TL;DR: Umhlahlandlela wokuqhathanisa izinhlaka zokusebenzisa izinhlelo zokusebenza ezitsheni. Amakhono e-Docker nezinye izinhlelo ezifanayo azocatshangelwa.
Umlando omncane wokuthi konke kwavelaphi
ΠΡΡΠΎΡΠΈΡ
Indlela yokuqala eyaziwa kakhulu yokuhlukanisa uhlelo lokusebenza i-chroot. Ucingo lwesistimu lwegama elifanayo luqinisekisa ukuthi uhla lwemibhalo lwempande luyashintshwa - ngaleyo ndlela luqinisekise ukuthi uhlelo olulubize lukwazi ukufinyelela kuphela amafayela ngaphakathi kwalolo lwazi. Kodwa uma uhlelo lunikezwa amalungelo ezimpande ngaphakathi, lungakwazi "ukuphunyuka" ku-chroot futhi luthole ukufinyelela kusistimu yokusebenza eyinhloko. Futhi, ngaphezu kokushintsha isiqondisi sezimpande, ezinye izinsiza (i-RAM, iprosesa), kanye nokufinyelela kwenethiwekhi, azikhawulelwe.
Indlela elandelayo ukwethulwa kwesistimu yokusebenza egcwele ngaphakathi kwesitsha, kusetshenziswa izindlela ze-kernel yesistimu yokusebenza. Le ndlela ibizwa ngokuhlukile kumasistimu wokusebenza ahlukene, kodwa ingqikithi iyafana - ukwethula izinhlelo zokusebenza eziningana ezizimele, ngayinye egijima i-kernel efanayo lapho isistimu yokusebenza eyinhloko isebenza khona. Lokhu kufaka phakathi amaJele e-FreeBSD, i-Solaris Zones, i-OpenVZ ne-LXC ye-Linux. Ukuhlukaniswa akuqinisekiswanga kuphela ngesikhala sediski, kodwa nangezinye izinsiza; ikakhulukazi, isiqukathi ngasinye singaba nemikhawulo ngesikhathi sokucubungula, i-RAM, kanye nomkhawulokudonsa wenethiwekhi. Uma kuqhathaniswa ne-chroot, ukushiya isitsha kunzima kakhulu, ngoba i-superuser esitsheni inokufinyelela kuphela okuqukethwe kwesitsha, noma kunjalo, ngenxa yesidingo sokugcina uhlelo lokusebenza ngaphakathi kwesiqukathi lusesikhathini kanye nokusetshenziswa kwezinguqulo ezindala. wezinhlamvu (ezifanele i-Linux, ngezinga elincane i-FreeBSD), kukhona okungewona uziro amathuba okuthi "ubhodloze" uhlelo lokuhlukanisa i-kernel futhi uthole ukufinyelela ohlelweni olusebenzayo oluyinhloko.
Esikhundleni sokwethula uhlelo lokusebenza olugcwele esitsheni (ngohlelo lokuqalisa, umphathi wephakheji, njll.), ungaqala izinhlelo zokusebenza ngokushesha, into esemqoka ukunikeza izinhlelo zokusebenza ithuba elinjalo (ukuba khona kwemitapo yolwazi edingekayo. namanye amafayela). Lo mbono usebenze njengesisekelo se-virtualization yezinhlelo zokusebenza ezifakwe emabhokisini, ummeleli ovelele nowaziwa kakhulu okuyi-Docker. Uma kuqhathaniswa nezinhlelo zangaphambilini, izindlela zokuzihlukanisa ezivumelana nezimo, ezihambisana nokusekelwa okwakhelwe ngaphakathi kwamanethiwekhi abonakalayo phakathi kweziqukathi kanye nokulandela isimo sohlelo lokusebenza ngaphakathi kwesiqukathi, kuphumele ekhonweni lokwakha indawo eyodwa ehambisanayo esuka kwinani elikhulu lamaseva aphathekayo okusebenzisa iziqukathi - ngaphandle kwesidingo sokuphathwa kwezinsiza ezenziwa ngesandla.
Docker
I-Docker iyisoftware edume kakhulu yokufaka iziqukathi. Ibhalwe ngolimi lwe-Go, isebenzisa izici ezijwayelekile ze-Linux kernel - amaqoqo, izindawo zamagama, amakhono, njll., kanye nezinhlelo zefayela le-Aufs nokunye okunjalo ukuze konge isikhala sediski.
Umthombo: wikimedia
bokwakha
Ngaphambi kwenguqulo 1.11, i-Docker yasebenza njengesevisi eyodwa eyenza yonke imisebenzi ngeziqukathi: ukulanda izithombe zeziqukathi, iziqukathi zokwethula, ukucubungula izicelo ze-API. Kusukela ngenguqulo 1.11, i-Docker yahlukaniswa yaba izingxenye eziningana ezisebenzisanayo: ifakwe, ukuze kucutshungulwe umjikelezo wokuphila weziqukathi (ukwaba isikhala sediski, ukulanda izithombe, ukusebenza nenethiwekhi, ukwethulwa, ukufaka nokuqapha isimo seziqukathi) kanye ne-runC, indawo yokusebenza yesiqukathi, ngokusekelwe ekusetshenzisweni kwamaqoqo nezinye izici ze-Linux kernel. Isevisi yedokhu ngokwayo isala, kodwa manje isisebenza kuphela ukucubungula izicelo ze-API ezihunyushelwe kokuthi eziqukethwe.
Ukufakwa nokumiswa
Indlela engiyithandayo yokufaka i-docker umshini we-docker, okuthi, ngaphezu kokufaka nokulungisa i-docker ngokuqondile kumaseva akude (kuhlanganise namafu ahlukahlukene), yenza kube nokwenzeka ukusebenza nezinhlelo zamafayela zamaseva akude futhi ingasebenzisa imiyalo ehlukahlukene.
Kodwa-ke, kusukela ngo-2018, iphrojekthi ayizange ithuthukiswe, ngakho-ke sizoyifaka ngendlela evamile yokusabalalisa okuningi kwe-Linux - ukwengeza indawo yokugcina nokufaka amaphakheji adingekayo.
Le ndlela iphinde isetshenziselwe ukufakwa okuzenzakalelayo, isibonelo ukusebenzisa i-Ansible noma ezinye izinhlelo ezifanayo, kodwa ngeke ngikucabangele kulesi sihloko.
Ukufakwa kuzokwenziwa ku-Centos 7, ngizosebenzisa umshini obonakalayo njengeseva, ukufaka vele usebenzise imiyalo engezansi:
# yum install -y yum-utils
# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
# yum install docker-ce docker-ce-cli containerd.ioNgemva kokufaka, udinga ukuqala isevisi futhi uyifake ekuqaleni:
# systemctl enable docker
# systemctl start docker
# firewall-cmd --zone=public --add-port=2377/tcp --permanentUkwengeza, ungakha iqembu le-docker, abasebenzisi balo abazokwazi ukusebenza ne-docker ngaphandle kwe-sudo, ukusetha ukugawulwa kwemithi, ukunika amandla ukufinyelela ku-API kusuka ngaphandle, futhi ungakhohlwa ukulungisa i-firewall ngokunembile (konke okungavunyelwe). kunqatshelwe ezibonelweni ezingenhla nangezansi - ngiyekile lokhu ukuze kube lula futhi kucace), kodwa ngeke ngingene emininingwaneni eyengeziwe lapha.
Ezinye izici
Ngokungeziwe kulo mshini we-docker oshiwo ngenhla, kukhona nerejista ye-docker, ithuluzi lokugcina izithombe zeziqukathi, kanye nokuhlanganiswa kwe-docker, ithuluzi lokuzenzakalela ukuthunyelwa kwezicelo ezitsheni, amafayela e-YAML asetshenziselwa ukwakha nokulungisa iziqukathi. nezinye izinto ezihlobene (isibonelo, amanethiwekhi, amasistimu efayela aqhubekayo okugcinwa kwedatha).
Ingasetshenziswa futhi ukuhlela ama-conveyors e-CICD. Esinye isici esithakazelisayo sisebenza kumodi yeqoqo, okuthiwa i-swarm mode (ngaphambi kwenguqulo 1.12 yayaziwa ngokuthi i-docker swarm), evumela ukuthi uhlanganise ingqalasizinda eyodwa kusuka kumaseva amaningana okusebenzisa iziqukathi. Kukhona ukusekelwa kwenethiwekhi ebonakalayo phezu kwawo wonke amaseva, kukhona ibhalansi yomthwalo eyakhelwe ngaphakathi, kanye nokusekelwa kwezimfihlo zeziqukathi.
Amafayela e-YAML asuka ekuqambeni kwe-docker, anezinguquko ezincane, angasetshenziselwa amaqoqo anjalo, enze ngokuzenzakalelayo ukugcinwa kwamaqoqo amancane naphakathi nendawo ngezinjongo ezihlukahlukene. Kumaqoqo amakhulu, i-Kubernetes iyathandeka ngoba izindleko zokunakekela zemodi yeswerm zingadlula ezakwaKubernetes. Ngokungeziwe ku-runC, ungafaka, ngokwesibonelo, njengendawo yokusebenza yesiqukathi
Ukusebenza ne-Docker
Ngemva kokufaka nokumisa, sizozama ukuhlanganisa iqoqo lapho sizofaka khona i-GitLab ne-Docker Registry yethimba lokuthuthukisa. Ngizosebenzisa imishini emithathu yama-virtual njengamaseva, lapho ngizophinde ngithumele i-FS GlusterFS esabalalisiwe; ngizoyisebenzisa njengendawo yokugcina amavolumu edokhu, isibonelo, ukuze ngiqalise inguqulo ebekezelela iphutha yokubhaliswa kwedokhi. Izingxenye ezibalulekile okufanele zisetshenziswe: I-Docker Registry, i-Postgresql, i-Redis, i-GitLab esekelwa i-GitLab Runner phezu kwe-Swarm. Sizokwethula i-Postgresql ngokuhlanganisa , ngakho-ke awudingi ukusebenzisa i-GlusterFS ukugcina idatha ye-Postgresql. Idatha esele ebalulekile izogcinwa ku-GlusterFS.
Ukuze usebenzise i-GlusterFS kuwo wonke amaseva (abizwa ngokuthi i-node1, node2, node3), udinga ukufaka amaphakheji, unike amandla i-firewall, futhi udale izinkomba ezidingekayo:
# yum -y install centos-release-gluster7
# yum -y install glusterfs-server
# systemctl enable glusterd
# systemctl start glusterd
# firewall-cmd --add-service=glusterfs --permanent
# firewall-cmd --reload
# mkdir -p /srv/gluster
# mkdir -p /srv/docker
# echo "$(hostname):/docker /srv/docker glusterfs defaults,_netdev 0 0" >> /etc/fstabNgemva kokufaka, umsebenzi wokumisa i-GlusterFS kumele uqhubeke usuka endaweni eyodwa, isibonelo node1:
# gluster peer probe node2
# gluster peer probe node3
# gluster volume create docker replica 3 node1:/srv/gluster node2:/srv/gluster node3:/srv/gluster force
# gluster volume start dockerBese udinga ukukhweza ivolumu ewumphumela (umyalo kufanele wenziwe kuwo wonke amaseva):
# mount /srv/dockerImodi ye-swarm ilungiselelwe kwenye yamaseva, okuzoba nguMholi, bonke abanye kuzodingeka bajoyine iqoqo, ngakho-ke umphumela wokwenza umyalo kuseva yokuqala uzodinga ukukopishwa futhi wenziwe kwabanye.
Ukusetha iqoqo lokuqala, ngisebenzisa umyalo ku-node1:
# docker swarm init
Swarm initialized: current node (a5jpfrh5uvo7svzz1ajduokyq) is now a manager.
To add a worker to this swarm, run the following command:
docker swarm join --token SWMTKN-1-0c5mf7mvzc7o7vjk0wngno2dy70xs95tovfxbv4tqt9280toku-863hyosdlzvd76trfptd4xnzd xx.xx.xx.xx:2377
To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
# docker swarm join-token managerSikopisha umphumela womyalo wesibili bese siwenza ku-node2 naku-node3:
# docker swarm join --token SWMTKN-x-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxx xx.xx.xx.xx:2377
This node joined a swarm as a manager.Kuleli qophelo, ukucushwa kokuqala kwamaseva kuqediwe, ake siqhubeke nokusetha izinsizakalo; imiyalo ezokhishwa izokwethulwa ku-node1, ngaphandle uma kuchazwe ngenye indlela.
Okokuqala, masidale amanethiwekhi eziqukathi:
# docker network create --driver=overlay etcd
# docker network create --driver=overlay pgsql
# docker network create --driver=overlay redis
# docker network create --driver=overlay traefik
# docker network create --driver=overlay gitlabBese simaka amaseva, lokhu kuyadingeka ukubopha ezinye izinsizakalo kumaseva:
# docker node update --label-add nodename=node1 node1
# docker node update --label-add nodename=node2 node2
# docker node update --label-add nodename=node3 node3Okulandelayo, sidala izinkomba zokugcina idatha njll, isitoreji se-KV, esidingekayo ku-Traefik ne-Stolon. Ngokufana ne-Postgresql, lezi kuzoba iziqukathi eziboshelwe kumaseva, ngakho-ke sisebenzisa lo myalo kuwo wonke amaseva:
# mkdir -p /srv/etcdOkulandelayo, dala ifayela ukuze ulungiselele njlld futhi ulisebenzise:
00etcd.yml
version: '3.7'
services:
etcd1:
image: quay.io/coreos/etcd:latest
hostname: etcd1
command:
- etcd
- --name=etcd1
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd1:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd1:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd1vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node1]
etcd2:
image: quay.io/coreos/etcd:latest
hostname: etcd2
command:
- etcd
- --name=etcd2
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd2:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd2:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd2vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node2]
etcd3:
image: quay.io/coreos/etcd:latest
hostname: etcd3
command:
- etcd
- --name=etcd3
- --data-dir=/data.etcd
- --advertise-client-urls=http://etcd3:2379
- --listen-client-urls=http://0.0.0.0:2379
- --initial-advertise-peer-urls=http://etcd3:2380
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-cluster=etcd1=http://etcd1:2380,etcd2=http://etcd2:2380,etcd3=http://etcd3:2380
- --initial-cluster-state=new
- --initial-cluster-token=etcd-cluster
networks:
- etcd
volumes:
- etcd3vol:/data.etcd
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node3]
volumes:
etcd1vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
etcd2vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
etcd3vol:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/etcd"
networks:
etcd:
external: true# docker stack deploy --compose-file 00etcd.yml etcdNgemva kwesikhathi esithile, sibheka ukuthi i- etcd cluster isiphelile:
# docker exec $(docker ps | awk '/etcd/ {print $1}') etcdctl member list
ade526d28b1f92f7: name=etcd1 peerURLs=http://etcd1:2380 clientURLs=http://etcd1:2379 isLeader=false
bd388e7810915853: name=etcd3 peerURLs=http://etcd3:2380 clientURLs=http://etcd3:2379 isLeader=false
d282ac2ce600c1ce: name=etcd2 peerURLs=http://etcd2:2380 clientURLs=http://etcd2:2379 isLeader=true
# docker exec $(docker ps | awk '/etcd/ {print $1}') etcdctl cluster-health
member ade526d28b1f92f7 is healthy: got healthy result from http://etcd1:2379
member bd388e7810915853 is healthy: got healthy result from http://etcd3:2379
member d282ac2ce600c1ce is healthy: got healthy result from http://etcd2:2379
cluster is healthySakha izinkomba ze-Postgresql, sikhiphe umyalo kuwo wonke amaseva:
# mkdir -p /srv/pgsqlOkulandelayo, dala ifayela ukuze ulungiselele i-Postgresql:
01pgsql.yml
version: '3.7'
services:
pgsentinel:
image: sorintlab/stolon:master-pg10
command:
- gosu
- stolon
- stolon-sentinel
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
- --log-level=debug
networks:
- etcd
- pgsql
deploy:
replicas: 3
update_config:
parallelism: 1
delay: 30s
order: stop-first
failure_action: pause
pgkeeper1:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper1
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper1
- --pg-repl-username=replica
- --uid=pgkeeper1
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper1:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node1]
pgkeeper2:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper2
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper2
- --pg-repl-username=replica
- --uid=pgkeeper2
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper2:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node2]
pgkeeper3:
image: sorintlab/stolon:master-pg10
hostname: pgkeeper3
command:
- gosu
- stolon
- stolon-keeper
- --pg-listen-address=pgkeeper3
- --pg-repl-username=replica
- --uid=pgkeeper3
- --pg-su-username=postgres
- --pg-su-passwordfile=/run/secrets/pgsql
- --pg-repl-passwordfile=/run/secrets/pgsql_repl
- --data-dir=/var/lib/postgresql/data
- --cluster-name=stolon-cluster
- --store-backend=etcdv3
- --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
environment:
- PGDATA=/var/lib/postgresql/data
volumes:
- pgkeeper3:/var/lib/postgresql/data
secrets:
- pgsql
- pgsql_repl
deploy:
replicas: 1
placement:
constraints: [node.labels.nodename == node3]
postgresql:
image: sorintlab/stolon:master-pg10
command: gosu stolon stolon-proxy --listen-address 0.0.0.0 --cluster-name stolon-cluster --store-backend=etcdv3 --store-endpoints http://etcd1:2379,http://etcd2:2379,http://etcd3:2379
networks:
- etcd
- pgsql
deploy:
replicas: 3
update_config:
parallelism: 1
delay: 30s
order: stop-first
failure_action: rollback
volumes:
pgkeeper1:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
pgkeeper2:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
pgkeeper3:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/pgsql"
secrets:
pgsql:
file: "/srv/docker/postgres"
pgsql_repl:
file: "/srv/docker/replica"
networks:
etcd:
external: true
pgsql:
external: trueSenza izimfihlo futhi sisebenzisa ifayela:
# </dev/urandom tr -dc 234567890qwertyuopasdfghjkzxcvbnmQWERTYUPASDFGHKLZXCVBNM | head -c $(((RANDOM%3)+15)) > /srv/docker/replica
# </dev/urandom tr -dc 234567890qwertyuopasdfghjkzxcvbnmQWERTYUPASDFGHKLZXCVBNM | head -c $(((RANDOM%3)+15)) > /srv/docker/postgres
# docker stack deploy --compose-file 01pgsql.yml pgsqlNgemva kwesikhathi esithile (bona ukukhishwa komyalo isevisi ye-docker lsukuthi zonke izinsiza ziphezulu) siqalisa iqoqo le-Postgresql:
# docker exec $(docker ps | awk '/pgkeeper/ {print $1}') stolonctl --cluster-name=stolon-cluster --store-backend=etcdv3 --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379 initIbheka ukulungela kweqoqo le-Postgresql:
# docker exec $(docker ps | awk '/pgkeeper/ {print $1}') stolonctl --cluster-name=stolon-cluster --store-backend=etcdv3 --store-endpoints=http://etcd1:2379,http://etcd2:2379,http://etcd3:2379 status
=== Active sentinels ===
ID LEADER
26baa11d false
74e98768 false
a8cb002b true
=== Active proxies ===
ID
4d233826
9f562f3b
b0c79ff1
=== Keepers ===
UID HEALTHY PG LISTENADDRESS PG HEALTHY PG WANTEDGENERATION PG CURRENTGENERATION
pgkeeper1 true pgkeeper1:5432 true 2 2
pgkeeper2 true pgkeeper2:5432 true 2 2
pgkeeper3 true pgkeeper3:5432 true 3 3
=== Cluster Info ===
Master Keeper: pgkeeper3
===== Keepers/DB tree =====
pgkeeper3 (master)
ββpgkeeper2
ββpgkeeper1
Silungiselela i-traefik ukuthi ivule ukufinyelela kuziqukathi kusuka ngaphandle:
03traefik.yml
version: '3.7'
services:
traefik:
image: traefik:latest
command: >
--log.level=INFO
--providers.docker=true
--entryPoints.web.address=:80
--providers.providersThrottleDuration=2
--providers.docker.watch=true
--providers.docker.swarmMode=true
--providers.docker.swarmModeRefreshSeconds=15s
--providers.docker.exposedbydefault=false
--accessLog.bufferingSize=0
--api=true
--api.dashboard=true
--api.insecure=true
networks:
- traefik
ports:
- 80:80
volumes:
- /var/run/docker.sock:/var/run/docker.sock
deploy:
replicas: 3
placement:
constraints:
- node.role == manager
preferences:
- spread: node.id
labels:
- traefik.enable=true
- traefik.http.routers.traefik.rule=Host(`traefik.example.com`)
- traefik.http.services.traefik.loadbalancer.server.port=8080
- traefik.docker.network=traefik
networks:
traefik:
external: true# docker stack deploy --compose-file 03traefik.yml traefikSethula i-Redis Cluster, ukwenza lokhu sakha inkomba yokugcina kuwo wonke ama-node:
# mkdir -p /srv/redis05redis.yml
version: '3.7'
services:
redis-master:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '6379:6379'
environment:
- REDIS_REPLICATION_MODE=master
- REDIS_PASSWORD=xxxxxxxxxxx
deploy:
mode: global
restart_policy:
condition: any
volumes:
- 'redis:/opt/bitnami/redis/etc/'
redis-replica:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '6379'
depends_on:
- redis-master
environment:
- REDIS_REPLICATION_MODE=slave
- REDIS_MASTER_HOST=redis-master
- REDIS_MASTER_PORT_NUMBER=6379
- REDIS_MASTER_PASSWORD=xxxxxxxxxxx
- REDIS_PASSWORD=xxxxxxxxxxx
deploy:
mode: replicated
replicas: 3
update_config:
parallelism: 1
delay: 10s
restart_policy:
condition: any
redis-sentinel:
image: 'bitnami/redis:latest'
networks:
- redis
ports:
- '16379'
depends_on:
- redis-master
- redis-replica
entrypoint: |
bash -c 'bash -s <<EOF
"/bin/bash" -c "cat <<EOF > /opt/bitnami/redis/etc/sentinel.conf
port 16379
dir /tmp
sentinel monitor master-node redis-master 6379 2
sentinel down-after-milliseconds master-node 5000
sentinel parallel-syncs master-node 1
sentinel failover-timeout master-node 5000
sentinel auth-pass master-node xxxxxxxxxxx
sentinel announce-ip redis-sentinel
sentinel announce-port 16379
EOF"
"/bin/bash" -c "redis-sentinel /opt/bitnami/redis/etc/sentinel.conf"
EOF'
deploy:
mode: global
restart_policy:
condition: any
volumes:
redis:
driver: local
driver_opts:
type: 'none'
o: 'bind'
device: "/srv/redis"
networks:
redis:
external: true# docker stack deploy --compose-file 05redis.yml redisEngeza i-Docker Registry:
06registry.yml
version: '3.7'
services:
registry:
image: registry:2.6
networks:
- traefik
volumes:
- registry_data:/var/lib/registry
deploy:
replicas: 1
placement:
constraints: [node.role == manager]
restart_policy:
condition: on-failure
labels:
- traefik.enable=true
- traefik.http.routers.registry.rule=Host(`registry.example.com`)
- traefik.http.services.registry.loadbalancer.server.port=5000
- traefik.docker.network=traefik
volumes:
registry_data:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/registry"
networks:
traefik:
external: true# mkdir /srv/docker/registry
# docker stack deploy --compose-file 06registry.yml registryFuthi ekugcineni - GitLab:
08gitlab-runner.yml
version: '3.7'
services:
gitlab:
image: gitlab/gitlab-ce:latest
networks:
- pgsql
- redis
- traefik
- gitlab
ports:
- 22222:22
environment:
GITLAB_OMNIBUS_CONFIG: |
postgresql['enable'] = false
redis['enable'] = false
gitlab_rails['registry_enabled'] = false
gitlab_rails['db_username'] = "gitlab"
gitlab_rails['db_password'] = "XXXXXXXXXXX"
gitlab_rails['db_host'] = "postgresql"
gitlab_rails['db_port'] = "5432"
gitlab_rails['db_database'] = "gitlab"
gitlab_rails['db_adapter'] = 'postgresql'
gitlab_rails['db_encoding'] = 'utf8'
gitlab_rails['redis_host'] = 'redis-master'
gitlab_rails['redis_port'] = '6379'
gitlab_rails['redis_password'] = 'xxxxxxxxxxx'
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.yandex.ru"
gitlab_rails['smtp_port'] = 465
gitlab_rails['smtp_user_name'] = "[email protected]"
gitlab_rails['smtp_password'] = "xxxxxxxxx"
gitlab_rails['smtp_domain'] = "example.com"
gitlab_rails['gitlab_email_from'] = '[email protected]'
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_tls'] = true
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_openssl_verify_mode'] = 'peer'
external_url 'http://gitlab.example.com/'
gitlab_rails['gitlab_shell_ssh_port'] = 22222
volumes:
- gitlab_conf:/etc/gitlab
- gitlab_logs:/var/log/gitlab
- gitlab_data:/var/opt/gitlab
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.role == manager
labels:
- traefik.enable=true
- traefik.http.routers.gitlab.rule=Host(`gitlab.example.com`)
- traefik.http.services.gitlab.loadbalancer.server.port=80
- traefik.docker.network=traefik
gitlab-runner:
image: gitlab/gitlab-runner:latest
networks:
- gitlab
volumes:
- gitlab_runner_conf:/etc/gitlab
- /var/run/docker.sock:/var/run/docker.sock
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.role == manager
volumes:
gitlab_conf:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/conf"
gitlab_logs:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/logs"
gitlab_data:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/data"
gitlab_runner_conf:
driver: local
driver_opts:
type: none
o: bind
device: "/srv/docker/gitlab/runner"
networks:
pgsql:
external: true
redis:
external: true
traefik:
external: true
gitlab:
external: true# mkdir -p /srv/docker/gitlab/conf
# mkdir -p /srv/docker/gitlab/logs
# mkdir -p /srv/docker/gitlab/data
# mkdir -p /srv/docker/gitlab/runner
# docker stack deploy --compose-file 08gitlab-runner.yml gitlabIsimo sokugcina seqoqo namasevisi:
# docker service ls
ID NAME MODE REPLICAS IMAGE PORTS
lef9n3m92buq etcd_etcd1 replicated 1/1 quay.io/coreos/etcd:latest
ij6uyyo792x5 etcd_etcd2 replicated 1/1 quay.io/coreos/etcd:latest
fqttqpjgp6pp etcd_etcd3 replicated 1/1 quay.io/coreos/etcd:latest
hq5iyga28w33 gitlab_gitlab replicated 1/1 gitlab/gitlab-ce:latest *:22222->22/tcp
dt7s6vs0q4qc gitlab_gitlab-runner replicated 1/1 gitlab/gitlab-runner:latest
k7uoezno0h9n pgsql_pgkeeper1 replicated 1/1 sorintlab/stolon:master-pg10
cnrwul4r4nse pgsql_pgkeeper2 replicated 1/1 sorintlab/stolon:master-pg10
frflfnpty7tr pgsql_pgkeeper3 replicated 1/1 sorintlab/stolon:master-pg10
x7pqqchi52kq pgsql_pgsentinel replicated 3/3 sorintlab/stolon:master-pg10
mwu2wl8fti4r pgsql_postgresql replicated 3/3 sorintlab/stolon:master-pg10
9hkbe2vksbzb redis_redis-master global 3/3 bitnami/redis:latest *:6379->6379/tcp
l88zn8cla7dc redis_redis-replica replicated 3/3 bitnami/redis:latest *:30003->6379/tcp
1utp309xfmsy redis_redis-sentinel global 3/3 bitnami/redis:latest *:30002->16379/tcp
oteb824ylhyp registry_registry replicated 1/1 registry:2.6
qovrah8nzzu8 traefik_traefik replicated 3/3 traefik:latest *:80->80/tcp, *:443->443/tcpYini enye engathuthukiswa? Qiniseka ukuthi ulungiselela i-Traefik ukuthi isebenzise iziqukathi phezu kwe-https, engeza ukubethela kwe-tls kwe-Postgresql ne-Redis. Kepha ngokujwayelekile, isivele inikezwe abathuthukisi njenge-PoC. Manje ake sibheke ezinye izindlela ze-Docker.
I-Podman
Enye injini eyaziwa kakhulu yokusebenzisa iziqukathi eziqoqwe ngama-pods (ama-pods, amaqembu eziqukathi ezisetshenziswe ndawonye). Ngokungafani ne-Docker, ayidingi noma iyiphi insiza ukusebenzisa iziqukathi; wonke umsebenzi wenziwa ngomtapo wezincwadi we-libpod. Futhi okubhalwe kokuthi Go, kudinga isikhathi sokusebenza esihambisana ne-OCI ukuze kusetshenziswe iziqukathi, ezifana ne-runC.
Ukusebenza noPodman ngokuvamile kukhumbuza lokho ku-Docker, kuze kube yilapho ungakwenza kanje (njengoba kushiwo abaningi abaye bazama, kuhlanganise nombhali wale ndatshana):
$ alias docker=podmanfuthi ungaqhubeka nokusebenza. Ngokuvamile, isimo ngePodman siyathakazelisa kakhulu, ngoba uma izinguqulo zakuqala ze-Kubernetes zisebenza ne-Docker, cishe ngo-2015, ngemva kokumiswa kweziqukathi zomhlaba (OCI - Open Container Initiative) kanye nokuhlukaniswa kwe-Docker ibe yi-contained and runC, enye i-Docker esebenza e-Kubernetes ibilokhu ithuthukisa: CRI-O. I-Podman mayelana nalokhu ingenye ye-Docker, eyakhelwe emigomeni ye-Kubernetes, kuhlanganise neziqukathi zokuqoqa, kodwa inhloso enkulu yephrojekthi ukwethula iziqukathi zesitayela se-Docker ngaphandle kwezinsizakalo ezengeziwe. Ngenxa yezizathu ezicacile, ayikho imodi ye-swarm, njengoba abathuthukisi besho ngokucacile ukuthi uma udinga iqoqo, thatha i-Kubernetes.
setting
Ukufaka ku-Centos 7, vele wenze kusebenze indawo yokugcina ye-Extras, bese ufaka yonke into ngomyalo:
# yum -y install podmanEzinye izici
I-Podman ingakwazi ukukhiqiza amayunithi e-systemd, ngaleyo ndlela ixazulule inkinga yokuqala iziqukathi ngemva kokuqaliswa kabusha kweseva. Ukwengeza, i-systemd imenyezelwa ukuthi isebenza kahle njenge-pid 1 esitsheni. Kukhona ithuluzi elihlukile le-buildah lokwakha iziqukathi, kukhona namathuluzi ezinkampani zangaphandle - ama-analogues we-docker-compose, abuye akhiqize amafayela wokumisa ahambisana ne-Kubernetes, ngakho-ke ukuguqulwa ukusuka ku-Podman kuya ku-Kubernetes kwenziwa lula ngangokunokwenzeka.
Ukusebenza nePodman
Njengoba ingekho i-swarm mode (kufanele sishintshele ku-Kubernetes uma iqoqo lidingeka), sizoliqoqa ezitsheni ezihlukene.
Faka i-podman-compose:
# yum -y install python3-pip
# pip3 install podman-composeIfayela eliwumphumela lokucushwa le-podman lihluke kancane, ngakho-ke ngokwesibonelo bekufanele sihambise ingxenye yamavolumu ehlukile ngqo esigabeni esinamasevisi.
gitlab-podman.yml
version: '3.7'
services:
gitlab:
image: gitlab/gitlab-ce:latest
hostname: gitlab.example.com
restart: unless-stopped
environment:
GITLAB_OMNIBUS_CONFIG: |
gitlab_rails['gitlab_shell_ssh_port'] = 22222
ports:
- "80:80"
- "22222:22"
volumes:
- /srv/podman/gitlab/conf:/etc/gitlab
- /srv/podman/gitlab/data:/var/opt/gitlab
- /srv/podman/gitlab/logs:/var/log/gitlab
networks:
- gitlab
gitlab-runner:
image: gitlab/gitlab-runner:alpine
restart: unless-stopped
depends_on:
- gitlab
volumes:
- /srv/podman/gitlab/runner:/etc/gitlab-runner
- /var/run/docker.sock:/var/run/docker.sock
networks:
- gitlab
networks:
gitlab:# podman-compose -f gitlab-runner.yml -d upUmphumela:
# podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
da53da946c01 docker.io/gitlab/gitlab-runner:alpine run --user=gitlab... About a minute ago Up About a minute ago 0.0.0.0:22222->22/tcp, 0.0.0.0:80->80/tcp root_gitlab-runner_1
781c0103c94a docker.io/gitlab/gitlab-ce:latest /assets/wrapper About a minute ago Up About a minute ago 0.0.0.0:22222->22/tcp, 0.0.0.0:80->80/tcp root_gitlab_1Ake sibone ukuthi ikhiqiza ini ye-systemd ne-kubernetes, ngalokhu sidinga ukuthola igama noma i-id ye-pod:
# podman pod ls
POD ID NAME STATUS CREATED # OF CONTAINERS INFRA ID
71fc2b2a5c63 root Running 11 minutes ago 3 db40ab8bf84bKubernetes:
# podman generate kube 71fc2b2a5c63
# Generation of Kubernetes YAML is still under development!
#
# Save the output of this file and use kubectl create -f to import
# it into Kubernetes.
#
# Created with podman-1.6.4
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: "2020-07-29T19:22:40Z"
labels:
app: root
name: root
spec:
containers:
- command:
- /assets/wrapper
env:
- name: PATH
value: /opt/gitlab/embedded/bin:/opt/gitlab/bin:/assets:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- name: TERM
value: xterm
- name: HOSTNAME
value: gitlab.example.com
- name: container
value: podman
- name: GITLAB_OMNIBUS_CONFIG
value: |
gitlab_rails['gitlab_shell_ssh_port'] = 22222
- name: LANG
value: C.UTF-8
image: docker.io/gitlab/gitlab-ce:latest
name: rootgitlab1
ports:
- containerPort: 22
hostPort: 22222
protocol: TCP
- containerPort: 80
hostPort: 80
protocol: TCP
resources: {}
securityContext:
allowPrivilegeEscalation: true
capabilities: {}
privileged: false
readOnlyRootFilesystem: false
volumeMounts:
- mountPath: /var/opt/gitlab
name: srv-podman-gitlab-data
- mountPath: /var/log/gitlab
name: srv-podman-gitlab-logs
- mountPath: /etc/gitlab
name: srv-podman-gitlab-conf
workingDir: /
- command:
- run
- --user=gitlab-runner
- --working-directory=/home/gitlab-runner
env:
- name: PATH
value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
- name: TERM
value: xterm
- name: HOSTNAME
- name: container
value: podman
image: docker.io/gitlab/gitlab-runner:alpine
name: rootgitlab-runner1
resources: {}
securityContext:
allowPrivilegeEscalation: true
capabilities: {}
privileged: false
readOnlyRootFilesystem: false
volumeMounts:
- mountPath: /etc/gitlab-runner
name: srv-podman-gitlab-runner
- mountPath: /var/run/docker.sock
name: var-run-docker.sock
workingDir: /
volumes:
- hostPath:
path: /srv/podman/gitlab/runner
type: Directory
name: srv-podman-gitlab-runner
- hostPath:
path: /var/run/docker.sock
type: File
name: var-run-docker.sock
- hostPath:
path: /srv/podman/gitlab/data
type: Directory
name: srv-podman-gitlab-data
- hostPath:
path: /srv/podman/gitlab/logs
type: Directory
name: srv-podman-gitlab-logs
- hostPath:
path: /srv/podman/gitlab/conf
type: Directory
name: srv-podman-gitlab-conf
status: {}Isistimu:
# podman generate systemd 71fc2b2a5c63
# pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
Documentation=man:podman-generate-systemd(1)
Requires=container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
Before=container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa
ExecStop=/usr/bin/podman stop -t 10 db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/db40ab8bf84bf35141159c26cb6e256b889c7a98c0418eee3c4aa683c14fccaa/userdata/conmon.pid
[Install]
WantedBy=multi-user.target
# container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman container-da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864.service
Documentation=man:podman-generate-systemd(1)
RefuseManualStart=yes
RefuseManualStop=yes
BindsTo=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
After=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864
ExecStop=/usr/bin/podman stop -t 10 da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/da53da946c01449f500aa5296d9ea6376f751948b17ca164df438b7df6607864/userdata/conmon.pid
[Install]
WantedBy=multi-user.target
# container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service
# autogenerated by Podman 1.6.4
# Thu Jul 29 15:23:28 EDT 2020
[Unit]
Description=Podman container-781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3.service
Documentation=man:podman-generate-systemd(1)
RefuseManualStart=yes
RefuseManualStop=yes
BindsTo=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
After=pod-71fc2b2a5c6346f0c1c86a2dc45dbe78fa192ea02aac001eb8347ccb8c043c26.service
[Service]
Restart=on-failure
ExecStart=/usr/bin/podman start 781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3
ExecStop=/usr/bin/podman stop -t 10 781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3
KillMode=none
Type=forking
PIDFile=/var/run/containers/storage/overlay-containers/781c0103c94aaa113c17c58d05ddabf8df4bf39707b664abcf17ed2ceff467d3/userdata/conmon.pid
[Install]
WantedBy=multi-user.targetNgeshwa, ngaphandle kokwethula iziqukathi, iyunithi ekhiqiziwe ye-systemd ayenzi lutho olunye (isibonelo, ukuhlanza iziqukathi ezindala lapho isevisi enjalo iqalwa kabusha), ngakho-ke kuzodingeka ubhale izinto ezinjalo ngokwakho.
Empeleni, iPodman yanele ukuzama ukuthi ziyini iziqukathi, ukudlulisa ukulungiselelwa okudala kokuqamba i-docker, bese udlulela ngase-Kubernetes, uma udinga iqoqo, noma uthole enye indlela esebenziseka kalula ku-Docker.
i-rkt
Le phrojekthi cishe ezinyangeni eziyisithupha ezedlule ngenxa yokuthi i-RedHat ithenge, ngakho-ke ngeke ngihlale kuyo ngokuningiliziwe. Sekukonke, kushiye umbono omuhle kakhulu, kepha uma kuqhathaniswa neDocker futhi ikakhulukazi iPodman, kubukeka njengenhlanganisela. Kuphinde kwaba nokusatshalaliswa kwe-CoreOS okwakhelwe phezu kwe-rkt (yize ekuqaleni babenayo i-Docker), kodwa lokhu kuphinde kwagcina ngokusekelwa ngemva kokuthengwa kwe-RedHat.
I-Plash
Okuningi , umbhali wayo owayefuna nje ukwakha nokusebenzisa iziqukathi. Ukwahlulela ngemibhalo kanye nekhodi, umbhali akazange alandele izindinganiso, kodwa wamane wanquma ukubhala ukuqaliswa kwakhe siqu, okuyinto, empeleni, akwenza.
okutholakele
Isimo nge-Kubernetes siyathakazelisa impela: ngakolunye uhlangothi, nge-Docker ungakha iqoqo (ngemodi ye-swarm), ongasebenzisa ngayo izindawo zomkhiqizo zamakhasimende, lokhu kuyiqiniso ikakhulukazi emaqenjini amancane (abantu abangu-3-5) , noma ngomthwalo omncane jikelele , noma ukungabi nesifiso sokuqonda izingqinamba zokusetha i-Kubernetes, kuhlanganise nemithwalo ephezulu.
I-Podman ayinikezi ukuhambisana okugcwele, kodwa inenzuzo eyodwa ebalulekile - ukuhambisana ne-Kubernetes, kuhlanganise namathuluzi engeziwe (i-buildah nabanye). Ngakho-ke, ngizosondela ekukhetheni ithuluzi lomsebenzi ngale ndlela elandelayo: emaqenjini amancane, noma ngesabelomali esinqunyelwe - I-Docker (enemodi engaba yizixuku), ukuze ngizithuthukisele endaweni yomuntu siqu - i-Podman comrades, kanye nawo wonke umuntu. - Kubernetes.
Angiqiniseki ukuthi isimo nge-Docker ngeke sishintshe esikhathini esizayo, emva kwakho konke, bangamaphayona, futhi kancane kancane balinganiswa isinyathelo ngesinyathelo, kodwa iPodman, ngenxa yazo zonke iziphambeko zayo (isebenza kuphela ku-Linux, akukho ukuhlanganisa, ukuhlangana nezinye izenzo ziyizixazululo zezinkampani zangaphandle) ikusasa licacile, ngakho ngimema wonke umuntu ukuthi axoxe ngalokhu okutholakele kumazwana.
PS Ngo-Agasti 3 sethula β", lapho ungafunda khona okwengeziwe ngomsebenzi wakhe. Sizohlaziya wonke amathuluzi ayo: kusukela ekunqanyulweni okuyisisekelo kuya kumapharamitha wenethiwekhi, ama-nuances okusebenza namasistimu wokusebenza ahlukahlukene nezilimi zokuhlela. Uzojwayelana nobuchwepheshe futhi uqonde ukuthi ungayisebenzisa kuphi futhi kanjani i-Docker. Sizophinde sabelane ngamacala omkhuba ahamba phambili.
Intengo yoku-oda kusengaphambili ngaphambi kokukhululwa: RUB 5000. Ungabuka uhlelo lwe-Docker Video Course .
Source: www.habr.com