Docker入门之安装Docker_refusing to start due to insecure secret_key

# docker ps

CONTAINER ID IMAGE     COMMAND     CREATED       STATUS       PORTS  NAMES

7518f632b6d0 centos  "/bin/bash" 4 seconds ago Up 2 seconds        focused_turing

d97bd379589c centos  "/bin/bash" 6 minutes ago Up 6 minutes        friendly_nightingale

# ip link add name docker0 type bridge # 创建网桥

# ip addr add dev docker0 172.17.0.1/16 # 设置网桥的IP和网关

# ip link set docker0 up # 启用网桥

# ip a # 查看创建好的网桥

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

       valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000

    link/ether 60:eb:69:fe:2e:20 brd ff:ff:ff:ff:ff:ff

3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000

    link/ether 60:eb:69:fe:2e:21 brd ff:ff:ff:ff:ff:ff

    inet 10.22.25.101/26 brd 10.223.25.127 scope global eth1

       valid_lft forever preferred_lft forever

4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN

    link/ether 6e:3c:cb:3e:a7:44 brd ff:ff:ff:ff:ff:ff

    inet 172.17.0.1/16 scope global docker0

       valid_lft forever preferred_lft forever

# ls /usr/bin/docker

containerd  containerd-shim  ctr  docker  dockerd  docker-init  docker-proxy  runc

# ls -l /usr/bin/docker

总用量 204720

-rwxr-xr-x 1 root root 34625816 2019-11-13 15:30 containerd

-rwxr-xr-x 1 root root  6116160 2019-11-13 15:30 containerd-shim

-rwxr-xr-x 1 root root 18850136 2019-11-13 15:30 ctr

-rwxr-xr-x 1 root root 65641786 2019-11-13 15:30 docker

-rwxr-xr-x 1 root root 72090824 2019-11-13 15:30 dockerd

-rwxr-xr-x 1 root root   764144 2019-11-13 15:30 docker-init

-rwxr-xr-x 1 root root  2877369 2019-11-13 15:30 docker-proxy

-rwxr-xr-x 1 root root  8649792 2019-11-13 15:30 runc

目录

说明

/etc/systemd/system

Local configuration

/run/systemd/system

Runtime units

/usr/lib/systemd/system

Units of installed packages

yum方式安装时，docker.service可能在此目录

# cat /etc/systemd/system/docker.service

[Unit]

Description=Docker Application Container Engine

Documentation=http://docs.docker.com

After=network.target rhel-push-plugin.socket

Wants=docker-storage-setup.service

[Service]

Type=notify

NotifyAccess=all

EnvironmentFile=-/etc/sysconfig/docker

EnvironmentFile=-/etc/sysconfig/docker-storage

EnvironmentFile=-/etc/sysconfig/docker-network

Environment=GOTRACEBACK=crash

ExecStart=/usr/bin/dockerd daemon \

          --graph /data/docker \

          --exec-opt native.cgroupdriver=systemd \

          $OPTIONS \

          $DOCKER_STORAGE_OPTIONS \

          $DOCKER_NETWORK_OPTIONS \

          $ADD_REGISTRY \

          $BLOCK_REGISTRY \

          $INSECURE_REGISTRY

LimitNOFILE=1048576

LimitNPROC=1048576

LimitCORE=infinity

TimeoutStartSec=0

MountFlags=slave

Restart=on-abnormal

[Install]

WantedBy=multi-user.target

# systemctl start docker.service

# ps aux|grep docker | grep -v grep

root     16052  0.3  0.1 600076 37332 ?        Ssl  16:46   0:00 /usr/bin/docker/dockerd --data-root /data/docker --exec-opt native.cgroupdriver=systemd

root     16060  0.1  0.0 571644 22196 ?        Ssl  16:46   0:00 containerd --config /var/run/docker/containerd/containerd.toml --log-level info

包名

说明

docker-ce

社区版（Community）容器引擎（Docker Engine），依赖containerd.io。包含了：

/usr/bin/dockerd

/usr/bin/docker-init

/usr/bin/docker-proxy

docker-ce-cli

docker-ce的命令行客户端工具，包含了命令行客户端工具/usr/bin/docker

containerd.io

隔离了Docker和OS（比如Linux容器LXC），有独立的官网：containerd – An industry-standard container runtime with an emphasis on simplicity, robustness and portability。

docker

对社区版而言，就是docker-ce，有些非官方仓库需要使用这个名字安装，使用docker-ce报“No package docker-ce available”。

yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

# yum -y install docker-ce

# yum -y install docker.io/docker-ce

# yum -y install docker

# file /usr/lib/systemd/system/docker.service

/usr/lib/systemd/system/docker.service: cannot open (No such file or directory)

# ls /usr/bin/dock*                          

ls: cannot access /usr/bin/dock*: No such file or directory

# yum -y install docker-ce

# file /usr/lib/systemd/system/docker.service

/usr/lib/systemd/system/docker.service: ASCII text

# ls /usr/bin/dock*                          

/usr/bin/docker  /usr/bin/docker-fetch  /usr/bin/dockertarsum

# cat /usr/lib/systemd/system/docker.service

[Unit]

Description=Docker Application Container Engine

Documentation=http://docs.docker.com

After=network.target

[Service]

Type=notify

EnvironmentFile=-/etc/sysconfig/docker

EnvironmentFile=-/etc/sysconfig/docker-storage

EnvironmentFile=-/etc/sysconfig/docker-network

ExecStart=/usr/bin/docker -d $OPTIONS \

          $DOCKER_STORAGE_OPTIONS \

          $DOCKER_NETWORK_OPTIONS \

          $ADD_REGISTRY \

          $BLOCK_REGISTRY \

          $INSECURE_REGISTRY

LimitNOFILE=1048576

LimitNPROC=1048576

LimitCORE=infinity

MountFlags=slave

TimeoutSec=0

[Install]

WantedBy=multi-user.target

# cat /usr/lib/systemd/system/docker.service

[Unit]

Description=Docker Application Container Engine

Documentation=https://docs.docker.com

BindsTo=containerd.service

After=network-online.target firewalld.service containerd.service

Wants=network-online.target

Requires=docker.socket

[Service]

Type=notify

# the default is not to use systemd for cgroups because the delegate issues still

# exists and systemd currently does not support the cgroup feature set required

# for containers run by docker

ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

ExecReload=/bin/kill -s HUP $MAINPID

TimeoutSec=0

RestartSec=2

Restart=always

# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.

# Both the old, and new location are accepted by systemd 229 and up, so using the old location

# to make them work for either version of systemd.

StartLimitBurst=3

# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.

# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make

# this option work for either version of systemd.

StartLimitInterval=60s

# Having non-zero Limit*s causes performance problems due to accounting overhead

# in the kernel. We recommend using cgroups to do container-local accounting.

LimitNOFILE=infinity

LimitNPROC=infinity

LimitCORE=infinity

# Comment TasksMax if your systemd version does not support it.

# Only systemd 226 and above support this option.

TasksMax=infinity

# set delegate yes so that systemd does not reset the cgroups of docker containers

Delegate=yes

# kill only the docker process, not all processes in the cgroup

KillMode=process

[Install]

WantedBy=multi-user.target

# systemctl start docker.service

# ps aux|grep docker | grep -v grep

/usr/bin/docker -d --selinux-enabled -b=none

# systemctl start docker.service

# docker images

REPOSITORY              TAG                 IMAGE ID            CREATED             SIZE

docker.io/hello-world   latest              fce289e99eb9        11 months ago       1.84 kB

# docker images

Cannot connect to the Docker daemon. Is the docker daemon running on this host?

# docker pull hello-world

Using default tag: latest

Trying to pull repository docker.io/library/hello-world ...

latest: Pulling from docker.io/library/hello-world

1b930d010525: Pull complete

# docker pull myrep.io/public/hello-world

# docker search myrep.io/hello-world

# docker pull myrep.io/public/hello-world:v1

# docker pull centos:7

# docker pull centos:centos7.2.1511

# cat /data/docker/image/aufs/imagedb/content/sha256/fce289e99eb9bca977dae136fbe2a82b6b7d4c372474c9235adc1741675f587e

{"architecture":"amd64","config":{"Hostname":"","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"],"Cmd":["/hello"],"ArgsEscaped":true,"Image":"sha256:a6d1aaad8ca65655449a26146699fe9d61240071f6992975be7e720f1cd42440","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"container":"8e2caa5a514bb6d8b4f2a2553e9067498d261a0fd83a96aeaaf303943dff6ff9","container_config":{"Hostname":"8e2caa5a514b","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"],"Cmd":["/bin/sh","-c","#(nop) ","CMD [\"/hello\"]"],"ArgsEscaped":true,"Image":"sha256:a6d1aaad8ca65655449a26146699fe9d61240071f6992975be7e720f1cd42440","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":{}},"created":"2019-01-01T01:29:27.650294696Z","docker_version":"18.06.1-ce","history":[{"created":"2019-01-01T01:29:27.416803627Z","created_by":"/bin/sh -c #(nop) COPY file:f77490f70ce51da25bd21bfc30cb5e1a24b2b65eb37d4af0c327ddc24f0986a6 in / "},{"created":"2019-01-01T01:29:27.650294696Z","created_by":"/bin/sh -c #(nop)  CMD [\"/hello\"]","empty_layer":true}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:af0b15c8625bb1938f1d7b17081031f649fd14e6b233688eea3c5483994a66a3"]}}

# docker run --rm hello-world

Hello from Docker!

This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:

 1. The Docker client contacted the Docker daemon.

 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.

    (amd64)

 3. The Docker daemon created a new container from that image which runs the

    executable that produces the output you are currently reading.

 4. The Docker daemon streamed that output to the Docker client, which sent it

    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:

 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:

 https://hub.docker.com/

For more examples and ideas, visit:

 Overview

# docker inspect hello-world

[

    {

        "Id": "sha256:fce289e99eb9bca977dae136fbe2a82b6b7d4c372474c9235adc1741675f587e",

        "RepoTags": [

            "docker.io/hello-world:latest"

        ],

。。。 。。。

# docker inspect 1fb1e1ad7356|grep '"IPAddress"' | head -n 1

            "IPAddress": "172.17.0.2",

ExecStart=/usr/bin/docker-current daemon \

          --graph /data/docker \

          --exec-opt native.cgroupdriver=systemd \

          $OPTIONS \

          $DOCKER_STORAGE_OPTIONS \

          $DOCKER_NETWORK_OPTIONS \

          $ADD_REGISTRY \

          $BLOCK_REGISTRY \

          $INSECURE_REGISTRY

# ps aux|grep docker

root     21757  0.0  0.0 358584 21060 ?        Ssl  09:45   0:00 /usr/bin/docker-current daemon --graph /data/docker --exec-opt native.cgroupdriver=systemd --selinux-enabled --log-driver=journald -b=none --iptables=false

/data/docker/image/aufs/imagedb/content/sha256/fce289e99eb9bca977dae136fbe2a82b6b7d4c372474c9235adc1741675f587e

# cat /data/docker/image/aufs/imagedb/content/sha256/fce289e99eb9bca977dae136fbe2a82b6b7d4c372474c9235adc1741675f587e | openssl dgst -sha256 -hex

(stdin)= fce289e99eb9bca977dae136fbe2a82b6b7d4c372474c9235adc1741675f587e

# cat /usr/lib/systemd/system/docker.service

[Unit]

Description=Docker Application Container Engine

Documentation=https://docs.docker.com

BindsTo=containerd.service

After=network-online.target firewalld.service containerd.service

Wants=network-online.target

Requires=docker.socket

[Service]

Type=notify

# the default is not to use systemd for cgroups because the delegate issues still

# exists and systemd currently does not support the cgroup feature set required

# for containers run by docker

ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

ExecReload=/bin/kill -s HUP $MAINPID

TimeoutSec=0

RestartSec=2

Restart=always

# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.

# Both the old, and new location are accepted by systemd 229 and up, so using the old location

# to make them work for either version of systemd.

StartLimitBurst=3

# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.

# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make

# this option work for either version of systemd.

StartLimitInterval=60s

# Having non-zero Limit*s causes performance problems due to accounting overhead

# in the kernel. We recommend using cgroups to do container-local accounting.

LimitNOFILE=infinity

LimitNPROC=infinity

LimitCORE=infinity

# Comment TasksMax if your systemd version does not support it.

# Only systemd 226 and above support this option.

TasksMax=infinity

# set delegate yes so that systemd does not reset the cgroups of docker containers

Delegate=yes

# kill only the docker process, not all processes in the cgroup

KillMode=process

[Install]

WantedBy=multi-user.target

ExecStart=/usr/bin/dockerd -H fd:// \

          --containerd=/run/containerd/containerd.sock \

          --data-root=/data/docker/data \

          --exec-root=/data/docker/run

# ps aux|grep docker

root     22564  0.6  0.1 593460 63488 ?        Ssl  11:04   0:00 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --data-root=/data/docker/data --exec-root=/data/docker/run

# ls -l /data/docker/data/overlay2/c1b9aec275a2cdf832c9f079389aa63577be6f8371dec164af8cc3e8c7fa77f8/diff

总用量 68

drwxr-xr-x  2 root root 4096 12月 19 23:20 bin

drwxr-xr-x  2 root root 4096 12月 19 23:20 dev

drwxr-xr-x 15 root root 4096 12月 19 23:20 etc

drwxr-xr-x  2 root root 4096 12月 19 23:20 home

drwxr-xr-x  5 root root 4096 12月 19 23:20 lib

drwxr-xr-x  5 root root 4096 12月 19 23:20 media

drwxr-xr-x  2 root root 4096 12月 19 23:20 mnt

drwxr-xr-x  2 root root 4096 12月 19 23:20 opt

dr-xr-xr-x  2 root root 4096 12月 19 23:20 proc

drwx------  2 root root 4096 12月 19 23:20 root

drwxr-xr-x  2 root root 4096 12月 19 23:20 run

drwxr-xr-x  2 root root 4096 12月 19 23:20 sbin

drwxr-xr-x  2 root root 4096 12月 19 23:20 srv

drwxr-xr-x  2 root root 4096 12月 19 23:20 sys

drwxrwxrwt  2 root root 4096 12月 19 23:20 tmp

drwxr-xr-x  7 root root 4096 12月 19 23:20 usr

drwxr-xr-x 12 root root 4096 12月 19 23:20 var

# docker logs -f -t --tail=100 container-id

参数名

参数说明

-f

跟踪（follow）实时日志

-t

显示时间戳（timestamps）

--tail=N

显示最后N条，如果不指定tail则默认是所有

--details

显示详细信息

--since=

显示某个时间后的日志，或者最近多长时间的日志：

1. --since=10m 查看最近10分钟的日志
2. --since="2019-12-19" 查看2019-12-19后的日志

--until

查看截止到指定时间的日志

# docker ps -a

参数名

参数说明

-a

列出当前所有正在运行的容器和历史上运行过的容器，如果运行容器时没有指定参数“--rm”，则容器退出后“docker ps -a”仍然看得到。

-l

显示最新创建的容器，包括已停止的容器

-n

显示最近n个创建的容器，包括已停止的容器

-q

安静模式，只显示容器编号

--no-trunc

不截断输出

# docker ps

# docker ps -a -f status=exited

# docker stop

# docker stop $(docker ps -a -q)

# docker kill

# docker rm [OPTIONS] CONTAINER [CONTAINER...]

# docker rm $(docker ps -a -q)

docker rm $(docker ps -a -f status=exited -q)

取值

作用

-f

通过SIGKILL信号强制删除一个运行中的容器

-l

移除容器间的网络连接，而非容器本身

-v

删除与容器关联的卷

# docker rmi <image id>

# docker rmi $(docker images -q)

$ docker images

REPOSITORY   TAG   IMAGE ID         REATED    SIZE

a/redis     6.0.6  1319b1eaa0b7  3 weeks ago  104MB

b/redis     6.0.6  1319b1eaa0b7  3 weeks ago  104MB

redis       6.0.6  1319b1eaa0b7  3 weeks ago  104MB

$ docker rmi a/redis:6.0.6

$ docker rmi -f a/redis:6.0.6

$ docker rmi -f a/redis

docker save -o 文件名.tar 镜像名称

docker save -o tinycore.tar tatsushid/tinycore

docker save -o tinycore.tar docker.io/tatsushid/tinycore

docker load < 文件名.tar

或

docker load -i 文件名.tar

# docker search alpine

INDEX     NAME                            DESCRIPTION                                 STARS OFFICIAL AUTOMATED

docker.io docker.io/alpine                A minimal Docker image based on Alpine Lin... 5927  [OK]       

docker.io docker.io/frolvlad/alpine-glibc Alpine Docker image with glibc (~12MB)        223   [OK]

docker.io docker.io/mhart/alpine-node     Minimal Node.js built on Alpine Linux         448   

docker.io docker.io/anapsix/alpine-java   Oracle Java 8 (and 7) with GLIBC 2.28 over... 434   [OK]

docker.io docker.io/gliderlabs/alpine     Image based on Alpine Linux will help you ... 180   

docker.io docker.io/alpine/git            A  simple git container running in alpine ... 109   [OK]

docker.io docker.io/mvertes/alpine-mongo  light MongoDB container                       106   [OK]

docker.io docker.io/alpine/socat          Run socat command in alpine container         43    [OK]

docker.io docker.io/zzrot/alpine-caddy    Caddy Server Docker Container running on A... 35    [OK]

docker.io docker.io/easypi/alpine-arm     AlpineLinux for RaspberryPi                   32    

docker.io docker.io/jfloff/alpine-python  A small, more complete, Python Docker imag... 32    [OK]

docker.io docker.io/byrnedo/alpine-curl   Alpine linux with curl installed and set a... 28    [OK]

docker.io docker.io/hermsi/alpine-sshd    Dockerize your OpenSSH-server with rsync a... 26    [OK]

docker.io docker.io/hermsi/alpine-fpm-php Dockerize your FPM PHP 7.4 upon a lightwei... 21    [OK]

docker.io docker.io/zenika/alpine-chrome  Chrome running in headless mode in a tiny ... 16    [OK]

docker.io docker.io/bashell/alpine-bash   Alpine Linux with /bin/bash as a default s... 14    [OK]

docker.io docker.io/spotify/alpine        Alpine image with `bash` and `curl`.          9     [OK]

docker.io docker.io/tenstartups/alpine    Alpine linux base docker image with useful... 9     [OK]

docker.io docker.io/roribio16/alpine-sqs  Dockerized ElasticMQ server + web UI over ... 7     [OK]

docker container attach [OPTIONS] CONTAINER-ID

docker container attach 2896d0dad64d

docker container exec [OPTIONS] CONTAINER-ID COMMAND [ARG...]

docker container exec -it 579f618416ca /bin/bash

# docker cp --help

Usage:  docker cp [OPTIONS] CONTAINER:SRC_PATH DEST_PATH|-

        docker cp [OPTIONS] SRC_PATH|- CONTAINER:DEST_PATH

Copy files/folders between a container and the local filesystem

Use '-' as the source to read a tar archive from stdin

and extract it to a directory destination in a container.

Use '-' as the destination to stream a tar archive of a

container source to stdout.

Options:

  -a, --archive       Archive mode (copy all uid/gid information)

  -L, --follow-link   Always follow symbol link in SRC_PATH

# docker cp abc 0eae45845fc3:/

# docker cp 0eae45845fc3:/abc /tmp

# docker commit --help

Usage:  docker commit [OPTIONS] CONTAINER-ID [REPOSITORY[:TAG]]

Create a new image from a container's changes

Options:

  -a, --author string    Author (e.g., "John Hannibal Smith <hannibal@a-team.com>")

  -c, --change list      Apply Dockerfile instruction to the created image

  -m, --message string   Commit message

  -p, --pause            Pause container during commit (default true)

docker tag 1319b1eaa0b2 redis:6.0.6

docker tag 1319b1eaa0b2 myrepository.com/redis:6.0.6

docker push redis:6.0.6

docker push myrepository.com/redis:6.0.6

docker login -u zhangsan -p password

docker login -u zhangsan -p password myrepository.com

参数名

参数说明

-f或--file

指定Dockerfile文件，默为当前目录下的Dockerfile，示例：

# docker build --tag echo -f Dockerfile.echo .

或

# docker build --tag echo -f=Dockerfile.echo .

或

# docker build --tag echo --file Dockerfile.echo .

或

# docker build --tag echo --file=Dockerfile.echo .

-t或--tag

指定镜像的名（name）和标签（tag），其中标签是可选的，格式“name:tag”

-m或--memory

指定容器最大可用内存，可带单位（不区分大小写）：

b、k、kb、m、mb、g、gb、t、tb、p、pb

不指定单位为字节数，但不能小于4M，值可大于实际的物理内存。容器中看到的物理内存大小仍然是宿主机的物理内存大小，并不受参数“-m”值的影响。

--memory-swap

内存+交换分区大小总限制，默认值为参数“-m”值的两倍，并且其值必须大于参数“-m”的值。值的格式同参数“-m”，两者差值即为交换分区大小，值-1表示不做限制。

如果只修改“-m”的值，并不会自动更新“--memory-swap”的值。只是如果不指定时，“--memory-swap”的默认值等于“-m”的值的两倍。

容器内的进程占用的内存大小不能超过“-m”和“--memory-swap”两者值之和，否则会被KILL掉。

--ulimit

设置容器的ulimit，示例：

# docker build --tag echo --ulimit=nofile=1235 --ulimit=nproc=235 .

--rm

成功构建后删除中间环节的容器，默认为true（即：--rm=true）

--force-rm

总是删除掉中间环节的容器，默认为false（即：--force-rm=false）

-q或--quiet

安静模式，构建成功只输出镜像ID，默认为false（即：--quiet=false）

--network

设置容器运行时的网络模式，默认值是default（即：--network=default），可取值：

1. bridge 容器的默认网络，执行命令“docker inspect bridge”可查看配置
2. none 不为容器创建任何网络，容器将只能使用loopback，即禁用所有联网
3. host 容器使用宿主机的网络，17.06及以上版本才有效
4. container:<name|id>
5. <network-name>|<network-id>

Docker安装的时候默认会创建三个不同的网络，可以执行命令“docker network ls”命令查看这些网络。

--no-cache

构建镜像过程中不使用缓存

--pull

总是尝试拉取镜像的更新版本

--iidfile

将镜像ID写到指定文件，如：

# docker build --tag echo --iidfile=myimage.id .

--add-host

添加主机名和主机IP的映射，结果反映在容器的/etc/hosts文件，在/etc/hosts中可以看到添加的映射。

示例：

# docker build --add-host=H1:192.168.0.1 --add-host=H2:192.168.0.2 .

--cpu-period

设置CPU CFS的调度周期，单位为微秒（us），取值范围为“1000us~1000000us”，即：1000~1000000。默认值为100000（即100ms），即一个调度周期时长为100ms。

--cpu-quota

设置容器的CPU CFS配额，即在一个“--cpu-period”周期内最多占用CPU的时长，单位为微秒（us）。值不能小于1000us，即不能小于1000，值-1表示不做控制。可大于“--cpu-period”的值，当大于“--cpu-period”的值时相当于占满了整个“--cpu-period”周期。

-c或--cpu-shares

CPU的共享权值（相对权重）

--cpuset-cpus

允许使用的CPU集，可取值：0-3、0或1

--cpuset-mems

对NUMA架构有效，可取值：0-3、0或1

参数名

参数说明

-d或--detach

以后台方式启动容器

--name

设置容器名，类似进程名

--rm

容器退出后，自动删除容器

-t或--tty

为容器分配一个伪终端

-i或--interactive

交互模式运行容器，保持标准输入打开

-p或--publish

指定宿主机和容器的端口映射列表，比如：

-p 7777:7778 -p 8888:8888

表示将宿主机的7777端口映射到容器的7778，将宿主的8888映射到容器的8888。

如果没有任何端口映射，则在宿主机上看不到容器内进程的痕迹。但如果有映射端口，则在宿主机上，以官方的Redis镜像为例，将可以看到如下：

# ps -Ao pid,args|grep 7778|grep -v grep

27736 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 7777 -container-ip 172.17.0.2 -container-port 7778

原因是外部只能通过宿主机访问容器内的进程（比如这里的Redis）。

--add-host

同“docker build”

--cpu-period

同“docker build”

--cpu-quota

同“docker build”

-c或--cpu-shares

同“docker build”

-m或--memory

同“docker build”

--memory-swap

同“docker build”

--ulimit

同“docker build”

--network

同“docker build”，设置连接的网络类型，如：

# docker run -it --rm --network=bridge centos

--network-alias

设置网络别名（列表），自定义网络模式才有效，否则报错“network-scoped aliases are only supported for user-defined networks”。

-u或--user

设置运行容器的用户（也可同时设置用户组），如：

# docker run -it --rm -u=dbus centos

--expose

容器对外暴露的端口（列表），会覆盖Dockerfile中定义的EXPOSE端口，如：

# docker run -it --rm --expose 2019 --expose 2020 centos

注意这只是一个声明，容器中是否有开启这个端口由容器中的程序决定。

-v或--volume

指定容器绑定的本地目录，格式：宿主机目录:容器目录，如：-v /host_data:/container_data

--link

设置要连接的其它容器（列表），如：

# docker run -it --rm --link=20cf8c99379e centos

--restart

容器重启策略：

1. no 默认值，表示表示容器退出时，Docker不自动重启容器
2. always 只要容器退出，Docker均重启容器
3. on-failure 容器退出状态值非0时，Docker自动重启容器

--pids-limit

设置容器内最多进程数，默认为-1表示不做限制

--oom-kill-disable

禁止容器内的OOM

--pid

和指定容器共享PID（进程ID）资源，如：

# docker run -it --rm --pid=container:4aae83be7a11 centos

--env

设置容器的环境变量

--env-file

设置容器的环境变量，环境变量来源于文件

参数名

参数说明

--cpu-period

同“docker run”

--cpu-quota

同“docker run”

-c或--cpu-shares

同“docker run”

-m或--memory

同“docker build”

--memory-swap

同“docker run”

--restart

同“docker run”

--pids-limit

同“docker run”

参数名

参数说明

ls

例举网格，比如：

# docker network ls

NETWORK ID      NAME            DRIVER              SCOPE

70524b6e0591    bridge          bridge              local

daef1c0068b0    host            host                local

cff2ec4f4275    none            null                local

inspect

查看指定网格，如：

# docker network inspect 70524b6e0591

connect

连接容器到指定网络

disconnect

将容器和网络断开

rm

删除指定的一个或多个网络

create

创建一个网络

prune

删除所有未用到的网络

# systemctl -l status docker.service

failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to create NAT chain DOCKER: Iptables not found

docker.service: main process exited, code=exited, status=1/FAILURE

Failed to start Docker Application Container Engine.

Unit docker.service entered failed state.

# systemctl status firewalld

firewalld.service - firewalld - dynamic firewall daemon

   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled)

   Active: inactive (dead)

# systemctl start firewalld

# systemctl status firewalld

firewalld.service - firewalld - dynamic firewall daemon

   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled)

   Active: active (running) since 三 2019-12-18 16:14:07 CST; 4s ago

 Main PID: 8066 (firewalld)

   CGroup: /system.slice/firewalld.service

           └─8066 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

12月 18 16:14:07 X.site systemd[1]: Started firewalld - dynamic firewall daemon.

# systemctl status firewalld.service

firewalld.service - firewalld - dynamic firewall daemon

   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled)

   Active: failed (Result: exit-code) since 三 2019-12-18 15:46:41 CST; 4s ago

  Process: 6381 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=exited, status=1/FAILURE)

 Main PID: 6381 (code=exited, status=1/FAILURE)

12月 18 15:46:41 X.site systemd[1]: firewalld.service: main process exited, code=exited, status=1/FAILURE

12月 18 15:46:41 X.site systemd[1]: Failed to start firewalld - dynamic firewall daemon.

12月 18 15:46:41 X.site systemd[1]: Unit firewalld.service entered failed state.

ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS

ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS

# /usr/sbin/firewalld --nofork --nopid

Traceback (most recent call last):

  File "/usr/sbin/firewalld", line 34, in <module>

    from firewall import config

ImportError: No module named firewall

# python

Python 2.7.5 (default, Nov 20 2015, 02:00:19)

[GCC 4.8.5 20150623 (Red Hat 4.8.5-4)] on linux2

Type "help", "copyright", "credits" or "license" for more information.

>>> import firewall

>>> print firewall.__file__

/usr/lib/python2.7/site-packages/firewall/__init__.pyc

>>>

# head -1 /usr/sbin/firewalld

#!/usr/bin/python -Es

# iptables -t nat -F

iptables v1.4.21: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

# modinfo iptable_nat

modinfo: ERROR: Module iptable_nat not found.

# modinfo iptable_nat

filename:       /lib/modules/3.10.107-1-0050/kernel/net/ipv4/netfilter/iptable_nat.ko

license:        GPL

srcversion:     22FC08135673BF996B25929

depends:        nf_nat,ip_tables,nf_nat_ipv4,nf_conntrack

intree:         Y

vermagic:       3.10.107-1-0050 SMP mod_unload modversions

signer:          sig

sig_key:        6E:69:6E:67:20:6B:65:79:2C:94:15:C6:82:EA:DB:06:CF:5A:37:57:72:EE:7A:58:2D:CA:23:38

sig_hashalgo:   sha512

# modinfo nf_nat

filename:       /lib/modules/3.10.107-1-0050/kernel/net/netfilter/nf_nat.ko

license:        GPL

srcversion:     5A7A5091ADF09B929C3EBC8

depends:        nf_conntrack

intree:         Y

vermagic:       3.10.107-1-0050 SMP mod_unload modversions

signer:          sig

sig_key:        6E:69:6E:67:20:6B:65:79:2C:94:15:C6:82:EA:DB:06:CF:5A:37:57:72:EE:7A:58:2D:CA:23:38

sig_hashalgo:   sha512

12月 18 16:26:19 X.site dockerd[23727]: failed to start daemon: Error initializing network controller: list bridge addresses failed: PredefinedLocalScopeDefaultNetworks List: [172.17.0.0/16 172.18.0.0/16 172.19.0.0/16 172.20.0.0/16 172.21.0.0/16 172.22.0.0/16 172.23.0.0/16 172.24.0.0/16 172.25.0.0/16 172.26.0.0/16 172.27.0.0/16 172.28.0.0/16 172.29.0.0/16 172.30.0.0/16 172.31.0.0/16 192.168.0.0/20 192.168.16.0/20 192.168.32.0/20 192.168.48.0/20 192.168.64.0/20 192.168.80.0/20 192.168.96.0/20 192.168.112.0/20 192.168.128.0/20 192.168.144.0/20 192.168.160.0/20 192.168.176.0/20 192.168.192.0/20 192.168.208.0/20 192.168.224.0/20 192.168.240.0/20]: no available network

12月 18 16:26:19 X.site systemd[1]: docker.service: main process exited, code=exited, status=1/FAILURE

12月 18 16:26:19 X.site systemd[1]: Failed to start Docker Application Container Engine.

12月 18 16:26:19 X.site systemd[1]: Unit docker.service entered failed state.

# ip link add name docker0 type bridge

# ip addr add dev docker0 172.17.0.1/16

# ip link set docker0 up

# ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

       valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000

    link/ether 60:eb:69:fe:2e:20 brd ff:ff:ff:ff:ff:ff

3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000

    link/ether 60:eb:69:fe:2e:21 brd ff:ff:ff:ff:ff:ff

    inet 10.22.25.101/26 brd 10.223.25.127 scope global eth1

       valid_lft forever preferred_lft forever

4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN

    link/ether 6e:3c:cb:3e:a7:44 brd ff:ff:ff:ff:ff:ff

    inet 172.17.0.1/16 scope global docker0

       valid_lft forever preferred_lft forever

# yum

There was a problem importing one of the Python modules

required to run yum. The error leading to this problem was:

   No module named yum

Please install a package which provides this module, or

verify that the module is installed correctly.

It's possible that the above module doesn't match the

current version of Python, which is:

2.7.5 (default, Jun 17 2014, 18:11:42)

[GCC 4.8.2 20140120 (Red Hat 4.8.2-16)]

If you cannot solve this problem yourself, please go to

the yum faq at:

  http://yum.baseurl.org/wiki/Faq

# python

Python 2.7.5 (default, Jun 17 2014, 18:11:42)

[GCC 4.8.2 20140120 (Red Hat 4.8.2-16)] on linux2

Type "help", "copyright", "credits" or "license" for more information.

>>> import sys

>>> print sys.path

['', '/usr/lib64/python27.zip', '/usr/lib64/python2.7', '/usr/lib64/python2.7/plat-linux2', '/usr/lib64/python2.7/lib-tk', '/usr/lib64/python2.7/lib-old', '/usr/lib64/python2.7/lib-dynload', '/usr/lib64/python2.7/site-packages', '/usr/lib64/python2.7/site-packages/gtk-2.0', '/usr/lib/python2.7/site-packages', '/usr/lib/python2.7/site-packages/setuptools-34.4.1-py2.7.egg', '/usr/lib/python2.7/site-packages/MySQL_python-1.2.5-py2.7-linux-x86_64.egg']

>>>

# python

>>> import yum

>>> print yum.__file__

/usr/lib/python2.7/site-packages/yum/__init__.pyc

# yum install docker-ce-19.03.5-3.el7.x86_64.rpm

error: rpmdb: BDB0113 Thread/process 7020/140405160273920 failed: BDB1507 Thread died in Berkeley DB library

error: db5 error(-30973) from dbenv->failchk: BDB0087 DB_RUNRECOVERY: Fatal error, run database recovery

error: cannot open Packages index using db5 -  (-30973)

error: cannot open Packages database in /var/lib/rpm

CRITICAL:yum.main:

Error: rpmdb open failed

# cd /var/lib/rpm

# tar czf x.tar.gz __db.*

# rm -f __db.*

# rpm --rebuilddb

# yum clean all

systemd[1]: start request repeated too quickly for docker.service

systemd[1]: Failed to start Docker Application Container Engine.

systemd[1]: Unit docker.service entered failed state.

systemd[1]: docker.service failed.

Running modprobe nf_nat failed with message: `modprobe: WARNING: Module nf_nat not found.`, error: exit status 1

# modinfo iptable_nat

modinfo: ERROR: Module iptable_nat not found.

# ls /lib/modules/`uname -r`/kernel/

arch  crypto  drivers  fs  kernel  lib  mm  net

# lsmod | grep nat

iptable_nat            13011  1

nf_nat_ipv4            13263  1 iptable_nat

nf_nat                 26711  3 ipt_MASQUERADE,nf_nat_ipv4,iptable_nat

nf_conntrack           96187  8 ipt_MASQUERADE,nf_nat,nf_nat_ipv4,xt_conntrack,nf_conntrack_netlink,iptable_nat,nf_conntrack_ipv4,nf_conntrack_ipv6

ip_tables              27239  4 iptable_filter,iptable_mangle,iptable_nat,iptable_raw

Error response from daemon: oci runtime error: container_linux.go:235: starting container process caused "process_linux.go:258: applying cgroup configuration for process caused \"Cannot set property TasksAccounting, or unknown property.\"".

Transaction check error:

  file /usr/bin/docker from install of docker-ce-cli-1:19.03.1-3.el7.x86_64 conflicts with file from package docker-common-2:1.13.1-96.gitb2f74b2.tl2.x86_64

  file /usr/bin/dockerd from install of docker-ce-3:19.03.1-3.el7.x86_64 conflicts with file from package docker-common-2:1.13.1-96.gitb2f74b2.tl2.x86_64

错误概要

-------------

Your kernel does not support swap limit capabilities or the cgroup is not mounted. Memory limited without swap.

cgroup_enable=memory swapaccount=1

docker: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?.

See 'docker run --help'.

Error response from daemon: Minimum memoryswap limit should be larger than memory limit, see usage

Value too large for defined data type

// g++ -g -o x x.cpp -m32

#include <errno.h>

#include <stdio.h>

#include <string.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <unistd.h>

#include <string>

int main(int argc, char* argv[])

{

  struct stat st;

  if (stat(argv[1], &st) != 0)

  {

    printf("stat failed: %s.\n", strerror(errno));

    return 1;

  }

  else {

    printf("%zd\n", st.st_size);

    return 0;

  }

}

// g++ -g -o x x.cpp -m32

#include <errno.h>

#include <stdio.h>

#include <string.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <unistd.h>

#include <string>

int main(int argc, char* argv[])

{

  struct stat64 st;

  if (stat64(argv[1], &st) != 0)

  {

    printf("stat failed: %s.\n", strerror(errno));

    return 1;

  }

  else {

    printf("%zd\n", st.st_size);

    return 0;

  }

}

命令

作用

说明

rpm -ivh packagename.rpm

安装

-i为install之意，即安装，等同--install；

-v为verbose之意，即显示详细信息，等同--verbose；

-h为hash之意，即显示进度信息，等同--hash。

rpm -ivh packagename.rpm --nodeps

强制安装，并忽略依赖

rpm -ivh packagename.rpm --force

强制安装，不忽略依赖

rpm -e packagename

卸载

rpm -qi packagename

查看信息

rpm -pq packagename.rpm

查询安装后的名字

rpm -ql packagename

查询安装后生成的文件

rpm -qlp packagename.rpm

查询安装后生成的文件

命令

作用

说明

yum list all

列举出仓库中的所有包

yum list installed

列举已安装的

yum list available

列举可安装的包

yum repolist all

列举出所有仓库，含禁用的

yum repolist

列举出可用的仓库

等同“yum repolist enabled”

yum repolist disabled

列举出禁用的仓库

yum clean all

清除所有缓存

yum search packagename

查找可安装的包

示例:

yum search docker

yum info packagename

查询包的摘要信息

示例:

yum info docker

yum deplist packagename

查看包依赖

示例：

yum deplist docker

yum list all packagename

查看仓库中指定名的包

救命：

yum list all docker

yum -y install packagename

安装

示例1（安装单个）：

yum -y install docker

示例2（安装多个）：

yum -y install \

docker-ce \

docker-ce-cli \

containerd.io \

docker

yum -y remove packagenameX

删除安装的包

注意packagenameX是命令yum list installed列出的包名（第1列），比如docker-ce-cli.x86_64。

示例1：

yum -y remove docker.x86_64

示例2：

yum -y remove \

docker-ce-cli.x86_64

yum-config-manager \

--add-repo=ADDREPO

添加和启用一个新的仓库，执行时会在目录/etc/yum.repos.d下生成一个repo文件。

示例：

yum-config-manager \

--add-repo=\

https://download.docker.com/linux/centos/docker-ce.repo

如果没有yum-config-manager，则可用下列命令安装：

yum install -y yum-utils \

device-mapper-persistent-data \

lvm2

yum-config-manager是包yum-utils中的一员。

命令

作用

说明

systemctl start service

启动服务

示例1：

system start docker.service

或

system start docker

systemctl stop service

停止服务

示例1

system stop crond

或

system stop crond.service

systemctl restart service

重启服务

systemctl enable service

设置服务随系统自动启动

以docker.service为例，“systemctl enable service”的作用实际等同于：

ln -s \

'/etc/systemd/system/docker.service' \

'/etc/systemd/system/multi-user.target.wants/docker.service'

systemctl disable service

取消服务随系统自动启动

以docker.service为例，“systemctl disable service”的作用实际等同于：

rm '/etc/systemd/system/multi-user.target.wants/docker.service'

systemctl status service

查看服务状态

systemctl reload

重加载配置

当修改诸如docker.service文件时，需要执行一次reload

systemctl reboot

重启系统

systemctl set-default

设置默认的启动级别，其中multi-user.target对应级别3，graphical.target对应级别5

示例1：

systemctl \

set-default \

multi-user.target

示例2：

systemctl \

set-default \

graphical.target

命令

作用

说明

brctl addbr <bridge>

创建网桥

示例：

brctl addbr docker0

brctl delbr <bridge>

删除网桥

示例：

brctl delbr docker0

brctl show <bridge>

查询网桥信息

brctl setfd <bridge> <time>

设置网桥转发延迟

示例：

brctl setfd docker0 10

brctl addif <bridge> <device>

网卡接入网桥

示例：

brctl addif docker0 eth1

brctl delif <bridge> <device>

删除接入网桥的网卡

brctl stp <bridge> <on>

启用网桥

示例：

brctl stp docker0 on

brctl stp <bridge> <off>

禁用网桥

brctl showmacs <bridge>

查看mac信息

示例：

brctl showmacs docker0

Ifconfig/netstat命令

ip命令

归属包

net-tools

iproute

ifconfig

ip link

ifconfig eth0 up

ip link set eth0 up

查看所有接口，包括已禁用的

ifconfig -a

ip addr show或ip a

ifconfig -s

ip -s link

netstat -i

ip -s link

netstat -r

ip route

ip link add name docker0 type bridge

ip addr add dev docker0 172.17.0.1/16

ip link set docker0 up

ip link set docker0 down

ip link delete docker0 type bridge

# file /lib/modules/`uname -r`/kernel/net/netfilter/nf_nat.ko

/lib/modules/3.10.107-1-0046/kernel/net/netfilter/nf_nat.ko: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=1a7527386082c922caeb208c7c9a1d530c079f1d, not stripped

# modinfo xt_limit.ko

filename:       /lib/modules/3.10.107-1-0046/kernel/net/netfilter/xt_limit.ko

alias:          ip6t_limit

alias:          ipt_limit

description:    Xtables: rate-limit match

author:         Herve Eychenne <rv@wallfire.org>

license:        GPL

srcversion:     B22C9E4BCCDBDFBFD5D4EFD

depends:        

intree:         Y

vermagic:       3.10.107-1-0046 SMP mod_unload modversions

signer:          sig

sig_key:        6E:69:6E:67:20:6B:65:79:2C:94:15:C6:82:EA:DB:06:CF:5A:37:57:72:EE:7A:58:2D:CA:23:38

sig_hashalgo:   sha512

# lsmod

Module                  Size  Used by

nf_nat                 26754  0

ip6t_rpfilter          12546  1

ip6t_REJECT            12939  2

nf_conntrack_ipv6      18738  4

nf_defrag_ipv6         34651  1 nf_conntrack_ipv6

# lsmod | grep nf_nat

nf_nat                 26754  0

nf_conntrack           96187  4 nf_nat,xt_conntrack,nf_conntrack_ipv4,nf_conntrack_ipv6

# rmmod nf_nat_proto_udplite

# rmmod nf_nat.ko

# insmod ./nf_nat_proto_udplite.ko

# insmod netfilter/nf_nat.ko

# modprobe nf_nat

modprobe: FATAL: Module nf_nat not found.

# modprobe nf_nat

modprobe: ERROR: could not insert 'nf_nat': Exec format error

# insmod ./nf_nat.ko

insmod: ERROR: could not insert module ./nf_nat.ko: Invalid module format