TL; DR: Iùl tar-shealladh air coimeas a dhèanamh eadar frèaman airson a bhith a’ ruith thagraidhean ann an soithichean. Thèid beachdachadh air comasan Docker agus siostaman eile den aon seòrsa.
Beagan eachdraidh air cò às a thàinig e
История
Is e chroot a’ chiad dòigh ainmeil airson a bhith a’ dealachadh tagradh. Bidh gairm an t-siostaim leis an aon ainm a’ dèanamh cinnteach gu bheil am pasgan freumha air atharrachadh - mar sin a’ dèanamh cinnteach nach eil cothrom aig a’ phrògram a dh’ainmich e ach air faidhlichean taobh a-staigh an eòlaire sin. Ach ma gheibh prògram sochairean freumhaich air an taobh a-staigh, faodaidh e “teicheadh” bhon chroot agus faighinn chun phrìomh shiostam obrachaidh. Cuideachd, a bharrachd air a bhith ag atharrachadh an eòlaire freumh, chan eil goireasan eile (RAM, pròiseasar), a bharrachd air ruigsinneachd lìonra cuingealaichte.
Is e an ath dhòigh siostam obrachaidh làn-chuimseach a chuir air bhog taobh a-staigh soitheach, a’ cleachdadh uidheamachdan kernel an t-siostaim obrachaidh. Canar dòigh eadar-dhealaichte ris an dòigh seo ann an diofar shiostaman obrachaidh, ach tha an aon rud mar an ceudna - a’ cur air bhog grunn shiostaman obrachaidh neo-eisimeileach, agus bidh gach fear dhiubh a ’ruith an aon kernel air a bheil am prìomh shiostam obrachaidh a’ ruith. Nam measg tha FreeBSD Jails, Solaris Zones, OpenVZ agus LXC airson Linux. Tha aonaranachd air a dhèanamh cinnteach chan ann a-mhàin le àite diosc, ach cuideachd le goireasan eile; gu sònraichte, dh ’fhaodadh gum bi crìochan aig gach inneal air ùine pròiseasar, RAM, agus leud-bann lìonra. An coimeas ri chroot, tha e nas duilghe an soitheach fhàgail, leis gu bheil cothrom aig an t-superuser anns a ’ghobhar air susbaint a’ bhogsa a-mhàin, ge-tà, air sgàth gu bheil feum air an siostam obrachaidh taobh a-staigh an t-soithich a chumail ùraichte agus cleachdadh dreachan nas sine. de kernels (buntainneach airson Linux, gu ìre nas lugha FreeBSD), tha coltas ann gun tèid “briseadh troimhe” an siostam iomallachd kernel agus faighinn chun phrìomh shiostam obrachaidh.
An àite siostam obrachaidh làn-chuimseach a chuir air bhog ann an soitheach (le siostam tòiseachaidh, manaidsear pacaid, msaa), faodaidh tu tagraidhean a chuir air bhog sa bhad, is e am prìomh rud a leithid de chothrom a thoirt dha na tagraidhean (làthaireachd nan leabharlannan riatanach). agus faidhlichean eile). Bha am beachd seo na bhunait airson virtualization tagraidh container, agus is e Docker an riochdaire as fhollaisiche agus as ainmeil dhiubh. An coimeas ri siostaman a bh’ ann roimhe, mar thoradh air uidheamachdan aonaranachd nas sùbailte, còmhla ri taic stèidhichte airson lìonraidhean brìgheil eadar soithichean agus lorg staid tagraidh taobh a-staigh an t-soithich, thàinig comas air aon àrainneachd cho-leanailteach a thogail bho àireamh mhòr de luchd-frithealaidh fiosaigeach airson soithichean a ruith - gun fheum air stiùireadh ghoireasan làimhe.
Docker
Is e Docker am bathar-bog gleidhidh tagraidh as ainmeil. Sgrìobhte sa chànan Go, bidh e a’ cleachdadh feartan àbhaisteach an kernel Linux - cgroups, ainmean-àite, comasan, msaa, a bharrachd air siostaman faidhle Aufs agus feadhainn eile mar sin gus àite diosc a shàbhaladh.
Stòr: wikimedia
ailtireachd
Ro dhreach 1.11, bha Docker ag obair mar aon sheirbheis a rinn a h-uile gnìomh le soithichean: luchdachadh sìos ìomhaighean airson soithichean, cuir air bhog soithichean, giullachd iarrtasan API. A’ tòiseachadh le dreach 1.11, chaidh Docker a roinn ann an grunn phàirtean a tha ag eadar-obrachadh le chèile: ann an soithichean, airson a bhith a’ giullachd cuairt-beatha iomlan nan soithichean (a’ riarachadh àite diosc, a’ luchdachadh sìos ìomhaighean, ag obair leis an lìonra, a’ cur air bhog, a’ stàladh agus a’ cumail sùil air staid shoithichean) agus runC, an àrainneachd cur an gnìomh container, stèidhichte air cleachdadh cgroups agus feartan eile den kernel Linux. Tha an t-seirbheis docker fhèin fhathast, ach a-nis chan eil e a’ frithealadh ach a bhith a ’giullachd iarrtasan API air an eadar-theangachadh gu container.
Stàladh agus rèiteachadh
Is e an dòigh as fheàrr leam docker a chuir a-steach inneal docker, a tha, a bharrachd air a bhith a’ stàladh agus a ’rèiteachadh docker gu dìreach air frithealaichean iomallach (a’ toirt a-steach diofar sgòthan), ga dhèanamh comasach obrachadh le siostaman faidhle de luchd-frithealaidh iomallach agus is urrainn dhaibh grunn òrdughan a ruith.
Ach, bho 2018, cha mhòr gu bheil am pròiseact air a leasachadh, agus mar sin cuiridh sinn a-steach e san dòigh àbhaisteach airson a’ mhòr-chuid de sgaoilidhean Linux - a ’cur stòr-dàta ris agus a’ stàladh na pacaidean riatanach.
Tha an dòigh seo cuideachd air a chleachdadh airson stàladh fèin-ghluasadach, mar eisimpleir a’ cleachdadh Ansible no siostaman eile den aon seòrsa, ach cha bheachdaich mi air san artaigil seo.
Thèid an stàladh a dhèanamh air Centos 7, cleachdaidh mi inneal brìgheil mar fhrithealaiche, gus stàladh dìreach ruith na h-òrdughan gu h-ìosal:
# yum install -y yum-utils
# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
# yum install docker-ce docker-ce-cli containerd.ioÀs deidh an stàladh, feumaidh tu an t-seirbheis a thòiseachadh agus a chuir air bhog:
# systemctl enable docker
# systemctl start docker
# firewall-cmd --zone=public --add-port=2377/tcp --permanentA bharrachd air an sin, faodaidh tu buidheann docker a chruthachadh, aig am bi an luchd-cleachdaidh comasach air obrachadh le docker gun sudo, logadh a chuir air dòigh, cothrom a thoirt don API bhon taobh a-muigh, agus na dìochuimhnich am balla-teine a rèiteachadh nas mionaidiche (a h-uile dad nach eil ceadaichte air a thoirmeasg anns na h-eisimpleirean gu h-àrd agus gu h-ìosal - dh’ fhàg mi seo airson sìmplidheachd agus soilleireachd), ach cha tèid mi a-steach nas mionaidiche an seo.
Comharran eile
A bharrachd air an inneal docker gu h-àrd, tha clàr docker ann cuideachd, inneal airson ìomhaighean a stòradh airson soithichean, a bharrachd air sgrìobhadh docker, inneal airson cleachdadh thagraidhean ann an soithichean gu fèin-ghluasadach, thathas a’ cleachdadh faidhlichean YAML gus soithichean a thogail agus a rèiteachadh. agus rudan co-cheangailte eile (mar eisimpleir, lìonraidhean, siostaman faidhle leantainneach airson dàta a stòradh).
Faodar a chleachdadh cuideachd airson innealan-giùlain a chuir air dòigh airson CICD. Tha feart inntinneach eile ag obair ann am modh brabhsair, am modh swarm ris an canar (ro thoiseach dreach 1.12 b ’e swarm docker a bh’ air), a leigeas leat aon bhun-structar a chruinneachadh bho ghrunn luchd-frithealaidh airson soithichean a ruith. Tha taic ann airson lìonra mas-fhìor a bharrachd air na frithealaichean uile, tha inneal-cothromachaidh luchdan ann, a bharrachd air taic airson dìomhaireachdan airson soithichean.
Faodar faidhlichean YAML bho docker compose, le mion-atharrachaidhean, a chleachdadh airson a leithid de chlàran, gu tur fèin-ghluasadach cumail suas cruinneachaidhean beaga is meadhanach airson diofar adhbharan. Airson cruinneachaidhean mòra, tha Kubernetes nas fheàrr oir faodaidh cosgaisean cumail suas modh swarm a bhith nas àirde na cosgaisean Kubernetes. A bharrachd air runC, faodaidh tu a stàladh, mar eisimpleir, mar an àrainneachd cur gu bàs container
Ag obair le Docker
Às deidh an stàladh agus an rèiteachadh, feuchaidh sinn ri cruinneachadh a chuir ri chèile anns am bi sinn a’ cleachdadh GitLab agus Clàr Docker airson an sgioba leasachaidh. Cleachdaidh mi trì innealan brìgheil mar luchd-frithealaidh, air am bi mi a’ cleachdadh an FS GlusterFS sgaoilte a bharrachd; Cleachdaidh mi e mar stòradh meudan docker, mar eisimpleir, gus dreach fulangach de lochdan de chlàradh docker a ruith. Prìomh phàirtean ri ruith: Clàr Docker, Postgresql, Redis, GitLab le taic airson GitLab Runner air mullach Swarm. Cuiridh sinn Postgresql air bhog le cruinneachadh , mar sin chan fheum thu GlusterFS a chleachdadh gus dàta Postgresql a stòradh. Thèid an dàta èiginneach a tha air fhàgail a stòradh air GlusterFS.
Gus GlusterFS a chuir a-steach air a h-uile seirbheisiche (canar node1, node2, nód3) riutha), feumaidh tu pacaidean a chuir a-steach, am balla-teine a chomasachadh, agus na clàran riatanach a chruthachadh:
# yum -y install centos-release-gluster7
# yum -y install glusterfs-server
# systemctl enable glusterd
# systemctl start glusterd
# firewall-cmd --add-service=glusterfs --permanent
# firewall-cmd --reload
# mkdir -p /srv/gluster
# mkdir -p /srv/docker
# echo "$(hostname):/docker /srv/docker glusterfs defaults,_netdev 0 0" >> /etc/fstabÀs deidh an stàladh, feumar leantainn air adhart leis an obair air rèiteachadh GlusterFS bho aon nód, mar eisimpleir nód1:
# gluster peer probe node2
# gluster peer probe node3
# gluster volume create docker replica 3 node1:/srv/gluster node2:/srv/gluster node3:/srv/gluster force
# gluster volume start dockerAn uairsin feumaidh tu an tomhas a thig às a chuir suas (feumaidh an àithne a chuir gu bàs air a h-uile frithealaiche):
# mount /srv/dockerTha am modh swarm air a rèiteachadh air aon de na frithealaichean, a bhios mar an Leader, feumaidh an còrr a dhol a-steach don bhuidheann, agus mar sin feumar toradh cur an gnìomh an àithne air a’ chiad fhrithealaiche a chopaigeadh agus a chuir gu bàs air an fheadhainn eile.
Suidheachadh brabhsair tùsail, bidh mi a’ ruith an àithne air nód1:
# docker swarm init
Swarm initialized: current node (a5jpfrh5uvo7svzz1ajduokyq) is now a manager.
To add a worker to this swarm, run the following command:
docker swarm join --token SWMTKN-1-0c5mf7mvzc7o7vjk0wngno2dy70xs95tovfxbv4tqt9280toku-863hyosdlzvd76trfptd4xnzd xx.xx.xx.xx:2377
To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
# docker swarm join-token managerBidh sinn a’ dèanamh lethbhreac de thoradh an dàrna àithne agus ga chuir an gnìomh air nód2 agus nód3:
# docker swarm join --token SWMTKN-x-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxx xx.xx.xx.xx:2377
This node joined a swarm as a manager.Aig an ìre seo, tha rèiteachadh tòiseachaidh nan frithealaichean crìochnaichte, rachamaid air adhart gu bhith a’ stèidheachadh nan seirbheisean; thèid na h-òrdughan a thèid a chur an gnìomh a chuir air bhog bho nód1, mura h-eilear ag ràdh a chaochladh.
An toiseach, cruthaichidh sinn lìonraidhean airson soithichean:
# docker network create --driver=overlay etcd
# docker network create --driver=overlay pgsql
# docker network create --driver=overlay redis
# docker network create --driver=overlay traefik
# docker network create --driver=overlay gitlabAn uairsin bidh sinn a’ comharrachadh na frithealaichean, tha seo riatanach gus cuid de sheirbheisean a cheangal ris na frithealaichean:
# docker node update --label-add nodename=node1 node1
# docker node update --label-add nodename=node2 node2
# docker node update --label-add nodename=node3 node3An uairsin, bidh sinn a’ cruthachadh chlàran airson dàta msaa a stòradh, stòradh KV, a tha a dhìth airson Traefik agus Stolon. Coltach ri Postgresql, bidh iad sin nan soithichean ceangailte ri frithealaichean, agus mar sin bidh sinn a’ ruith an àithne seo air a h-uile frithealaiche:
# mkdir -p /srv/etcdAn uairsin, cruthaich faidhle airson a rèiteachadh msaa agus cleachd e:
00etcd.yml
version: '3.7'
services:
etcd1:
image: quay.io/coreos/etcd:latest
hostname: etcd1
command:
- etcd
- --name=etcd1
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd1:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd1:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd1vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node1]
etcd2:
image: quay.io/coreos/etcd:latest
hostname: etcd2
command:
- etcd
- --name=etcd2
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd2:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd2:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd2vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node2]
etcd3:
image: quay.io/coreos/etcd:latest
hostname: etcd3
command:
- etcd
- --name=etcd3
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd3:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd3:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd3vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node3]
volumes:
etcd1vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
etcd2vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
etcd3vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
networks:
etcd:
external: true# docker stack deploy --compose-file 00etcd.yml etcdÀs deidh beagan ùine, nì sinn cinnteach gu bheil an cruinneachadh msaa suas:
# docker exec $(docker ps | awk '/etcd/ {print $1}') etcdctl member list
ade526d28b1f92f7: name=etcd1 peerURLs=http://etcd1:2380 clientURLs=http://etcd1:2379 isLeader=false
bd388e7810915853: name=etcd3 peerURLs=http://etcd3:2380 clientURLs=http://etcd3:2379 isLeader=false
d282ac2ce600c1ce: name=etcd2 peerURLs=http://etcd2:2380 clientURLs=http://etcd2:2379 isLeader=true
# docker exec $(docker ps | awk '/etcd/ {print $1}') etcdctl cluster-health
member ade526d28b1f92f7 is healthy: got healthy result from http://etcd1:2379
member bd388e7810915853 is healthy: got healthy result from http://etcd3:2379
member d282ac2ce600c1ce is healthy: got healthy result from http://etcd2:2379
cluster is healthyBidh sinn a’ cruthachadh chlàran airson Postgresql, cuir an gnìomh an àithne air a h-uile frithealaiche:
# mkdir -p /srv/pgsqlAn uairsin, cruthaich faidhle gus Postgresql a rèiteachadh:
01pgsql.yml
version: '3.7'
services:
pgsentinel:
image: sorintlab/stolon:master-pg10
command:
- gosu
- stolon
- stolon-sentinel
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
- --log-level=debug
networks:
- etcd
- pgsql
deploy:
replicas: 3
update_config:
parallelism: 1
delay: 30s
order: stop-first
failure_action: pause
pgkeeper1:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper1
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper1
- --pg-repl-username=replica
- --uid=pgkeeper1
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper1:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node1]
pgkeeper2:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper2
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper2
- --pg-repl-username=replica
- --uid=pgkeeper2
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper2:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node2]
pgkeeper3:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper3
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper3
- --pg-repl-username=replica
- --uid=pgkeeper3
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper3:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node3]
postgresql:
image: sorintlab/stolon:master-pg10
command: gosu stolon stolon-proxy --listen-address 0.0.0.0 --cluster-name stolon-cluster --store-backend=etcdv3 --store-endpoints http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
deploy:
replicas: 3
update_config:
parallelism: 1
delay: 30s
order: stop-first
failure_action: rollback
volumes:
pgkeeper1:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
pgkeeper2:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
pgkeeper3:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
secrets:
pgsql:
file: "/srv/docker/postgres"
pgsql_repl:
file: "/srv/docker/replica"
networks:
etcd:
external: true
pgsql:
external: trueBidh sinn a’ gineadh dìomhaireachdan agus a’ cleachdadh am faidhle:
# </dev/urandom tr -dc 234567890qwertyuopasdfghjkzxcvbnmQWERTYUPASDFGHKLZXCVBNM | head -c $(((RANDOM%3)+15)) > /srv/docker/replica
# </dev/urandom tr -dc 234567890qwertyuopasdfghjkzxcvbnmQWERTYUPASDFGHKLZXCVBNM | head -c $(((RANDOM%3)+15)) > /srv/docker/postgres
# docker stack deploy --compose-file 01pgsql.yml pgsqlÀs deidh beagan ùine (faic toradh an àithne seirbheis docker lsgu bheil a h-uile seirbheis suas) bidh sinn a’ tòiseachadh cruinneachadh Postgresql:
# docker exec $(docker ps | awk '/pgkeeper/ {print $1}') stolonctl --cluster-name=stolon-cluster --store-backend=etcdv3 --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379 initA’ sgrùdadh cho deònach sa tha am buidheann Postgresql:
# docker exec $(docker ps | awk '/pgkeeper/ {print $1}') stolonctl --cluster-name=stolon-cluster --store-backend=etcdv3 --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379 status
=== Active sentinels ===
ID LEADER
26baa11d false
74e98768 false
a8cb002b true
=== Active proxies ===
ID
4d233826
9f562f3b
b0c79ff1
=== Keepers ===
UID HEALTHY PG LISTENADDRESS PG HEALTHY PG WANTEDGENERATION PG CURRENTGENERATION
pgkeeper1 true pgkeeper1:5432 true 2 2
pgkeeper2 true pgkeeper2:5432 true 2 2
pgkeeper3 true pgkeeper3:5432 true 3 3
=== Cluster Info ===
Master Keeper: pgkeeper3
===== Keepers/DB tree =====
pgkeeper3 (master)
├─pgkeeper2
└─pgkeeper1
Bidh sinn a’ rèiteachadh traefik gus ruigsinneachd fhosgladh gu soithichean bhon taobh a-muigh:
03traefik.yml
version: '3.7'
services:
traefik:
image: traefik:latest
command: >
--log.level=INFO
--providers.docker=true
--entryPoints.web.address=:80
--providers.providersThrottleDuration=2
--providers.docker.watch=true
--providers.docker.swarmMode=true
--providers.docker.swarmModeRefreshSeconds=15s
--providers.docker.exposedbydefault=false
--accessLog.bufferingSize=0
--api=true
--api.dashboard=true
--api.insecure=true
networks:
- traefik
ports:
- 80:80
volumes:
- /var/run/docker.sock:/var/run/docker.sock
deploy:
replicas: 3
placement:
constraints:
- node.role == manager
preferences:
- spread: node.id
labels:
- traefik.enable=true
- traefik.http.routers.traefik.rule=Host(`traefik.example.com`)
- traefik.http.services.traefik.loadbalancer.server.port=8080
- traefik.docker.network=traefik
networks:
traefik:
external: true# docker stack deploy --compose-file 03traefik.yml traefikBidh sinn a’ cur air bhog Redis Cluster, gus seo a dhèanamh bidh sinn a’ cruthachadh eòlaire stòraidh air a h-uile nod:
# mkdir -p /srv/redis05 dearg.yml
version: '3.7'
services:
redis-master:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '6379:6379'
environment:
- REDIS_REPLICATION_MODE=master
- REDIS_PASSWORD=xxxxxxxxxxx
deploy:
mode: global
restart_policy:
condition: any
volumes:
- 'redis:/opt/bitnami/redis/etc/'
redis-replica:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '6379'
depends_on:
- redis-master
environment:
- REDIS_REPLICATION_MODE=slave
- REDIS_MASTER_HOST=redis-master
- REDIS_MASTER_PORT_NUMBER=6379
- REDIS_MASTER_PASSWORD=xxxxxxxxxxx
- REDIS_PASSWORD=xxxxxxxxxxx
deploy:
mode: replicated
replicas: 3
update_config:
parallelism: 1
delay: 10s
restart_policy:
condition: any
redis-sentinel:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '16379'
depends_on:
- redis-master
- redis-replica
entrypoint: |
bash -c 'bash -s <<EOF
"/bin/bash" -c "cat <<EOF > /opt/bitnami/redis/etc/sentinel.conf
port 16379
dir /tmp
sentinel monitor master-node redis-master 6379 2
sentinel down-after-milliseconds master-node 5000
sentinel parallel-syncs master-node 1
sentinel failover-timeout master-node 5000
sentinel auth-pass master-node xxxxxxxxxxx
sentinel announce-ip redis-sentinel
sentinel announce-port 16379
EOF"
"/bin/bash" -c "redis-sentinel /opt/bitnami/redis/etc/sentinel.conf"
EOF'
deploy:
mode: global
restart_policy:
condition: any
volumes:
redis:
driver: local
driver_opts:
type: 'none'
o: 'bind'
device: "/srv/redis"
networks:
redis:
external: true# docker stack deploy --compose-file 05redis.yml redisCuir Clàr Docker ris:
06 clàradh.yml
version: '3.7'
services:
registry:
image: registry:2.6
networks:
- traefik
volumes:
- registry_data:/var/lib/registry
deploy:
replicas: 1
placement:
constraints: [node.role == manager]
restart_policy:
condition: on-failure
labels:
- traefik.enable=true
- traefik.http.routers.registry.rule=Host(`registry.example.com`)
- traefik.http.services.registry.loadbalancer.server.port=5000
- traefik.docker.network=traefik
volumes:
registry_data:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/registry"
networks:
traefik:
external: true# mkdir /srv/docker/registry
# docker stack deploy --compose-file 06registry.yml registryAgus mu dheireadh - GitLab:
08gitlab-runner.yml
version: '3.7'
services:
gitlab:
image: gitlab/gitlab-ce:latest
networks:
- pgsql
- redis
- traefik
- gitlab
ports:
- 22222:22
environment:
GITLAB_OMNIBUS_CONFIG: |
postgresql['enable'] = false
redis['enable'] = false
gitlab_rails['registry_enabled'] = false
gitlab_rails['db_username'] = "gitlab"
gitlab_rails['db_password'] = "XXXXXXXXXXX"
gitlab_rails['db_host'] = "postgresql"
gitlab_rails['db_port'] = "5432"
gitlab_rails['db_database'] = "gitlab"
gitlab_rails['db_adapter'] = 'postgresql'
gitlab_rails['db_encoding'] = 'utf8'
gitlab_rails['redis_host'] = 'redis-master'
gitlab_rails['redis_port'] = '6379'
gitlab_rails['redis_password'] = 'xxxxxxxxxxx'
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.yandex.ru"
gitlab_rails['smtp_port'] = 465
gitlab_rails['smtp_user_name'] = "[email protected]"
gitlab_rails['smtp_password'] = "xxxxxxxxx"
gitlab_rails['smtp_domain'] = "example.com"
gitlab_rails['gitlab_email_from'] = '[email protected]'
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_tls'] = true
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_openssl_verify_mode'] = 'peer'
external_url 'http://gitlab.example.com/'
gitlab_rails['gitlab_shell_ssh_port'] = 22222
volumes:
- gitlab_conf:/etc/gitlab
- gitlab_logs:/var/log/gitlab
- gitlab_data:/var/opt/gitlab
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.role == manager
labels:
- traefik.enable=true
- traefik.http.routers.gitlab.rule=Host(`gitlab.example.com`)
- traefik.http.services.gitlab.loadbalancer.server.port=80
- traefik.docker.network=traefik
gitlab-runner:
image: gitlab/gitlab-runner:latest
networks:
- gitlab
volumes:
- gitlab_runner_conf:/etc/gitlab
- /var/run/docker.sock:/var/run/docker.sock
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.role == manager
volumes:
gitlab_conf:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/conf"
gitlab_logs:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/logs"
gitlab_data:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/data"
gitlab_runner_conf:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/runner"
networks:
pgsql:
external: true
redis:
external: true
traefik:
external: true
gitlab:
external: true# mkdir -p /srv/docker/gitlab/conf
# mkdir -p /srv/docker/gitlab/logs
# mkdir -p /srv/docker/gitlab/data
# mkdir -p /srv/docker/gitlab/runner
# docker stack deploy --compose-file 08gitlab-runner.yml gitlabAn staid mu dheireadh den bhuidheann agus seirbheisean:
# docker service ls
ID NAME MODE REPLICAS IMAGE PORTS
lef9n3m92buq etcd_etcd1 replicated 1/1 quay.io/coreos/etcd:latest
ij6uyyo792x5 etcd_etcd2 replicated 1/1 quay.io/coreos/etcd:latest
fqttqpjgp6pp etcd_etcd3 replicated 1/1 quay.io/coreos/etcd:latest
hq5iyga28w33 gitlab_gitlab replicated 1/1 gitlab/gitlab-ce:latest *:22222->22/tcp
dt7s6vs0q4qc gitlab_gitlab-runner replicated 1/1 gitlab/gitlab-runner:latest
k7uoezno0h9n pgsql_pgkeeper1 replicated 1/1 sorintlab/stolon:master-pg10
cnrwul4r4nse pgsql_pgkeeper2 replicated 1/1 sorintlab/stolon:master-pg10
frflfnpty7tr pgsql_pgkeeper3 replicated 1/1 sorintlab/stolon:master-pg10
x7pqqchi52kq pgsql_pgsentinel replicated 3/3 sorintlab/stolon:master-pg10
mwu2wl8fti4r pgsql_postgresql replicated 3/3 sorintlab/stolon:master-pg10
9hkbe2vksbzb redis_redis-master global 3/3 bitnami/redis:latest *:6379->6379/tcp
l88zn8cla7dc redis_redis-replica replicated 3/3 bitnami/redis:latest *:30003->6379/tcp
1utp309xfmsy redis_redis-sentinel global 3/3 bitnami/redis:latest *:30002->16379/tcp
oteb824ylhyp registry_registry replicated 1/1 registry:2.6
qovrah8nzzu8 traefik_traefik replicated 3/3 traefik:latest *:80->80/tcp, *:443->443/tcpDè eile a ghabhas a leasachadh? Dèan cinnteach gun cuir thu air dòigh Traefik gus soithichean a ruith thairis air https, cuir crioptachadh tls airson Postgresql agus Redis. Ach san fharsaingeachd, faodar a thoirt do luchd-leasachaidh mar PoC mar-thà. Bheir sinn sùil a-nis air roghainnean eile an àite Docker.
podman
Einnsean eile a tha gu math ainmeil airson a bhith a 'ruith shoithichean air an cruinneachadh le pods (pods, buidhnean de shoithichean air an cleachdadh còmhla). Eu-coltach ri Docker, chan eil feum air seirbheis sam bith airson soithichean a ruith; tha a h-uile obair air a dhèanamh tron leabharlann libpod. Cuideachd sgrìobhte ann an Go, feumar ùine ruith a tha co-chosmhail ri OCI airson soithichean a ruith, leithid runC.
Tha a bhith ag obair le Podman mar as trice a’ cur nar cuimhne sin airson Docker, chun na h-ìre gun urrainn dhut a dhèanamh mar seo (mar a thuirt mòran a dh’ fheuch e, ùghdar an artaigil seo nam measg):
$ alias docker=podmanagus faodaidh tu leantainn air adhart ag obair. San fharsaingeachd, tha an suidheachadh le Podman gu math inntinneach, oir nam biodh dreachan tràth de Kubernetes ag obair le Docker, an uairsin timcheall air 2015, às deidh gnàthachadh saoghal nan soithichean (OCI - Open Container Initiative) agus an Docker a roinn ann an soithichean agus runC, tha roghainn eile an àite Docker airson ruith ann an Kubernetes air a bhith a’ leasachadh: CRI-O. Tha Podman a thaobh seo na roghainn eile an àite Docker, stèidhichte air prionnsapalan Kubernetes, a ’toirt a-steach cruinneachadh shoithichean, ach is e prìomh adhbhar a’ phròiseict soithichean ann an stoidhle Docker a chuir air bhog às aonais seirbheisean a bharrachd. Airson adhbharan follaiseach, chan eil modh swarm ann, leis gu bheil an luchd-leasachaidh ag ràdh gu soilleir ma tha feum agad air brabhsair, gabh Kubernetes.
suidheachadh
Gus stàladh air Centos 7, dìreach cuir an gnìomh an stòr Extras, agus an uairsin stàlaich a h-uile càil leis an àithne:
# yum -y install podmanComharran eile
Faodaidh Podman aonadan a ghineadh airson systemd, agus mar sin fuasgladh fhaighinn air an duilgheadas a thaobh soithichean a thòiseachadh às deidh ath-thòiseachadh frithealaiche. A bharrachd air an sin, thathas ag ainmeachadh gu bheil systemd ag obair gu ceart mar pid 1 anns a’ ghobhar. Tha inneal buildah air leth ann airson soithichean a thogail, tha innealan treas-phàrtaidh ann cuideachd - analogues de docker-compose, a bhios cuideachd a ’gineadh faidhlichean rèiteachaidh a tha co-chosmhail ri Kubernetes, agus mar sin tha an gluasad bho Podman gu Kubernetes air a dhèanamh nas sìmplidhe cho mòr‘ s a ghabhas.
Ag obair còmhla ri Podman
Leis nach eil modh swarm ann (tha còir againn atharrachadh gu Kubernetes ma tha feum air cruinneachadh), cruinnichidh sinn e ann an soithichean fa leth.
Stàlaich podman-compose:
# yum -y install python3-pip
# pip3 install podman-composeTha am faidhle rèiteachaidh airson podman beagan eadar-dhealaichte, mar sin mar eisimpleir bha againn ri roinn leabhraichean fa leth a ghluasad gu dìreach chun roinn le seirbheisean.
gitlab-podman.yml
version: '3.7'
services:
gitlab:
image: gitlab/gitlab-ce:latest
hostname: gitlab.example.com
restart: unless-stopped
environment:
GITLAB_OMNIBUS_CONFIG: |
gitlab_rails['gitlab_shell_ssh_port'] = 22222
ports:
- "80:80"
- "22222:22"
volumes:
- /srv/podman/gitlab/conf:/etc/gitlab
- /srv/podman/gitlab/data:/var/opt/gitlab
- /srv/podman/gitlab/logs:/var/log/gitlab
networks:
- gitlab
gitlab-runner:
image: gitlab/gitlab-runner:alpine
restart: unless-stopped
depends_on:
- gitlab
volumes:
- /srv/podman/gitlab/runner:/etc/gitlab-runner
- /var/run/docker.sock:/var/run/docker.sock
networks:
- gitlab
networks:
gitlab:# podman-compose -f gitlab-runner.yml -d upToradh:
# podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
da53da946c01 docker.io/gitlab/gitlab-runner:alpine run --user=gitlab... About a minute ago Up About a minute ago 0.0.0.0:22222->22/tcp, 0.0.0.0:80->80/tcp root_gitlab-runner_1
781c0103c94a docker.io/gitlab/gitlab-ce:latest /assets/wrapper About a minute ago Up About a minute ago 0.0.0.0:22222->22/tcp, 0.0.0.0:80->80/tcp root_gitlab_1Chì sinn dè a bhios e a’ gineadh airson systemd agus kubernetes, airson seo feumaidh sinn faighinn a-mach ainm no id a’ phoit:
# podman pod ls
POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID
71fc2b2a5c63 root Running 11 minutes ago 3 db40ab8bf84bCubernetes:
# podman generate kube 71fc2b2a5c63
# Generation of Kubernetes YAML is still under development!
#
# Save the output of this file and use kubectl create -f to import
# it into Kubernetes.
#
# Created with podman-1.6.4
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: "2020-07-29T19:22:40Z"
labels:
app: root
name: root
spec:
containers:
- command:
- /assets/wrapper
env:
- name: PATH
value: /opt/gitlab/embedded/bin:/opt/gitlab/bin:/assets:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- name: TERM
value: xterm
- name: HOSTNAME
value: gitlab.example.com
- name: container
value: podman
- name: GITLAB_OMNIBUS_CONFIG
value: |
gitlab_rails['gitlab_shell_ssh_port'] = 22222
- name: LANG
value: C.UTF-8
image: docker.io/gitlab/gitlab-ce:latest
name: rootgitlab1
ports:
- containerPort: 22
hostPort: 22222
protocol: TCP
- containerPort: 80
hostPort: 80
protocol: TCP
resources: {}
securityContext:
allowPrivilegeEscalation: true
capabilities: {}
privileged: false
readOnlyRootFilesystem: false
volumeMounts:
- mountPath: /var/opt/gitlab
name: srv-podman-gitlab-data
- mountPath: /var/log/gitlab
name: srv-podman-gitlab-logs
- mountPath: /etc/gitlab
name: srv-podman-gitlab-conf
workingDir: /
- command:
- run
- --user=gitlab-runner
- --working-directory=/home/gitlab-runner
env:
- name: PATH
value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- name: TERM
value: xterm
- name: HOSTNAME
- name: container
value: podman
image: docker.io/gitlab/gitlab-runner:alpine
name: rootgitlab-runner1
resources: {}
securityContext:
allowPrivilegeEscalation: true
capabilities: {}
privileged: false
readOnlyRootFilesystem: false
volumeMounts:
- mountPath: /etc/gitlab-runner
name: srv-podman-gitlab-runner
- mountPath: /var/run/docker.sock
name: var-run-docker.sock
workingDir: /
volumes:
- hostPath:
path: /srv/podman/gitlab/runner
type: Directory
name: srv-podman-gitlab-runner
- hostPath:
path: /var/run/docker.sock
type: File
name: var-run-docker.sock
- hostPath:
path: /srv/podman/gitlab/data
type: Directory
name: srv-podman-gitlab-data
- hostPath:
path: /srv/podman/gitlab/logs
type: Directory
name: srv-podman-gitlab-logs
- hostPath:
path: /srv/podman/gitlab/conf
type: Directory
name: srv-podman-gitlab-conf
status: {}Siostam:
# podman generate systemd 71fc2b2a5c63
# pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
Documentation=man:podman-generate-systemd(1)
Requires=container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
Before=container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa
ExecStop=/usr/bin/podman stop -t 10 db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa/userdata/conmon.pid
[Install]
WantedBy=multi-user.target
# container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
Documentation=man:podman-generate-systemd(1)
RefuseManualStart=yes
RefuseManualStop=yes
BindsTo=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
After=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864
ExecStop=/usr/bin/podman stop -t 10 da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864/userdata/conmon.pid
[Install]
WantedBy=multi-user.target
# container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service
Documentation=man:podman-generate-systemd(1)
RefuseManualStart=yes
RefuseManualStop=yes
BindsTo=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
After=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start 781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3
ExecStop=/usr/bin/podman stop -t 10 781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3/userdata/conmon.pid
[Install]
WantedBy=multi-user.targetGu mì-fhortanach, a bharrachd air soithichean a chuir air bhog, chan eil an aonad gineadh airson systemd a ’dèanamh dad eile (mar eisimpleir, a’ glanadh seann shoithichean nuair a thèid an leithid de sheirbheis ath-thòiseachadh), agus mar sin feumaidh tu na rudan sin a sgrìobhadh thu fhèin.
Ann am prionnsapal, tha Podman gu leòr airson feuchainn dè a th’ ann an soithichean, gluais seann rèiteachaidhean airson sgrìobhadh docker, agus an uairsin gluais gu Kubernetes, ma tha feum agad air cruinneachadh, no faigh roghainn eile a tha nas fhasa a chleachdadh an àite Docker.
rkt
Am pròiseact timcheall air sia mìosan air ais air sgàth gun do cheannaich RedHat e, agus mar sin cha bhith mi a’ fuireach air nas mionaidiche. Gu h-iomlan, dh’ fhàg e deagh bheachd, ach an taca ri Docker agus gu sònraichte Podman, tha e coltach ri cothlamadh. Bha cuideachd cuairteachadh CoreOS air a thogail air mullach rkt (ged a bha Docker aca bho thùs), ach thàinig seo gu crìch cuideachd mar thaic às deidh ceannach RedHat.
Plastaig
Barrachd , agus bha an t-ùghdar dìreach airson soithichean a thogail agus a ruith. A 'breithneachadh leis na sgrìobhainnean agus an còd, cha do lean an t-ùghdar ris na h-inbhean, ach cho-dhùin e gu sìmplidh a bhuileachadh fhèin a sgrìobhadh, a rinn e ann am prionnsabal.
toraidhean
Tha an suidheachadh le Kubernetes gu math inntinneach: air an aon làimh, le Docker faodaidh tu cruinneachadh a thogail (ann am modh swarm), leis an urrainn dhut eadhon àrainneachdan toraidh a ruith airson teachdaichean, tha seo gu sònraichte fìor airson sgiobaidhean beaga (3-5 neach) , no le eallach beag iomlan , no dìth miann a bhith a 'tuigsinn cho duilich' sa tha stèidheachadh Kubernetes, a 'gabhail a-steach luchdan àrda.
Chan eil Podman a 'toirt seachad co-fhreagarrachd iomlan, ach tha aon bhuannachd chudromach aige - co-chòrdadh ri Kubernetes, a' gabhail a-steach innealan a bharrachd (buildah agus feadhainn eile). Mar sin, thig mi gu taghadh inneal airson obair mar a leanas: airson sgiobaidhean beaga, no le buidseat cuibhrichte - Docker (le modh swarm a dh’ fhaodadh a bhith ann), airson leasachadh dhomh fhìn air neach-aoigheachd pearsanta - companaich Podman, agus airson a h-uile duine eile - Beanntan.
Chan eil mi cinnteach nach atharraich an suidheachadh le Docker san àm ri teachd, às deidh a h-uile càil, tha iad nan tùsairean, agus tha iad cuideachd mean air mhean air an gnàthachadh ceum air cheum, ach Podman, airson a h-uile easbhaidhean (ag obair a-mhàin air Linux, gun cruinneachadh, co-chruinneachadh agus gnìomhan eile mar fhuasglaidhean treas-phàrtaidh) tha an àm ri teachd nas soilleire, agus mar sin tha mi a’ toirt cuireadh don h-uile duine bruidhinn mu na co-dhùnaidhean sin anns na beachdan.
PS Air 3 Lùnastal bidh sinn a’ cur air bhog “", far an ionnsaich thu barrachd mun obair aige. Nì sinn mion-sgrùdadh air na h-innealan aige: bho tharraingean bunaiteach gu paramadairean lìonra, nuances a bhith ag obair le diofar shiostaman obrachaidh agus cànanan prògramaidh. Bidh thu eòlach air an teicneòlas agus tuigidh tu càite agus an dòigh as fheàrr air Docker a chleachdadh. Bidh sinn cuideachd a’ roinn chùisean deagh chleachdadh.
Prìs ro-òrdugh mus tèid a leigeil ma sgaoil: RUB 5000. Chì thu prògram Cùrsa Bhidio Docker .
Source: www.habr.com