TL;DR: He aratohu tirohanga ki te whakatairite anga mo te whakahaere tono i roto i nga ipu. Ka whakaarohia nga kaha o Docker me etahi atu punaha rite.
He korero iti mo te wahi i ahu mai ai
kōrero
Ko te tikanga rongonui tuatahi mo te wehe i tetahi tono ko te chroot. Ko te waea punaha o taua ingoa ka huri ki te raarangi pakiaka - na reira ka uru atu ki te hotaka nana i karanga, ka uru noa ki nga konae kei roto i tenei raarangi. Engari mena ka whakawhiwhia te kaupapa ki nga mana superuser ki roto, tera pea ka "mawhiti" mai i te chroot ka uru atu ki te punaha whakahaere matua. Ano, i tua atu i te whakarereke i te whaiaronga pakiaka, ko etahi atu rauemi (RAM, tukatuka), me te uru ki te whatunga, kaore i te iti.
Ko te huarahi e whai ake nei ko te whakarewa i te punaha whakahaere katoa ki roto i te ipu, ma te whakamahi i nga tikanga o te kernel punaha whakahaere. He rereke te ingoa o tenei tikanga i roto i nga punaha whakahaere rereke, engari he rite tonu te kaupapa - he maha nga punaha whakahaere motuhake, kei te rere ia i runga i te kernel kotahi e whakahaere ana i te punaha whakahaere matua. Kei roto i tenei ko FreeBSD Jails, Solaris Zones, OpenVZ, me LXC mo Linux. Ka whakaratohia te wehe mo te mokowā kōpae anake, engari mo etahi atu rauemi, ina koa, ka taea e ia ipu te aukati i te wa tukatuka, te RAM, te bandwidth whatunga. Ka whakatauritea ki te chroot, he uaua ake te waiho i te ipu, na te mea ko te superuser kei roto i te ipu ka uru noa ki roto o te ipu, heoi, na te hiahia kia mau tonu te punaha whakahaere i roto i te ipu ki te waa me te whakamahi i te kakano tawhito. nga putanga (e tika ana mo te Linux, he iti ake te FreeBSD), he kore-kore te tupono o te "pakaru" i te punaha wehenga kernel me te uru atu ki te punaha whakahaere matua.
Engari ki te whakarewa i tetahi punaha whakahaere katoa i roto i te ipu (me te punaha arataki, kaiwhakahaere kete, me etahi atu), ka taea e koe te whakarewa i nga tono tonu, ko te mea nui ko te whakarato i nga tono ki te whai waahi (te aroaro o nga whare pukapuka e tika ana. me etahi atu kōnae). Ko tenei whakaaro i noho hei turanga mo te marikotanga tono ipuipui, ko te tino rongonui me te tino rongonui ko Docker. Ka whakatauritea ki nga punaha o mua, he ngawari ake nga tikanga wehe, me te tautoko i roto i nga whatunga mariko i waenga i nga ipu me te whai i te ahua o te tono i roto i te ipu, i puta mai te kaha ki te hanga i tetahi taiao whakakotahi mai i te maha o nga kaitoro tinana mo nga ipu rere - me te kore e hiahia ki te whakahaere rauemi a-ringa.
Docker
Ko Docker te raupaparorohiko whakauru tono tino rongonui. I tuhia ki te reo Haere, ka whakamahia e ia nga ahuatanga paerewa o te kernel Linux - cgroups, ingoa mokowhiti, kaha, aha atu, me nga punaha konae Aufs me etahi atu penei hei penapena mokowā kōpae.
Puna: wikimedia
hoahoanga
I mua i te putanga 1.11, i mahi a Docker hei ratonga kotahi e whakahaere ana i nga mahi katoa me nga ipu: te tango whakaahua mo nga ipu, te whakarewa i nga ipu, te tukatuka i nga tono API. I timata mai i te putanga 1.11, ka wehea a Docker ki etahi waahanga e pahekoheko ana tetahi ki tetahi: containerd, mo te tukatuka i te huringa ora katoa o nga ipu (te tohatoha mokowā kōpae, te tango whakaahua, te mahi me te whatunga, te whakarewa, te whakauru me te tirotiro i te ahua o nga ipu) me te runC, te taiao whakahaere ipu, i runga i te whakamahinga o cgroups me etahi atu ahuatanga o te kernel Linux. Kei te noho tonu te ratonga docker, engari inaianei ka mahi noa ki te tukatuka i nga tono API kua whakamaoritia ki te ipu.
Whakauru me te whirihoranga
Ko taku huarahi tino pai ki te whakauru i te docker he docker-miihini, hei taapiri atu ki te whakauru tika me te whirihora i te docker ki runga i nga kaitoro mamao (tae atu ki nga kapua rereke), ka taea te mahi me nga punaha konae o nga kaitoro mamao ka taea hoki te whakahaere i nga momo whakahau.
Heoi, mai i te tau 2018, kaore i tino whakawhanakehia te kaupapa, no reira ka whakauruhia e matou ki te huarahi paerewa mo te nuinga o nga tohatoha Linux - te taapiri i tetahi putunga me te whakauru i nga kohinga e tika ana.
Ka whakamahia ano tenei tikanga mo te whakaurunga aunoa, hei tauira ma te whakamahi i te Ansible me etahi atu punaha rite, engari kaore au e whakaaro ki tenei tuhinga.
Ka mahia te whakaurunga i runga i te Centos 7, ka whakamahia e ahau he miihini mariko hei tūmau, ki te whakauru i nga whakahau i raro nei:
# yum install -y yum-utils
# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
# yum install docker-ce docker-ce-cli containerd.ioI muri i te whakaurunga, me timata koe i te ratonga ka tuu ki te whakaoho:
# systemctl enable docker
# systemctl start docker
# firewall-cmd --zone=public --add-port=2377/tcp --permanentI tua atu, ka taea e koe te hanga i tetahi roopu docker, ka taea e nga kaiwhakamahi te mahi tahi me te docker me te kore sudo, te whakarite i te takiuru, ka taea te uru ki te API mai i waho, a kaua e wareware ki te whirihora i te papangaahi kia tino tika (nga mea katoa kaore e whakaaetia. kua rahuitia i roto i nga tauira i runga ake nei me raro iho - I whakarerea e ahau tenei mo te ngawari me te marama), engari kaore au e korero atu ki konei.
Ētahi atu āhuatanga
I tua atu i te miihini docker kua whakahuahia ake nei, kei reira ano te rehita docker, he taputapu mo te penapena whakaahua mo nga ipu, me te tito docker, he taputapu mo te whakaaunoa i te tuku tono ki roto i nga ipu, ka whakamahia nga konae YAML ki te hanga me te whirihora i nga ipu. me etahi atu mea e pa ana (hei tauira, nga whatunga, nga punaha konae mo te rokiroki raraunga).
Ka taea hoki te whakamahi hei whakarite i nga kaikawe mo te CICD. Ko tetahi atu mea whakamere kei te mahi i roto i te aratau tautau, te aratau e kiia nei he pokai (i mua i te putanga 1.12 i mohiotia ko docker swarm), e taea ai e koe te whakahiato i tetahi hanganga mai i te maha o nga kaitoro mo te whakahaere ipu. He tautoko mo te whatunga mariko kei runga ake o nga kaitoro katoa, he taurite kawenga kua hangaia, me te tautoko mo nga mea ngaro mo nga ipu.
Ko nga konae YAML mai i te docker tito, me nga whakarereketanga iti, ka taea te whakamahi mo aua tautau, me te whakaaunoa i te tiaki i nga tautau iti me te reo-rahi mo nga kaupapa rereke. Mo nga tautau nunui, he pai ake nga Kubernetes na te mea ko nga utu tiaki o te aratau pokai ka nui ake i era o Kubernetes. I tua atu i te runC, ka taea e koe te whakauru, hei tauira, hei taiao mahi ipu
Mahi tahi me Docker
Whai muri i te whakaurunga me te whirihoranga, ka ngana matou ki te hanga i tetahi kahui ka tukuna e matou a GitLab me Docker Rehita mo te roopu whanaketanga. Hei tūmau, ka whakamahia e ahau nga miihini mariko e toru, ka tukuna ano e ahau te FS kua tohatohahia a GlusterFS, ka whakamahia e ahau hei rokiroki pukapuka docker, hei tauira, ki te whakahaere i tetahi putanga kore-haumaru o te rehita docker. Nga waahanga matua hei whakahaere: Docker Registry, Postgresql, Redis, GitLab me te tautoko mo GitLab Runner i runga ake o Swarm. Ka whakarewahia e matou te Postgresql me te kohinga , no reira kaore koe e hiahia ki te whakamahi GlusterFS ki te penapena i nga raraunga Postgresql. Ko te toenga o nga raraunga whakahirahira ka penapena ki GlusterFS.
Hei tuku i a GlusterFS ki runga i nga tūmau katoa (e kiia ana ko te node1, te node2, te node3), me whakauru koe i nga kohinga, ka taea te paahi ahi, me te hanga i nga raarangi e tika ana:
# yum -y install centos-release-gluster7
# yum -y install glusterfs-server
# systemctl enable glusterd
# systemctl start glusterd
# firewall-cmd --add-service=glusterfs --permanent
# firewall-cmd --reload
# mkdir -p /srv/gluster
# mkdir -p /srv/docker
# echo "$(hostname):/docker /srv/docker glusterfs defaults,_netdev 0 0" >> /etc/fstabWhai muri i te whakaurunga, me mahi tonu te whirihora i a GlusterFS mai i tetahi node, hei tauira node1:
# gluster peer probe node2
# gluster peer probe node3
# gluster volume create docker replica 3 node1:/srv/gluster node2:/srv/gluster node3:/srv/gluster force
# gluster volume start dockerNa ka hiahia koe ki te whakairi i te rōrahi hua (me mahi te whakahau ki runga i nga tūmau katoa):
# mount /srv/dockerKua whirihorahia te aratau pokai ki runga i tetahi o nga tuumau, ka noho hei Kaihautu, ko te toenga me uru ki te roopu, na ko te hua o te whakahaere i te whakahau i runga i te tūmau tuatahi me kape me te mahi ki te toenga.
Ko te huinga huinga tuatahi, ka whakahaerehia e ahau te whakahau ki te node1:
# docker swarm init
Swarm initialized: current node (a5jpfrh5uvo7svzz1ajduokyq) is now a manager.
To add a worker to this swarm, run the following command:
docker swarm join --token SWMTKN-1-0c5mf7mvzc7o7vjk0wngno2dy70xs95tovfxbv4tqt9280toku-863hyosdlzvd76trfptd4xnzd xx.xx.xx.xx:2377
To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
# docker swarm join-token managerKa kapehia te hua o te whakahau tuarua ka mahia ki te node2 me te node3:
# docker swarm join --token SWMTKN-x-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxx xx.xx.xx.xx:2377
This node joined a swarm as a manager.I tenei wa, kua oti te whirihoranga tuatahi o nga kaitoro, me haere tonu ki te whakarite i nga ratonga; ko nga whakahau kia mahia ka whakarewahia mai i te node1, mena kaore i tohua.
Tuatahi, me hanga whatunga mo nga ipu:
# docker network create --driver=overlay etcd
# docker network create --driver=overlay pgsql
# docker network create --driver=overlay redis
# docker network create --driver=overlay traefik
# docker network create --driver=overlay gitlabNa ka tohuhia e matou nga kaitoro, me herea etahi ratonga ki nga kaitoro:
# docker node update --label-add nodename=node1 node1
# docker node update --label-add nodename=node2 node2
# docker node update --label-add nodename=node3 node3I muri mai, ka hangaia e matou he raarangi mo te penapena raraunga etcd, te rokiroki KV e hiahiatia ana e Traefik me Stolon. He rite ki te Postgresql, he ipu e herea ana ki nga kaimau, no reira ka whakahaerehia e matou tenei whakahau ki runga i nga kaimau katoa:
# mkdir -p /srv/etcdMuri iho, hanga he konae hei whirihora etcd me te whakamahi:
00etcd.yml
version: '3.7'
services:
etcd1:
image: quay.io/coreos/etcd:latest
hostname: etcd1
command:
- etcd
- --name=etcd1
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd1:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd1:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd1vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node1]
etcd2:
image: quay.io/coreos/etcd:latest
hostname: etcd2
command:
- etcd
- --name=etcd2
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd2:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd2:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd2vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node2]
etcd3:
image: quay.io/coreos/etcd:latest
hostname: etcd3
command:
- etcd
- --name=etcd3
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd3:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd3:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd3vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node3]
volumes:
etcd1vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
etcd2vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
etcd3vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
networks:
etcd:
external: true# docker stack deploy --compose-file 00etcd.yml etcdI muri i etahi wa, ka tirohia e matou kua eke te roopu etcd:
# docker exec $(docker ps | awk '/etcd/ {print $1}') etcdctl member list
ade526d28b1f92f7: name=etcd1 peerURLs=http://etcd1:2380 clientURLs=http://etcd1:2379 isLeader=false
bd388e7810915853: name=etcd3 peerURLs=http://etcd3:2380 clientURLs=http://etcd3:2379 isLeader=false
d282ac2ce600c1ce: name=etcd2 peerURLs=http://etcd2:2380 clientURLs=http://etcd2:2379 isLeader=true
# docker exec $(docker ps | awk '/etcd/ {print $1}') etcdctl cluster-health
member ade526d28b1f92f7 is healthy: got healthy result from http://etcd1:2379
member bd388e7810915853 is healthy: got healthy result from http://etcd3:2379
member d282ac2ce600c1ce is healthy: got healthy result from http://etcd2:2379
cluster is healthyKa waihangahia e matou he raarangi mo Postgresql, mahia te whakahau ki nga kaitoro katoa:
# mkdir -p /srv/pgsqlWhai muri, hanga he konae hei whirihora i te Postgresql:
01pgsql.yml
version: '3.7'
services:
pgsentinel:
image: sorintlab/stolon:master-pg10
command:
- gosu
- stolon
- stolon-sentinel
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
- --log-level=debug
networks:
- etcd
- pgsql
deploy:
replicas: 3
update_config:
parallelism: 1
delay: 30s
order: stop-first
failure_action: pause
pgkeeper1:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper1
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper1
- --pg-repl-username=replica
- --uid=pgkeeper1
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper1:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node1]
pgkeeper2:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper2
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper2
- --pg-repl-username=replica
- --uid=pgkeeper2
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper2:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node2]
pgkeeper3:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper3
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper3
- --pg-repl-username=replica
- --uid=pgkeeper3
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper3:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node3]
postgresql:
image: sorintlab/stolon:master-pg10
command: gosu stolon stolon-proxy --listen-address 0.0.0.0 --cluster-name stolon-cluster --store-backend=etcdv3 --store-endpoints http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
deploy:
replicas: 3
update_config:
parallelism: 1
delay: 30s
order: stop-first
failure_action: rollback
volumes:
pgkeeper1:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
pgkeeper2:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
pgkeeper3:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
secrets:
pgsql:
file: "/srv/docker/postgres"
pgsql_repl:
file: "/srv/docker/replica"
networks:
etcd:
external: true
pgsql:
external: trueKa whakaputahia e matou nga mea ngaro ka whakamahi i te konae:
# </dev/urandom tr -dc 234567890qwertyuopasdfghjkzxcvbnmQWERTYUPASDFGHKLZXCVBNM | head -c $(((RANDOM%3)+15)) > /srv/docker/replica
# </dev/urandom tr -dc 234567890qwertyuopasdfghjkzxcvbnmQWERTYUPASDFGHKLZXCVBNM | head -c $(((RANDOM%3)+15)) > /srv/docker/postgres
# docker stack deploy --compose-file 01pgsql.yml pgsqlWhai muri i etahi wa (tirohia te putanga o te whakahau ratonga docker lskua eke nga ratonga katoa) ka tiimata e matou te roopu Postgresql:
# docker exec $(docker ps | awk '/pgkeeper/ {print $1}') stolonctl --cluster-name=stolon-cluster --store-backend=etcdv3 --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379 initTe tirotiro i te reri o te kohinga Postgresql:
# docker exec $(docker ps | awk '/pgkeeper/ {print $1}') stolonctl --cluster-name=stolon-cluster --store-backend=etcdv3 --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379 status
=== Active sentinels ===
ID LEADER
26baa11d false
74e98768 false
a8cb002b true
=== Active proxies ===
ID
4d233826
9f562f3b
b0c79ff1
=== Keepers ===
UID HEALTHY PG LISTENADDRESS PG HEALTHY PG WANTEDGENERATION PG CURRENTGENERATION
pgkeeper1 true pgkeeper1:5432 true 2 2
pgkeeper2 true pgkeeper2:5432 true 2 2
pgkeeper3 true pgkeeper3:5432 true 3 3
=== Cluster Info ===
Master Keeper: pgkeeper3
===== Keepers/DB tree =====
pgkeeper3 (master)
├─pgkeeper2
└─pgkeeper1
Ka whirihorahia e matou te traefik hei whakatuwhera i te uru ki nga ipu mai i waho:
03traefik.yml
version: '3.7'
services:
traefik:
image: traefik:latest
command: >
--log.level=INFO
--providers.docker=true
--entryPoints.web.address=:80
--providers.providersThrottleDuration=2
--providers.docker.watch=true
--providers.docker.swarmMode=true
--providers.docker.swarmModeRefreshSeconds=15s
--providers.docker.exposedbydefault=false
--accessLog.bufferingSize=0
--api=true
--api.dashboard=true
--api.insecure=true
networks:
- traefik
ports:
- 80:80
volumes:
- /var/run/docker.sock:/var/run/docker.sock
deploy:
replicas: 3
placement:
constraints:
- node.role == manager
preferences:
- spread: node.id
labels:
- traefik.enable=true
- traefik.http.routers.traefik.rule=Host(`traefik.example.com`)
- traefik.http.services.traefik.loadbalancer.server.port=8080
- traefik.docker.network=traefik
networks:
traefik:
external: true# docker stack deploy --compose-file 03traefik.yml traefikKa whakarewahia e matou a Redis Cluster, hei mahi i tenei ka hangahia e matou he raarangi rokiroki ki nga waahanga katoa:
# mkdir -p /srv/redis05redis.yml
version: '3.7'
services:
redis-master:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '6379:6379'
environment:
- REDIS_REPLICATION_MODE=master
- REDIS_PASSWORD=xxxxxxxxxxx
deploy:
mode: global
restart_policy:
condition: any
volumes:
- 'redis:/opt/bitnami/redis/etc/'
redis-replica:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '6379'
depends_on:
- redis-master
environment:
- REDIS_REPLICATION_MODE=slave
- REDIS_MASTER_HOST=redis-master
- REDIS_MASTER_PORT_NUMBER=6379
- REDIS_MASTER_PASSWORD=xxxxxxxxxxx
- REDIS_PASSWORD=xxxxxxxxxxx
deploy:
mode: replicated
replicas: 3
update_config:
parallelism: 1
delay: 10s
restart_policy:
condition: any
redis-sentinel:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '16379'
depends_on:
- redis-master
- redis-replica
entrypoint: |
bash -c 'bash -s <<EOF
"/bin/bash" -c "cat <<EOF > /opt/bitnami/redis/etc/sentinel.conf
port 16379
dir /tmp
sentinel monitor master-node redis-master 6379 2
sentinel down-after-milliseconds master-node 5000
sentinel parallel-syncs master-node 1
sentinel failover-timeout master-node 5000
sentinel auth-pass master-node xxxxxxxxxxx
sentinel announce-ip redis-sentinel
sentinel announce-port 16379
EOF"
"/bin/bash" -c "redis-sentinel /opt/bitnami/redis/etc/sentinel.conf"
EOF'
deploy:
mode: global
restart_policy:
condition: any
volumes:
redis:
driver: local
driver_opts:
type: 'none'
o: 'bind'
device: "/srv/redis"
networks:
redis:
external: true# docker stack deploy --compose-file 05redis.yml redisTāpirihia te Rēhita Docker:
06rehita.yml
version: '3.7'
services:
registry:
image: registry:2.6
networks:
- traefik
volumes:
- registry_data:/var/lib/registry
deploy:
replicas: 1
placement:
constraints: [node.role == manager]
restart_policy:
condition: on-failure
labels:
- traefik.enable=true
- traefik.http.routers.registry.rule=Host(`registry.example.com`)
- traefik.http.services.registry.loadbalancer.server.port=5000
- traefik.docker.network=traefik
volumes:
registry_data:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/registry"
networks:
traefik:
external: true# mkdir /srv/docker/registry
# docker stack deploy --compose-file 06registry.yml registryKa mutu - GitLab:
08gitlab-runner.yml
version: '3.7'
services:
gitlab:
image: gitlab/gitlab-ce:latest
networks:
- pgsql
- redis
- traefik
- gitlab
ports:
- 22222:22
environment:
GITLAB_OMNIBUS_CONFIG: |
postgresql['enable'] = false
redis['enable'] = false
gitlab_rails['registry_enabled'] = false
gitlab_rails['db_username'] = "gitlab"
gitlab_rails['db_password'] = "XXXXXXXXXXX"
gitlab_rails['db_host'] = "postgresql"
gitlab_rails['db_port'] = "5432"
gitlab_rails['db_database'] = "gitlab"
gitlab_rails['db_adapter'] = 'postgresql'
gitlab_rails['db_encoding'] = 'utf8'
gitlab_rails['redis_host'] = 'redis-master'
gitlab_rails['redis_port'] = '6379'
gitlab_rails['redis_password'] = 'xxxxxxxxxxx'
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.yandex.ru"
gitlab_rails['smtp_port'] = 465
gitlab_rails['smtp_user_name'] = "[email protected]"
gitlab_rails['smtp_password'] = "xxxxxxxxx"
gitlab_rails['smtp_domain'] = "example.com"
gitlab_rails['gitlab_email_from'] = '[email protected]'
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_tls'] = true
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_openssl_verify_mode'] = 'peer'
external_url 'http://gitlab.example.com/'
gitlab_rails['gitlab_shell_ssh_port'] = 22222
volumes:
- gitlab_conf:/etc/gitlab
- gitlab_logs:/var/log/gitlab
- gitlab_data:/var/opt/gitlab
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.role == manager
labels:
- traefik.enable=true
- traefik.http.routers.gitlab.rule=Host(`gitlab.example.com`)
- traefik.http.services.gitlab.loadbalancer.server.port=80
- traefik.docker.network=traefik
gitlab-runner:
image: gitlab/gitlab-runner:latest
networks:
- gitlab
volumes:
- gitlab_runner_conf:/etc/gitlab
- /var/run/docker.sock:/var/run/docker.sock
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.role == manager
volumes:
gitlab_conf:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/conf"
gitlab_logs:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/logs"
gitlab_data:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/data"
gitlab_runner_conf:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/runner"
networks:
pgsql:
external: true
redis:
external: true
traefik:
external: true
gitlab:
external: true# mkdir -p /srv/docker/gitlab/conf
# mkdir -p /srv/docker/gitlab/logs
# mkdir -p /srv/docker/gitlab/data
# mkdir -p /srv/docker/gitlab/runner
# docker stack deploy --compose-file 08gitlab-runner.yml gitlabTe ahua whakamutunga o te roopu me nga ratonga:
# docker service ls
ID NAME MODE REPLICAS IMAGE PORTS
lef9n3m92buq etcd_etcd1 replicated 1/1 quay.io/coreos/etcd:latest
ij6uyyo792x5 etcd_etcd2 replicated 1/1 quay.io/coreos/etcd:latest
fqttqpjgp6pp etcd_etcd3 replicated 1/1 quay.io/coreos/etcd:latest
hq5iyga28w33 gitlab_gitlab replicated 1/1 gitlab/gitlab-ce:latest *:22222->22/tcp
dt7s6vs0q4qc gitlab_gitlab-runner replicated 1/1 gitlab/gitlab-runner:latest
k7uoezno0h9n pgsql_pgkeeper1 replicated 1/1 sorintlab/stolon:master-pg10
cnrwul4r4nse pgsql_pgkeeper2 replicated 1/1 sorintlab/stolon:master-pg10
frflfnpty7tr pgsql_pgkeeper3 replicated 1/1 sorintlab/stolon:master-pg10
x7pqqchi52kq pgsql_pgsentinel replicated 3/3 sorintlab/stolon:master-pg10
mwu2wl8fti4r pgsql_postgresql replicated 3/3 sorintlab/stolon:master-pg10
9hkbe2vksbzb redis_redis-master global 3/3 bitnami/redis:latest *:6379->6379/tcp
l88zn8cla7dc redis_redis-replica replicated 3/3 bitnami/redis:latest *:30003->6379/tcp
1utp309xfmsy redis_redis-sentinel global 3/3 bitnami/redis:latest *:30002->16379/tcp
oteb824ylhyp registry_registry replicated 1/1 registry:2.6
qovrah8nzzu8 traefik_traefik replicated 3/3 traefik:latest *:80->80/tcp, *:443->443/tcpHe aha atu ka taea te whakapai ake? Kia mahara ki te whirihora i a Traefik ki te mahi me nga ipu https, taapirihia te whakamunatanga tls mo Postgresql me Redis. Engari i te nuinga o te waa, ka taea te hoatu ki nga kaihanga hei PoC. Me titiro inaianei ki etahi atu huarahi ki a Docker.
Pukeraki
Ko tetahi atu miihini rongonui mo te whakahaere i nga ipu kua whakarōpūhia e nga pene (poka, he roopu ipu kua tohatohahia). Kaore i rite ki a Docker, kaore e hiahiatia he ratonga hei whakahaere ipu; ka mahia nga mahi katoa ma te whare pukapuka libpod. I tuhia ano ki te Haere, me whai wa-whakahaere hototahi-OCI hei whakahaere ipu, penei i te runC.
Ko te mahi tahi me Podman e maumahara ana ki tera mo Docker, tae noa ki tenei ka taea e koe te mahi penei (e kii ana te tini kua whakamatauria, tae atu ki te kaituhi o tenei tuhinga):
$ alias docker=podmana ka taea e koe te mahi tonu. I te nuinga o te waa, he tino pai te ahuatanga o Podman, na te mea i mahi tahi nga putanga tuatahi o Kubernetes ki a Docker, katahi ka huri noa i te 2015, i muri i te whakaritenga o te ao o nga ipu (OCI - Open Container Initiative) me te wehewehenga o Docker ki containerd me runC, he rereke ki a Docker mo te whakahaere i Kubernetes kua whanake: CRI-O. Ko Podman mo tenei kaupapa he rereke ki a Docker, i hangaia i runga i nga maataapono o Kubernetes, tae atu ki te whakarōpū ipu, engari ko te kaupapa matua o te kaupapa ko te whakarewa i nga ipu momo Docker kaore he ratonga taapiri. Mo nga take maamaa, kaore he aratau pokai, na te mea e kii ana nga kaiwhakawhanake mena ka hiahia koe ki te tautau, tangohia a Kubernetes.
tāutanga
Hei whakauru i runga i te Centos 7, whakahohe noa i te rehitatanga Extras, katahi ka whakauruhia nga mea katoa me te whakahau:
# yum -y install podmanĒtahi atu āhuatanga
Ka taea e Podman te whakaputa i nga waeine mo te systemd, na reira ka whakatau i te raru o te tiimata o nga ipu i muri i te whakaara ano o te tūmau. I tua atu, ka kii te systemd ki te mahi tika hei pid 1 i roto i te ipu. Ki te hanga ipu, he taputapu hanga motuhake, kei reira ano nga taputapu-tuatoru - he rite ki te docker-compose, e whakaputa ana hoki i nga konae whirihoranga-hototahi a Kubernetes, no reira he ngawari te whakawhiti mai i Podman ki Kubernetes.
Mahi tahi me Podman
I te mea karekau he aratau pokai (e tika ana kia huri ki te Kubernetes mena ka hiahiatia he tautau), ka whakahiatohia ki roto i nga ipu motuhake.
Tāuta podman-tito:
# yum -y install python3-pip
# pip3 install podman-composeHe rereke te ahua o te konae whirihoranga mo te podman, no reira, hei tauira, me neke tika te waahanga pukapuka motuhake ki te waahanga me nga ratonga.
gitlab-podman.yml
version: '3.7'
services:
gitlab:
image: gitlab/gitlab-ce:latest
hostname: gitlab.example.com
restart: unless-stopped
environment:
GITLAB_OMNIBUS_CONFIG: |
gitlab_rails['gitlab_shell_ssh_port'] = 22222
ports:
- "80:80"
- "22222:22"
volumes:
- /srv/podman/gitlab/conf:/etc/gitlab
- /srv/podman/gitlab/data:/var/opt/gitlab
- /srv/podman/gitlab/logs:/var/log/gitlab
networks:
- gitlab
gitlab-runner:
image: gitlab/gitlab-runner:alpine
restart: unless-stopped
depends_on:
- gitlab
volumes:
- /srv/podman/gitlab/runner:/etc/gitlab-runner
- /var/run/docker.sock:/var/run/docker.sock
networks:
- gitlab
networks:
gitlab:# podman-compose -f gitlab-runner.yml -d upHua o te mahi:
# podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
da53da946c01 docker.io/gitlab/gitlab-runner:alpine run --user=gitlab... About a minute ago Up About a minute ago 0.0.0.0:22222->22/tcp, 0.0.0.0:80->80/tcp root_gitlab-runner_1
781c0103c94a docker.io/gitlab/gitlab-ce:latest /assets/wrapper About a minute ago Up About a minute ago 0.0.0.0:22222->22/tcp, 0.0.0.0:80->80/tcp root_gitlab_1Kia kite tatou he aha tana whakaputa mo systemd me nga kubernetes, mo tenei me rapu tatou i te ingoa, id ranei o te pod:
# podman pod ls
POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID
71fc2b2a5c63 root Running 11 minutes ago 3 db40ab8bf84bKubernetes:
# podman generate kube 71fc2b2a5c63
# Generation of Kubernetes YAML is still under development!
#
# Save the output of this file and use kubectl create -f to import
# it into Kubernetes.
#
# Created with podman-1.6.4
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: "2020-07-29T19:22:40Z"
labels:
app: root
name: root
spec:
containers:
- command:
- /assets/wrapper
env:
- name: PATH
value: /opt/gitlab/embedded/bin:/opt/gitlab/bin:/assets:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- name: TERM
value: xterm
- name: HOSTNAME
value: gitlab.example.com
- name: container
value: podman
- name: GITLAB_OMNIBUS_CONFIG
value: |
gitlab_rails['gitlab_shell_ssh_port'] = 22222
- name: LANG
value: C.UTF-8
image: docker.io/gitlab/gitlab-ce:latest
name: rootgitlab1
ports:
- containerPort: 22
hostPort: 22222
protocol: TCP
- containerPort: 80
hostPort: 80
protocol: TCP
resources: {}
securityContext:
allowPrivilegeEscalation: true
capabilities: {}
privileged: false
readOnlyRootFilesystem: false
volumeMounts:
- mountPath: /var/opt/gitlab
name: srv-podman-gitlab-data
- mountPath: /var/log/gitlab
name: srv-podman-gitlab-logs
- mountPath: /etc/gitlab
name: srv-podman-gitlab-conf
workingDir: /
- command:
- run
- --user=gitlab-runner
- --working-directory=/home/gitlab-runner
env:
- name: PATH
value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- name: TERM
value: xterm
- name: HOSTNAME
- name: container
value: podman
image: docker.io/gitlab/gitlab-runner:alpine
name: rootgitlab-runner1
resources: {}
securityContext:
allowPrivilegeEscalation: true
capabilities: {}
privileged: false
readOnlyRootFilesystem: false
volumeMounts:
- mountPath: /etc/gitlab-runner
name: srv-podman-gitlab-runner
- mountPath: /var/run/docker.sock
name: var-run-docker.sock
workingDir: /
volumes:
- hostPath:
path: /srv/podman/gitlab/runner
type: Directory
name: srv-podman-gitlab-runner
- hostPath:
path: /var/run/docker.sock
type: File
name: var-run-docker.sock
- hostPath:
path: /srv/podman/gitlab/data
type: Directory
name: srv-podman-gitlab-data
- hostPath:
path: /srv/podman/gitlab/logs
type: Directory
name: srv-podman-gitlab-logs
- hostPath:
path: /srv/podman/gitlab/conf
type: Directory
name: srv-podman-gitlab-conf
status: {}Pūnaha:
# podman generate systemd 71fc2b2a5c63
# pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
Documentation=man:podman-generate-systemd(1)
Requires=container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
Before=container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa
ExecStop=/usr/bin/podman stop -t 10 db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa/userdata/conmon.pid
[Install]
WantedBy=multi-user.target
# container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
Documentation=man:podman-generate-systemd(1)
RefuseManualStart=yes
RefuseManualStop=yes
BindsTo=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
After=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864
ExecStop=/usr/bin/podman stop -t 10 da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864/userdata/conmon.pid
[Install]
WantedBy=multi-user.target
# container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service
Documentation=man:podman-generate-systemd(1)
RefuseManualStart=yes
RefuseManualStop=yes
BindsTo=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
After=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start 781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3
ExecStop=/usr/bin/podman stop -t 10 781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3/userdata/conmon.pid
[Install]
WantedBy=multi-user.targetHeoi ano, i tua atu i te whakarewa ipu, karekau he mahi e te waeine i hangaia mo te systemd (hei tauira, te horoi i nga ipu tawhito ina timata ano te mahi pera), na me tuhi koe i aua mea.
Ko te tikanga, he nui a Podman ki te whakamatau he aha nga ipu, whakawhiti i nga whirihoranga tawhito mo te docker-compose, katahi ka haere ki Kubernetes, mena e tika ana, i runga i te tautau, ki te tiki i tetahi huarahi ngawari ki te whakamahi ki a Docker.
Tuhinga o mua
Ko te kaupapa tata ki te ono marama ki muri na te mea i hokona mai e RedHat, na reira kaore au e noho ki runga i nga korero. I roto i te katoa, i waiho he ahua tino pai, engari ki te whakataurite ki a Docker me te Podman, he rite te ahua o te whakakotahi. He tohatoha ano hoki a CoreOS i hangaia i runga ake o te rkt (ahakoa kei a ratou a Docker i te tuatahi), engari i mutu ano tenei ki te tautoko i muri i te hoko a RedHat.
Whakanuia
Ētahi atu , ko te kaituhi i hiahia noa ki te hanga me te whakahaere ipu. Ma te whakatau i nga tuhinga me te waehere, kaore te kaituhi i whai i nga paerewa, engari i whakatau noa ki te tuhi i tana ake whakatinanatanga, ko te tikanga, i mahia e ia.
kitenga
He tino rawe te ahuatanga ki a Kubernetes: i tetahi taha, me Docker ka taea e koe te hanga he tautau (i roto i te aratau pokai), ka taea e koe te whakahaere i nga taiao hua mo nga kaihoko, he tino pono tenei mo nga roopu iti (3-5 tangata) , me te iti noa o te kawenga, te kore hiahia ranei ki te mohio ki nga uaua o te whakatu i nga Kubernetes, tae atu ki nga kawenga teitei.
Kaore a Podman e whakarato i te hototahitanga katoa, engari he painga nui - ko te hototahi ki nga Kubernetes, tae atu ki etahi atu taputapu (buildah me etahi atu). Na reira, ka whakatata atu ahau ki te kowhiringa o tetahi taputapu mo te mahi penei: mo nga roopu iti, he iti noa ranei te tahua - Docker (me te aratau pokai ka taea), mo te whakawhanake mo au ake i runga i te kaihautu whaiaro - Podman hoa, me era atu. - Kubernetes.
Kaore au i te tino mohio ko te ahuatanga o Docker e kore e rereke a muri ake nei, he paionia ratou, kei te whakatauhia ano hoki i ia taahiraa, engari ko Podman, mo ona ngoikoretanga katoa (mahi noa i runga i te Linux, kaore he kohinga, Ko te huihuinga me etahi atu mahi he otinga tuatoru) ka marama ake te heke mai, no reira ka tono ahau ki nga tangata katoa ki te matapaki i enei kitenga i roto i nga korero.
PS Hei te 3 o Akuhata ka whakarewahia "", ka taea e koe te ako ake mo ana mahi. Ka tātarihia e maatau ana taputapu katoa: mai i nga tangohanga taketake ki nga tawhā whatunga, nga ahuatanga o te mahi me nga momo punaha whakahaere me nga reo hotaka. Ka waia koe ki te hangarau me te mohio ki hea me pehea te pai ki te whakamahi i a Docker. Ka tohatohahia e matou nga keehi mahi tino pai.
Utu o mua i mua i te tukunga: RUB 5000. Ka taea e koe te tiro i te kaupapa Docker Video Course .
Source: will.com