了解Docker，容器和更安全的软件交付

Databases, dependencies, cron jobs … Applications today have so many layers that it isn’t a surprise when moving things takes a lot of time. But it doesn’t have to be that way. Today, you can ship software to virtually any environment, and be up and running in seconds. Enter Docker.

数据库，依赖项，cron作业…当今的应用程序具有许多层，因此移动事物需要大量时间就不足为奇了。 但这不是必须的。 今天，您可以将软件运送到几乎任何环境，并在几秒钟内启动并运行。 输入Docker 。

软件交付 (Software delivery)

Delivering software used to be easy. The hard part was programming, but once you finished you would just handle the product, maybe fix some bugs, and that’d be all.

过去交付软件很容易。 困难的部分是编程，但是一旦完成，您就可以处理产品，也许可以修复一些错误，仅此而已。

Later, with the “LAMP stack” (Linux, Apache, MySQL, PHP) — which was widely supported by hosting companies — things got slightly more complicated, but were still manageable. You could deliver dynamic sites linked to databases and set everything up via control panels.

后来，有了托管公司广泛支持的“ LAMP堆栈”(Linux，Apache，MySQL，PHP)，事情变得稍微复杂了一些，但是仍然可以管理。 您可以提供链接到数据库的动态站点，并通过控制面板设置所有内容。

But in more recent times, the scenario has gotten even more diverse and demanding, as new technologies have broken in. NoSQL databases and Node.js, programming languages like Python and Ruby, have gained in prominence. All of these and more have opened lots of possibilities, but now delivering software is not so easy anymore.

但是在最近一段时间，随着新技术的涌入，这种情况变得更加多样化和苛刻。NoSQL数据库和Node.js(Python和Ruby等编程语言)的地位日益突出。 所有这些以及更多这些都带来了许多可能性，但是现在交付软件已不再那么容易了。

实作 (Implementation)

Applications have become hard to implement. Even if you get yourself a dedicated server, you still have to deal with installing and setting things up, and even some of the maintenance that’s needed to get everything up and running. And yet, with everything working, given that now you are in complex and tightly coupled systems with different services and programming languages, there’s always the chance that things will break all of a sudden.

应用程序已变得难以实现 。 即使您拥有专用的服务器，也仍然必须处理安装和设置工作，甚至还需要进行一些维护才能使一切正常运行。 但是，在一切正常的情况下，鉴于您现在处在具有不同服务和编程语言的复杂且紧密耦合的系统中，总有可能突然之间出现问题。

Docker解救 (Docker to the rescue)

Docker makes delivering software easy again. Docker allows you to set up everything — the software you’ve developed, the OS in which it will run, the services that it needs, the modules and back-end tools such as cron jobs. All of it can be set up to run in minutes, with the guarantee that it will work on the target system as well as it works on your development environment.

Docker使再次交付软件变得容易 。 Docker允许您设置所有内容 -开发的软件，将在其中运行的操作系统，所需的服务，模块以及诸如cron作业之类的后端工具。 所有这些都可以设置为在几分钟内运行，并保证它可以在目标系统上运行，也可以在您的开发环境上运行。

Docker解决的问题 (The Problems Docker Solves)

These are some of the issues you’ll come across at some point or another when delivering software:

这些是在交付软件时有时会遇到的一些问题：

• The application you carefully developed with your favorite language (Python, Ruby, PHP, C) doesn’t seem to work on the target system, and you can’t quite figure why.

  您使用自己喜欢的语言(Python，Ruby，PHP，C)精心开发的应用程序似乎无法在目标系统上运行 ，并且您也不十分清楚为什么。

• Everything was working just fine … until someone updated something on the server, and now it doesn’t anymore.

  一切工作都很好……直到有人更新了服务器上的内容 ，现在不再了。

• An otherwise minor dependency (e.g. a module that’s used only occasionally, or a cron job) causes problems when your client uses the software … But it was working just fine on your computer when you tested it!

  否则，较小的依赖关系(例如，仅偶尔使用的模块或cron作业)会在您的客户端使用该软件时引起问题……但是，在您测试该软件时，它在您的计算机上工作得很好 ！

• A service your product relies on, like a database or a web server, has some problem (e.g. high traffic for a website, or some problematic SQL code) and acts as a bottleneck slowing down the entire system.

  您的产品所依赖的服务(例如数据库或Web服务器)存在一些问题(例如，网站的高流量或某些有问题SQL代码)，并且成为降低整个系统速度的瓶颈 。

• A security breach compromises some component of the system and, as a result, everything goes down.

  安全漏洞破坏了系统的某些组件 ，结果一切都崩溃了。

These issues fall within the somewhat fuzzy territory of “DevOps”, with some of them involving maintenance issues (server updates), some testing issues (checking modules versions), and some deployment issues (installing and setting up everything on a different location). It’s a real pain when deployment of something that’s already working doesn’t go smoothly, instead becoming problematic and time consuming.

这些问题属于“ DevOps”的模糊范畴，其中一些涉及维护问题(服务器更新)，一些测试问题(检查模块版本)和一些部署问题(在不同位置安装和设置所有组件)。 当已经运行的某些东西的部署不能顺利进行而变成问题和耗时的时候，这确实是一个痛苦。

软件容器 (Software Containers)

You’re probably familiar with those large, standardized shipping containers that exist to simplify delivery around the world — the intermodal container:

您可能熟悉那些存在的大型标准化运输容器，它们可以简化在世界范围内的交货-联运集装箱：

You can put pretty much anything in one, ship it anywhere, and at the other end unload what’s there — a car, some furniture, a piano — in exactly the same, original condition.

您可以将几乎任何东西放在一起，将其运送到任何地方，然后在另一端以完全相同的原始状态卸载那里的东西-汽车，家具，钢琴。

In software development, we may spend days trying to get things working on a different environment — only for them to fail a couple of days later. It’s easier and faster to ship a working car to a different continent than to deliver software that works reliably. Isn’t that kind of embarrassing?

在软件开发中，我们可能会花费数天的时间来尝试使事情在不同的环境下工作-仅在几天后失败。 将工作用的汽车运送到另一个大陆要比交付可靠的软件要容易和快捷得多。 那不是很尴尬吗？

So people started thinking of something similar to shipping containers for delivering software — something you could use to ship software in a reliable way, that would actually work as expected: software containers.

因此，人们开始考虑类似于为交付软件而运送容器的某些事情—您可以用一种可靠的方式来运送软件的事情，实际上可以按预期工作： 软件容器 。

This might make you thinks of software installers, like those used to easily distribute desktop applications. With an installer, all you can distribute is an executable and some runtime libraries (small programs that the main application needs for running) — as long as these don’t conflict with those that the system has already installed. In contrast, software containers enable us to ship pretty much anything — just as with physical containers.

这可能会让您想到软件安装程序，例如那些用于轻松分发桌面应用程序的安装程序。 使用安装程序，您可以分发的只是一个可执行文件和一些运行时库(主应用程序需要运行的小程序)，只要它们与系统已安装的程序不冲突即可。 相比之下，软件容器使我们可以运送几乎所有东西 ，就像物理容器一样。

Examples of what you can put in software containers include:

可以放入软件容器中的示例包括：

• a Python, Ruby or PHP interpreter, packed with all of the required modules
  Python，Ruby或PHP解释器，包含所有必需的模块

• any runtime libraries

  任何运行时库

• specific versions of certain modules (because you never know when a newer version will cause some problems)
  某些模块的特定版本(因为您永远不知道更新的版本何时会引起一些问题)
• services your application needs, like a web server or a database
  应用程序需要的服务，例如Web服务器或数据库
• some specific tweaks for the system
  系统的一些特定调整
• maintenance back end tools, such as cron jobs and other automation.
  维护后端工具，例如cron作业和其他自动化。

简化操作 (Simplified operations)

Containers simplify operations dramatically. And they’re so practical, easy to create and easy to handle that there’s no need to put everything into a single one.

容器大大简化了操作 。 它们是如此实用，易于创建和易于处理，因此无需将所有内容都放在一个单独的容器中。

You can put the core of your application with the libraries in one container, and call services such as Apache, MySQL or MongoDB, from different containers. This all may sound strange and even complicated, but bear with me and you’ll see how doing so not only makes a lot of sense, but it’s way easier that it sounds.

您可以将应用程序的核心与库放在一个容器中，并从不同的容器中调用Apache，MySQL或MongoDB之类的服务。 这一切都可能听起来很奇怪，甚至很复杂，但忍耐一下，你会看到这样做不仅使一个很大的意义，但它的方式更容易，它的声音。

何时使用软件容器 (When to Use Software Containers)

Before we get into the mechanics and some details of how it works, we’ll review some use cases. Here are some scenarios that would greatly benefit from using software containers:

在深入探讨机制及其工作原理的一些细节之前，我们将回顾一些用例 。 以下是使用软件容器将大大受益的一些方案：

• a web application that relies on back-end technologies
  依赖于后端技术的Web应用程序
• a service (such as web, or database) that needs the be scaled up and down based on demand
  需要根据需求扩展和缩减的服务(例如Web或数据库)
• an application (web or otherwise) with a very specific setup (OS, tools, environment variables, etc.)
  具有非常特定的设置(操作系统，工具，环境变量等)的应用程序(Web或其他)
• a development environment easy to distribute among peers (that is, a quick and easy way to share a certain setup)
  易于在同级之间分发的开发环境(即，共享特定设置的快速简便的方法)
• an environment for sandboxing (to test things safely) that can rapidly be created and disposed as many times as needed
  一个可以快速创建和处置所需次数的沙箱环境(以安全地测试事物)

• a setup with an effective separation of concerns, with loosely coupled components (apps from services to operating systems) that can be handled independently.

  有效关注点分离的设置，具有松散耦合的组件(从服务到操作系统的应用程序)，可以独立处理。

何时不使用软件容器 (When Not to Use Software Containers)

Equivalently, before we all jump into the hype, there are other situations in which containers have little to offer, such as:

同样，在大家大肆宣传之前，还有其他情况下容器提供的内容很少 ，例如：

• a website that uses only client-side technologies such as HTML, CSS, and JavaScript
  仅使用客户端技术(例如HTML，CSS和JavaScript)的网站
• a simple desktop application that can otherwise be distributed with a software installer
  一个简单的桌面应用程序，可以与软件安装程序一起分发
• a Windows-based development environment (such as .NET Framework, or VisualBasic runtimes) that cannot be implemented on Linux.
  一个基于Windows的开发环境(例如.NET Framework或VisualBasic运行时)，无法在Linux上实现。

什么是Docker？ (What is Docker?)

For those situations in which containers shine, you may be wondering how this technology is implemented in practice. So let’s see look at how Docker delivers on all of these promises.

对于那些容器发光的情况，您可能想知道在实践中如何实现此技术。 因此，让我们看看Docker如何实现所有这些承诺。

Docker: “Build, ship, and run any app. Anywhere.”

Docker：“构建，发布和运行任何应用程序。 任何地方。”

Docker is an open-source project — as well as a company, based in San Francisco, supporting that project. It was just born in 2013, and yet in so little time and still partly in beta, it’s being massively adopted in a number of industries.

Docker是一个开源项目，也是位于旧金山的一家公司，都在支持该项目。 它刚好诞生于2013年，但是时间却很短，仍然处于beta版本， 在许多行业都得到了广泛的采用 。

But what is it? Docker is software that you run from the command line and that allows you to automate the deployment of applications inside software containers. From the Docker website:

那是什么 Docker是您从命令行运行的软件，它允许您自动在软件容器内部署应用程序。 从Docker网站 ：

Docker containers wrap a piece of software in a complete filesystem that contains everything needed to run: code, runtime, system tools, system libraries — anything that can be installed on a server. This guarantees that the software will always run the same, regardless of its environment.

Docker容器将一个软件包装在一个完整的文件系统中，该文件系统包含运行所需的一切：代码，运行时，系统工具，系统库-可以安装在服务器上的任何内容。 这保证了无论其环境如何，该软件将始终运行相同的软件。

As that may still be a little too abstract, let’s see what running a container is like.

由于可能仍然有点抽象，让我们看看运行容器是什么样的。

Docker演示 (A Docker demo)

This is how your run a the “hello-world” container:

这是您运行“ hello-world”容器的方式：

$ docker run hello-world

And here’s the output, generated from within the container, with a little description of the Docker internals:

这是从容器内部生成的输出，并简要描述了Docker内部：

Hello from Docker.
This message shows that your installation appears to be working correctly.
 
To generate this message, Docker took the following steps:
1. The Docker Engine CLI client contacted the Docker Engine daemon.
2. The Docker Engine daemon pulled the "hello-world" image from the Docker Hub.
3. The Docker Engine daemon created a new container from that image which runs the
   executable that produces the output you are currently reading.
4. The Docker Engine daemon streamed that output to the Docker Engine CLI client, which sent it
   to your terminal.
 
To try something more ambitious, you can run an Ubuntu container with:
$ docker run -it ubuntu bash
 
Share images, automate workflows, and more with a free Docker Hub account:
https://hub.docker.com
 
For more examples and ideas, visit:
https://docs.docker.com/userguide/

Hopefully that was simple enough, but there isn’t much more we can do with the “hello-world” container, so let’s go further and run an interactive shell in an Ubuntu Linux:

希望这很简单，但是“ hello-world”容器可以做的事情不多，因此，让我们进一步了解一下，并在Ubuntu Linux中运行交互式shell：

$ docker run -i -t ubuntu bash
 
# cat /etc/issue
Ubuntu 16.04 LTS \n \l

The first command launches interactive (-i) TTY or console (-t) in the ubuntu container with the bash shell. The second command (cat /etc/issue) is already inside the container (and we could have continued running commands, of course). To be clear: no matter if you’re on Windows, your Mac, or your Debian box, for that container you’re in an Ubuntu machine. And for the record, that console was up and running in a second!

第一个命令使用bash shell在ubuntu容器中启动交互式( -i )TTY或控制台( -t )。 第二个命令( cat /etc/issue )已经在容器内(当然，我们可以继续运行命令)。 需要明确的是：无论您使用的是Windows，Mac还是Debian机器，该容器都位于Ubuntu计算机中。 记录下来，该控制台很快就启动并运行 ！

Additionally, since containers are completely isolated and disposable environments, you can do crazy things in them, such as:

此外，由于容器是完全隔离且可丢弃的环境，因此您可以在容器中做疯狂的事情，例如：

# rm -rf /etc
# cat /etc/issue
cat: /etc/issue: No such file or directory

And when you exit or kill that container, all you have to do is relaunch it, and you’ll get a new one on the exact same initial state:

当您退出或杀死该容器时，您要做的就是重新启动它，您将在完全相同的初始状态下得到一个新容器：

# exit
$ docker run -i -t ubuntu bash
# cat /etc/issue
Ubuntu 16.04 LTS \n \l

It’s that simple!

就这么简单！

Docker如何工作 (How Docker Works)

架构 (The architecture)

If you’re familiar with virtual machines (VM) such as a hypervisor, you may already have started to notice some differences. While they allow you to run different operating systems (OS), VMs have a heavy memory footprint on the host machine, as every new OS is loaded from scratch into main memory. And since every OS requires all its own binaries and libraries for the entire system, that usually accounts for several extra GBs of space on disk. Last but not least, just as when launching an actual OS, the system takes several minutes to load before it’s operational.

如果您熟悉虚拟机管理程序等虚拟机 (VM)，则可能已经开始注意到一些差异。 尽管它们允许您运行不同的操作系统(OS)，但由于每个新的OS都是从头开始加载到主内存中的，因此VM在主机上的内存占用很大。 而且，由于每个OS都需要用于整个系统的所有二进制文件和库，因此通常会占用磁盘上几个GB的额外空间。 最后但并非最不重要的一点是，就像在启动实际操作系统时一样，系统需要几分钟才能加载，然后才能运行。

Virtual machines diagram by Docker, Inc.

Docker，Inc.的虚拟机图

Software containers, on the other hand, dramatically reduce most of this overhead, because they directly use resources from the host OS, which are handled by the Docker Engine, allowing for a more direct and efficient management of resources. That’s why, in just about a 100MB you can have a minimal yet fully working Linux distribution such as Ubuntu that you can launch in literally 1 second.

另一方面，由于软件容器直接使用主机操作系统中的资源(由Docker引擎处理)，因此可以大大减少这些开销，从而可以更直接，更有效地管理资源。 这就是为什么，在大约100MB中，您可以拥有最小但可以正常运行的Linux发行版，例如Ubuntu，您可以在1秒内启动它。

Software containers diagram by Docker, Inc.

Docker，Inc.的软件容器图

图片和容器 (Images and containers)

You’ll hear a lot about “images” and “containers” when working with Docker, so let’s clarify what they are.

使用Docker时，您会听到很多有关“图像”和“容器”的信息，所以让我们弄清楚它们是什么。

An image (sometimes called “the build”) is a file, a read-only resource that you download or create, packed with everything that’s needed for an operational environment. Building images is very easy, because you can use already available images as a base (for example, a Debian distribution), and tell Docker what you want on top of it, like certain development tools, libraries, and even put your own application inside.

映像 (有时称为“内部版本”)是文件，是您下载或创建的只读资源，其中包含操作环境所需的所有内容。 构建映像非常简单，因为您可以使用已经可用的映像作为基础(例如，Debian发行版)，并告诉Docker您想要在其之上拥有什么，例如某些开发工具，库，甚至可以将自己的应用程序放入其中。

A container, on the other hand, is the isolated environment that you get when you run an image, and it is read and write, so you can do whatever you want in them. This environment is going to be in the precise state that was defined when building the image. And since images are read-only, when you run a new container you have a perfect new environment, no matter what you did in other containers. You can run as many simultaneous containers as your system can handle.

的容器 ，在另一方面，是隔离的环境，当你运行一个形象，你得到的，并且它的读写 ，所以你可以做任何你想要他们。 该环境将处于构建映像时定义的精确状态。 而且由于图像是只读的，因此无论您在其他容器中执行了什么操作，当您运行新容器时，您都拥有一个完美的新环境。 您可以运行系统可以处理的多个容器。

So you run containers from images. An analogy that can be useful — if you work with object-oriented programming such as C or Java — is that an image is like a class, whereas a container would be an instance of that class.

因此，您可以从图像运行容器。 如果您使用的是面向对象的程序(例如C或Java)，则可能有用的类比是，图像就像一个类，而容器则是该类的实例。

Docker工作流程 (Docker workflow)

Since this is an introductory article, we won’t get into full details just now, but for you to have an idea of what a typical workflow with Docker looks like, here are the main three steps:

由于这是一篇介绍性文章，因此我们暂时不会深入了解所有细节，但是为了让您了解Docker的典型工作流程是什么样子，以下是主要的三个步骤：

1. Build an image using the Dockerfile, a plain text file in which you set the instructions for what you want to bundle in the build — such as base OS, libraries, applications, environment variables and local files. (See the Dockerfile reference for more.)

   使用Dockerfile(一个纯文本文件) 构建映像 ，您可以在其中设置要捆绑到构建中的内容的说明-例如基本OS，库，应用程序，环境变量和本地文件。 (有关更多信息，请参阅Dockerfile参考 。)

2. Ship the image through the Docker Hub, or your private repository. You can now very easily distribute this application or development environment with Docker — and in fact, there are dozens of official, pre-built images offered by software developers, ready to use. (Explore the Docker Hub for more.)

   通过Docker Hub或您的私有存储库发送映像 。 您现在可以使用Docker轻松分发此应用程序或开发环境-实际上，软件开发人员提供了数十个正式的，预先构建的映像，可供使用。 (进一步了解Docker Hub 。)

3. Run a container on a host machine. All you need is to have Docker installed in order to be able to run containers, deploy microservices (that is, launching different containers running different services), and have the environment you need for development or deployment.

   在主机上运行容器 。 您所需要做的就是安装Docker，以便能够运行容器，部署微服务(即，启动运行不同服务的不同容器)并拥有开发或部署所需的环境。

接下来做什么 (What to Do Next)

The possibilities with software containers are immense, and they provide in many cases definite solutions to what used to be open problems in the area of development and operations (DevOps). We’ll give you here a list of resources to get you started working with Docker and software containers.

软件容器的可能性是巨大的，并且在许多情况下，它们为开发和运营(DevOps)领域中的开放性问题提供了明确的解决方案。 我们将在此处为您提供资源列表，以帮助您开始使用Docker和软件容器。

The requirements for installing Docker are somewhat high:

安装Docker的要求有些高：

• Windows: 64-bit operating system, Windows 7 or higher.

  Windows ：64位操作系统，Windows 7或更高版本。

• Mac: OS X 10.8 “Mountain Lion” or newer, with Intel’s hardware support for memory management unit (MMU) virtualization, and at least 4GB of RAM.

  Mac ：OS X 10.8“ Mountain Lion”或更高版本，具有英特尔对内存管理单元(MMU)虚拟化的硬件支持，以及至少4GB的RAM。

• Linux: 64-bit installation (regardless of your Linux distro and version), with a 3.10 kernel or higher. (Older kernels lack some features required to run Docker containers.)

  Linux ：64位安装(与Linux发行版和版本无关)，具有3.10或更高版本的内核。 (较旧的内核缺少运行Docker容器所需的某些功能。)

Because Docker is a Linux-based technology, for Windows and Mac you will first need to install the Docker Toolbox that will easily set up a Docker environment on your computer, including a virtual machine running Linux and the Docker Engine. For instructions on the installation and setup, you can refer to the OS specific guides:

由于Docker是基于Linux的技术，因此对于Windows和Mac，您首先需要安装Docker Toolbox ，该工具箱可以轻松地在计算机上设置Docker环境，包括运行Linux和Docker Engine的虚拟机。 有关安装和设置的说明，您可以参考操作系统特定的指南：

• Getting Started with Docker for Windows.

  Windows Docker入门 。

• Getting Started with Docker for Mac.

  Mac的Docker入门 。

For the different Linux distributions, you’ll just install the Docker Engine:

对于不同的Linux发行版 ，您只需安装Docker Engine：

• Install Docker Engine on Linux.

  在Linux上安装Docker Engine 。

Once you have Docker installed, you can follow this step-by-step walkthrough on running and building your own images, creating a repository on the Docker Hub, and more:

安装Docker之后，您可以按照以下分步演练来运行和构建自己的映像，在Docker Hub上创建存储库，以及更多：

• Get Started with Docker.

  Docker入门 。

To go further, you’ll find many technology specific Docker tutorials on SitePoint, such as for Ruby, WordPress, and Node.js. (You can also explore all of SitePoint’s Docker offerings.)

为了走得更远，你会发现许多SitePoint 技术特定泊坞教程 ，如Ruby ， WordPress的 ，和Node.js的 。 (您还可以浏览所有SitePoint的Docker产品 。)

Finally, keep in mind that this technology consists of a lot more than a command tool for running containers. Docker is an ecosystem of products and services oriented towards centralizing everything you can possibly do with containers — from creation to distribution, from running on a single machine to orchestration across hundreds or even thousands of servers.

最后，请记住，该技术不仅包含用于运行容器的命令工具，还包含许多其他内容。 Docker是一个产品和服务生态系统 ，旨在集中化您可能使用容器进行的所有操作-从创建到分发，从在一台计算机上运行到跨数百甚至数千台服务器的编排。

翻译自: https://www.sitepoint.com/docker-containers-software-delivery/