docker进阶与实战 3 理解docker镜像
3 理解docker镜像
build,ship and run是基于镜像系统的.
打包环境,解决依赖;分层镜像,解决存储利用.
3.1 docker概念介绍
remote-image-hub/namespace/repository:tag
layer分层,每一层都由64们十六进制组成;最上层的layer ID是镜像ID,tag提供了易于人识别的名字.
/var/lib/docker
3.2 使用镜像
RESTful API或客户端command执行制作,上传,管理,下载.
3.2.1列出本机镜像
[root@220 ~]# docker images
REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE
docker.io/centos latest 0e0217391d41 2 weeks ago 196.6 MB
docker.io/busybox latest fef924a0204a 2 weeks ago 1.114 MB
[root@220 ~]# docker images --help
Usage: docker images [OPTIONS] [REPOSITORY]
List images
-a, --all=false Show all images (default hides intermediate images)
--digests=false Show digests
-f, --filter=[] Filter output based on conditions provided
--help=false Print usage
--no-trunc=false Don't truncate output
-q, --quiet=false Only show numeric IDs
[root@220 ~]# docker images --filter 'dangling=true' 过滤悬挂镜像(悬挂镜像对我们没有用,且占用资源)
[root@220 ~]# docker images --filter "dangling=true" -q |xargs docker images rmi 删除悬挂镜像
dockviz工具分析images之前分层关系http://github.com/justone/dockviz
3.2.2 Build: 创建一个镜像
1.直接下载 [root@220 ~]# docker pull centos
2.导入镜像
docker import(导入包含文件系统的归档,并把它变成镜像)
docker load(导入docker save导出的镜像,导入后跟原来的ID分层全部一样)
[root@220 ~]# docker save -o busybox.tar busybox
[root@220 ~]# ls -l busybox.tar
-rw-r--r-- 1 root root 1323008 Mar 4 11:56 busybox.tar
[root@220 ~]# docker load -i busybox.tar
[root@220 ~]# docker images
REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE
docker.io/centos latest 0e0217391d41 2 weeks ago 196.6 MB
docker.io/busybox latest fef924a0204a 2 weeks ago 1.114 MB
3.制作镜像
docker export(导出)
docker commit(增量)
docker build(dockerfile)
3.2.3 ship: 传输镜像
是连接开发与运维的桥梁.
可制作镜像然后导入.
使用仓库,利用github的webhook功能自动触发
3.2.4 run:以images为模板启动容器
docker run
docker生命周期:build,ship and run
3.3 docker image 组织结构
image
数据(image layer)
元数据(json)
[root@220 ~]# docker daemon -D -s overlay -g /var/lib/docker
[root@220 ~]# ll /var/lib/docker/
total 24
drwx------ 2 root root 6 Feb 29 17:53 containers
drwx------ 5 root root 50 Feb 29 17:56 devicemapper
drwx------ 9 root root 4096 Mar 4 10:41 graph
-rw-r--r-- 1 root root 5120 Feb 29 20:33 linkgraph.db
drwxr-xr-x 8 root root 4096 Mar 4 10:41 overlay
-rw------- 1 root root 235 Feb 29 17:57 repositories-devicemapper
-rw------- 1 root root 235 Mar 4 11:57 repositories-overlay
drwx------ 2 root root 6 Mar 4 11:57 tmp
drwx------ 2 root root 26 Feb 29 17:56 trust
drwx------ 2 root root 6 Feb 29 17:53 volumes
3.3 Docker image的组织结构
3.3.1数据的内容
docker image 包含着数据及必要的元数据。数据由一层层的image layer组成，元数据则是一些JSON文件，用来数据（image layer）之间的关系及容器的一些配置信息。
[root@220 ~]# nohup docker daemon -D -s overlay -g /var/lib/docker &
[root@220 ~]# docker pull busybox
Using default tag: latest
Trying to pull repository docker.io/library/busybox ... latest: Pulling from library/busybox
9a163e0b8d13: Pull complete
fef924a0204a: Pull complete
library/busybox:latest: The image you are pulling has been verified. Important: image verification is a tech preview feature and should not be relied on to provide security.
Digest: sha256:97473e34e311e6c1b3f61f2a721d038d1e5eef17d98d1353a513007cf46ca6bd
Status: Downloaded newer image for docker.io/busybox:latest
这时有三层layer
[root@220 docker]# docker history busybox
IMAGE CREATED CREATED BY SIZE COMMENT
fef924a0204a 12 days ago /bin/sh -c #(nop) CMD ["sh"] 0 B
9a163e0b8d13 12 days ago /bin/sh -c #(nop) ADD file:7cdf7a89f6a004b2e9 1.114 MB
[root@220 ~]# cd /var/lib/docker/
[root@220 docker]# ls
containers（容器运行相关信息） devicemapper graph（各层的元数据） linkgraph.db overlay（各层数据） repositories-devicemapper repositories-overlay（总体信息） tmp trust（验证相关信息） volumes（数据卷相关信息）
[root@220 docker]# cat repositories-overlay |python -m json.tool 所有image及对应layerID
{
"ConfirmDefPush": true,
"Repositories": {
"docker.io/busybox": {
"latest": "fef924a0204a00b3ec67318e2ed337b189c99ea19e2bf10ed30a13b87c5e17ab"
}
}
}
数据和元数据
根据repositories-overlay中的id找到数据及元数据
[root@220 fef924a0204a00b3ec67318e2ed337b189c99ea19e2bf10ed30a13b87c5e17ab]# pwd
/var/lib/docker/graph/fef924a0204a00b3ec67318e2ed337b189c99ea19e2bf10ed30a13b87c5e17ab
[root@220 fef924a0204a00b3ec67318e2ed337b189c99ea19e2bf10ed30a13b87c5e17ab]# ls
checksum json layersize tar-data.json.gz
[root@220 fef924a0204a00b3ec67318e2ed337b189c99ea19e2bf10ed30a13b87c5e17ab]# cat json |python -m json.tool
{
"Size": 0,
"architecture": "amd64",
"config": {
"AttachStderr": false,
"AttachStdin": false,
"AttachStdout": false,
"Cmd": [
"sh"
],
"Domainname": "",
"Entrypoint": null,
"Env": null,
"ExposedPorts": null,
"Hostname": "13709f13afe1",
"Image": "9a163e0b8d138ec700b5a5f7e62509012f7eb34b9f86cd3bbeb3d183958114a9",
"Labels": {},
"MacAddress": "",
"NetworkDisabled": false,
"OnBuild": null,
"OpenStdin": false,
"PublishService": "",
"StdinOnce": false,
"Tty": false,
"User": "",
"VolumeDriver": "",
"Volumes": null,
"WorkingDir": ""
},
"container": "d23509cd0189de02bef382544ebfab515f29094f3c0e2f161fa7ce09afa8974e",
"container_config": {
"AttachStderr": false,
"AttachStdin": false,
"AttachStdout": false,
"Cmd": [
"/bin/sh",
"-c",
"#(nop) CMD [\"sh\"]"
],
"Domainname": "",
"Entrypoint": null,
"Env": null,
"ExposedPorts": null,
"Hostname": "13709f13afe1",
"Image": "9a163e0b8d138ec700b5a5f7e62509012f7eb34b9f86cd3bbeb3d183958114a9",
"Labels": {},
"MacAddress": "",
"NetworkDisabled": false,
"OnBuild": null,
"OpenStdin": false,
"PublishService": "",
"StdinOnce": false,
"Tty": false,
"User": "",
"VolumeDriver": "",
"Volumes": null,
"WorkingDir": ""
},
"created": "2016-02-16T22:59:37.407805421Z",
"docker_version": "1.9.1",
"id": "fef924a0204a00b3ec67318e2ed337b189c99ea19e2bf10ed30a13b87c5e17ab",
"os": "linux",
"parent": "9a163e0b8d138ec700b5a5f7e62509012f7eb34b9f86cd3bbeb3d183958114a9"
}
[root@220 ~]# docker inspect busybox
[
{
"Id": "fef924a0204a00b3ec67318e2ed337b189c99ea19e2bf10ed30a13b87c5e17ab",
"Parent": "9a163e0b8d138ec700b5a5f7e62509012f7eb34b9f86cd3bbeb3d183958114a9",
"Comment": "",
"Created": "2016-02-16T22:59:37.407805421Z",
"Container": "d23509cd0189de02bef382544ebfab515f29094f3c0e2f161fa7ce09afa8974e",
"ContainerConfig": {
"Hostname": "13709f13afe1",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"ExposedPorts": null,
"PublishService": "",
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": null,
"Cmd": [
"/bin/sh",
"-c",
"#(nop) CMD [\"sh\"]"
],
"Image": "9a163e0b8d138ec700b5a5f7e62509012f7eb34b9f86cd3bbeb3d183958114a9",
"Volumes": null,
"VolumeDriver": "",
"WorkingDir": "",
"Entrypoint": null,
"NetworkDisabled": false,
"MacAddress": "",
"OnBuild": null,
"Labels": {}
},
"DockerVersion": "1.9.1",
"Author": "",
"Config": {
"Hostname": "13709f13afe1",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"ExposedPorts": null,
"PublishService": "",
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": null,
"Cmd": [
"sh"
],
"Image": "9a163e0b8d138ec700b5a5f7e62509012f7eb34b9f86cd3bbeb3d183958114a9",
"Volumes": null,
"VolumeDriver": "",
"WorkingDir": "",
"Entrypoint": null,
"NetworkDisabled": false,
"MacAddress": "",
"OnBuild": null,
"Labels": {}
},
"Architecture": "amd64",
"Os": "linux",
"Size": 0,
"VirtualSize": 1113554,
"GraphDriver": {
"Name": "overlay",
"Data": {
"RootDir": "/var/lib/docker/overlay/fef924a0204a00b3ec67318e2ed337b189c99ea19e2bf10ed30a13b87c5e17ab/root"
}
}
}
]
Docker把Cgroup，Namespace等容器相关技术整合带入大众视野，糅合老技术适应新技术。
Docker引入联合挂载（union mount）使镜像分层；Git式的管理方式使基础镜像重用。
联合文件（overlayFS）挂载：这类文件系统会把多个目录，可能对应不同的文件系统，挂载到同一个目录，对外呈现这些目录的联合。
写时复制 copy-on-write，所有导致文件谈到的修改都会添加到新的文件层。
写时复制是Docker image之所以如此强大的重要原因。快，省空间。
[root@220 ~]# cat /proc/filesystems |grep overlay
nodev overlay
联合文件系统是实现写时复制的基础。
ubuntu使用aufs，redhat,suse使用devicemapper,另外btrfs也具有写时复制的能力。
[root@220 ~]# mkdir dockerimage
[root@220 ~]# cd dockerimage/
[root@220 dockerimage]# ls
[root@220 dockerimage]# mkdir material
[root@220 dockerimage]# echo bad > material/concrete
[root@220 dockerimage]# echo rebar > material/rebar
[root@220 dockerimage]# mkdir material2
[root@220 dockerimage]# echo good > material2/concrete
[root@220 dockerimage]# echo marble > material2/marble
[root@220 dockerimage]# mkdir merge work build
[root@220 dockerimage]# ls
build material material2 merge work
[root@220 dockerimage]# mount -t overlay overlay -o lowerdir=material:material2,upperdir=build,workdir=work merge
[root@220 dockerimage]# echo 'main structure' > merge/frame
