container run -d --network demo-network \
--name flask-demo \
--env REDIS_HOST=redis-server \
-p 5000:5000 flask-demo
```
打開瀏覽器訪問 [http://127.0.0.1:5000](http://127.0.0.1:5000/)
應該能看到類似下面的內容，每次刷新頁面，計數加1
Hello Container World! I have been seen 36 times and my hostname is 925ecb8d111a.
合併步驟成一腳本
```shell
# prepare image
docker image pull redis
docker image build -t flask-demo .
# create network
docker network create -d bridge demo-network
# create container
docker container run -d --name redis-server --network demo-network redis
docker container run -d --network demo-network --name flask-demo --env REDIS_HOST=redis-server -p 5000:5000 flask-demo
```
# 【Docker】【錯誤處理】無法停止服務
\*使用systemctl stop docker 無法停止服務
```shell
[root@localhost docker]# systemctl stop docker
Warning: Stopping docker.service, but it can still be activated by:
docker.socket
```
\*解決
```shell
#停止
[root@localhost docker]# systemctl stop docker.socket
[root@localhost docker]# systemctl stop docker.service
#啟動
[root@localhost docker]# systemctl daemon-reload
[root@localhost docker]# systemctl restart docker
```
\*\*如果還沒辦法解決
```shell
# 删除 docker socket 文件
cd /lib/systemd/system/ && rm -rf docker.socket
# 查看 docker 状态，已dead
sudo systemctl status docker.service
# 重新创建 docker.socket
cd /lib/systemd/system/
vim docker.socket
# 添加如下内容
[Unit]
Description=Docker Socket for the API
PartOf=docker.service
[Socket]
ListenStream=/var/run/docker.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker
[Install]
WantedBy=sockets.target
```
```shell
#啟動
[root@localhost docker]# systemctl daemon-reload
[root@localhost docker]# systemctl restart docker
```
# 【Webmin】相關
查詢被Deny 需要從Zone default -> Allow queries form ... -> 【 Listed..】-> 加入 any -> 右上角 【 Apply 】
[](https://bookstack.treemanou.com/uploads/images/gallery/2023-04/ekv5h0IjPh5QuFza-image-1681888539338.png)
[](https://bookstack.treemanou.com/uploads/images/gallery/2023-04/3i1aqB3ElPohVONm-image-1681888508758.png)
[](https://bookstack.treemanou.com/uploads/images/gallery/2023-04/wxlJrQurZrfPxJgj-image-1681888698503.png)
# Docker 各系統安裝
### 各系統安裝連結
- zabbix
[https://www.zabbix.com/documentation/4.4/zh/manual/installation/containers](https://www.zabbix.com/documentation/4.4/zh/manual/installation/containers)
[https://github.com/zabbix/zabbix-docker/tree/6.4/Dockerfiles/web-nginx-pgsql](https://github.com/zabbix/zabbix-docker/tree/6.4/Dockerfiles/web-nginx-pgsql)
- elk
[https://github.com/deviantony/docker-elk](https://github.com/deviantony/docker-elk)
https://github.com/deviantony/docker-elk
[https://github.com/deviantony/docker-elk](https://github.com/deviantony/docker-elk)
```
$ docker network ls
NETWORK ID NAME DRIVER SCOPE
9781b1f585ae bridge bridge local
1252da701e55 host host local
237ea3d5cfbf none null local
```
啟動 Docker的時候，用 `--network `引數，可以指定網路型別，如：
```
~ docker run -itd --name test1 --network bridge --ip 172.17.0.10 centos:latest /bin/bash
```
**bridge：橋接網路**
預設情況下啟動的Docker容器，都是使用 bridge，Docker安裝時建立的橋接網路，每次Docker容器重啟時，會按照順序獲取對應的IP地址，這個就導致重啟下，Docker的IP地址就變了
**none：無指定網路**
使用 `--network=none `，docker 容器就不會分配區域網的IP
**host： 主機網路**
使用 `--network=host`，此時，Docker 容器的網路會附屬在主機上，兩者是互通的。
例如，在容器中執行一個Web服務，監聽8080埠，則主機的8080埠就會自動對映到容器中。
**建立自定義網路：（設定固定IP）**
啟動Docker容器的時候，使用預設的網路是不支援指派固定IP的，如下：
```
~ docker run -itd --net bridge --ip 172.17.0.10 centos:latest /bin/bash
6eb1f228cf308d1c60db30093c126acbfd0cb21d76cb448c678bab0f1a7c0df6
docker: Error response from daemon: User specified IP address is supported on user defined networks only.
```
因此，需要建立自定義網路，下面是具體的步驟：
**步驟1: 建立自定義網路**
建立自定義網路，並且指定網段：172.18.0.0/16
```
➜ ~ docker network create --subnet=172.18.0.0/16 mynetwork
➜ ~ docker network ls
NETWORK ID NAME DRIVER SCOPE
9781b1f585ae bridge bridge local
1252da701e55 host host local
4f11ae9c85de mynetwork bridge local
237ea3d5cfbf none null local
```
**步驟2: 建立Docker容器**
程式碼如下:
➜ ~ docker run -itd --name networkTest1 --net mynetwork --ip 172.18.0.2 centos:latest /bin/bash
這個時候，建立的Docker容器就會持有 172.18.0.2 這個IP.
```
[root@ec8e31938fe7 /]# ifconfig
eth0 Link encap:Ethernet HWaddr 02:42:AC:12:00:02
inet addr:172.18.0.2 Bcast:0.0.0.0 Mask:255.255.0.0
inet6 addr: fe80::42:acff:fe12:2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:88 errors:0 dropped:0 overruns:0 frame:0
TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:4056 (3.9 KiB) TX bytes:1068 (1.0 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
```
# Docker安裝
### Centos
[Docker Engine on CentOS | Docker Documentation](https://docs.docker.com/engine/install/centos/)
```highlight
sudo yum remove docker \
docker-client \
docker-client-latest \
docker-common \
docker-latest \
docker-latest-logrotate \
docker-logrotate \
docker-engine
```
```
sudo yum install -y yum-utils
sudo yum-config-manager \
--add-repo \
https://download.docker.com/linux/centos/docker-ce.repo
```
```
sudo yum-config-manager --enable docker-ce-nightly
sudo yum install docker-ce docker-ce-cli containerd.io
sudo systemctl start docker
sudo systemctl enable docker
```
~/.docker/config.json
```
{
"proxies":
{
"default":
{
"httpProxy": "http://192.168.1.12:3128",
"httpsProxy": "http://192.168.1.12:3128",
"noProxy": "*.test.example.com,.example2.com,127.0.0.0/8"
}
}
}
```
/etc/docker/daemon.json
```
{
"registry-mirrors":["http://hub-mirror.c.163.com"],
}
```
```
registry-1.docker.io. 54 IN A 34.197.211.151
registry-1.docker.io. 54 IN A 34.192.145.113
registry-1.docker.io. 54 IN A 18.214.230.110
registry-1.docker.io. 54 IN A 52.55.168.20
registry-1.docker.io. 54 IN A 3.229.227.53
registry-1.docker.io. 54 IN A 3.209.182.229
registry-1.docker.io. 54 IN A 3.213.204.48
registry-1.docker.io. 54 IN A 54.161.109.204
```
```
mkdir /etc/systemd/system/docker.service.d
vim /etc/systemd/system/docker.service.d/http-proxy.conf
########################################################
[Service]
Environment="HTTP_PROXY=http://proxy.example.com:80/"
Environment="NO_PROXY=localhost,127.0.0.0/8,docker-registry.somecorporation.com"
########################################################
sudo systemctl daemon-reload
sudo systemctl show --property Environment docker
sudo systemctl restart docker
```
---
### 使用get.docker.com 腳本
[https://get.docker.com](https://get.docker.com/)
```shell
curl -L get.docker.com -o get-docker.sh
sh get-docker.sh
```
```shell
#!/bin/sh
set -e
# Docker CE for Linux installation script
#
# See https://docs.docker.com/engine/install/ for the installation steps.
#
# This script is meant for quick & easy install via:
# $ curl -fsSL https://get.docker.com -o get-docker.sh
# $ sh get-docker.sh
#
# For test builds (ie. release candidates):
# $ curl -fsSL https://test.docker.com -o test-docker.sh
# $ sh test-docker.sh
#
# NOTE: Make sure to verify the contents of the script
# you downloaded matches the contents of install.sh
# located at https://github.com/docker/docker-install
# before executing.
#
# Git commit from https://github.com/docker/docker-install when
# the script was uploaded (Should only be modified by upload job):
SCRIPT_COMMIT_SHA="93d2499759296ac1f9c510605fef85052a2c32be"
# strip "v" prefix if present
VERSION="${VERSION#v}"
# The channel to install from:
# * nightly
# * test
# * stable
# * edge (deprecated)
DEFAULT_CHANNEL_VALUE="stable"
if [ -z "$CHANNEL" ]; then
CHANNEL=$DEFAULT_CHANNEL_VALUE
fi
DEFAULT_DOWNLOAD_URL="https://download.docker.com"
if [ -z "$DOWNLOAD_URL" ]; then
DOWNLOAD_URL=$DEFAULT_DOWNLOAD_URL
fi
DEFAULT_REPO_FILE="docker-ce.repo"
if [ -z "$REPO_FILE" ]; then
REPO_FILE="$DEFAULT_REPO_FILE"
fi
mirror=''
DRY_RUN=${DRY_RUN:-}
while [ $# -gt 0 ]; do
case "$1" in
--mirror)
mirror="$2"
shift
;;
--dry-run)
DRY_RUN=1
;;
--*)
echo "Illegal option $1"
;;
esac
shift $(( $# > 0 ? 1 : 0 ))
done
case "$mirror" in
Aliyun)
DOWNLOAD_URL="https://mirrors.aliyun.com/docker-ce"
;;
AzureChinaCloud)
DOWNLOAD_URL="https://mirror.azure.cn/docker-ce"
;;
esac
command_exists() {
command -v "$@" > /dev/null 2>&1
}
# version_gte checks if the version specified in $VERSION is at least
# the given CalVer (YY.MM) version. returns 0 (success) if $VERSION is either
# unset (=latest) or newer or equal than the specified version. Returns 1 (fail)
# otherwise.
#
# examples:
#
# VERSION=20.10
# version_gte 20.10 // 0 (success)
# version_gte 19.03 // 0 (success)
# version_gte 21.10 // 1 (fail)
version_gte() {
if [ -z "$VERSION" ]; then
return 0
fi
eval calver_compare "$VERSION" "$1"
}
# calver_compare compares two CalVer (YY.MM) version strings. returns 0 (success)
# if version A is newer or equal than version B, or 1 (fail) otherwise. Patch
# releases and pre-release (-alpha/-beta) are not taken into account
#
# examples:
#
# calver_compare 20.10 19.03 // 0 (success)
# calver_compare 20.10 20.10 // 0 (success)
# calver_compare 19.03 20.10 // 1 (fail)
calver_compare() (
set +x
yy_a="$(echo "$1" | cut -d'.' -f1)"
yy_b="$(echo "$2" | cut -d'.' -f1)"
if [ "$yy_a" -lt "$yy_b" ]; then
return 1
fi
if [ "$yy_a" -gt "$yy_b" ]; then
return 0
fi
mm_a="$(echo "$1" | cut -d'.' -f2)"
mm_b="$(echo "$2" | cut -d'.' -f2)"
if [ "${mm_a#0}" -lt "${mm_b#0}" ]; then
return 1
fi
return 0
)
is_dry_run() {
if [ -z "$DRY_RUN" ]; then
return 1
else
return 0
fi
}
is_wsl() {
case "$(uname -r)" in
*microsoft* ) true ;; # WSL 2
*Microsoft* ) true ;; # WSL 1
* ) false;;
esac
}
is_darwin() {
case "$(uname -s)" in
*darwin* ) true ;;
*Darwin* ) true ;;
* ) false;;
esac
}
deprecation_notice() {
distro=$1
distro_version=$2
echo
printf "\033[91;1mDEPRECATION WARNING\033[0m\n"
printf " This Linux distribution (\033[1m%s %s\033[0m) reached end-of-life and is no longer supported by this script.\n" "$distro" "$distro_version"
echo " No updates or security fixes will be released for this distribution, and users are recommended"
echo " to upgrade to a currently maintained version of $distro."
echo
printf "Press \033[1mCtrl+C\033[0m now to abort this script, or wait for the installation to continue."
echo
sleep 10
}
get_distribution() {
lsb_dist=""
# Every system that we officially support has /etc/os-release
if [ -r /etc/os-release ]; then
lsb_dist="$(. /etc/os-release && echo "$ID")"
fi
# Returning an empty string here should be alright since the
# case statements don't act unless you provide an actual value
echo "$lsb_dist"
}
echo_docker_as_nonroot() {
if is_dry_run; then
return
fi
if command_exists docker && [ -e /var/run/docker.sock ]; then
(
set -x
$sh_c 'docker version'
) || true
fi
# intentionally mixed spaces and tabs here -- tabs are stripped by "<<-EOF", spaces are kept in the output
echo
echo "================================================================================"
echo
if version_gte "20.10"; then
echo "To run Docker as a non-privileged user, consider setting up the"
echo "Docker daemon in rootless mode for your user:"
echo
echo " dockerd-rootless-setuptool.sh install"
echo
echo "Visit https://docs.docker.com/go/rootless/ to learn about rootless mode."
echo
fi
echo
echo "To run the Docker daemon as a fully privileged service, but granting non-root"
echo "users access, refer to https://docs.docker.com/go/daemon-access/"
echo
echo "WARNING: Access to the remote API on a privileged Docker daemon is equivalent"
echo " to root access on the host. Refer to the 'Docker daemon attack surface'"
echo " documentation for details: https://docs.docker.com/go/attack-surface/"
echo
echo "================================================================================"
echo
}
# Check if this is a forked Linux distro
check_forked() {
# Check for lsb_release command existence, it usually exists in forked distros
if command_exists lsb_release; then
# Check if the `-u` option is supported
set +e
lsb_release -a -u > /dev/null 2>&1
lsb_release_exit_code=$?
set -e
# Check if the command has exited successfully, it means we're in a forked distro
if [ "$lsb_release_exit_code" = "0" ]; then
# Print info about current distro
cat <<-EOF
You're using '$lsb_dist' version '$dist_version'.
EOF
# Get the upstream release info
lsb_dist=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'id' | cut -d ':' -f 2 | tr -d '[:space:]')
dist_version=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'codename' | cut -d ':' -f 2 | tr -d '[:space:]')
# Print info about upstream distro
cat <<-EOF
Upstream release is '$lsb_dist' version '$dist_version'.
EOF
else
if [ -r /etc/debian_version ] && [ "$lsb_dist" != "ubuntu" ] && [ "$lsb_dist" != "raspbian" ]; then
if [ "$lsb_dist" = "osmc" ]; then
# OSMC runs Raspbian
lsb_dist=raspbian
else
# We're Debian and don't even know it!
lsb_dist=debian
fi
dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')"
case "$dist_version" in
11)
dist_version="bullseye"
;;
10)
dist_version="buster"
;;
9)
dist_version="stretch"
;;
8)
dist_version="jessie"
;;
esac
fi
fi
fi
}
do_install() {
echo "# Executing docker install script, commit: $SCRIPT_COMMIT_SHA"
if command_exists docker; then
cat >&2 <<-'EOF'
Warning: the "docker" command appears to already exist on this system.
If you already have Docker installed, this script can cause trouble, which is
why we're displaying this warning and provide the opportunity to cancel the
installation.
If you installed the current Docker package using this script and are using it
again to update Docker, you can safely ignore this message.
You may press Ctrl+C now to abort this script.
EOF
( set -x; sleep 20 )
fi
user="$(id -un 2>/dev/null || true)"
sh_c='sh -c'
if [ "$user" != 'root' ]; then
if command_exists sudo; then
sh_c='sudo -E sh -c'
elif command_exists su; then
sh_c='su -c'
else
cat >&2 <<-'EOF'
Error: this installer needs the ability to run commands as root.
We are unable to find either "sudo" or "su" available to make this happen.
EOF
exit 1
fi
fi
if is_dry_run; then
sh_c="echo"
fi
# perform some very rudimentary platform detection
lsb_dist=$( get_distribution )
lsb_dist="$(echo "$lsb_dist" | tr '[:upper:]' '[:lower:]')"
if is_wsl; then
echo
echo "WSL DETECTED: We recommend using Docker Desktop for Windows."
echo "Please get Docker Desktop from https://www.docker.com/products/docker-desktop"
echo
cat >&2 <<-'EOF'
You may press Ctrl+C now to abort this script.
EOF
( set -x; sleep 20 )
fi
case "$lsb_dist" in
ubuntu)
if command_exists lsb_release; then
dist_version="$(lsb_release --codename | cut -f2)"
fi
if [ -z "$dist_version" ] && [ -r /etc/lsb-release ]; then
dist_version="$(. /etc/lsb-release && echo "$DISTRIB_CODENAME")"
fi
;;
debian|raspbian)
dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')"
case "$dist_version" in
11)
dist_version="bullseye"
;;
10)
dist_version="buster"
;;
9)
dist_version="stretch"
;;
8)
dist_version="jessie"
;;
esac
;;
centos|rhel|sles)
if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then
dist_version="$(. /etc/os-release && echo "$VERSION_ID")"
fi
;;
*)
if command_exists lsb_release; then
dist_version="$(lsb_release --release | cut -f2)"
fi
if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then
dist_version="$(. /etc/os-release && echo "$VERSION_ID")"
fi
;;
esac
# Check if this is a forked Linux distro
check_forked
# Print deprecation warnings for distro versions that recently reached EOL,
# but may still be commonly used (especially LTS versions).
case "$lsb_dist.$dist_version" in
debian.stretch|debian.jessie)
deprecation_notice "$lsb_dist" "$dist_version"
;;
raspbian.stretch|raspbian.jessie)
deprecation_notice "$lsb_dist" "$dist_version"
;;
ubuntu.xenial|ubuntu.trusty)
deprecation_notice "$lsb_dist" "$dist_version"
;;
fedora.*)
if [ "$dist_version" -lt 33 ]; then
deprecation_notice "$lsb_dist" "$dist_version"
fi
;;
esac
# Run setup for each distro accordingly
case "$lsb_dist" in
ubuntu|debian|raspbian)
pre_reqs="apt-transport-https ca-certificates curl"
if ! command -v gpg > /dev/null; then
pre_reqs="$pre_reqs gnupg"
fi
apt_repo="deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] $DOWNLOAD_URL/linux/$lsb_dist $dist_version $CHANNEL"
(
if ! is_dry_run; then
set -x
fi
$sh_c 'apt-get update -qq >/dev/null'
$sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq $pre_reqs >/dev/null"
$sh_c "curl -fsSL \"$DOWNLOAD_URL/linux/$lsb_dist/gpg\" | gpg --dearmor --yes -o /usr/share/keyrings/docker-archive-keyring.gpg"
$sh_c "echo \"$apt_repo\" > /etc/apt/sources.list.d/docker.list"
$sh_c 'apt-get update -qq >/dev/null'
)
pkg_version=""
if [ -n "$VERSION" ]; then
if is_dry_run; then
echo "# WARNING: VERSION pinning is not supported in DRY_RUN"
else
# Will work for incomplete versions IE (17.12), but may not actually grab the "latest" if in the test channel
pkg_pattern="$(echo "$VERSION" | sed "s/-ce-/~ce~.*/g" | sed "s/-/.*/g").*-0~$lsb_dist"
search_command="apt-cache madison 'docker-ce' | grep '$pkg_pattern' | head -1 | awk '{\$1=\$1};1' | cut -d' ' -f 3"
pkg_version="$($sh_c "$search_command")"
echo "INFO: Searching repository for VERSION '$VERSION'"
echo "INFO: $search_command"
if [ -z "$pkg_version" ]; then
echo
echo "ERROR: '$VERSION' not found amongst apt-cache madison results"
echo
exit 1
fi
if version_gte "18.09"; then
search_command="apt-cache madison 'docker-ce-cli' | grep '$pkg_pattern' | head -1 | awk '{\$1=\$1};1' | cut -d' ' -f 3"
echo "INFO: $search_command"
cli_pkg_version="=$($sh_c "$search_command")"
fi
pkg_version="=$pkg_version"
fi
fi
(
pkgs=""
if version_gte "18.09"; then
# older versions don't support a cli package
pkgs="$pkgs docker-ce-cli${cli_pkg_version%=}"
fi
if version_gte "20.10" && [ "$(uname -m)" = "x86_64" ]; then
# also install the latest version of the "docker scan" cli-plugin (only supported on x86 currently)
pkgs="$pkgs docker-scan-plugin"
fi
pkgs="$pkgs docker-ce${pkg_version%=}"
if ! is_dry_run; then
set -x
fi
$sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends $pkgs >/dev/null"
if version_gte "20.10"; then
# Install docker-ce-rootless-extras without "--no-install-recommends", so as to install slirp4netns when available
$sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq docker-ce-rootless-extras${pkg_version%=} >/dev/null"
fi
)
echo_docker_as_nonroot
exit 0
;;
centos|fedora|rhel)
if [ "$(uname -m)" != "s390x" ] && [ "$lsb_dist" = "rhel" ]; then
echo "Packages for RHEL are currently only available for s390x."
exit 1
fi
yum_repo="$DOWNLOAD_URL/linux/$lsb_dist/$REPO_FILE"
if ! curl -Ifs "$yum_repo" > /dev/null; then
echo "Error: Unable to curl repository file $yum_repo, is it valid?"
exit 1
fi
if [ "$lsb_dist" = "fedora" ]; then
pkg_manager="dnf"
config_manager="dnf config-manager"
enable_channel_flag="--set-enabled"
disable_channel_flag="--set-disabled"
pre_reqs="dnf-plugins-core"
pkg_suffix="fc$dist_version"
else
pkg_manager="yum"
config_manager="yum-config-manager"
enable_channel_flag="--enable"
disable_channel_flag="--disable"
pre_reqs="yum-utils"
pkg_suffix="el"
fi
(
if ! is_dry_run; then
set -x
fi
$sh_c "$pkg_manager install -y -q $pre_reqs"
$sh_c "$config_manager --add-repo $yum_repo"
if [ "$CHANNEL" != "stable" ]; then
$sh_c "$config_manager $disable_channel_flag docker-ce-*"
$sh_c "$config_manager $enable_channel_flag docker-ce-$CHANNEL"
fi
$sh_c "$pkg_manager makecache"
)
pkg_version=""
if [ -n "$VERSION" ]; then
if is_dry_run; then
echo "# WARNING: VERSION pinning is not supported in DRY_RUN"
else
pkg_pattern="$(echo "$VERSION" | sed "s/-ce-/\\\\.ce.*/g" | sed "s/-/.*/g").*$pkg_suffix"
search_command="$pkg_manager list --showduplicates 'docker-ce' | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'"
pkg_version="$($sh_c "$search_command")"
echo "INFO: Searching repository for VERSION '$VERSION'"
echo "INFO: $search_command"
if [ -z "$pkg_version" ]; then
echo
echo "ERROR: '$VERSION' not found amongst $pkg_manager list results"
echo
exit 1
fi
if version_gte "18.09"; then
# older versions don't support a cli package
search_command="$pkg_manager list --showduplicates 'docker-ce-cli' | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'"
cli_pkg_version="$($sh_c "$search_command" | cut -d':' -f 2)"
fi
# Cut out the epoch and prefix with a '-'
pkg_version="-$(echo "$pkg_version" | cut -d':' -f 2)"
fi
fi
(
if ! is_dry_run; then
set -x
fi
# install the correct cli version first
if [ -n "$cli_pkg_version" ]; then
$sh_c "$pkg_manager install -y -q docker-ce-cli-$cli_pkg_version"
fi
$sh_c "$pkg_manager install -y -q docker-ce$pkg_version"
if version_gte "20.10"; then
$sh_c "$pkg_manager install -y -q docker-ce-rootless-extras$pkg_version"
fi
)
echo_docker_as_nonroot
exit 0
;;
sles)
if [ "$(uname -m)" != "s390x" ]; then
echo "Packages for SLES are currently only available for s390x"
exit 1
fi
sles_version="${dist_version##*.}"
sles_repo="$DOWNLOAD_URL/linux/$lsb_dist/$REPO_FILE"
opensuse_repo="https://download.opensuse.org/repositories/security:SELinux/SLE_15_SP$sles_version/security:SELinux.repo"
if ! curl -Ifs "$sles_repo" > /dev/null; then
echo "Error: Unable to curl repository file $sles_repo, is it valid?"
exit 1
fi
pre_reqs="ca-certificates curl libseccomp2 awk"
(
if ! is_dry_run; then
set -x
fi
$sh_c "zypper install -y $pre_reqs"
$sh_c "zypper addrepo $sles_repo"
if ! is_dry_run; then
cat >&2 <<-'EOF'
WARNING!!
openSUSE repository (https://download.opensuse.org/repositories/security:SELinux) will be enabled now.
Do you wish to continue?
You may press Ctrl+C now to abort this script.
EOF
( set -x; sleep 30 )
fi
$sh_c "zypper addrepo $opensuse_repo"
$sh_c "zypper --gpg-auto-import-keys refresh"
$sh_c "zypper lr -d"
)
pkg_version=""
if [ -n "$VERSION" ]; then
if is_dry_run; then
echo "# WARNING: VERSION pinning is not supported in DRY_RUN"
else
pkg_pattern="$(echo "$VERSION" | sed "s/-ce-/\\\\.ce.*/g" | sed "s/-/.*/g")"
search_command="zypper search -s --match-exact 'docker-ce' | grep '$pkg_pattern' | tail -1 | awk '{print \$6}'"
pkg_version="$($sh_c "$search_command")"
echo "INFO: Searching repository for VERSION '$VERSION'"
echo "INFO: $search_command"
if [ -z "$pkg_version" ]; then
echo
echo "ERROR: '$VERSION' not found amongst zypper list results"
echo
exit 1
fi
search_command="zypper search -s --match-exact 'docker-ce-cli' | grep '$pkg_pattern' | tail -1 | awk '{print \$6}'"
# It's okay for cli_pkg_version to be blank, since older versions don't support a cli package
cli_pkg_version="$($sh_c "$search_command")"
pkg_version="-$pkg_version"
search_command="zypper search -s --match-exact 'docker-ce-rootless-extras' | grep '$pkg_pattern' | tail -1 | awk '{print \$6}'"
rootless_pkg_version="$($sh_c "$search_command")"
rootless_pkg_version="-$rootless_pkg_version"
fi
fi
(
if ! is_dry_run; then
set -x
fi
# install the correct cli version first
if [ -n "$cli_pkg_version" ]; then
$sh_c "zypper install -y docker-ce-cli-$cli_pkg_version"
fi
$sh_c "zypper install -y docker-ce$pkg_version"
if version_gte "20.10"; then
$sh_c "zypper install -y docker-ce-rootless-extras$rootless_pkg_version"
fi
)
echo_docker_as_nonroot
exit 0
;;
*)
if [ -z "$lsb_dist" ]; then
if is_darwin; then
echo
echo "ERROR: Unsupported operating system 'macOS'"
echo "Please get Docker Desktop from https://www.docker.com/products/docker-desktop"
echo
exit 1
fi
fi
echo
echo "ERROR: Unsupported distribution '$lsb_dist'"
echo
exit 1
;;
esac
exit 1
}
# wrapped up in a function so that we have some protection against only getting
# half the file during "curl | sh"
do_install
```
# Docker架構
[](https://bookstack.treemanou.com/uploads/images/gallery/2022-02/XEObQQ2Bh4FolaIj-image-1644994790311.png)
[](https://bookstack.treemanou.com/uploads/images/gallery/2022-02/5xLhezmrYbZpz2O4-image-1644994815207.png)
[](https://bookstack.treemanou.com/uploads/images/gallery/2022-02/4KpqHL7bW0Xqz794-image-1644994935799.png)
# Docker常用指令
[](https://bookstack.treemanou.com/uploads/images/gallery/2022-01/yQqsC2nE74AEf4ci-image-1641898072150.png)
\*container 運行
```shell
#run:
#-d 背景執行
#nginx 執行什麼服務
#ng 自訂的tagname
#-name 自訂名稱
# -e 設定環境變數, TZ=Asia/Taipei => 設定時區
docker container run -d nginx
docker container run -d -name ngx nginx
docker container run -d nginx:ng
docker container run -d -e "TZ=Asia/Taipei" nginx
```
\*查看運行container
```shell
docker container ls -a
[tomcat@docker-qc ~]$ docker container ls -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
df6ab3df4b14 nginx "nginx -g 'daemon of…" 9 seconds ago Up 8 seconds 80/tcp modest_cray
940d3d804bcd nginx "nginx -g 'daemon of…" 7 minutes ago Up 7 minutes 80/tcp elastic_raman
```
\*運行container 並進入shell
```shell
docker container run -it {container name} sh
```
[](https://bookstack.treemanou.com/uploads/images/gallery/2021-11/XbqLbfiUKtgdFbYz-image-1637142725643.png)
\*進入已運行container
```shell
# 進入名為apache的容器執行sh
docker exec -it apache sh
```
\*複製檔案
```shell
# 建立一個hello.html
echo "hello" > hello.html
# 建立apache
docker run -d --name apache httpd:alpine
# 複製檔案至apache容器中
docker cp hello.html apache:/usr/local/apache2/htdocs/
# 複製容器中的檔案至本機
docker cp apache:/usr/local/apache2/htdocs/index.html ./index.html
```
\*掛載目錄
```shell
# 把hello.html掛成index.html
docker run -d --name apache2 -v $PWD/hello.html:/usr/local/apache2/htdocs/index.html httpd:alpine
```
\*建立外部連線
```shell
# -p port 對應 {本機}:{容器}
docker run -d -v $PWD.hell.html:/url/local/apache2/htdocs/index.html -p 80:80 httpd:alpine
```
---
\*刪除container
[](https://bookstack.treemanou.com/uploads/images/gallery/2021-11/qOCJd5dGCtA5ZwlU-image-1637142432159.png)
```shell
#-f 強制
docker rm -f {container id}
#刪除所有容器
docker rm -f $(docker ps -a -q)
#刪除所有名字有demo的容器
docker rm -f $(docker ps -a -q -f name=demo)
# 停用所有container
docker stop $(docker ps -a -q)
# 刪除沒已使用的container 與 image
docker system prune
# 刪除所有映像檔
docker rmi $(docker images -a -q)
# 刪除所有name = 的映像檔
docker rmi $(docker images -f "dangling=true" -q)
# 刪除所有名稱叫shopcar的映像檔
docker rmi $(docker images shopcar* -q)
# 清除volume
docker volume rm $(docker volume ls)
# 刪除所有沒有使用的container image volume
docker system prune -a -f --volumes
#起一個不會停止的centos
docker run -d --name centos7 centos:7 sleep infinity
```
---
#### 查看要效能
\*從主機查看container process
[](https://bookstack.treemanou.com/uploads/images/gallery/2021-11/VJEXMxCf0qyoGca5-image-1637142044315.png)
[](https://bookstack.treemanou.com/uploads/images/gallery/2021-11/aeI7SiLajqZ2uD20-image-1637142037886.png)
```shell
docker container top {container id}
```
\*查看狀態
```shell
# 容器狀態
docker stats {container id | name }
# cpu ram
docker top {container id | name }
# log
docker logs {container id | name }
docker logs -f {container id | name }
```
---
# Dockerfile 的 /etc/hosts 如何設定
來源：
[Dockerfile 的 /etc/hosts 如何設定 – Tsung's Blog (longwin.com.tw)](https://blog.longwin.com.tw/2018/09/docker-dockerfile-etc-hosts-dns-setup-2018/)
## Dockerfile 的 /etc/hosts 如何設定
於 [Dockerfile reference](https://docs.docker.com/engine/reference/builder/) 文件裡面，沒有看到 /etc/hosts 該怎麼改，後來發現 /etc/hosts 修改的方式還蠻黑暗的~
修改 /etc/hosts 的作法有兩種，先講比較正確的方法：
Docker 增加 hosts 可以參考 Docker run 的文件：[Docker run reference](https://docs.docker.com/engine/reference/run/)
於 Docker run 使用 --add-host=server-name:127.0.0.1，多個用空白隔開，繼續寫下去即可，範例如下：
- **docker run ... --add-host='server:0.0.0.0' ...**
- **docker run ... --add-host='server:127.0.0.1' --add-host='server2:127.0.0.2'...**
若有 /etc/hosts 有太多需要增加，可以使用下述 Shell script 產生 --add-host 參數
- /etc/hosts 若要 1 vs 1 的 ip host 對應
- **cat /etc/hosts | sed 's/^#.\*//g' | grep '\[0-9\]\[0-9\]' | tr "\\t" " " | awk '{print "--add-host="$2":"$1 }' | tr '\\n' ' '**
- /etc/hosts 若要 1 vs n(多) 的 ip host 對應
- **cat /etc/hosts | grep -v "^#" | awk '{for(i=2;i<=NF;i++){print "--add-host "$i":"$1}}'**
再來看比較暴力的作法：(直接寫在 Dockerfile 裡面)
```
# 使用 /tmp/hosts 當 /etc/hosts COPY /etc/hosts /tmp/hosts.bak
RUN cp hosts /tmp/hosts # hosts 於外部 cp /etc/hosts .
#RUN cp /etc/hosts /tmp/hosts #路径长度最好保持一致
RUN mkdir -p -- /lib-override && cp /lib/x86_64-linux-gnu/libnss_files.so.2 /lib-override
RUN sed -i 's:/etc/hosts:/tmp/hosts:g' /lib-override/libnss_files.so.2
ENV LD_LIBRARY_PATH /lib-override
RUN cat /tmp/hosts.bak >> /tmp/hosts
```
Docker 內部讀取 /etc/hosts 的部份，修改成讀取 **/tmp/hosts** (參考自此篇：[Docker 修改 hosts](https://wongxingjun.github.io/2016/04/06/Docker%E4%BF%AE%E6%94%B9hosts/))
將下述寫入 Dockerfile，於 build 的時候，就會讀取 /tmp/hosts 來操作囉~
### 相關網頁
- - [docker 之 dockerFile (解決 hosts，hostname 問題)](https://blog.csdn.net/libo222/article/details/52669093)
- [docker - Modify hosts file in dockerfile](https://serverfault.com/questions/777714/modify-hosts-file-in-dockerfil)
# Docker 使用私有repo (Nexus)
```p1
vim /etc/docker/daemon.json
```
```
{
"insecure-registries": ["10.10.10.10:8083"],
"registry-mirrors": ["http://10.10.10.10:8083"]
}
```
```
sudo systemctl restart docker
```
[](https://bookstack.treemanou.com/uploads/images/gallery/2024-12/Sun0E0r2v3qHI2mq-image-1733823888931.png)
[](https://bookstack.treemanou.com/uploads/images/gallery/2024-12/OeE7TnZi2zpJNQfu-image-1733823909856.png)
https://registry-1.docker.io
[](https://bookstack.treemanou.com/uploads/images/gallery/2024-12/k9GuHCfoM0j1FhJO-image-1733824478204.png)
# Docker 內 container 如何使用Docker
在 Docker 容器內部直接執行宿主機上的 Docker 命令有一定的限制，因為 Docker 容器本身是與宿主機隔離的。以下是一些實現方法，根據不同需求選擇適合的解法：
---
### **方法 1：將 Docker socket 映射到容器**
將宿主機的 Docker socket (`/var/run/docker.sock`) 映射到容器內部，這樣容器內部的 Docker CLI 可以直接與宿主機的 Docker daemon 通訊。
#### **步驟**
1. **啟動容器時掛載 Docker socket：**
```bash
docker run -it --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $(which docker):/usr/bin/docker \
your-image
```
2. **在容器內使用 Docker 命令：** 容器內的 Docker CLI 可以直接操作宿主機的 Docker，執行例如 `docker ps`、`docker run` 等指令。
3. **注意安全性：** 授予容器訪問 Docker socket 的權限會帶來安全風險，因為容器內的進程可以完全控制宿主機的 Docker。僅在信任的環境下使用此方法。
---
### **方法 2：使用 Docker-in-Docker (DinD)**
如果希望在容器內運行獨立的 Docker daemon，可以使用 Docker 官方的 `docker:dind` 映像。
#### **步驟**
1. 啟動 DinD 容器：
```bash
docker run --privileged --name dind-container -d docker:dind
```
2. 進入容器：
```bash
docker exec -it dind-container sh
```
3. 在容器內執行 Docker 命令（這是獨立的 Docker daemon，不會影響宿主機的 Docker）。
---
### **方法 3：使用 Docker CLI 並通過 API 操作**
宿主機的 Docker daemon 提供 REST API，可以在容器內安裝 Docker CLI 並通過 API 操作。
#### **步驟**
1. 確保宿主機的 Docker daemon 開啟遠程 API，編輯 `/etc/docker/daemon.json`：
```json
{
"hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"]
}
```
然後重啟 Docker：
```bash
sudo systemctl restart docker
```
2. 啟動容器，並配置環境變數 `DOCKER_HOST` 指向宿主機 API：
```bash
docker run -it --rm \
-e DOCKER_HOST=tcp://:2375 \
your-image
```
3. 在容器內執行 Docker 命令：
```bash
docker ps
```
---
### **注意事項**
1. **安全風險：**
- 授予容器訪問 Docker socket 或 Docker daemon 的權限可能導致安全漏洞。
- 確保只在受信任的環境中使用，並採取必要的隔離措施（例如：限制網路訪問、使用 TLS 保護 API）。
2. **性能影響：**
- 如果容器內需要頻繁操作宿主機的 Docker，可能會影響宿主機的性能。
3. **權限問題：**
- 確保容器內的進程有足夠的權限訪問 `/var/run/docker.sock` 或 Docker API。
希望這些方法能幫助你解決問題！如果需要更詳細的操作指引，可以告訴我具體的需求或環境設定。
# 【Docker】上傳自己的 Docker image 到 Docker Hub
要上傳自己的 Docker image 到 Docker Hub，請按照以下步驟操作：
### 1. 登入 Docker Hub
確保你的電腦已經安裝了 Docker，然後使用以下命令登入 Docker Hub：
```sh
docker login
```
系統會要求輸入你的 Docker Hub 帳號和密碼。
### 2. 建立 Docker Image
如果你還沒有 Docker image，可以使用 `docker build` 指令來建立：
```sh
docker build -t <你的DockerHub帳號>/: .
```
例如：
```sh
docker build -t myusername/myapp:v1 .
```
這樣就會建立一個 `myusername/myapp` 的 image，標籤（tag）為 `v1`。
### 3. 標記 (Tag) Image
如果你已經有一個本地的 image，但還沒有加上 Docker Hub 的 repository 名稱，你需要先標記它：
```sh
docker tag <本地image ID或名稱> <你的DockerHub帳號>/:
```
例如：
```sh
docker tag myapp:latest myusername/myapp:v1
```
### 4. 推送 (Push) Image
將 image 推送到 Docker Hub：
```sh
docker push <你的DockerHub帳號>/:
```
例如：
```sh
docker push myusername/myapp:v1
```
### 5. 確認上傳成功
你可以到 [Docker Hub](https://hub.docker.com/) 查看你的 repository，或者在其他機器上使用以下命令來拉取（pull）該 image：
```sh
docker pull myusername/myapp:v1
```
### 常見問題
1. **登入失敗**：
- 如果 `docker login` 失敗，可以先在 Docker Hub 上確認你的帳號密碼是否正確。
- 如果你使用的是 Docker Hub 產生的 Access Token，請在密碼欄位輸入該 Token。
2. **推送失敗，沒有權限 (denied: requested access to the resource is denied)**：
- 確保你的 image tag 是 `你的DockerHub帳號/你的image名稱`，而不是本地的名稱。
- 使用 `docker login` 確保你已登入正確的帳號。
這樣你就能成功上傳自己的 Docker image 到 Docker Hub 了！ 🚀
# 【Docker】自動分配網路用盡
failed to create network pub-sub\_pubsub: Error response from daemon: could not find an available, non-overlapping IPv4 address pool among the defaults to assign to the network
👉 **這個錯誤的意思是**：
> Docker **沒有可用的 IP 網段** 來建立新的 network。
Docker 每次起新的 network，會自動從預設的 IP range (例如 172.18.0.0/16) 分配一段子網（subnet）來給你的 `docker-compose`。
但因為你本機已經有太多 Docker network（或之前的 container network 沒清乾淨），導致 **IP address range 已經用光了**。
解法，詳細往下看
```YAML
# 查詢目前所有container網段
docker network inspect $(docker network ls -q) --format '{{.Name}}: {{(index .IPAM.Config 0).Subnet}}'
# 刪除無用network
docker network prune
#解法，指定網段
networks:
ngtest:
driver: bridge
ipam:
config:
- subnet: 172.20.0.0/24
```
---
# 🛠️ 解法 1：刪掉無用的 Docker Network
先看一下目前的 network：
```bash
docker network ls
```
會看到一堆像這樣：
| NETWORK ID | NAME | DRIVER | SCOPE |
|---|
| 1a2b3c4d5e | bridge | bridge | local |
| 6f7g8h9i0j | pub-sub\_pubsub | bridge | local |
| ... | ... | ... | ... |
然後手動刪掉沒用的 network，例如：
```bash
docker network rm network_name
```
例如：
```bash
docker network rm pub-sub_pubsub
```
要一口氣刪很多：
```bash
docker network prune
```
（⚡小心！`prune` 會**把所有未使用的網路刪掉**。）
---
# 🛠️ 解法 2：docker-compose.yml 手動指定 IP 範圍
如果你想避免這個問題，以後可以**自己在 `docker-compose.yml` 裡面設定固定的子網段**，例如：
```yaml
networks:
pubsub-net:
driver: bridge
ipam:
config:
- subnet: 172.30.0.0/16
```
然後每個 service 指定 network：
```yaml
services:
pubsub-emulator:
image: google/cloud-sdk:latest
networks:
- pubsub-net
```
這樣 Docker 就不會自己亂分配 IP，會用你指定的 `172.30.0.0/16`，可以大大降低出錯的機會。
---
# 🔥 最快速推薦操作
直接下這兩行，清除掉無用網路 ➔ 再重開 docker-compose：
```bash
docker network prune -f
docker-compose up
```
---
# 🛎️ 小提醒
| 問題情境 | 說明 |
|---|
| 通常出現在 Docker Desktop 很久沒清 | 每次起 network，Docker 自動分配，結果越堆越多 |
| `docker network ls` 看太多 bridge | 可以確認哪些是 zombie network |
| `docker-compose down` 不一定會清 network | 要自己下 `prune` 或 `network rm` |
---
好問題！
你問的這個其實就是：
> **如何查目前 Docker 所有 network 的網段（subnet），確保自己新建的網段不會衝突？**
這個是專業級的 docker networking 操作了，我來直接教你最正確、完整又快速的方法 👨🏻💻
---
# ✅ 查詢目前所有 Docker network 網段的方法
直接打：
```bash
docker network inspect $(docker network ls -q) --format '{{.Name}}: {{(index .IPAM.Config 0).Subnet}}'
```
這條指令的意思是：
- `docker network ls -q`：列出所有 network 的 ID
- `docker network inspect`：逐個去查 network 詳細資訊
- `--format`：只輸出你要看的部分（名字 + 子網範圍）
👉 出來結果像這樣：
```
bridge: 172.17.0.0/16
host:
none:
myproject_default: 172.21.0.0/16
another-network: 172.22.0.0/16
```
如果某些 network 是空的（像 `host`、`none`），那是正常的，因為它們沒有自己管理 IP。
---
# 🛠️ 查完之後怎麼重新分配？
- 看到目前用掉哪些子網了（例如 172.17.0.0/16、172.21.0.0/16）
- 選一個**完全沒重疊**的新網段來建你的 network，例如：
- `172.28.0.0/24`
- `172.30.0.0/24`
- `192.168.100.0/24`
- `10.20.0.0/24`
- 然後在你的 `docker-compose.yml` 裡設定你自己的網段！
（一般建議用 172.x.x.x / 192.168.x.x / 10.x.x.x 這些 private 網段）
---
# 🔥 進階版（更詳細看）
如果你想要看得更細，例如看到每個 container 的 IP，可以打：
```bash
docker network inspect network-name
```
例：
```bash
docker network inspect bridge
docker network inspect pubsub-net
```
它會印出一個超大 JSON，裡面會列出：
- 網段 subnet
- gateway
- 已連接的 container 名稱和 IP 地址
---
# 🛎️ 小結論
| 你想做什麼 | 指令 |
|---|
| 看所有 network 網段 | `docker network inspect $(docker network ls -q) --format '{{.Name}}: {{(index .IPAM.Config 0).Subnet}}'` |
| 詳細看某個 network | `docker network inspect network-name` |
---
# 【Docker】image tage 比較
當然可以！我們來一一比較你提到的這些 Docker image tag（以 Node.js 為例常見的 tag 形式），重點在於：
> ❗**它們的差異主要在底層作業系統的發行版與體積，會影響相容性、功能完整度、啟動速度與安全更新週期。**
---
## ✅ 比較總覽表
| Tag | 底層系統 | 體積（概估） | 相容性 | 套件完整度 | 適合場景 |
|---|
| `20.19.3` | Debian（預設） | 🟠 中（~100MB） | ✅ 高 | ✅ 完整 | 開發 / 安全穩定部署 |
| `20.19.3-slim` | Debian（精簡） | 🟡 較小（~30–50MB） | ✅ 高 | 🟡 精簡套件 | 精簡部署，但仍需套件支援 |
| `20.19.3-bullseye` | Debian 11 (Bullseye) | 🟠 中 | ✅ 高 | ✅ 完整 | LTS 開發與部署 |
| `20.19.3-bullseye-slim` | Debian 11 (精簡) | 🟡 較小 | ✅ 高 | 🟡 精簡 | 比 `slim` 更指定版本的精簡版 |
| `20.19.3-bookworm` | Debian 12 (Bookworm) | 🟠 中 | ✅ 高 | ✅ 完整 | 新版 Debian，未來趨勢 |
| `20.19.3-bookworm-slim` | Debian 12 (精簡) | 🟡 較小 | ✅ 高 | 🟡 精簡 | 更「新」的精簡版本 |
| `20.19.3-alpine3.22` | Alpine Linux 3.22 | 🟢 超小（~5MB） | ⚠️ 中 | ❌ 非常精簡 | 超小部署映像，需自行加套件 |
| `20.19.3-alpine` | 最新 Alpine 版本 | 🟢 超小 | ⚠️ 中 | ❌ 非常精簡 | 最新 alpine，可能有相容性風險 |
---
## 🧩 詳細說明與比較依據
### 1️⃣ **無尾碼版本：`20.19.3`**
- 預設會用 **Debian（目前是 Bookworm 或 Bullseye）**
- 最穩定、最多人支援的標準版本
- 套件支援完整，但 image 比 slim 大
---
### 2️⃣ **slim 系列（`slim`, `bullseye-slim`, `bookworm-slim`）**
- 相比完整版，移除了 **man pages、locale 資料、編譯工具**
- 仍然保留 Debian 的核心相容性
- 較小但仍易於除錯與擴充，比 alpine 安全穩
---
### 3️⃣ **alpine 系列（`alpine`, `alpine3.22`）**
- 超小型（~5MB），非常適合部署
- 缺點：需額外安裝 libc（有時需 glibc，不然會出現 `segmentation fault`）
- 有些 Node 原生模組會無法正常編譯
- 建議只在熟悉 Alpine Linux 的情況下使用
---
### 4️⃣ **bullseye vs. bookworm**
- `bullseye` = Debian 11（2021 發布）
- `bookworm` = Debian 12（2023 發布，目前最新版）
> 若你要做長期部署，**bookworm 更新、更長期支援**；但部分舊系統（如 AWS AMI、某些 lib）可能還用 bullseye。
---
## ✅ 實務建議
| 需求 | 建議使用 |
|---|
| 要最穩、開發與部署兼顧 | `20.19.3` 或 `20.19.3-bookworm` |
| 部署在 Docker，但想減少容量 | `20.19.3-slim` 或 `20.19.3-bookworm-slim` |
| 專案熟悉 Alpine、對大小敏感 | `20.19.3-alpine`（但需額外測試） |
| 你想明確指定環境版本以便重建一致性 | `20.19.3-bullseye` / `bookworm` / `alpine3.22` 等有版本號的更佳 |
---
## 📌 附加提醒
- 有些 Node 原生模組（如 `bcrypt`, `sharp`, `canvas`）在 `alpine` 上常常會遇到編譯問題。
- `slim` 不代表最小，只是比完整版小；真正小的是 `alpine`。
- 不同 tag 最安全的選法是「**明確指定版本與 base image**」，可確保可重現性。
---