Docker容器化部署完全指南

# ========== 1. 卸载旧版本（避免冲突） ==========
yum remove -y docker \
                  docker-client \
                  docker-client-latest \
                  docker-common \
                  docker-latest \
                  docker-latest-logrotate \
                  docker-logrotate \
                  docker-engine

# ========== 2. 安装依赖包 ==========
yum install -y yum-utils device-mapper-persistent-data lvm2

# ========== 3. 添加Docker官方源（国内建议用阿里云源） ==========
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

# ========== 4. 安装Docker CE（指定版本，避免自动升级） ==========
# 查看可用版本
yum list docker-ce --showduplicates | sort -r
# 安装稳定版（推荐24.0.x系列）
yum install -y docker-ce-24.0.9 docker-ce-cli-24.0.9 containerd.io

# ========== 5. 启动并设置开机自启 ==========
systemctl start docker
systemctl enable docker
systemctl status docker

# ========== 6. 配置国内镜像加速（解决拉取镜像慢） ==========
mkdir -p /etc/docker
cat > /etc/docker/daemon.json << EOF
{
  "registry-mirrors": [
    "https://hub-mirror.c.163.com",
    "https://mirror.baidubce.com",
    "https://docker.mirrors.ustc.edu.cn"
  ],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  },
  "storage-driver": "overlay2"
}
EOF

# 重启Docker生效
systemctl daemon-reload
systemctl restart docker

# ========== 7. 验证安装 ==========
docker --version
docker run --rm hello-world

# ========== 1. 卸载旧版本 ==========
apt-get remove -y docker docker-engine docker.io containerd runc

# ========== 2. 更新包索引 ==========
apt-get update
apt-get install -y ca-certificates curl gnupg lsb-release

# ========== 3. 添加Docker GPG密钥 ==========
mkdir -p /etc/apt/trusted.gpg.d
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/trusted.gpg.d/docker.gpg

# ========== 4. 添加源 ==========
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/trusted.gpg.d/docker.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu \
$(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null

# ========== 5. 安装Docker ==========
apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io

# ========== 6. 配置加速（同CentOS） ==========
mkdir -p /etc/docker
cat > /etc/docker/daemon.json << EOF
{
  "registry-mirrors": [
    "https://hub-mirror.c.163.com",
    "https://mirror.baidubce.com"
  ]
}
EOF

systemctl daemon-reload
systemctl restart docker
systemctl enable docker

# ========== 7. 验证 ==========
docker --version
docker run --rm hello-world

# 1. 拉取镜像（指定版本，避免latest）
docker pull nginx:1.24.0
docker pull mysql:8.0.36

# 2. 查看本地镜像
docker images
docker image ls

# 3. 搜索镜像
docker search redis

# 4. 标记镜像（用于推送到仓库）
docker tag nginx:1.24.0 myregistry.com/nginx:1.24.0

# 5. 删除镜像（先删容器，再删镜像）
docker rmi nginx:1.24.0
# 强制删除
docker rmi -f nginx:1.24.0

# 6. 导出/导入镜像（离线部署）
docker save -o nginx-1.24.0.tar nginx:1.24.0
docker load -i nginx-1.24.0.tar

# 7. 清理无用镜像
docker image prune -a

# 1. 创建并启动容器（常用参数）
# -d: 后台运行 -p: 端口映射 -v: 数据卷挂载 --name: 容器名 --restart: 重启策略
docker run -d \
  -p 80:80 \
  -v nginx-html:/usr/share/nginx/html \
  -v nginx-conf:/etc/nginx/conf.d \
  --name nginx-server \
  --restart=always \
  nginx:1.24.0

# 2. 查看容器
# 运行中的容器
docker ps
# 所有容器（含停止的）
docker ps -a

# 3. 容器启停/重启
docker start nginx-server
docker stop nginx-server
docker restart nginx-server

# 4. 进入容器（调试用）
# 方式1：bash终端
docker exec -it nginx-server /bin/bash
# 方式2：sh终端（兼容更多镜像）
docker exec -it nginx-server /bin/sh

# 5. 查看容器日志
# 实时日志
docker logs -f nginx-server
# 最近100行
docker logs --tail=100 nginx-server
# 按时间筛选
docker logs --since="2025-12-01" nginx-server

# 6. 查看容器详情
docker inspect nginx-server

# 7. 删除容器
# 停止并删除
docker stop nginx-server && docker rm nginx-server
# 强制删除运行中的容器
docker rm -f nginx-server

# 8. 清理停止的容器
docker container prune

# 1. 创建数据卷
docker volume create mysql-data

# 2. 查看数据卷
docker volume ls
# 查看数据卷详情（含存储路径）
docker volume inspect mysql-data

# 3. 挂载数据卷到容器
docker run -d \
  -p 3306:3306 \
  -v mysql-data:/var/lib/mysql \
  -e MYSQL_ROOT_PASSWORD=123456 \
  --name mysql-server \
  mysql:8.0.36

# 4. 删除数据卷（谨慎！数据会丢失）
docker volume rm mysql-data
# 清理未使用的数据卷
docker volume prune

# 1. 查看网络
docker network ls

# 2. 创建自定义网络（推荐，容器间可通过容器名通信）
docker network create my-app-network

# 3. 将容器加入自定义网络
docker run -d \
  --name nginx-1 \
  --network my-app-network \
  nginx:1.24.0

docker run -d \
  --name nginx-2 \
  --network my-app-network \
  nginx:1.24.0

# 4. 容器间互通（在nginx-1中ping nginx-2）
docker exec -it nginx-1 ping nginx-2

# 5. 删除网络
docker network rm my-app-network

# ========== 阶段1：构建依赖 ==========
FROM python:3.9-slim AS builder

# 设置工作目录
WORKDIR /app

# 复制依赖文件
COPY requirements.txt .

# 安装依赖到临时目录
RUN pip install --no-cache-dir -r requirements.txt -t /app/lib

# ========== 阶段2：构建最终镜像 ==========
FROM python:3.9-slim

# 设置非root用户（安全）
RUN useradd -m appuser
WORKDIR /app

# 复制依赖和代码
COPY --from=builder /app/lib /app/lib
COPY app.py .

# 设置环境变量
ENV PYTHONPATH=/app/lib \
    PYTHONUNBUFFERED=1

# 暴露端口
EXPOSE 8080

# 切换非root用户
USER appuser

# 启动命令
CMD ["python", "app.py"]

# 1. 构建镜像（-t: 标签，.：Dockerfile所在目录）
docker build -t my-python-app:1.0.0 .

# 2. 本地测试镜像
docker run -p 8080:8080 my-python-app:1.0.0

# 3. 推送到私有仓库（先登录）
docker login myregistry.com
docker tag my-python-app:1.0.0 myregistry.com/my-python-app:1.0.0
docker push myregistry.com/my-python-app:1.0.0

# 下载Compose（指定版本）
curl -L "https://github.com/docker/compose/releases/download/v2.23.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

# 添加执行权限
chmod +x /usr/local/bin/docker-compose

# 验证安装
docker-compose --version

version: '3.8'

# 自定义网络
networks:
  app-network:
    driver: bridge

# 数据卷
volumes:
  mysql-data:
  redis-data:
  nginx-html:

# 服务定义
services:
  # Nginx服务
  nginx:
    image: nginx:1.24.0
    container_name: app-nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - nginx-html:/usr/share/nginx/html
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./nginx/ssl:/etc/nginx/ssl
    networks:
      - app-network
    restart: always
    # 健康检查
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # MySQL服务
  mysql:
    image: mysql:8.0.36
    container_name: app-mysql
    ports:
      - "3306:3306"
    volumes:
      - mysql-data:/var/lib/mysql
      - ./mysql/init:/docker-entrypoint-initdb.d
    environment:
      - MYSQL_ROOT_PASSWORD=MyPass123!
      - MYSQL_DATABASE=app_db
      - MYSQL_USER=app_user
      - MYSQL_PASSWORD=AppPass456!
    networks:
      - app-network
    restart: always
    # 资源限制
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 1G
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p$$MYSQL_ROOT_PASSWORD"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Redis服务
  redis:
    image: redis:7.2.3
    container_name: app-redis
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    command: redis-server --requirepass RedisPass789! --appendonly yes
    networks:
      - app-network
    restart: always
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "RedisPass789!", "ping"]
      interval: 30s
      timeout: 10s
      retries: 3

# 1. 启动所有服务（后台运行）
docker-compose up -d

# 2. 查看服务状态
docker-compose ps

# 3. 查看指定服务日志
docker-compose logs -f nginx

# 4. 启动/停止/重启服务
docker-compose start mysql
docker-compose stop mysql
docker-compose restart nginx

# 5. 构建自定义镜像（如果有build字段）
docker-compose build

# 6. 扩展服务（仅适用于swarm模式）
docker-compose up -d --scale web=3

# 7. 停止并删除容器/网络（保留数据卷）
docker-compose down

# 8. 停止并删除所有（含数据卷，谨慎！）
docker-compose down -v

# 1. 拉取registry镜像
docker pull registry:2.8.3

# 2. 创建数据卷
docker volume create registry-data

# 3. 启动私有仓库（带认证+HTTPS）
# 先创建认证文件
mkdir -p /opt/registry/auth
docker run --rm \
  -v /opt/registry/auth:/auth \
  -e "REGISTRY_AUTH=htpasswd" \
  -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
  -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" \
  registry:2.8.3 \
  htpasswd -Bbn admin MyRegistryPass123! > /opt/registry/auth/htpasswd

# 创建SSL证书目录（替换为自己的域名/IP）
mkdir -p /opt/registry/certs
# 生成自签证书（生产环境用CA签发证书）
openssl req -newkey rsa:4096 -nodes -sha256 -keyout /opt/registry/certs/domain.key -x509 -days 365 -out /opt/registry/certs/domain.crt

# 启动仓库容器
docker run -d \
  -p 5000:5000 \
  --name docker-registry \
  --restart=always \
  -v registry-data:/var/lib/registry \
  -v /opt/registry/auth:/auth \
  -v /opt/registry/certs:/certs \
  -e "REGISTRY_AUTH=htpasswd" \
  -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
  -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" \
  -e "REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt" \
  -e "REGISTRY_HTTP_TLS_KEY=/certs/domain.key" \
  registry:2.8.3

# 4. 验证仓库
curl -u admin:MyRegistryPass123! https://your-registry-ip:5000/v2/_catalog

# 1. 复制证书到客户端
mkdir -p /etc/docker/certs.d/your-registry-ip:5000
cp /opt/registry/certs/domain.crt /etc/docker/certs.d/your-registry-ip:5000/ca.crt

# 2. 重启Docker
systemctl restart docker

# 3. 登录私有仓库
docker login your-registry-ip:5000

# 4. 推送/拉取镜像
docker tag nginx:1.24.0 your-registry-ip:5000/nginx:1.24.0
docker push your-registry-ip:5000/nginx:1.24.0
docker pull your-registry-ip:5000/nginx:1.24.0