grep -A10 CONFIG_NAMESPACES "/boot/config-$(uname -r)"

apt-get update
apt-get install -y ca-certificates curl gnupg
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg \
  | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
  > /etc/apt/sources.list.d/docker.list
apt update

apt-cache madison docker-ce | head -n2

# 安装仓库当前提供的版本及配套组件
apt install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin

# 如需固定版本，先从 madison 输出复制实际存在的版本号
# apt install docker-ce=<实际版本> docker-ce-cli=<实际版本> containerd.io

systemctl is-active docker
docker version
docker info
ip addr show docker0
nft list ruleset | wc -l
iptables -vnL

https://hub-mirror.c.163.com
https://f1361db2.m.daocloud.io
https://docker.1ms.run
https://docker.xuanyuan.me
https://docker.m.daocloud.io
https://docker.1panel.live
https://hub.rat.dev
https://doublezonline.cloud
https://docker.mrxn.net
https://docker.anyhub.us.kg
https://dislabaiot.xyz
https://docker.fxxk.dedyn.io

curl https://docker.xuanyuan.me/v2/

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]}

{
  "registry-mirrors": [
    "https://docker.xuanyuan.me"
  ]
}

systemctl restart docker
docker info | grep -A2 Regi
docker run hello-world
pstree -p | grep docker

Unable to find image 'hello-world:latest' locally

{
  "registry-mirrors": [
    "https://docker.xuanyuan.me",
    "https://82ue03hk.mirror.aliyuncs.com"
  ],
  "insecure-registries": []
}

cp /etc/docker/daemon.json{,.bak}
systemctl restart docker

docker ps -a
docker rm -f 9e
systemctl stop docker.service docker.socket
apt purge -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin

# 仅在确认实验数据不再需要时执行
rm -rf /etc/docker /var/lib/docker /var/lib/containerd
rm -f /etc/apt/sources.list.d/docker.list
rm -f /etc/apt/keyrings/docker.gpg
reboot

mkdir -p /data/{server,softs}
# 将 <实际版本> 替换为已核实存在的版本
wget 'https://mirrors.aliyun.com/docker-ce/linux/static/stable/x86_64/docker-<实际版本>.tgz' \
  -O /data/softs/docker.tgz
tar xf /data/softs/docker.tgz -C /data/server/
chown -R root:root /data/server/docker
echo 'export PATH=$PATH:/data/server/docker' > /etc/profile.d/docker.sh
source /etc/profile.d/docker.sh

dockerd >/tmp/dockerd-lab.log 2>&1 &
# 原稿后台作业 PID 示例：4985
docker version

# 使用实际 PID，优先正常发送 SIGTERM
kill -TERM 4985

[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service
Wants=network-online.target
StartLimitBurst=3
StartLimitIntervalSec=60s

[Service]
Type=notify
Environment="PATH=/data/server/docker:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"
ExecStart=/data/server/docker/dockerd -H unix:///var/run/docker.sock
ExecReload=/bin/kill -s HUP $MAINPID
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
TimeoutStartSec=0
Delegate=yes
KillMode=process
Restart=on-failure

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl start docker
docker info | grep Version
mkdir -p /etc/docker
# 按上一节写入 daemon.json
systemctl restart docker
docker info | grep -A2 Regi
docker run hello-world

docker ps -a
docker rm -f 27a21e5655da
systemctl disable --now docker
rm -rf /etc/docker /var/lib/docker /var/lib/containerd
rm -rf /var/run/docker /var/run/containerd
rm -f /var/run/docker.sock /var/run/docker.pid
rm -rf /data/server/docker
rm -f /etc/systemd/system/docker.service /etc/profile.d/docker.sh
systemctl daemon-reload
reboot

/bin/bash onekey_deploy_docker_offline.sh
systemctl status docker.service
source /etc/profile.d/docker.sh
docker info

[INFO] ... 22:59:18 ========== 开始执行Docker安装脚本 ==========
[INFO] ... 22:59:18 开始检查系统环境...
[WARNING] ... 22:59:18 系统已安装Docker ...
是否继续安装？(y/n): y

[INFO] ... 22:59:41 ========== 开始执行Docker安装脚本 ==========
[INFO] ... 22:59:41 开始检查系统环境...
[WARNING] ... 22:59:41 系统已安装Docker ...
是否继续安装？(y/n): n
[INFO] ... 22:59:43 用户取消安装

Usage: docker [OPTIONS] COMMAND
Common Commands:
Management Commands:
Swarm Commands:
Commands:
Global Options:

docker
docker help
docker --help
docker help COMMAND
docker COMMAND --help
docker version
docker info

docker images
docker image ls

REPOSITORY   TAG      IMAGE ID       CREATED        SIZE
debian       latest   b3a422523a11   30 hours ago   117MB
nginx        latest   9a9a9fd723f1   6 days ago     192MB
alpine       latest   cea2ff433c61   4 weeks ago    8.31MB
ubuntu       latest   bf16bdcff9c9   4 weeks ago    78.1MB
busybox      latest   6d3e4188a38a   9 months ago   4.28MB

[registry[:port]/][namespace/]repository[:tag]
registry/namespace/repository@sha256:<digest>

docker pull --help
docker image pull --help
docker pull redis
docker pull registry.cn-hangzhou.aliyuncs.com/sswang-cloudnative/web-nginx:v1
docker pull registry.cn-hangzhou.aliyuncs.com/sswang-cloudnative/web-tomcat:v1
docker pull registry.cn-hangzhou.aliyuncs.com/sswang-cloudnative/web-django:v1
docker images

# 其他练习镜像；是否可拉取取决于仓库状态
docker pull busybox
docker pull alpine
docker pull debian
docker pull ubuntu
docker pull nginx
docker pull centos
docker pull centos:7
docker pull rockylinux
docker pull rockylinux:9

docker history --help
docker image history --help
docker history registry.cn-hangzhou.aliyuncs.com/sswang-cloudnative/web-nginx:v1

docker inspect --help
docker image inspect --help
docker image inspect registry.cn-hangzhou.aliyuncs.com/sswang-cloudnative/web-nginx:v1

docker search [OPTIONS] TERM

docker search --filter is-official=true nginx
docker search --filter stars=1000 nginx
docker search --format '{{.Name}}: {{.Description}}' nginx

Error response from daemon: Get "https://index.docker.io/v1/search?q=nginx&n=25":
dial tcp 199.59.149.237:443: connect: connection refused

docker pull nginx
docker pull ccr.ccs.tencentyun.com/library/nginx:latest

# 原稿历史 Kubernetes 镜像及其替代路径示例
docker pull k8s.gcr.io/coredns:1.2.2
docker pull registry.aliyuncs.com/google_containers/coredns:1.2.2

Error response from daemon: Get "https://k8s.gcr.io/v2/": context deadline exceeded

Error response from daemon: Get "https://registry-1.docker.io/v2/": net/http:
request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

docker rmi --help
docker image rm --help
docker rmi centos:7
docker rmi rockylinux:9 ubuntu:latest debian:latest
docker images

docker save --help
docker images nginx
docker save -o nginx.tar nginx:latest
docker save -o multiple_images.tar nginx redis alpine busybox
docker save nginx:latest | gzip > nginx.tar.gz

docker load --help
docker rmi nginx redis alpine busybox
docker load -i multiple_images.tar

docker rmi nginx
gunzip -c nginx.tar.gz | docker load

docker rmi nginx
docker load -i nginx.tar -q

docker image tag SOURCE_IMAGE[:TAG] TARGET_IMAGE[:TAG]

docker tag --help
docker image tag --help
docker images | grep web-nginx
# 原稿镜像 ID：48d5de12bb81

docker tag registry.cn-hangzhou.aliyuncs.com/sswang-cloudnative/web-nginx:v1 web-nginx:v1
docker rmi registry.cn-hangzhou.aliyuncs.com/sswang-cloudnative/web-nginx:v1

REPO_ADDR='registry.cn-hangzhou.aliyuncs.com/sswang-cloudnative'
docker tag "$REPO_ADDR/web-tomcat:v1" web-tomcat:v1
docker tag "$REPO_ADDR/web-django:v1" web-django:v1
docker tag registry.aliyuncs.com/google_containers/coredns:1.2.2 coredns:1.2.2
docker rmi "$REPO_ADDR/web-tomcat:v1"
docker rmi "$REPO_ADDR/web-django:v1"
docker rmi registry.aliyuncs.com/google_containers/coredns:1.2.2
docker images

docker images --format '{{.Repository}}:{{.Tag}}'
docker images --format '{{.Repository}}:{{.Tag}}\t{{.Size}}\t{{.CreatedAt}}'
docker images --format 'table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}'
docker images --format '{"name":"{{.Repository}}","tag":"{{.Tag}}","size":"{{.Size}}"}'
docker images --format '{"name":"{{.Repository}}","tag":"{{.Tag}}"}' | jq .
docker images --format '{{.Size}}'

# 查看实际存储占用及可回收情况
docker system df
docker system df -v

docker run nginx
docker run -d nginx

docker ps --help
docker ps
docker ps -a
docker ps -q
docker ps -l
docker ps --filter 'status=running'
docker ps --format 'table {{.ID}}\t{{.Names}}\t{{.Status}}\t{{.Ports}}'

CONTAINER ID   IMAGE   COMMAND                  CREATED          STATUS         PORTS    NAMES
f5229c2e1d2d   nginx   "/docker-entrypoint.…"   45 seconds ago   Up 44 seconds  80/tcp   inspiring_wright

docker run --name my-nginx -d nginx
docker ps
docker rename my-nginx new-nginx

docker run --name nginx-it -it nginx /bin/bash

root@a8783baff9bc:/# hostname
a8783baff9bc
root@a8783baff9bc:/# pwd
/
root@a8783baff9bc:/# echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
root@a8783baff9bc:/# exit
exit

docker run --name nginx-it2 -it nginx /bin/sh

# ls^H^H^H^C
# ls^H^H
/bin/sh: 2: : not found

docker run --rm -d --name nginx-rm nginx
docker stop nginx-rm
docker ps -a -f 'name=nginx-rm'

docker run -it --name nginx-rm --rm nginx /bin/bash
# 容器内：exit
docker ps -a -f 'name=nginx-rm'

CONTAINER ID   IMAGE   COMMAND   CREATED   STATUS   PORTS   NAMES

docker run -d --restart=always --name nginx-restart nginx
docker ps
docker stop nginx-restart
docker ps -a
systemctl restart docker
docker ps

docker rm [OPTIONS] CONTAINER [CONTAINER...]

docker ps -a
docker rm e1cb8ec5d341
docker rm e7
docker rm my-nginx

Error response from daemon: cannot remove container "96110f4b62a0": container is
running: stop the container before removing or force remove

docker rm -f 96110f4b62a0

# 删除创建超过 24 小时的已停止容器，并清理匿名卷
docker container prune --filter 'until=24h'
# 如果还需清理关联卷，应单独按卷的实际用途检查处理

# 仅查看所有容器 ID
docker ps -a -q

# 删除全部实验容器，空列表时不执行 rm
cs=$(docker ps -a -q)
[ -z "$cs" ] || docker rm -f $cs

docker ps
docker top <容器名或ID>
docker top <容器名或ID> aux

# 准备两台实验容器
docker run -d nginx
docker run -d nginx
docker ps -q

docker stats
docker stats 43007f11dfe8
docker stats 43007f11dfe8 145b5a7f6b84
docker stats --no-stream 145b5a7f6b84
docker stats --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemPerc}}' --no-stream

CONTAINER ID   NAME   CPU%   MEM USAGE/LIMIT   MEM%   NET I/O   BLOCK I/O   PIDS

NAME              CPU %   MEM %
upbeat_goldberg   0.00%   0.29%
sharp_gates       0.00%   0.29%

docker inspect [OPTIONS] NAME|ID [NAME|ID...]

docker inspect sharp_gates

# 默认 bridge 网络，bridge 是具体网络名称
docker inspect --format '{{.NetworkSettings.Networks.bridge.IPAddress}}' sharp_gates

# 自定义网络应按实际名称查询，不能一律写 bridge
docker inspect --format '{{(index .NetworkSettings.Networks "app-net").IPAddress}}' sharp_gates

# 列出所有网络及地址，避免多地址无分隔地拼接
docker inspect -f '{{range $name, $net := .NetworkSettings.Networks}}{{printf "%s %s\n" $name $net.IPAddress}}{{end}}' sharp_gates

docker logs sharp_gates
docker logs --tail 5 sharp_gates
docker logs --tail 5 -t sharp_gates
docker logs -f sharp_gates
docker logs --since '2025-10-01T00:00:00' --until '2025-10-02T12:00:00' sharp_gates

docker ps
docker kill <容器名>
docker ps -a
docker kill -s SIGTERM my-container

docker stop my-container
docker kill my-container

docker exec [OPTIONS] CONTAINER COMMAND [ARG...]

docker run -d --name nginx-exec nginx
docker exec -it nginx-exec /bin/bash
# 使用 exit 或 Ctrl+D 退出新 Shell，主服务通常继续运行

docker exec -it nginx-exec sh
docker exec nginx-exec ls /etc/hosts
docker exec nginx-exec cat /etc/hosts

OCI runtime exec failed: exec failed: unable to start container process: exec:
"ll": executable file not found in $PATH: unknown

docker exec nginx-exec ls -l

docker exec -e 'DEBUG1=true1' nginx-exec env
# 输出包含 DEBUG1=true1

# 未保护的 $DEBUG1 先由宿主机 Shell 展开，可能为空
docker exec -e 'DEBUG1=true1' nginx-exec echo $DEBUG1

# 交给容器内的 Shell 展开
docker exec -e 'DEBUG1=true1' nginx-exec bash -c 'echo "$DEBUG1"'
# true1

# 双引号也能使用，但必须保护美元符号
docker exec -e 'DEBUG1=true1' nginx-exec bash -c "echo \$DEBUG1"

aliyun_url='registry.cn-hangzhou.aliyuncs.com/sswang-image'
for i in wordpress:php8.4-apache mysql:oraclelinux9; do
  docker pull "$aliyun_url/$i"
  docker tag "$aliyun_url/$i" "$i"
  docker rmi "$aliyun_url/$i"
done

用法: get_ali_images.sh [选项] [镜像名称[:标签]]
从阿里云镜像仓库拉取Docker镜像并打标签
-h, --help   显示帮助
-l, --list   列出预定义镜像
-a, --all    处理全部预定义镜像

/bin/bash get_ali_images.sh wordpress:php8.4-apache
/bin/bash get_ali_images.sh mysql:oraclelinux9
/bin/bash get_ali_images.sh -a

docker run -p 3306:3306 \
  -e MYSQL_ROOT_PASSWORD=123456 \
  -e MYSQL_DATABASE=wordpress \
  -e MYSQL_USER=wordpress -e MYSQL_PASSWORD=123456 \
  --name mysql -d --restart=always mysql:oraclelinux9

docker inspect mysql -f '{{.NetworkSettings.Networks.bridge.IPAddress}}'
docker inspect mysql -f '{{range $name, $net := .NetworkSettings.Networks}}{{printf "%s %s\n" $name $net.IPAddress}}{{end}}'
docker inspect mysql | jq -r '.[0].NetworkSettings.Networks.bridge.IPAddress'

apt install -y mysql-client-core-8.0
mysql -uroot -h172.17.0.2 -p123456 -e 'select version();'

docker run -d -p 80:80 --name wordpress \
  -e WORDPRESS_DB_HOST=10.0.0.13:3306 \
  -e WORDPRESS_DB_USER=wordpress \
  -e WORDPRESS_DB_PASSWORD=123456 \
  -e WORDPRESS_DB_NAME=wordpress \
  --restart=always wordpress:php8.4-apache

mkdir -p /data/server/lamp
cat > /data/server/lamp/mysql_env.list <<'ENVFILE'
MYSQL_ROOT_PASSWORD=123456
MYSQL_DATABASE=wordpress
MYSQL_USER=wordpress
MYSQL_PASSWORD=123456
TZ=Asia/Shanghai
ENVFILE

cat > /data/server/lamp/wordpress_env.list <<'ENVFILE'
WORDPRESS_DB_HOST=10.0.0.13:3306
WORDPRESS_DB_USER=wordpress
WORDPRESS_DB_PASSWORD=123456
WORDPRESS_DB_NAME=wordpress
TZ=Asia/Shanghai
ENVFILE

cd /data/server/lamp
docker run -p 3306:3306 --env-file=mysql_env.list \
  --name mysql -d --restart=always mysql:oraclelinux9
docker run -d -p 80:80 --env-file=wordpress_env.list \
  --name wordpress --restart=always wordpress:php8.4-apache
docker ps --format 'table {{.ID}}\t{{.Names}}\t{{.Status}}\t{{.Ports}}'

docker rm -f wordpress mysql

alias dps='docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Ports}}"'
alias dpas='docker ps -a --format "table {{.ID}}\t{{.Names}}\t{{.Ports}}"'
alias dka='cs=$(docker ps -a -q); [ -z "$cs" ] || docker rm -f $cs'
alias dcn='docker inspect --format "{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}"'
alias dcc="docker inspect -f '{{join .Config.Entrypoint \" \"}} {{join .Config.Cmd \" \"}}'"
alias dims='docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"'

cp docker_define_my_cmd.sh /etc/profile.d/
dhelp
dcn mysql
dcc mysql

docker cp [OPTIONS] CONTAINER:SRC_PATH DEST_PATH
docker cp [OPTIONS] SRC_PATH CONTAINER:DEST_PATH

docker run --name nginx_cp -d nginx:latest
docker exec nginx_cp bash -c 'mkdir -p /data/server/dir{1..3}'
mkdir -p /tmp/docker-cp-lab

# 复制 server 目录到宿主机
# 目标已存在时，这两种写法均复制为 /tmp/docker-cp-lab/server
docker cp nginx_cp:/data/server/ /tmp/docker-cp-lab/
docker cp nginx_cp:/data/server /tmp/docker-cp-lab

# 只复制目录内容时使用 /.
docker cp nginx_cp:/data/server/. /tmp/docker-cp-lab/

# 单个文件及重命名
docker cp nginx_cp:/etc/hosts /tmp/docker-cp-lab/
docker cp nginx_cp:/etc/hosts /tmp/docker-cp-lab/hosts-con

# 宿主机到容器
docker cp /etc/hosts nginx_cp:/tmp/
mkdir -p /tmp/docker-cp-lab/server/dir{1..3}
docker cp /tmp/docker-cp-lab/server nginx_cp:/tmp/

docker system prune
docker system df
docker system prune -a

WARNING! This will remove:
 - all stopped containers
 - all networks not used by at least one container
 - all dangling images
 - unused build cache
Are you sure you want to continue? [y/N] y
Deleted build cache objects:
ufaaz35mq69lnxqz7nbevigo1
6tc9414h9feyp6mxn67wwzk08
Total reclaimed space: 19B

TYPE            TOTAL   ACTIVE   SIZE      RECLAIMABLE
Images          9       1        2.838GB   2.721GB (95%)
Containers      1       1        1.253kB   0B (0%)
Local Volumes   7       0        1.134GB   1.134GB (100%)
Build Cache     1       0        0B        0B

# 当前目录下已有镜像归档时，逐个加载
for i in ./*.tar; do
  [ -f "$i" ] || continue
  docker load -i "$i"
done
/bin/bash get_ali_images.sh -a

docker run --name nginx_test -d nginx:latest
docker exec nginx_test bash -c "echo 'Nginx Web Page by sswang' > /usr/share/nginx/html/index.html"
curl 172.17.0.2

Nginx Web Page by sswang

docker export -o nginx_test.tar nginx_test
docker export nginx_test | gzip > nginx_test.tar.gz

docker import nginx_test.tar mynginx:v1
gunzip -c nginx_test.tar.gz | docker import - mynginx:v2

docker import [OPTIONS] FILE|URL|- [REPOSITORY[:TAG]]

docker commit [OPTIONS] CONTAINER [REPOSITORY[:TAG]]

docker exec nginx_test bash -c "echo 'Nginx Web Page by sswang with commit' > /usr/share/nginx/html/index.html"
docker commit -m 'new image' nginx_test mynginx:v3
docker run -d --name mynginx mynginx:v3
dcn mynginx
curl 172.17.0.3

172.17.0.3
Nginx Web Page by sswang with commit

docker pull registry.cn-hangzhou.aliyuncs.com/openspug/spug-service
docker tag registry.cn-hangzhou.aliyuncs.com/openspug/spug-service spug-service
docker rmi registry.cn-hangzhou.aliyuncs.com/openspug/spug-service

docker pull registry.cn-hangzhou.aliyuncs.com/openspug/mariadb:10.8.2
docker tag registry.cn-hangzhou.aliyuncs.com/openspug/mariadb:10.8.2 mariadb:10.8.2
docker rmi registry.cn-hangzhou.aliyuncs.com/openspug/mariadb:10.8.2

mkdir -p /data/spug/mysql
docker run -d \
  --name spug-db --restart always --network bridge \
  --mount type=bind,source=/data/spug/mysql,target=/var/lib/mysql \
  -e MYSQL_DATABASE=spug -e MYSQL_USER=spug \
  -e MYSQL_PASSWORD=123456 -e MYSQL_ROOT_PASSWORD=123456 \
  mariadb:10.8.2 \
  --port=3306 --character-set-server=utf8mb4 \
  --collation-server=utf8mb4_unicode_ci

mysql -uspug -h$(dcn spug-db) -p123456 -e 'show databases;'

mkdir -p /data/spug/{service,repos}
docker run -d \
  --name spug --restart always --network bridge --privileged=true \
  --mount type=bind,source=/data/spug/service,target=/data/spug \
  --mount type=bind,source=/data/spug/repos,target=/data/repos \
  -p 80:80 -e MYSQL_DATABASE=spug -e MYSQL_USER=spug \
  -e MYSQL_PASSWORD=123456 -e MYSQL_HOST=db \
  -e MYSQL_PORT=3306 --link spug-db:db \
  spug-service:latest

CONTAINER ID   NAMES     PORTS
fbcbad0d7c93   spug      0.0.0.0:80->80/tcp, [::]:80->80/tcp
85d383a05eaf   spug-db   3306/tcp

docker logs spug
docker exec spug init_spug admin 123456

docker rm -f spug spug-db

docker commit <容器> <镜像:标签>
docker build -t <镜像:标签> .
docker export <容器> -o rootfs.tar
docker import rootfs.tar <镜像:标签>

docker build -t my-image:v1.0 .
docker tag my-image:v1.0 registry.example.com/team/my-image:v1.0
docker run -d --name my-container -p 8080:80 my-image:v1.0
docker stop my-container
docker start my-container
docker restart my-container

# 登录并确保具有目标仓库权限后才可推送
docker login registry.example.com
docker push registry.example.com/team/my-image:v1.0
docker pull registry.example.com/team/my-image:v1.0

docker save -o my-image.tar my-image:v1.0
docker load -i my-image.tar

RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*

docker build [OPTIONS] PATH|URL|-

docker build -t my-image:v1 .
docker build -t my-image:v1 -f /path/to/Dockerfile /path/to/context
docker build --build-arg APP_VERSION=1.2 -t my-image:v1 .

docker builder prune
docker builder prune -a --force
docker builder prune --keep-storage=5GB
docker builder prune -f
docker system prune -a --volumes

FROM [--platform=<platform>] <image>[:<tag>|@<digest>] [AS <name>]

FROM ubuntu:20.04

FROM nginx:latest

FROM python:3.9-slim

LABEL version="1.0"
LABEL author="John Doe" \
      description="This is a sample Docker image"
LABEL description="This image is used to run a web server."

RUN <command>
RUN ["executable", "param1", "param2"]

RUN apt-get update && apt-get install -y curl wget vim

RUN yum install -y curl wget

RUN wget https://example.com/file.tar.gz -O /tmp/file.tar.gz && \
    tar -xzf /tmp/file.tar.gz -C /opt && rm /tmp/file.tar.gz

RUN ["apt-get", "update"]

RUN cd nginx-1.29.0 && ./configure

EXPOSE 80
EXPOSE 80 443
EXPOSE 80/tcp
EXPOSE 53/udp

CMD command param1 param2

CMD ["executable", "param1", "param2"]

CMD ["/bin/bash", "-c", "echo hello"]

CMD ["param1", "param2"]

CMD ["echo", "Hello, Docker"]

CMD ["nginx", "-g", "daemon off;"]

CMD ["/apps/nginx/sbin/nginx", "-g", "daemon off;"]

ENTRYPOINT command param1 param2
ENTRYPOINT ["executable", "param1", "param2"]

ENTRYPOINT ["nginx", "-g", "daemon off;"]

ENTRYPOINT ["/usr/sbin/nginx"]
CMD ["-g", "daemon off;"]

mkdir -p /data/images/nginx
cd /data/images/nginx

FROM rockylinux:9
LABEL description="Nginx compiled on Rocky Linux 9"
RUN yum install -y gcc make pcre2-devel zlib-devel wget tar gzip
RUN wget https://nginx.org/download/nginx-1.29.0.tar.gz
RUN tar xf nginx-1.29.0.tar.gz
RUN cd nginx-1.29.0 && ./configure --prefix=/data/server/nginx
RUN cd nginx-1.29.0 && make && make install
RUN echo "Nginx Web Page from Rocky" > /data/server/nginx/html/index.html
RUN rm -rf nginx-1.29.0*
RUN yum autoremove -y && yum clean all && rm -rf /var/cache/yum
EXPOSE 80
ENTRYPOINT ["/data/server/nginx/sbin/nginx", "-g", "daemon off;"]

docker build -t nginx-test:v1 .
docker run --name nginx_test -d nginx-test:v1
dps
curl $(dcn nginx_test)
docker rm -f nginx_test

cp Dockerfile{,.bak}

ENTRYPOINT ["/data/server/nginx/sbin/nginx"]
CMD ["-g", "daemon off;"]

docker build -t nginx-test:v2 .
docker run --name nginx_test -d nginx-test:v2
dps
dcc nginx_test

# 覆盖默认参数：检查配置，是一次性任务
docker run --rm --name nginx_test1 nginx-test:v2 -t

# 让已运行的服务重新加载配置，应在原容器内执行
docker exec nginx_test /data/server/nginx/sbin/nginx -s reload

ENV APP_PORT=8080 DB_HOST=localhost
ENV APP_ENV=production
CMD ["node", "app.js"]

ENV NODE_VERSION=16.14.2
RUN curl -fsSL "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.gz" \
    | tar -xz -C /usr/local/

ARG DB_HOST
ENV DB_HOST=$DB_HOST

COPY [--chown=<user>:<group>] <源路径>... <目标路径>
COPY [--chown=<user>:<group>] ["<源路径1>", "<目标路径>"]

COPY app.js /app/
COPY src/ /app/src/
COPY *.txt /app/config/
COPY --chown=www-data:www-data html/ /var/www/html/
COPY file.txt /app/new.txt

ADD [--chown=<user>:<group>] <源路径>... <目标路径>
ADD [--chown=<user>:<group>] ["<源路径1>", "<目标路径>"]

ADD app.js /app/
ADD src/ /app/src/
ADD https://example.com/file.txt /app/data/
ADD archive.tar.gz /app/
ADD --chown=www-data:www-data html/ /var/www/html/

WORKDIR /app
RUN echo "Hello from $(pwd)"
COPY . .

WORKDIR /tmp
RUN touch test.txt
WORKDIR /app
RUN cp /tmp/test.txt .

WORKDIR /app
WORKDIR src
# 当前工作目录为 /app/src

WORKDIR /app
CMD ["node", "server.js"]

USER <用户名或UID>[:<组名或GID>]

RUN useradd -m appuser
WORKDIR /app
RUN chown appuser:appuser /app
USER appuser
RUN touch /app/file
RUN echo "Hello" > /app/hello.txt
CMD ["node", "server.js"]

ARG <参数名>[=<默认值>]

ARG APP_ENV=development
RUN echo "Building for $APP_ENV"

docker build --build-arg APP_ENV=production -t myapp .

ARG NODE_VERSION=16
ENV NODE_VERSION=$NODE_VERSION
LABEL runtime.node=$NODE_VERSION

ARG BUILD_DATE
LABEL build.date=$BUILD_DATE

docker build --build-arg BUILD_DATE="$(date +%Y-%m-%d)" -t myapp .

mkdir -p /data/images/nginx1/{softs,conf}
cd /data/images/nginx1/softs
wget https://nginx.org/download/nginx-1.29.0.tar.gz
wget https://nginx.org/download/nginx-1.28.0.tar.gz
cd ../conf
echo 'Nginx VERSION Web Page from Rocky' > index.html
cd ..

FROM rockylinux:9
LABEL description="Versioned Nginx on Rocky Linux 9"
ENV NGINX_PREFIX=/data/server/nginx \
    BUILD_DIR=/tmp/build \
    NGINX_USER=nginx \
    NGINX_GROUP=nginx
RUN groupadd -r "$NGINX_GROUP" && \
    useradd -r -g "$NGINX_GROUP" "$NGINX_USER"
WORKDIR $BUILD_DIR
RUN yum install -y gcc make pcre2-devel zlib-devel wget tar gzip && \
    yum clean all && rm -rf /var/cache/yum
ARG NGINX_VERSION=1.29.0
ADD softs/nginx-${NGINX_VERSION}.tar.gz .
WORKDIR nginx-${NGINX_VERSION}
RUN ./configure --prefix="$NGINX_PREFIX" \
      --user="$NGINX_USER" --group="$NGINX_GROUP" && \
    make && make install
WORKDIR $NGINX_PREFIX
COPY conf/index.html html/
RUN sed -i "s/VERSION/$NGINX_VERSION/" html/index.html && \
    sed -i -E 's/(listen[[:space:]]+)80;/\18080;/' conf/nginx.conf && \
    chown -R "$NGINX_USER:$NGINX_GROUP" "$NGINX_PREFIX"
RUN yum autoremove -y && rm -rf /tmp/build
USER $NGINX_USER
EXPOSE 8080
ENTRYPOINT ["sbin/nginx", "-g", "daemon off;"]

docker build -t rocky_nginx:v1.29.0 .
docker build --build-arg NGINX_VERSION=1.28.0 -t rocky_nginx:v1.28.0 .
docker run --name nginx-1.29 -d rocky_nginx:v1.29.0
docker run --name nginx-1.28 -d rocky_nginx:v1.28.0
dps
curl "$(dcn nginx-1.29):8080"
curl "$(dcn nginx-1.28):8080"

dka
docker builder prune -a --force
docker images --filter dangling=true
docker image prune -f

<none>   <none>   8d4884557405   46 hours ago   563MB
<none>   <none>   81a1bc8dd2f6   2 days ago     192MB

VOLUME /path/to/volume
VOLUME ["/path1", "/path2"]

ONBUILD <Dockerfile 指令>

FROM node:18
WORKDIR /app
ONBUILD COPY package*.json ./
ONBUILD RUN npm install
ONBUILD COPY . .
CMD ["node", "index.js"]

FROM my-node-base
ENV NODE_ENV=production
CMD ["npm", "start"]

HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
    CMD curl -f http://localhost:8080/ || exit 1
STOPSIGNAL SIGQUIT

cd /data/images
cp -a nginx1 nginx2
cd nginx2
mkdir -p scripts

worker_processes 1;
events {
    worker_connections 1024;
}
http {
    include mime.types;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 65;
    server {
        listen 8080;
        server_name localhost;
        location / {
            root html;
            index index.html index.htm;
        }
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root html;
        }
    }
    include conf.d/*.conf;
}

log_format custom_format '$remote_addr - $remote_user [$time_local] '
                         '"$request" $status $body_bytes_sent '
                         '"$http_referer" "$http_user_agent" '
                         '"$http_x_forwarded_for"';
access_log /data/server/nginx/logs/access_custom.log custom_format;
server {
    listen 8081;
    server_name localhost;
    location /test {
        return 200 "Hello from extra.conf!\n";
    }
}

#!/bin/sh
set -eu
exec "$NGINX_PREFIX/sbin/nginx" -g 'daemon off;'

chmod +x scripts/start-nginx.sh

FROM rockylinux:9
LABEL description="Nginx ONBUILD base on Rocky Linux 9"
ENV NGINX_PREFIX=/data/server/nginx \
    BUILD_DIR=/tmp/build \
    NGINX_USER=nginx \
    NGINX_GROUP=nginx
RUN groupadd -r "$NGINX_GROUP" && \
    useradd -r -g "$NGINX_GROUP" "$NGINX_USER"
WORKDIR $BUILD_DIR
RUN yum install -y gcc make pcre2-devel zlib-devel wget tar gzip curl && \
    yum clean all && rm -rf /var/cache/yum
ARG NGINX_VERSION=1.29.0
ADD softs/nginx-${NGINX_VERSION}.tar.gz .
WORKDIR nginx-${NGINX_VERSION}
RUN ./configure --prefix="$NGINX_PREFIX" \
      --user="$NGINX_USER" --group="$NGINX_GROUP" && \
    make && make install
WORKDIR $NGINX_PREFIX
COPY conf/index.html html/
COPY conf/nginx.conf conf/
COPY scripts/start-nginx.sh sbin/
RUN mkdir -p conf/conf.d && \
    sed -i "s/VERSION/$NGINX_VERSION/" html/index.html && \
    chmod +x sbin/start-nginx.sh && \
    chown -R "$NGINX_USER:$NGINX_GROUP" "$NGINX_PREFIX" && \
    rm -rf /tmp/build
EXPOSE 8080 8081
VOLUME ["/data/server/nginx/conf/conf.d"]
ONBUILD USER root
ONBUILD COPY conf/extra.conf /data/server/nginx/conf/conf.d/extra.conf
ONBUILD RUN chown -R "$NGINX_USER:$NGINX_GROUP" "$NGINX_PREFIX"
ONBUILD USER nginx
ONBUILD RUN /data/server/nginx/sbin/nginx -t
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
    CMD curl -f http://localhost:8080/ || exit 1
STOPSIGNAL SIGQUIT
USER nginx
ENTRYPOINT ["sbin/start-nginx.sh"]

FROM nginx-base

docker build -t nginx-base .
docker build -f Dockerfile.derived -t nginx-derived .
docker run -d -p 80:8080 -p 8080:8081 --name nginx-test nginx-derived
docker inspect nginx-test --format '{{json .Mounts}}'
docker ps
docker inspect nginx-test --format '{{json .State.Health}}'
curl localhost
curl localhost:8080
curl localhost:8080/test

STATUS                         PORTS                      NAMES
Up About a minute (healthy)    0.0.0.0:80->80/tcp, ...     nginx-test

CREATED         STATUS                       PORTS   NAMES
6 seconds ago   Exited (1) 6 seconds ago               nginx-test
nginx: [alert] could not open error log file: open()
"/data/server/nginx/logs/error.log" failed (13: Permission denied)
[emerg] 1#0: open() "/data/server/nginx/logs/access_custom.log"
failed (13: Permission denied)

# 版本控制
.git
.gitignore

# 依赖与构建产物
node_modules
dist
build
*.log

# 环境与编辑器
.env
.ENV
.idea
.vscode

# 如前面有规则排除了该文件，可重新包含
!package.json

.dockerignore
Dockerfile
Dockerfile.derived
tmp/
build/
*.log
*.tmp
.cache/
logs/
*.key
*.pem
.env
passwords.txt
.git/
.gitignore
.idea/
.vscode/
**/*.md
**/*.txt
**/*.log

mkdir -p files
touch files/file-{1..5}.txt
touch files/file-{1..5}.log
touch files/file-{1..5}.md
touch files/file-{1..5}.png

COPY files files

docker build --progress=plain -t nginx-test .
docker run -d --name nginx-ignore-test nginx-test
docker exec nginx-ignore-test ls files

#18 [14/14] COPY files files
#18 DONE 0.0s

dka
docker image prune -f
docker builder prune -a --force

# 仅当备份目标不存在时使用该示例
mv /data/images /data/images-bak
mkdir -p /data/images/{web/{nginx,apache,tomcat,jdk},system/{centos,ubuntu,alpine,debian}}

# 明确拉取指定版本，不能给任意 latest 改标签就认为它是 3.22.0
docker pull alpine:3.22.0
docker history alpine:3.22.0
cd /data/images/system/alpine

https://mirrors.aliyun.com/alpine/v3.22/main
https://mirrors.aliyun.com/alpine/v3.22/community

ARG VERSION=3.22.0
FROM alpine:$VERSION
LABEL description="Alpine Linux 3.22 common build environment"
COPY repositories /etc/apk/repositories
RUN apk update && apk add --no-cache \
    tzdata gcc make curl zip unzip net-tools psmisc wget \
    libgcc musl-dev pcre2-dev zlib-dev iproute2 tar gzip && \
    ln -snf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
    echo 'Asia/Shanghai' > /etc/timezone

docker build -t alpine-base:3.22 .

mkdir -p /data/images/web/nginx/1.29.0/{softs,html,conf}
cd /data/images/web/nginx/1.29.0/softs
wget https://nginx.org/download/nginx-1.29.0.tar.gz
cd ../html
echo 'Test Page based nginx-alpine' > index.html
cd ../conf

worker_processes 1;
daemon off;
events {
    worker_connections 1024;
}
http {
    include mime.types;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 65;
    server {
        listen 80;
        server_name localhost;
        location / {
            root html;
            index index.html index.htm;
        }
    }
}

ARG VERSION=3.22
FROM alpine-base:$VERSION
ARG NGINX_VERSION=1.29.0
LABEL description="Nginx compiled on Alpine Linux"
ADD softs/nginx-${NGINX_VERSION}.tar.gz /usr/local/src/
ENV NGINX_DIR=/data/server/nginx
RUN cd "/usr/local/src/nginx-$NGINX_VERSION" && \
    ./configure --prefix="$NGINX_DIR" --user=nginx --group=nginx && \
    make && make install && \
    ln -s "$NGINX_DIR/sbin/nginx" /usr/sbin/nginx && \
    addgroup -g 888 -S nginx && \
    adduser -s /sbin/nologin -S -D -u 888 -G nginx nginx
COPY conf/nginx.conf ${NGINX_DIR}/conf/nginx.conf
COPY html/index.html ${NGINX_DIR}/html/index.html
RUN chown -R nginx:nginx "$NGINX_DIR"
EXPOSE 80
CMD ["nginx"]

cd /data/images/web/nginx/1.29.0
docker build -t nginx-alpine:1.29.0 .
docker run -d -p 80:80 nginx-alpine:1.29.0
curl localhost

mkdir -p /data/images/app/{java,golang,python}
cd /data/images/app/java

FROM alpine-base:3.22
LABEL description="Alpine Linux 3.22 with OpenJDK 17"
ARG JDK_PACKAGE=openjdk17
RUN apk update && \
    apk add --no-cache "$JDK_PACKAGE" tzdata && \
    rm -rf /var/cache/apk/* && \
    ln -snf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
    echo 'Asia/Shanghai' > /etc/timezone
ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk
ENV PATH=${JAVA_HOME}/bin:${PATH}
RUN java -version && javac -version
CMD ["sh"]

docker build -t jdk-alpine:17 .
docker run --rm jdk-alpine:17 java -version

mkdir -p /data/images/web/halo/jar
cd /data/images/web/halo
# 将实际配套 HelloWorld.java 放入 jar/，不要用空文件替代
docker run -it --name java_test -v ./jar:/jar jdk-alpine:17 sh

cd /jar
javac HelloWorld.java
printf 'Main-Class: HelloWorld\n\n' > MANIFEST.MF
jar cfm hello-world.jar MANIFEST.MF *.class
ls -l hello-world.jar
jar tf hello-world.jar
exit

-rw-r--r-- 1 root root 1192 Jul 22 14:39 hello-world.jar
META-INF/
META-INF/MANIFEST.MF
HelloWorld$1.class
HelloWorld.class

FROM jdk-alpine:17
WORKDIR /app
COPY jar/hello-world.jar /app/hello-world.jar
EXPOSE 8000
ENTRYPOINT ["java", "-jar", "hello-world.jar"]

docker build -t hello-world-app:1.0 .
docker run -d -p 8000:8000 --name hello-app hello-world-app:1.0
curl localhost:8000
docker logs hello-app

dka
docker image prune -f
docker builder prune -a --force

FROM <构建镜像> AS builder
# 编译、打包

FROM <运行镜像>
COPY --from=builder /绝对产物路径 /运行目录/

docker build --target builder -t app-builder .

FROM maven:3.9-eclipse-temurin-17 AS builder
WORKDIR /app
COPY pom.xml ./
COPY src/ ./src/
RUN mvn package -DskipTests

FROM eclipse-temurin:17-jre-alpine
WORKDIR /app
COPY --from=builder /app/target/*.jar app.jar
EXPOSE 8000
ENTRYPOINT ["java", "-jar", "app.jar"]

cd /data/images/web
cp -a halo halo2
cd halo2
rm -f jar/*.class jar/hello-world.jar
ls jar

HelloWorld.java   MANIFEST.MF

FROM jdk-alpine:17 AS builder
WORKDIR /build
COPY jar/HelloWorld.java .
RUN javac HelloWorld.java
RUN printf 'Main-Class: HelloWorld\n\n' > MANIFEST.MF
RUN jar cfm hello-world.jar MANIFEST.MF *.class

FROM jdk-alpine:17
WORKDIR /app
COPY --from=builder /build/hello-world.jar .
EXPOSE 8000
ENTRYPOINT ["java", "-jar", "hello-world.jar"]

docker build -t hello-world-app:multi-stage .

mkdir -p /data/image/case/python
cd /data/image/case/python

FROM alpine-base:3.22
ENV PYTHON_VERSION=3.11.0 \
    PYTHON_HOME=/usr/local
RUN apk add --no-cache \
    gcc g++ make musl-dev libffi-dev openssl-dev zlib-dev bzip2-dev \
    readline-dev sqlite-dev wget tar xz && \
    cd /tmp && \
    wget "https://mirrors.aliyun.com/python-release/source/Python-${PYTHON_VERSION}.tgz" && \
    tar -xzf "Python-${PYTHON_VERSION}.tgz" && \
    cd "Python-${PYTHON_VERSION}" && \
    ./configure --enable-optimizations --with-ensurepip=install && \
    make -j"$(nproc)" && \
    make install && \
    ln -sf "${PYTHON_HOME}/bin/python3.11" /usr/bin/python3 && \
    cd / && \
    rm -rf /var/cache/apk/* \
      "/tmp/Python-${PYTHON_VERSION}" \
      "/tmp/Python-${PYTHON_VERSION}.tgz" && \
    python3 --version

docker build -t python-alpine:3.11-single .
docker images python-alpine

[+] Building 359.2s (6/6) FINISHED

mkdir -p /data/image/case/python2
cd /data/image/case/python2

FROM alpine-base:3.22 AS builder
RUN apk add --no-cache \
    gcc g++ make musl-dev libffi-dev openssl-dev zlib-dev bzip2-dev \
    readline-dev sqlite-dev wget tar xz
RUN cd /tmp && \
    wget -q 'https://mirrors.aliyun.com/python-release/source/Python-3.11.0.tgz' && \
    tar -xzf Python-3.11.0.tgz && \
    cd Python-3.11.0 && \
    ./configure --enable-optimizations --with-ensurepip=install && \
    make -j"$(nproc)" && \
    make install

FROM alpine-base:3.22
RUN apk add --no-cache \
    libffi openssl zlib bzip2 readline sqlite-libs
COPY --from=builder /usr/local/ /usr/local/
RUN ln -sf /usr/local/bin/python3.11 /usr/bin/python3 && \
    python3 --version && \
    python3 -m pip --version

# 原稿为了比较执行过缓存清理，实际不必每次构建都清空缓存
docker builder prune -a --force
docker build -t python-alpine:3.11-multi .
docker images python-alpine
docker run --rm python-alpine:3.11-multi python3 --version
docker run --rm python-alpine:3.11-multi python3 -m pip --version

[+] Building 335.7s (13/13) FINISHED
REPOSITORY      TAG    IMAGE ID       CREATED              SIZE
python-alpine   3.11   5cefcdd95937   About a minute ago   520MB
Python 3.11.0