TL;DR: Jagorar dubawa don kwatanta tsarin aiki don gudanar da aikace-aikacen a cikin kwantena. Za a yi la'akari da damar Docker da sauran tsarin makamantan su.
Dan tarihin inda duk ya fito
История
Sananniyar hanya ta farko don ware aikace-aikace ita ce chroot. Kiran tsarin sunan iri ɗaya yana tabbatar da cewa an canza tushen directory - don haka tabbatar da cewa shirin da ya kira shi yana da damar yin amfani da fayiloli kawai a cikin wannan kundin. Amma idan shirin ya sami tushen gata a ciki, yana iya yuwuwar "kujewa" chroot kuma ya sami damar shiga babban tsarin aiki. Har ila yau, ban da canza tushen directory, sauran albarkatu (RAM, processor), da damar hanyar sadarwa, ba su da iyaka.
Hanya ta gaba ita ce ƙaddamar da cikakken tsarin aiki a cikin kwantena, ta amfani da hanyoyin kernel ɗin tsarin aiki. Ana kiran wannan hanya daban-daban a tsarin aiki daban-daban, amma ainihin ma'anar iri ɗaya ne - ƙaddamar da tsarin aiki masu zaman kansu da yawa, kowannensu yana tafiyar da kernel iri ɗaya wanda babban tsarin aiki ke gudana. Waɗannan sun haɗa da Jails na FreeBSD, Yankunan Solaris, OpenVZ da LXC don Linux. Ana tabbatar da keɓewa ba kawai ta sararin faifai ba, har ma da wasu albarkatu; musamman, kowane akwati na iya samun iyakancewa akan lokacin sarrafawa, RAM, da bandwidth na cibiyar sadarwa. Idan aka kwatanta da chroot, barin kwandon ya fi wahala, tun da superuser a cikin akwati yana da damar yin amfani da abubuwan da ke cikin akwati kawai, duk da haka, saboda buƙatar kiyaye tsarin aiki a cikin akwati har zuwa yau da kuma amfani da tsofaffin nau'ikan. na kernels (wanda ya dace da Linux, zuwa ƙarami FreeBSD), akwai rashin sifili da yuwuwar “watse” tsarin keɓewar kwaya da samun dama ga babban tsarin aiki.
Maimakon ƙaddamar da cikakken tsarin aiki a cikin akwati (tare da tsarin farawa, mai sarrafa kunshin, da dai sauransu), za ku iya kaddamar da aikace-aikacen nan da nan, babban abu shine samar da aikace-aikacen irin wannan damar (kasancewar dakunan karatu masu mahimmanci). da sauran fayiloli). Wannan ra'ayin ya zama tushen tushen aikace-aikacen ƙwanƙwasa, mafi shahara kuma sanannen wakilin wanda shine Docker. Idan aka kwatanta da tsarin da suka gabata, ƙarin hanyoyin keɓewa masu sassauƙa, haɗe tare da ginanniyar tallafi don cibiyoyin sadarwa na zamani tsakanin kwantena da bin diddigin yanayin aikace-aikacen a cikin akwati, ya haifar da ikon gina mahalli guda ɗaya mai daidaituwa daga babban adadin sabar jiki don kwantena masu gudana - ba tare da buƙatar sarrafa albarkatun hannu ba.
Docker
Docker shine mafi shaharar software na kwantena aikace-aikace. An rubuta shi a cikin yaren Go, yana amfani da daidaitattun fasalulluka na kernel Linux - ƙungiyoyi, wuraren suna, damar aiki, da sauransu, da tsarin fayilolin Aufs da sauran makamantansu don adana sararin diski.
Source: wikimedia
gine
Kafin sigar 1.11, Docker yayi aiki azaman sabis guda ɗaya wanda ke aiwatar da duk ayyuka tare da kwantena: zazzage hotuna don kwantena, ƙaddamar da kwantena, sarrafa buƙatun API. An fara da sigar 1.11, Docker ya kasu kashi da yawa waɗanda ke hulɗa da juna: kwantena, don sarrafa duk tsarin rayuwar kwantena (waɗanda sararin faifai, zazzage hotuna, aiki tare da hanyar sadarwa, ƙaddamarwa, shigarwa da saka idanu kan yanayin kwantena) da runC, yanayin aiwatar da kwantena, dangane da amfani da ƙungiyoyi da sauran fasalulluka na kernel na Linux. Sabis ɗin docker da kansa ya rage, amma yanzu yana aiki ne kawai don aiwatar da buƙatun API da aka fassara zuwa akwati.
Shigarwa da daidaitawa
Hanyar da na fi so don shigar da docker shine docker-machine, wanda, ban da shigarwa kai tsaye da daidaita docker akan sabobin nesa (ciki har da gizagizai daban-daban), yana ba da damar yin aiki tare da tsarin fayil na sabar nesa kuma yana iya aiwatar da umarni daban-daban.
Duk da haka, tun daga 2018, aikin ba a haɓaka shi ba, don haka za mu shigar da shi a daidaitaccen hanya don yawancin rarraba Linux - ƙara wurin ajiya da shigar da abubuwan da suka dace.
Hakanan ana amfani da wannan hanyar don shigarwa ta atomatik, misali ta amfani da Mai yiwuwa ko wasu tsarin makamantansu, amma ba zan yi la'akari da shi a cikin wannan labarin ba.
Za a aiwatar da shigarwa akan Centos 7, Zan yi amfani da injin kama-da-wane azaman uwar garken, don shigar kawai aiwatar da umarnin da ke ƙasa:
# yum install -y yum-utils
# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
# yum install docker-ce docker-ce-cli containerd.ioBayan shigarwa, kuna buƙatar fara sabis ɗin kuma sanya shi cikin farawa:
# systemctl enable docker
# systemctl start docker
# firewall-cmd --zone=public --add-port=2377/tcp --permanentBugu da ƙari, za ku iya ƙirƙirar ƙungiyar docker, waɗanda masu amfani za su iya yin aiki tare da docker ba tare da sudo ba, saita shiga, ba da damar yin amfani da API daga waje, kuma kar ku manta da daidaita tsarin tacewar zaɓi daidai (duk abin da ba a yarda da shi ba). An haramta shi a cikin misalan sama da ƙasa - Na bar wannan don sauƙi da tsabta), amma ba zan yi karin bayani ba a nan.
Sauran siffofi
Baya ga na'urar docker da aka ambata a sama, akwai kuma rajistar docker, kayan aiki don adana hotuna don kwantena, da kuma rubutun docker, kayan aiki don sarrafa sarrafa aikace-aikacen a cikin kwantena, ana amfani da fayilolin YAML don ginawa da daidaita kwantena. da sauran abubuwa masu alaƙa (misali, cibiyoyin sadarwa, tsarin fayil na dindindin don bayanan ajiya).
Hakanan za'a iya amfani dashi don tsara masu jigilar kaya don CICD. Wani fasali mai ban sha'awa yana aiki a cikin yanayin tari, abin da ake kira yanayin swarm (kafin sigar 1.12 an san shi da docker swarm), wanda ke ba ku damar tattara kayan aikin guda ɗaya daga sabobin da yawa don kwantena masu gudana. Akwai goyan baya ga cibiyar sadarwa mai kama-da-wane a saman duk sabobin, akwai madaidaicin ma'aunin nauyi, da kuma tallafi ga sirrin kwantena.
Ana iya amfani da fayilolin YAML daga rubutattun docker, tare da ƙananan gyare-gyare, don irin waɗannan gungu, suna sarrafa gaba ɗaya sarrafa ƙananan gungu da matsakaita don dalilai daban-daban. Don manyan gungu, Kubernetes ya fi dacewa saboda farashin kula da yanayin swarm na iya wuce na Kubernetes. Baya ga runC, zaku iya shigar, misali, azaman yanayin aiwatar da kwantena
Yin aiki tare da Docker
Bayan shigarwa da daidaitawa, za mu yi ƙoƙarin tara gungu wanda a ciki za mu tura GitLab da Docker Registry don ƙungiyar ci gaba. Zan yi amfani da injunan kama-da-wane guda uku azaman sabobin, wanda a cikinsu zan tura FS GlusterFS da aka rarraba; Zan yi amfani da shi azaman ma'ajiyar juzu'i, alal misali, don gudanar da nau'in rajista na docker mai jurewa. Maɓallin abubuwan da za a gudanar: Docker Registry, Postgresql, Redis, GitLab tare da goyan bayan GitLab Runner a saman Swarm. Za mu ƙaddamar da Postgresql tare da tari , don haka ba kwa buƙatar amfani da GlusterFS don adana bayanan Postgresql. Za a adana sauran mahimman bayanai akan GlusterFS.
Don tura GlusterFS akan duk sabobin (ana kiran su node1, node2, node3), kuna buƙatar shigar da fakiti, kunna Tacewar zaɓi, kuma ƙirƙirar kundayen adireshi masu dacewa:
# yum -y install centos-release-gluster7
# yum -y install glusterfs-server
# systemctl enable glusterd
# systemctl start glusterd
# firewall-cmd --add-service=glusterfs --permanent
# firewall-cmd --reload
# mkdir -p /srv/gluster
# mkdir -p /srv/docker
# echo "$(hostname):/docker /srv/docker glusterfs defaults,_netdev 0 0" >> /etc/fstabBayan shigarwa, dole ne a ci gaba da aiki akan daidaita GlusterFS daga kumburi ɗaya, misali node1:
# gluster peer probe node2
# gluster peer probe node3
# gluster volume create docker replica 3 node1:/srv/gluster node2:/srv/gluster node3:/srv/gluster force
# gluster volume start dockerSannan kuna buƙatar hawa ƙarar sakamakon (dole ne a aiwatar da umarnin akan duk sabobin):
# mount /srv/dockerAna saita yanayin swarm akan ɗaya daga cikin sabobin, wanda shine jagora, sauran zasu shiga cikin cluster, don haka sakamakon aiwatar da umarni akan uwar garken farko zai buƙaci kwafi da aiwatar da sauran.
Saitin gungu na farko, Ina gudanar da umarni akan node1:
# docker swarm init
Swarm initialized: current node (a5jpfrh5uvo7svzz1ajduokyq) is now a manager.
To add a worker to this swarm, run the following command:
docker swarm join --token SWMTKN-1-0c5mf7mvzc7o7vjk0wngno2dy70xs95tovfxbv4tqt9280toku-863hyosdlzvd76trfptd4xnzd xx.xx.xx.xx:2377
To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
# docker swarm join-token managerMuna kwafi sakamakon umarni na biyu kuma muna aiwatar da shi akan node2 da node3:
# docker swarm join --token SWMTKN-x-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxx xx.xx.xx.xx:2377
This node joined a swarm as a manager.A wannan gaba, saitin farko na sabobin ya ƙare, bari mu ci gaba da kafa ayyukan; umarnin da za a aiwatar za a ƙaddamar da su daga node1, sai dai in an ƙayyade.
Da farko, bari mu ƙirƙiri cibiyoyin sadarwa don kwantena:
# docker network create --driver=overlay etcd
# docker network create --driver=overlay pgsql
# docker network create --driver=overlay redis
# docker network create --driver=overlay traefik
# docker network create --driver=overlay gitlabSa'an nan kuma za mu yi alama ga uwar garken, wannan ya zama dole don ɗaure wasu ayyuka ga sabar:
# docker node update --label-add nodename=node1 node1
# docker node update --label-add nodename=node2 node2
# docker node update --label-add nodename=node3 node3Bayan haka, muna ƙirƙirar kundayen adireshi don adana bayanan da sauransu, ma'ajiyar KV, waɗanda ake buƙata don Traefik da Stolon. Kama da Postgresql, waɗannan za su zama kwantena da aka ɗaure zuwa sabobin, don haka muna gudanar da wannan umarni akan duk sabobin:
# mkdir -p /srv/etcdNa gaba, ƙirƙiri fayil don saita etcd kuma yi amfani da shi:
00etcd.yml
version: '3.7'
services:
etcd1:
image: quay.io/coreos/etcd:latest
hostname: etcd1
command:
- etcd
- --name=etcd1
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd1:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd1:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd1vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node1]
etcd2:
image: quay.io/coreos/etcd:latest
hostname: etcd2
command:
- etcd
- --name=etcd2
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd2:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd2:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd2vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node2]
etcd3:
image: quay.io/coreos/etcd:latest
hostname: etcd3
command:
- etcd
- --name=etcd3
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd3:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd3:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd3vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node3]
volumes:
etcd1vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
etcd2vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
etcd3vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
networks:
etcd:
external: true# docker stack deploy --compose-file 00etcd.yml etcdBayan wani lokaci, muna duba cewa gungu na etcd ya tashi:
# docker exec $(docker ps | awk '/etcd/ {print $1}') etcdctl member list
ade526d28b1f92f7: name=etcd1 peerURLs=http://etcd1:2380 clientURLs=http://etcd1:2379 isLeader=false
bd388e7810915853: name=etcd3 peerURLs=http://etcd3:2380 clientURLs=http://etcd3:2379 isLeader=false
d282ac2ce600c1ce: name=etcd2 peerURLs=http://etcd2:2380 clientURLs=http://etcd2:2379 isLeader=true
# docker exec $(docker ps | awk '/etcd/ {print $1}') etcdctl cluster-health
member ade526d28b1f92f7 is healthy: got healthy result from http://etcd1:2379
member bd388e7810915853 is healthy: got healthy result from http://etcd3:2379
member d282ac2ce600c1ce is healthy: got healthy result from http://etcd2:2379
cluster is healthyMuna ƙirƙirar kundayen adireshi don Postgresql, aiwatar da umarni akan duk sabobin:
# mkdir -p /srv/pgsqlNa gaba, ƙirƙiri fayil don saita Postgresql:
01pgsql.yml
version: '3.7'
services:
pgsentinel:
image: sorintlab/stolon:master-pg10
command:
- gosu
- stolon
- stolon-sentinel
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
- --log-level=debug
networks:
- etcd
- pgsql
deploy:
replicas: 3
update_config:
parallelism: 1
delay: 30s
order: stop-first
failure_action: pause
pgkeeper1:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper1
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper1
- --pg-repl-username=replica
- --uid=pgkeeper1
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper1:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node1]
pgkeeper2:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper2
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper2
- --pg-repl-username=replica
- --uid=pgkeeper2
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper2:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node2]
pgkeeper3:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper3
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper3
- --pg-repl-username=replica
- --uid=pgkeeper3
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper3:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node3]
postgresql:
image: sorintlab/stolon:master-pg10
command: gosu stolon stolon-proxy --listen-address 0.0.0.0 --cluster-name stolon-cluster --store-backend=etcdv3 --store-endpoints http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
deploy:
replicas: 3
update_config:
parallelism: 1
delay: 30s
order: stop-first
failure_action: rollback
volumes:
pgkeeper1:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
pgkeeper2:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
pgkeeper3:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
secrets:
pgsql:
file: "/srv/docker/postgres"
pgsql_repl:
file: "/srv/docker/replica"
networks:
etcd:
external: true
pgsql:
external: trueMuna ƙirƙirar sirri kuma muna amfani da fayil ɗin:
# </dev/urandom tr -dc 234567890qwertyuopasdfghjkzxcvbnmQWERTYUPASDFGHKLZXCVBNM | head -c $(((RANDOM%3)+15)) > /srv/docker/replica
# </dev/urandom tr -dc 234567890qwertyuopasdfghjkzxcvbnmQWERTYUPASDFGHKLZXCVBNM | head -c $(((RANDOM%3)+15)) > /srv/docker/postgres
# docker stack deploy --compose-file 01pgsql.yml pgsqlBayan wani lokaci (duba fitarwa na umarnin sabis na docker lscewa duk ayyukan sun ƙare) mun fara gungu na Postgresql:
# docker exec $(docker ps | awk '/pgkeeper/ {print $1}') stolonctl --cluster-name=stolon-cluster --store-backend=etcdv3 --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379 initDuba shirye-shiryen gungu na Postgresql:
# docker exec $(docker ps | awk '/pgkeeper/ {print $1}') stolonctl --cluster-name=stolon-cluster --store-backend=etcdv3 --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379 status
=== Active sentinels ===
ID LEADER
26baa11d false
74e98768 false
a8cb002b true
=== Active proxies ===
ID
4d233826
9f562f3b
b0c79ff1
=== Keepers ===
UID HEALTHY PG LISTENADDRESS PG HEALTHY PG WANTEDGENERATION PG CURRENTGENERATION
pgkeeper1 true pgkeeper1:5432 true 2 2
pgkeeper2 true pgkeeper2:5432 true 2 2
pgkeeper3 true pgkeeper3:5432 true 3 3
=== Cluster Info ===
Master Keeper: pgkeeper3
===== Keepers/DB tree =====
pgkeeper3 (master)
├─pgkeeper2
└─pgkeeper1
Muna saita traefik don buɗe hanyar shiga kwantena daga waje:
03 traefik.yml
version: '3.7'
services:
traefik:
image: traefik:latest
command: >
--log.level=INFO
--providers.docker=true
--entryPoints.web.address=:80
--providers.providersThrottleDuration=2
--providers.docker.watch=true
--providers.docker.swarmMode=true
--providers.docker.swarmModeRefreshSeconds=15s
--providers.docker.exposedbydefault=false
--accessLog.bufferingSize=0
--api=true
--api.dashboard=true
--api.insecure=true
networks:
- traefik
ports:
- 80:80
volumes:
- /var/run/docker.sock:/var/run/docker.sock
deploy:
replicas: 3
placement:
constraints:
- node.role == manager
preferences:
- spread: node.id
labels:
- traefik.enable=true
- traefik.http.routers.traefik.rule=Host(`traefik.example.com`)
- traefik.http.services.traefik.loadbalancer.server.port=8080
- traefik.docker.network=traefik
networks:
traefik:
external: true# docker stack deploy --compose-file 03traefik.yml traefikMun ƙaddamar da Redis Cluster, don yin wannan muna ƙirƙirar kundin adireshi akan duk nodes:
# mkdir -p /srv/redis05redis.yml
version: '3.7'
services:
redis-master:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '6379:6379'
environment:
- REDIS_REPLICATION_MODE=master
- REDIS_PASSWORD=xxxxxxxxxxx
deploy:
mode: global
restart_policy:
condition: any
volumes:
- 'redis:/opt/bitnami/redis/etc/'
redis-replica:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '6379'
depends_on:
- redis-master
environment:
- REDIS_REPLICATION_MODE=slave
- REDIS_MASTER_HOST=redis-master
- REDIS_MASTER_PORT_NUMBER=6379
- REDIS_MASTER_PASSWORD=xxxxxxxxxxx
- REDIS_PASSWORD=xxxxxxxxxxx
deploy:
mode: replicated
replicas: 3
update_config:
parallelism: 1
delay: 10s
restart_policy:
condition: any
redis-sentinel:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '16379'
depends_on:
- redis-master
- redis-replica
entrypoint: |
bash -c 'bash -s <<EOF
"/bin/bash" -c "cat <<EOF > /opt/bitnami/redis/etc/sentinel.conf
port 16379
dir /tmp
sentinel monitor master-node redis-master 6379 2
sentinel down-after-milliseconds master-node 5000
sentinel parallel-syncs master-node 1
sentinel failover-timeout master-node 5000
sentinel auth-pass master-node xxxxxxxxxxx
sentinel announce-ip redis-sentinel
sentinel announce-port 16379
EOF"
"/bin/bash" -c "redis-sentinel /opt/bitnami/redis/etc/sentinel.conf"
EOF'
deploy:
mode: global
restart_policy:
condition: any
volumes:
redis:
driver: local
driver_opts:
type: 'none'
o: 'bind'
device: "/srv/redis"
networks:
redis:
external: true# docker stack deploy --compose-file 05redis.yml redisƘara Registry Docker:
06 rajista.yml
version: '3.7'
services:
registry:
image: registry:2.6
networks:
- traefik
volumes:
- registry_data:/var/lib/registry
deploy:
replicas: 1
placement:
constraints: [node.role == manager]
restart_policy:
condition: on-failure
labels:
- traefik.enable=true
- traefik.http.routers.registry.rule=Host(`registry.example.com`)
- traefik.http.services.registry.loadbalancer.server.port=5000
- traefik.docker.network=traefik
volumes:
registry_data:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/registry"
networks:
traefik:
external: true# mkdir /srv/docker/registry
# docker stack deploy --compose-file 06registry.yml registryKuma a ƙarshe - GitLab:
08gitlab-mai gudu.yml
version: '3.7'
services:
gitlab:
image: gitlab/gitlab-ce:latest
networks:
- pgsql
- redis
- traefik
- gitlab
ports:
- 22222:22
environment:
GITLAB_OMNIBUS_CONFIG: |
postgresql['enable'] = false
redis['enable'] = false
gitlab_rails['registry_enabled'] = false
gitlab_rails['db_username'] = "gitlab"
gitlab_rails['db_password'] = "XXXXXXXXXXX"
gitlab_rails['db_host'] = "postgresql"
gitlab_rails['db_port'] = "5432"
gitlab_rails['db_database'] = "gitlab"
gitlab_rails['db_adapter'] = 'postgresql'
gitlab_rails['db_encoding'] = 'utf8'
gitlab_rails['redis_host'] = 'redis-master'
gitlab_rails['redis_port'] = '6379'
gitlab_rails['redis_password'] = 'xxxxxxxxxxx'
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.yandex.ru"
gitlab_rails['smtp_port'] = 465
gitlab_rails['smtp_user_name'] = "[email protected]"
gitlab_rails['smtp_password'] = "xxxxxxxxx"
gitlab_rails['smtp_domain'] = "example.com"
gitlab_rails['gitlab_email_from'] = '[email protected]'
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_tls'] = true
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_openssl_verify_mode'] = 'peer'
external_url 'http://gitlab.example.com/'
gitlab_rails['gitlab_shell_ssh_port'] = 22222
volumes:
- gitlab_conf:/etc/gitlab
- gitlab_logs:/var/log/gitlab
- gitlab_data:/var/opt/gitlab
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.role == manager
labels:
- traefik.enable=true
- traefik.http.routers.gitlab.rule=Host(`gitlab.example.com`)
- traefik.http.services.gitlab.loadbalancer.server.port=80
- traefik.docker.network=traefik
gitlab-runner:
image: gitlab/gitlab-runner:latest
networks:
- gitlab
volumes:
- gitlab_runner_conf:/etc/gitlab
- /var/run/docker.sock:/var/run/docker.sock
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.role == manager
volumes:
gitlab_conf:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/conf"
gitlab_logs:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/logs"
gitlab_data:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/data"
gitlab_runner_conf:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/runner"
networks:
pgsql:
external: true
redis:
external: true
traefik:
external: true
gitlab:
external: true# mkdir -p /srv/docker/gitlab/conf
# mkdir -p /srv/docker/gitlab/logs
# mkdir -p /srv/docker/gitlab/data
# mkdir -p /srv/docker/gitlab/runner
# docker stack deploy --compose-file 08gitlab-runner.yml gitlabHalin ƙarshe na gungu da sabis:
# docker service ls
ID NAME MODE REPLICAS IMAGE PORTS
lef9n3m92buq etcd_etcd1 replicated 1/1 quay.io/coreos/etcd:latest
ij6uyyo792x5 etcd_etcd2 replicated 1/1 quay.io/coreos/etcd:latest
fqttqpjgp6pp etcd_etcd3 replicated 1/1 quay.io/coreos/etcd:latest
hq5iyga28w33 gitlab_gitlab replicated 1/1 gitlab/gitlab-ce:latest *:22222->22/tcp
dt7s6vs0q4qc gitlab_gitlab-runner replicated 1/1 gitlab/gitlab-runner:latest
k7uoezno0h9n pgsql_pgkeeper1 replicated 1/1 sorintlab/stolon:master-pg10
cnrwul4r4nse pgsql_pgkeeper2 replicated 1/1 sorintlab/stolon:master-pg10
frflfnpty7tr pgsql_pgkeeper3 replicated 1/1 sorintlab/stolon:master-pg10
x7pqqchi52kq pgsql_pgsentinel replicated 3/3 sorintlab/stolon:master-pg10
mwu2wl8fti4r pgsql_postgresql replicated 3/3 sorintlab/stolon:master-pg10
9hkbe2vksbzb redis_redis-master global 3/3 bitnami/redis:latest *:6379->6379/tcp
l88zn8cla7dc redis_redis-replica replicated 3/3 bitnami/redis:latest *:30003->6379/tcp
1utp309xfmsy redis_redis-sentinel global 3/3 bitnami/redis:latest *:30002->16379/tcp
oteb824ylhyp registry_registry replicated 1/1 registry:2.6
qovrah8nzzu8 traefik_traefik replicated 3/3 traefik:latest *:80->80/tcp, *:443->443/tcpMe kuma za a iya inganta? Tabbatar da saita Traefik don gudanar da kwantena akan https, ƙara ɓoyayyen tls don Postgresql da Redis. Amma gabaɗaya, ana iya riga an ba wa masu haɓakawa azaman PoC. Yanzu bari mu kalli madadin Docker.
podman
Wani sanannen injiniyan da ya dace don kwantena masu gudana wanda aka haɗa su ta kwasfa (pods, rukunin kwantena waɗanda aka tura tare). Ba kamar Docker ba, baya buƙatar kowane sabis don gudanar da kwantena; duk ayyukan ana yin su ta ɗakin karatu na libpod. Hakanan an rubuta a cikin Go, yana buƙatar lokacin aiki mai dacewa da OCI don gudanar da kwantena, kamar runC.
Yin aiki tare da Podman gabaɗaya yana tunawa da hakan don Docker, har zuwa za ku iya yin haka (kamar yadda mutane da yawa waɗanda suka gwada ta suka faɗi, gami da marubucin wannan labarin):
$ alias docker=podmankuma za ku iya ci gaba da aiki. Gabaɗaya, halin da ake ciki tare da Podman yana da ban sha'awa sosai, saboda idan nau'ikan Kubernetes na farko sun yi aiki tare da Docker, to, a kusa da 2015, bayan daidaita yanayin kwantena na duniya (OCI - Buɗe Kwantena Initiative) da rarraba Docker cikin kwantena da runC. madadin Docker don gudana a Kubernetes yana haɓaka: CRI-O. Podman a wannan batun shine madadin Docker, wanda aka gina akan ka'idodin Kubernetes, gami da haɗa kwantena, amma babban manufar aikin shine ƙaddamar da kwantena na Docker ba tare da ƙarin ayyuka ba. Don dalilai masu ma'ana, babu yanayin swarm, tunda masu haɓakawa sun faɗi a sarari cewa idan kuna buƙatar gungu, ɗauki Kubernetes.
saitin
Don shigarwa akan Centos 7, kawai kunna Extras ma'ajiyar, sannan shigar da komai tare da umarnin:
# yum -y install podmanSauran siffofi
Podman na iya samar da raka'a don systemd, don haka magance matsalar fara kwantena bayan sake kunna uwar garken. Bugu da ƙari, an ayyana systemd don yin aiki daidai kamar pid 1 a cikin akwati. Akwai kayan aikin gini daban don ginin kwantena, akwai kuma kayan aikin ɓangare na uku - analogues na docker-compose, wanda kuma ke haifar da fayilolin sanyi da suka dace da Kubernetes, don haka ana sauƙaƙa sauyawa daga Podman zuwa Kubernetes kamar yadda zai yiwu.
Yin aiki tare da Podman
Tun da babu yanayin swarm (ya kamata mu canza zuwa Kubernetes idan ana buƙatar gungu), za mu tattara shi a cikin kwantena daban.
Sanya podman-compose:
# yum -y install python3-pip
# pip3 install podman-composeFayil ɗin daidaitawa da aka samu don podman ya ɗan bambanta, don haka misali dole ne mu matsar da sashin juzu'i daban kai tsaye zuwa sashin tare da ayyuka.
gitlab-podman.yml
version: '3.7'
services:
gitlab:
image: gitlab/gitlab-ce:latest
hostname: gitlab.example.com
restart: unless-stopped
environment:
GITLAB_OMNIBUS_CONFIG: |
gitlab_rails['gitlab_shell_ssh_port'] = 22222
ports:
- "80:80"
- "22222:22"
volumes:
- /srv/podman/gitlab/conf:/etc/gitlab
- /srv/podman/gitlab/data:/var/opt/gitlab
- /srv/podman/gitlab/logs:/var/log/gitlab
networks:
- gitlab
gitlab-runner:
image: gitlab/gitlab-runner:alpine
restart: unless-stopped
depends_on:
- gitlab
volumes:
- /srv/podman/gitlab/runner:/etc/gitlab-runner
- /var/run/docker.sock:/var/run/docker.sock
networks:
- gitlab
networks:
gitlab:# podman-compose -f gitlab-runner.yml -d upSakamako:
# podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
da53da946c01 docker.io/gitlab/gitlab-runner:alpine run --user=gitlab... About a minute ago Up About a minute ago 0.0.0.0:22222->22/tcp, 0.0.0.0:80->80/tcp root_gitlab-runner_1
781c0103c94a docker.io/gitlab/gitlab-ce:latest /assets/wrapper About a minute ago Up About a minute ago 0.0.0.0:22222->22/tcp, 0.0.0.0:80->80/tcp root_gitlab_1Bari mu ga abin da yake haifarwa don systemd da kubernetes, don wannan muna buƙatar gano sunan ko id na kwafsa:
# podman pod ls
POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID
71fc2b2a5c63 root Running 11 minutes ago 3 db40ab8bf84bKubernetes:
# podman generate kube 71fc2b2a5c63
# Generation of Kubernetes YAML is still under development!
#
# Save the output of this file and use kubectl create -f to import
# it into Kubernetes.
#
# Created with podman-1.6.4
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: "2020-07-29T19:22:40Z"
labels:
app: root
name: root
spec:
containers:
- command:
- /assets/wrapper
env:
- name: PATH
value: /opt/gitlab/embedded/bin:/opt/gitlab/bin:/assets:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- name: TERM
value: xterm
- name: HOSTNAME
value: gitlab.example.com
- name: container
value: podman
- name: GITLAB_OMNIBUS_CONFIG
value: |
gitlab_rails['gitlab_shell_ssh_port'] = 22222
- name: LANG
value: C.UTF-8
image: docker.io/gitlab/gitlab-ce:latest
name: rootgitlab1
ports:
- containerPort: 22
hostPort: 22222
protocol: TCP
- containerPort: 80
hostPort: 80
protocol: TCP
resources: {}
securityContext:
allowPrivilegeEscalation: true
capabilities: {}
privileged: false
readOnlyRootFilesystem: false
volumeMounts:
- mountPath: /var/opt/gitlab
name: srv-podman-gitlab-data
- mountPath: /var/log/gitlab
name: srv-podman-gitlab-logs
- mountPath: /etc/gitlab
name: srv-podman-gitlab-conf
workingDir: /
- command:
- run
- --user=gitlab-runner
- --working-directory=/home/gitlab-runner
env:
- name: PATH
value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- name: TERM
value: xterm
- name: HOSTNAME
- name: container
value: podman
image: docker.io/gitlab/gitlab-runner:alpine
name: rootgitlab-runner1
resources: {}
securityContext:
allowPrivilegeEscalation: true
capabilities: {}
privileged: false
readOnlyRootFilesystem: false
volumeMounts:
- mountPath: /etc/gitlab-runner
name: srv-podman-gitlab-runner
- mountPath: /var/run/docker.sock
name: var-run-docker.sock
workingDir: /
volumes:
- hostPath:
path: /srv/podman/gitlab/runner
type: Directory
name: srv-podman-gitlab-runner
- hostPath:
path: /var/run/docker.sock
type: File
name: var-run-docker.sock
- hostPath:
path: /srv/podman/gitlab/data
type: Directory
name: srv-podman-gitlab-data
- hostPath:
path: /srv/podman/gitlab/logs
type: Directory
name: srv-podman-gitlab-logs
- hostPath:
path: /srv/podman/gitlab/conf
type: Directory
name: srv-podman-gitlab-conf
status: {}Tsari:
# podman generate systemd 71fc2b2a5c63
# pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
Documentation=man:podman-generate-systemd(1)
Requires=container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
Before=container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa
ExecStop=/usr/bin/podman stop -t 10 db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa/userdata/conmon.pid
[Install]
WantedBy=multi-user.target
# container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
Documentation=man:podman-generate-systemd(1)
RefuseManualStart=yes
RefuseManualStop=yes
BindsTo=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
After=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864
ExecStop=/usr/bin/podman stop -t 10 da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864/userdata/conmon.pid
[Install]
WantedBy=multi-user.target
# container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service
Documentation=man:podman-generate-systemd(1)
RefuseManualStart=yes
RefuseManualStop=yes
BindsTo=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
After=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start 781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3
ExecStop=/usr/bin/podman stop -t 10 781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3/userdata/conmon.pid
[Install]
WantedBy=multi-user.targetAbin takaici, ban da ƙaddamar da kwantena, naúrar da aka samar don systemd ba ta yin wani abu (misali, tsaftace tsoffin kwantena lokacin da aka sake kunna irin wannan sabis ɗin), don haka dole ne ku rubuta waɗannan abubuwan da kanku.
A ka'ida, Podman ya isa ya gwada menene kwantena, canja wurin tsoffin saiti don tsarawa, sannan matsa zuwa Kubernetes, idan kuna buƙatar gungu, ko samun madadin amfani mai sauƙin amfani zuwa Docker.
rkt
Wannan aikin kimanin watanni shida da suka gabata saboda gaskiyar cewa RedHat ya saya, don haka ba zan yi magana da shi dalla-dalla ba. Gabaɗaya, ya bar ra'ayi mai kyau sosai, amma idan aka kwatanta da Docker kuma musamman Podman, yana kama da haɗuwa. Hakanan akwai rarrabawar CoreOS da aka gina akan rkt (kodayake suna da Docker asali), amma wannan kuma ya ƙare cikin tallafi bayan siyan RedHat.
Filashi
Ƙari , marubucin wanda kawai ya so ya gina da sarrafa kwantena. Yin la'akari da takardun shaida da lambar, marubucin bai bi ka'idodin ba, amma kawai ya yanke shawarar rubuta nasa aiwatarwa, wanda, bisa ga ka'ida, ya yi.
binciken
Halin da Kubernetes yake da shi yana da ban sha'awa sosai: a gefe guda, tare da Docker za ku iya gina gungu (a cikin yanayin swarm), wanda har ma za ku iya gudanar da yanayin samfurin ga abokan ciniki, wannan gaskiya ne ga ƙananan ƙungiyoyi (mutane 3-5) , ko kuma tare da ƙananan nauyin nauyi , ko rashin sha'awar fahimtar ma'auni na kafa Kubernetes, ciki har da manyan kaya.
Podman baya samar da cikakkiyar daidaituwa, amma yana da fa'ida ɗaya mai mahimmanci - dacewa tare da Kubernetes, gami da ƙarin kayan aikin (gina da sauransu). Sabili da haka, zan kusanci zaɓin kayan aiki don aiki kamar haka: don ƙananan ƙungiyoyi, ko tare da ƙarancin kasafin kuɗi - Docker (tare da yanayin swarm mai yuwuwa), don haɓakawa kaina akan wani yanki na sirri - Abokan Podman, da sauran mutane. - Kubernetes.
Ban tabbata cewa halin da ake ciki tare da Docker ba zai canza a nan gaba ba, bayan haka, su majagaba ne, kuma a hankali ana daidaita su mataki-mataki, amma Podman, ga duk gazawarsa (yana aiki kawai akan Linux, babu tari, taro da sauran ayyuka sune mafita na ɓangare na uku) gaba ya fi haske, don haka ina gayyatar kowa da kowa don tattauna waɗannan binciken a cikin sharhi.
PS A ranar 3 ga Agusta mun ƙaddamar da "", inda za ku iya ƙarin koyo game da aikinsa. Za mu bincika duk kayan aikin sa: daga asali na abstractions zuwa sigogi na cibiyar sadarwa, nuances na aiki tare da tsarin aiki daban-daban da harsunan shirye-shirye. Za ku saba da fasaha kuma ku fahimci inda kuma yadda mafi kyawun amfani da Docker. Za mu kuma raba mafi kyawun lokuta.
Farashin pre-oda kafin a saki: RUB 5000. Kuna iya duba shirin Docker Video Course .
source: www.habr.com