在专用服务器上使用 Docker 容器化您的应用程序：分步指南

# 检查内核版本
uname -r

# 检查系统架构
uname -m

# 检查可用内存
free -h

# 检查可用磁盘空间
df -h

sudo apt update
sudo apt upgrade -y

sudo yum update -y

sudo apt install -y apt-transport-https ca-certificates curl software-properties-common gnupg lsb-release

sudo yum install -y yum-utils device-mapper-persistent-data lvm2

# 允许 Docker 守护进程端口
sudo ufw allow 2375/tcp
sudo ufw allow 2376/tcp

# 根据需要允许容器端口
# 示例：允许 HTTP 和 HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

sudo firewall-cmd --permanent --zone=public --add-port=2375/tcp
sudo firewall-cmd --permanent --zone=public --add-port=2376/tcp
sudo firewall-cmd --permanent --zone=public --add-port=80/tcp
sudo firewall-cmd --permanent --zone=public --add-port=443/tcp
sudo firewall-cmd --reload

# 创建新用户
sudo adduser dockeruser

# 将用户添加到 sudo 组
sudo usermod -aG sudo dockeruser

# 切换到新用户
su - dockeruser

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io

sudo docker --version

sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

sudo yum install -y docker-ce docker-ce-cli containerd.io

sudo systemctl start docker
sudo systemctl enable docker

sudo docker --version

sudo usermod -aG docker $USER

newgrp docker

docker run hello-world

sudo nano /etc/docker/daemon.json

{
  "data-root": "/var/lib/docker",
  "storage-driver": "overlay2",
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "default-address-pools": [
    {"base": "172.17.0.0/16", "size": 24}
  ],
  "registry-mirrors": [],
  "dns": ["8.8.8.8", "8.8.4.4"]
}

sudo systemctl restart docker

# 下载当前稳定版
sudo curl -L "https://github.com/docker/compose/releases/download/v2.18.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

# 应用可执行权限
sudo chmod +x /usr/local/bin/docker-compose

# 验证安装
docker-compose --version

docker login [registry-url]

docker login

docker info | grep "Storage Driver"

sudo nano /etc/docker/daemon.json

{
  "storage-driver": "overlay2"
}

sudo systemctl restart docker

# 搜索镜像
docker search nginx

# 从 Docker Hub 拉取镜像
docker pull nginx:latest

# 拉取特定版本
docker pull nginx:1.21.6

# 运行一个 Nginx 容器
docker run --name my-nginx -p 80:80 -d nginx

# 列出正在运行的容器
docker ps

# 列出所有容器（包括已停止的）
docker ps -a

# 停止容器
docker stop my-nginx

# 启动已停止的容器
docker start my-nginx

# 重启容器
docker restart my-nginx

# 删除容器（必须先停止）
docker rm my-nginx

# 强制删除容器（即使正在运行）
docker rm -f my-nginx

docker run -d --name my-app -e DB_HOST=localhost -e DB_PORT=5432 my-app-image

# 将主机目录挂载到容器目录
docker run -d --name my-nginx -p 80:80 -v /path/on/host:/usr/share/nginx/html nginx

# 创建网络
docker network create my-network

# 在网络上运行容器
docker run -d --name my-app --network my-network my-app-image

mkdir node-app
cd node-app

# 创建 package.json
echo '{
  "name": "node-app",
  "version": "1.0.0",
  "main": "server.js",
  "scripts": {
    "start": "node server.js"
  },
  "dependencies": {
    "express": "^4.18.2"
  }
}' > package.json

# 创建 server.js
echo 'const express = require("express");
const app = express();
const PORT = process.env.PORT || 3000;

app.get("/", (req, res) => {
  res.send("Hello from Docker on TildaVPS!");
});

app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});' > server.js

echo 'FROM node:16-alpine

WORKDIR /app

COPY package*.json ./

RUN npm install

COPY . .

EXPOSE 3000

CMD ["npm", "start"]' > Dockerfile

docker build -t my-node-app .

docker run -d --name my-node-app -p 3000:3000 my-node-app

docker logs my-container-name
# 用于连续日志输出
docker logs -f my-container-name

# 将容器限制为 2 个 CPU 和 1GB 内存
docker run -d --name resource-limited-app --cpus=2 --memory=1g my-app-image

# 列出所有镜像
docker images

# 获取有关镜像的详细信息
docker inspect nginx

# 显示镜像的历史记录
docker history nginx

# 删除特定镜像
docker rmi nginx:1.21.6

# 删除悬空镜像（未标记的镜像）
docker image prune

# 删除所有未使用的镜像
docker image prune -a

# 创建容器而不启动它
docker create --name my-container nginx

# 启动已创建的容器
docker start my-container

# 暂停运行中的容器
docker pause my-container

# 取消暂停已暂停的容器
docker unpause my-container

# 停止运行中的容器
docker stop my-container

# 移除容器
docker rm my-container

# 显示运行中容器的状态
docker stats

# 显示特定容器的状态
docker stats container1 container2

# 以 JSON 格式获取一次性状态
docker stats --no-stream --format "{{json .}}" container1

# 始终重启容器
docker run -d --restart always --name my-app my-app-image

# 仅在失败时重启
docker run -d --restart on-failure --name my-app my-app-image

# 在失败时重启，并设置最大重试次数
docker run -d --restart on-failure:5 --name my-app my-app-image

docker run -d --name my-web-app \
  --health-cmd="curl -f http://localhost/ || exit 1" \
  --health-interval=30s \
  --health-timeout=10s \
  --health-retries=3 \
  nginx

# 创建一个命名卷
docker volume create my-data

# 列出卷
docker volume ls

# 检查卷
docker volume inspect my-data

# 删除卷
docker volume rm my-data

# 删除所有未使用的卷
docker volume prune

# 挂载命名卷
docker run -d --name my-db -v my-data:/var/lib/mysql mysql:8.0

# 挂载主机目录
docker run -d --name my-web -v /path/on/host:/usr/share/nginx/html nginx

# 创建一个备份容器，挂载卷并将其备份到 tar 文件
docker run --rm -v my-data:/source -v $(pwd):/backup alpine tar -czf /backup/my-data-backup.tar.gz -C /source .

# 创建一个新卷
docker volume create my-data-restored

# 从备份中恢复
docker run --rm -v my-data-restored:/target -v $(pwd):/backup alpine sh -c "tar -xzf /backup/my-data-backup.tar.gz -C /target"

# 下载 Docker Compose
sudo curl -L "https://github.com/docker/compose/releases/download/v2.18.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

# 应用可执行权限
sudo chmod +x /usr/local/bin/docker-compose

# 验证安装
docker-compose --version

mkdir compose-demo
cd compose-demo

nano docker-compose.yml

version: '3.8'

services:
  web:
    image: nginx:latest
    ports:
      - "80:80"
    volumes:
      - ./website:/usr/share/nginx/html
    depends_on:
      - app
    networks:
      - frontend
      - backend

  app:
    build: ./app
    environment:
      - DB_HOST=db
      - DB_USER=myuser
      - DB_PASSWORD=mypassword
      - DB_NAME=mydb
    depends_on:
      - db
    networks:
      - backend

  db:
    image: mysql:8.0
    environment:
      - MYSQL_ROOT_PASSWORD=rootpassword
      - MYSQL_DATABASE=mydb
      - MYSQL_USER=myuser
      - MYSQL_PASSWORD=mypassword
    volumes:
      - db-data:/var/lib/mysql
    networks:
      - backend

networks:
  frontend:
  backend:

volumes:
  db-data:

# 以分离模式启动服务
docker-compose up -d

# 查看运行中的服务
docker-compose ps

# 查看所有服务的日志
docker-compose logs

# 查看特定服务的日志
docker-compose logs app

# 停止服务
docker-compose stop

# 停止并删除容器、网络和卷
docker-compose down

# 停止并删除容器、网络、卷和镜像
docker-compose down --rmi all --volumes

mkdir lamp-docker
cd lamp-docker

mkdir -p www/html
mkdir mysql

echo '<?php
phpinfo();
?>' > www/html/index.php

nano docker-compose.yml

version: '3.8'

services:
  webserver:
    image: php:8.0-apache
    ports:
      - "80:80"
    volumes:
      - ./www/html:/var/www/html
    depends_on:
      - db
    networks:
      - lamp-network

  db:
    image: mysql:8.0
    ports:
      - "3306:3306"
    environment:
      MYSQL_ROOT_PASSWORD: rootpassword
      MYSQL_DATABASE: lamp_db
      MYSQL_USER: lamp_user
      MYSQL_PASSWORD: lamp_password
    volumes:
      - ./mysql:/var/lib/mysql
    networks:
      - lamp-network

  phpmyadmin:
    image: phpmyadmin/phpmyadmin
    ports:
      - "8080:80"
    environment:
      PMA_HOST: db
      PMA_PORT: 3306
    depends_on:
      - db
    networks:
      - lamp-network

networks:
  lamp-network:

docker-compose up -d

nano .env

MYSQL_ROOT_PASSWORD=securepassword
MYSQL_DATABASE=production_db
MYSQL_USER=prod_user
MYSQL_PASSWORD=prod_password

services:
  db:
    image: mysql:8.0
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}

services:
  db:
    image: mysql:8.0
    secrets:
      - db_root_password
      - db_password
    environment:
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
      MYSQL_PASSWORD_FILE: /run/secrets/db_password

secrets:
  db_root_password:
    file: ./secrets/db_root_password.txt
  db_password:
    file: ./secrets/db_password.txt

docker-compose up -d --build

# 生成 CA、服务器和客户端证书
mkdir -p ~/.docker/certs
cd ~/.docker/certs
openssl genrsa -aes256 -out ca-key.pem 4096
openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem

{
  "tls": true,
  "tlscacert": "/root/.docker/certs/ca.pem",
  "tlscert": "/root/.docker/certs/server-cert.pem",
  "tlskey": "/root/.docker/certs/server-key.pem",
  "tlsverify": true
}

sudo systemctl restart docker

# 安装 Docker Scan
docker scan --version

# 扫描镜像
docker scan nginx:latest

FROM alpine:3.16
# 而不是
# FROM ubuntu:22.04

docker pull nginx:latest

# 构建阶段
FROM node:16 AS build
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build

# 生产阶段
FROM nginx:alpine
COPY --from=build /app/dist /usr/share/nginx/html

# 在您的 Dockerfile 中添加非 root 用户
RUN addgroup -g 1000 appuser && \
    adduser -u 1000 -G appuser -s /bin/sh -D appuser
USER appuser

docker run --read-only --tmpfs /tmp nginx

docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE nginx

docker run --memory=512m --cpus=0.5 nginx

docker run --security-opt=no-new-privileges nginx

# 创建自定义网络
docker network create --driver bridge secure-network

# 在此网络上运行容器
docker run --network secure-network --name app1 my-app
docker run --network secure-network --name db mysql

# 仅暴露给 localhost
docker run -p 127.0.0.1:80:80 nginx

# 创建一个 env 文件
echo "DB_PASSWORD=securepassword" > .env

# 在 Docker run 中使用它
docker run --env-file .env my-app

# 创建一个 secrets 目录
mkdir -p secrets
echo "securepassword" > secrets/db_password

# 以只读文件形式挂载
docker run -v $(pwd)/secrets/db_password:/run/secrets/db_password:ro my-app

# 创建一个秘密
echo "securepassword" | docker secret create db_password -

# 在服务中使用秘密
docker service create --name my-app --secret db_password my-app

sudo auditctl -w /usr/bin/docker -p rwxa

# 运行 Prometheus
docker run -d -p 9090:9090 --name prometheus prom/prometheus

# 运行 Grafana
docker run -d -p 3000:3000 --name grafana grafana/grafana

docker run -d --name falco --privileged -v /var/run/docker.sock:/var/run/docker.sock falcosecurity/falco

sudo apt update
sudo apt upgrade docker-ce docker-ce-cli containerd.io

sudo adduser dockeruser
sudo usermod -aG docker dockeruser

{
  "icc": false,
  "userns-remap": "default",
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "no-new-privileges": true
}

sudo systemctl restart docker

docker network create --driver bridge secure-network

# 使用 Trivy 示例
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image nginx:latest

# 运行 cAdvisor 进行容器监控
docker run -d --name cadvisor \
  --volume=/:/rootfs:ro \
  --volume=/var/run:/var/run:ro \
  --volume=/sys:/sys:ro \
  --volume=/var/lib/docker/:/var/lib/docker:ro \
  --publish=8080:8080 \
  gcr.io/cadvisor/cadvisor:latest

# 拉取新镜像
docker pull myapp:v2
# 在不同端口运行新容器
docker run -d --name myapp-v2 -p 8081:80 myapp:v2
# 测试新容器
# 更新负载均衡器指向新容器
# 停止旧容器
docker stop myapp-v1

# 为监控创建一个网络
docker network create monitoring

# 运行 Prometheus
docker run -d --name prometheus \
  --network monitoring \
  -p 9090:9090 \
  -v prometheus-data:/prometheus \
  prom/prometheus

# 运行 Grafana
docker run -d --name grafana \
  --network monitoring \
  -p 3000:3000 \
  -v grafana-data:/var/lib/grafana \
  grafana/grafana