# Ubuntu
apt-cache madison podman
# Rocky
yum list --showduplicates podman

podman | 4.9.3+ds1-1ubuntu0.2 | noble-updates/universe amd64
podman | 4.9.3+ds1-1ubuntu0.1 | noble-security/universe amd64
podman | 4.9.3+ds1-1build2    | noble/universe amd64

已安装的软件包
podman.x86_64   4:4.9.4-3.el9_4    @AppStream
可安装的软件包
podman.x86_64   5:5.4.0-10.el9_6   appstream

apt update
apt install -y podman
podman --version
podman info | wc -l
podman info

host:
  arch: amd64
  buildahVersion: 1.33.7
  cgroupControllers: [cpuset, cpu, io, memory, hugetlb, pids, rdma, misc]
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon_2.1.10+ds1-1build2_amd64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: unknown'
  cpuUtilization:
    idlePercent: 87.5
    systemPercent: 6.73
    userPercent: 5.77
  cpus: 2
  databaseBackend: sqlite
  distribution:
    codename: noble
    distribution: ubuntu
    version: '24.04'
  eventLogger: journald
  freeLocks: 2048
  hostname: ubuntu24-13
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.11.0-26-generic
  linkmode: dynamic
  logDriver: journald
  memFree: 1952002048
  memTotal: 4054519808
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns_1.4.0-5_amd64
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.4.0
    package: netavark_1.4.0-4_amd64
    path: /usr/lib/podman/netavark
    version: netavark 1.4.0
  ociRuntime:
    name: crun
    package: crun_1.14.1-1_amd64
    path: /usr/bin/crun
    version: |-
      crun version 1.14.1
      commit: de537a7965bfbe9992e2cfae0baeb56a08128171
      rundir: /run/user/0/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt_0.0~git20240220.1e6f92b-1_amd64
    version: pasta unknown version
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: true
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns_1.2.1-1build2_amd64
    version: |-
      slirp4netns version 1.2.1
      commit: 09e31e92fa3d2a1d3ca261adaeb012c8d75a8194
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.5
  swapFree: 4055887872
  swapTotal: 4055887872
  uptime: 0h 6m 33.00s
  variant: ''
plugins:
  authorization: null
  log: [k8s-file, none, passthrough, journald]
  network: [bridge, macvlan, ipvlan]
  volume: [local]
registries: {}
store:
  configFile: /usr/share/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 210238414848
  graphRootUsed: 12464111616
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: 'true'
    Supports d_type: 'true'
    Supports shifting: 'true'
    Supports volatile: 'true'
    Using metacopy: 'false'
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 0
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 4.9.3
  Built: 0
  BuiltTime: Thu Jan 1 08:00:00 1970
  GitCommit: ''
  GoVersion: go1.22.2
  Os: linux
  OsArch: linux/amd64
  Version: 4.9.3

apt autoremove --purge podman
rm -rf /etc/containers /var/lib/containers /run/containers /run/podman
reboot

podman --version
podman version
yum install -y podman
podman --version
podman info

podman version 4.9.4-rhel
Client: Podman Engine
Version: 4.9.4-rhel
API Version: 4.9.4-rhel
Go Version: go1.21.9 (Red Hat 1.21.9-2.el9_4)
Built: Wed May 1 09:15:44 2024
OS/Arch: linux/amd64

host:
  arch: amd64
  buildahVersion: 1.39.4
  cgroupControllers: [cpuset, cpu, io, memory, hugetlb, pids, rdma, misc]
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.10-1.el9.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: 3ea3d7f99779af0fcd69ec16c211a7dc3b4efb60'
  cpuUtilization:
    idlePercent: 95.37
    systemPercent: 2.21
    userPercent: 2.42
  cpus: 2
  databaseBackend: sqlite
  distribution:
    distribution: rocky
    version: '9.4'
  eventLogger: journald
  freeLocks: 2048
  hostname: rocky9-12
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 5.14.0-427.13.1.el9_4.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 2200293376
  memTotal: 3803803648
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.10.0-3.el9_4.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.10.0
    package: netavark-1.10.3-1.el9.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.10.3
  ociRuntime:
    name: crun
    package: crun-1.14.3-1.el9.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.14.3
      commit: 1961d211ba98f532ea52d2e80f4c20359f241a98
      rundir: /run/user/0/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20250217.ga1e48a0-1.el9.x86_64
    version: ''
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.3-1.el9.x86_64
    version: |-
      slirp4netns version 1.2.3
      commit: c22fde291bb35b354e6ca44d13be181c76a0a432
      libslirp: 4.4.0
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.2
  swapFree: 4206882816
  swapTotal: 4206882816
  uptime: 0h 21m 20.00s
  variant: ''
plugins:
  authorization: null
  log: [k8s-file, none, passthrough, journald]
  network: [bridge, macvlan, ipvlan]
  volume: [local]
registries:
  search: [registry.access.redhat.com, registry.redhat.io, docker.io]
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 75094818816
  graphRootUsed: 5430738944
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: 'false'
    Supports d_type: 'true'
    Supports shifting: 'false'
    Supports volatile: 'true'
    Using metacopy: 'true'
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 0
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 5.4.0
  Built: 1750148132
  BuiltTime: Tue Jun 17 16:15:32 2025
  GitCommit: ''
  GoVersion: go1.23.9 (Red Hat 1.23.9-1.el9_6)
  Os: linux
  OsArch: linux/amd64
  Version: 5.4.0

yum remove 'podman*'
rm -rf /etc/containers /var/lib/containers /run/containers /run/podman
reboot

wsl --status
wsl --install
wsl --update

docker info

Client:
 Version: 28.5.1
 Context: desktop-linux
 Debug Mode: false
 Plugins:
  ai: Docker AI Agent - Ask Gordon (Docker Inc.)
  ...

直接拉取：Docker CLI → dockerd → Registry
配置代理：Docker CLI → dockerd → HTTP(S) 代理 → Registry
容器应用：应用自身 → 按应用配置使用代理 → 目标服务

{
  "proxies": {
    "http-proxy": "http://proxy.example.com:3128",
    "https-proxy": "http://proxy.example.com:3128",
    "no-proxy": "localhost,127.0.0.0/8,.test.example.com,.example.org"
  }
}

[Service]
Environment="HTTP_PROXY=http://10.0.0.1:10809/"
Environment="HTTPS_PROXY=http://10.0.0.1:10809/"
Environment="NO_PROXY=localhost,127.0.0.0/8,172.17.0.0/16,10.0.0.0/24,10.244.0.0/16,192.168.0.0/16,wang.org,cluster.local"

docker run -it \
  --env http_proxy=http://proxy.example.com:8080 \
  --env https_proxy=http://proxy.example.com:8080 \
  --env no_proxy=localhost,127.0.0.1 \
  your_image_name

ENV http_proxy=http://proxy.example.com:8080
ENV https_proxy=http://proxy.example.com:8080
ENV no_proxy=localhost,127.0.0.1

docker exec -it container_name /bin/bash

export http_proxy=http://proxy.example.com:8080
export https_proxy=http://proxy.example.com:8080
export no_proxy=localhost,127.0.0.1

curl -x http://10.0.0.1:10809 https://registry-1.docker.io/v2/

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]}

ss -nt
telnet 10.0.0.1 10809

ESTAB ... [::ffff:10.0.0.13]:22 ... [::ffff:10.0.0.1]:8978 ...
Trying 10.0.0.1...
Connected to 10.0.0.1.
Escape character is '^]'.
Connection closed by foreign host.

PROXY_SERVER_IP=10.0.0.1
PROXY_PORT=10809
mkdir -p /etc/systemd/system/docker.service.d
cat > /etc/systemd/system/docker.service.d/http-proxy.conf <<PROXYCONF
[Service]
Environment="HTTP_PROXY=http://${PROXY_SERVER_IP}:${PROXY_PORT}/"
Environment="HTTPS_PROXY=http://${PROXY_SERVER_IP}:${PROXY_PORT}/"
Environment="NO_PROXY=localhost,127.0.0.0/8,172.17.0.0/16,10.0.0.0/24,192.168.0.0/16,10.244.0.0/16,cluster.local"
PROXYCONF
systemctl daemon-reload
systemctl restart docker.service
docker info | grep -i proxy

HTTP Proxy: http://10.0.0.1:10809/
HTTPS Proxy: http://10.0.0.1:10809/
No Proxy: localhost,127.0.0.0/8,172.17.0.0/16,10.0.0.0/24,192.168.0.0/16,10.244.0.0/16,cluster.local

docker pull gcr.io/google-containers/kube-proxy:v1.18.0

v1.18.0: Pulling from google-containers/kube-proxy
597de8ba0c30: Pull complete
...
51432749cbec: Pull complete
Digest: sha256:9e858386d52d0abaf936c1d10a763648ab7d85c8eb0af08a50a64238146e5571
Status: Downloaded newer image for gcr.io/google-containers/kube-proxy:v1.18.0
gcr.io/google-containers/kube-proxy:v1.18.0

rm -f /etc/systemd/system/docker.service.d/http-proxy.conf
systemctl daemon-reload
systemctl restart docker
docker info | grep -i proxy

Error response from daemon: Get "https://gcr.io/v2/": context deadline exceeded

{
  "proxies": {
    "http-proxy": "http://10.0.0.1:10809",
    "https-proxy": "http://10.0.0.1:10809",
    "no-proxy": "localhost,127.0.0.0/8,172.17.0.0/16,10.0.0.0/24,192.168.0.0/16,10.244.0.0/16,.cluster.local"
  }
}

systemctl restart docker
docker info | grep -i proxy
docker pull gcr.io/google-containers/kube-proxy:v1.17.0

v1.17.0: Pulling from google-containers/kube-proxy
597de8ba0c30: Already exists
...
d3609306ce38: Already exists
d7c1c982f192: Pull complete
Digest: sha256:b2ba9441af30261465e5c41be63e462d0050b09ad280001ae731f399b2b00b75
Status: Downloaded newer image for gcr.io/google-containers/kube-proxy:v1.17.0
gcr.io/google-containers/kube-proxy:v1.17.0

Usage: docker_set_proxy.sh {daemon|service} {start|stop}
 daemon  使用 daemon.json 配置
 service 使用 systemd 配置
 start   设置代理
 stop    取消代理

/bin/bash docker_set_proxy.sh daemon start
docker info | grep -i proxy
/bin/bash docker_set_proxy.sh daemon stop
docker info | grep -i proxy
/bin/bash docker_set_proxy.sh service start
docker info | grep -i proxy
/bin/bash docker_set_proxy.sh service stop
docker info | grep -i proxy

正在通过daemon.json取消Docker代理配置...
已备份原配置文件到 /etc/docker/daemon.json.bak [OK]
已移除代理配置(使用jq) [OK]
重新加载systemd配置 [OK]
正在重启Docker服务...
Docker服务重启成功 [OK]
Docker代理配置已成功移除! [OK]
当前Docker代理配置:
无代理相关配置

正在通过systemd配置Docker代理...
配置目录 /etc/systemd/system/docker.service.d 已存在 [OK]
写入代理配置到 /etc/systemd/system/docker.service.d/http-proxy.conf [OK]
重新加载systemd配置 [OK]
正在重启Docker服务...
Docker服务重启成功 [OK]
Docker服务代理配置验证成功! [OK]
当前Docker代理配置:
Environment=HTTP_PROXY=http://10.0.0.1:10809 HTTPS_PROXY=https://10.0.0.1:10809
NO_PROXY=127.0.0.0/8,172.17.0.0/16,10.0.0.0/24,10.244.0.0/16,192.168.0.0/16,wang.org,cluster.local

正在通过systemd取消Docker代理配置...
移除代理配置 /etc/systemd/system/docker.service.d [OK]
重新加载systemd配置 [OK]
正在重启Docker服务...
Docker服务重启成功 [OK]
Docker服务代理配置已成功移除! [OK]
当前Docker环境变量配置:
无代理相关配置

yum install -y yum-utils
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum makecache
yum list docker-ce --showduplicates

docker-ce.x86_64   3:28.2.2-1.el9   docker-ce-stable
docker-ce.x86_64   3:28.2.1-1.el9   docker-ce-stable

# 版本必须真实存在；CLI 的 epoch 不一定与 Engine 相同
yum install docker-ce-3:28.2.2-1.el9 docker-ce-cli-1:28.2.2-1.el9 containerd.io

# 或安装当前仓库版本及插件
yum install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin

systemctl is-active docker
systemctl start docker
systemctl is-active docker
docker version
docker info

Client: Docker Engine - Community
 Version: 28.2.2
 API version: 1.50
 Go version: go1.24.3
 Git commit: e6534b4
 Built: Fri May 30 12:09:15 2025
 OS/Arch: linux/amd64
 Context: default
Server: Docker Engine - Community
 Engine:
  Version: 28.2.2
  API version: 1.50 (minimum version 1.24)
  Go version: go1.24.3
  Git commit: 45873be
  Built: Fri May 30 12:07:23 2025
  OS/Arch: linux/amd64
  Experimental: false
 containerd:
  Version: 1.7.27
  GitCommit: 05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version: 1.2.5
  GitCommit: v1.2.5-0-g59923ef
 docker-init:
  Version: 0.19.0
  GitCommit: de40ad0

Client: Docker Engine - Community
 Version: 28.2.2
 Context: default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
   Version: v0.24.0
   Path: /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
   Version: v2.36.2
   Path: /usr/libexec/docker/cli-plugins/docker-compose
Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 0
 Server Version: 28.2.2
 Storage Driver: overlay2
  Backing Filesystem: xfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 05044ec0a9a75232cad458027ca83437aae3f4da
 runc version: v1.2.5-0-g59923ef
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 5.14.0-427.13.1.el9_4.x86_64
 Operating System: Rocky Linux 9.4 (Blue Onyx)
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 1.703GiB
 Name: rocky9-12
 ID: 7848764d-c041-4bc5-ba75-787886e367b5
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false

ip addr show docker0
nft list ruleset | wc -l
iptables -vnL

3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN
 link/ether 36:47:80:a6:d2:0a brd ff:ff:ff:ff:ff:ff
 inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
 valid_lft forever preferred_lft forever

Warning: table ip nat is managed by iptables-nft, do not touch!
Warning: table ip filter is managed by iptables-nft, do not touch!
Warning: table ip6 nat is managed by iptables-nft, do not touch!
102

INPUT policy ACCEPT
FORWARD policy DROP
  DOCKER-USER
  DOCKER-FORWARD
OUTPUT policy ACCEPT
DOCKER:
  DROP all -- !docker0 docker0 0.0.0.0/0 0.0.0.0/0
DOCKER-BRIDGE:
  DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
DOCKER-CT:
  ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
DOCKER-FORWARD:
  DOCKER-CT
  DOCKER-ISOLATION-STAGE-1
  DOCKER-BRIDGE
  ACCEPT all -- docker0 * 0.0.0.0/0 0.0.0.0/0
DOCKER-ISOLATION-STAGE-1:
  DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
DOCKER-ISOLATION-STAGE-2:
  DROP all -- * docker0 0.0.0.0/0 0.0.0.0/0
DOCKER-USER:
  无自定义规则

ip addr show docker0
route -n
iptables -vnL

Unable to find image 'hello-world:latest' locally
docker: Error response from daemon: Get "https://registry-1.docker.io/v2/":
net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
Run 'docker run --help' for more information

{
  "registry-mirrors": [
    "https://docker.xuanyuan.me"
  ]
}

systemctl restart docker
docker info | grep -A2 Regi
curl https://docker.xuanyuan.me/v2/
docker run hello-world

Insecure Registries:
 ::1/128
 127.0.0.0/8
Registry Mirrors:
 https://docker.xuanyuan.me/
Live Restore Enabled: false

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
e6590344b1a5: Pull complete
Digest: sha256:940c619fbd418f9b2b1b63e25d8861f9cc1b46e3fc8b018ccfe8b78f19b8cc4f
Status: Downloaded newer image for hello-world:latest
Hello from Docker!
This message shows that your installation appears to be working correctly.

docker ps -a
docker rm -f edc
systemctl stop docker.service docker.socket
yum remove docker-ce docker-ce-cli docker-buildx-plugin \
  docker-ce-rootless-extras docker-compose-plugin containerd.io

rm -rf /etc/docker /var/lib/docker /var/lib/containerd
rm -f /etc/yum.repos.d/docker-ce.repo
reboot

rpm -ql docker-ce | grep docker.service
cat /usr/lib/systemd/system/docker.service

[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target nss-lookup.target docker.socket firewalld.service containerd.service time-set.target
Wants=network-online.target containerd.service
Requires=docker.socket
StartLimitBurst=3
StartLimitIntervalSec=60

[Service]
Type=notify
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutStartSec=0
RestartSec=2
Restart=always
LimitNPROC=infinity
LimitCORE=infinity
TasksMax=infinity
Delegate=yes
KillMode=process
OOMScoreAdjust=-500

[Install]
WantedBy=multi-user.target

{
  "registry-mirrors": ["https://mirror.example.com"],
  "data-root": "/var/lib/docker",
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "experimental": false
}

{
  "registry-mirrors": ["https://mirror.example.com"],
  "insecure-registries": ["myregistry.local:5000"],
  "max-concurrent-downloads": 10,
  "max-concurrent-uploads": 5
}

{
  "data-root": "/mnt/docker-data",
  "storage-driver": "overlay2"
}

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3",
    "labels": "production_status",
    "env": "os,customer"
  }
}

{
  "bip": "172.17.0.1/16",
  "mtu": 1450,
  "default-address-pools": [
    {"base": "172.28.0.0/16", "size": 24},
    {"base": "172.29.0.0/16", "size": 24}
  ]
}

{
  "userns-remap": "default",
  "seccomp-profile": "/etc/docker/seccomp.json",
  "cgroup-parent": "docker.slice",
  "live-restore": true
}

{
  "debug": true,
  "experimental": true,
  "metrics-addr": "127.0.0.1:9323"
}

{
  "hosts": ["unix:///var/run/docker.sock", "tcp://127.0.0.1:2375"]
}

{
  "ipv6": true,
  "fixed-cidr-v6": "2001:db8:1::/64"
}

{
  "default-ulimits": {
    "nofile": {"Name": "nofile", "Hard": 65536, "Soft": 65536}
  },
  "default-shm-size": "256m"
}

unqualified-search-registries = ["docker.io", "quay.io", "registry.access.redhat.com"]
short-name-mode = "enforcing"

[[registry]]
prefix = "docker.io"
location = "docker.io"
insecure = false

[[registry.mirror]]
location = "mirror1.example.com"
insecure = false

[[registry.mirror]]
location = "mirror2.example.com"
insecure = false

[[registry]]
prefix = "myregistry.example.com"
location = "myregistry.example.com"
insecure = true

[aliases]
"nginx" = "docker.io/library/nginx"

rpm -ql docker-ce
docker info

/etc/docker
/usr/bin/docker-proxy
/usr/bin/dockerd
/usr/lib/.build-id/29/7ae7d963b1d086bda9a175fdea23aede84174b
/usr/lib/.build-id/5e/a3b63c402bc4ede3e624dae4bba674c1a5cbdf
/usr/lib/.build-id/97/d094c5e36ef7995b54069b3c2a6f699d4df640
/usr/lib/systemd/system/docker.service
/usr/lib/systemd/system/docker.socket
/usr/libexec/docker/docker-init
/usr/share/man/man8/dockerd.8.gz

WARNING: No swap limit support

GRUB_CMDLINE_LINUX="<原有参数> cgroup_enable=memory swapaccount=1"

update-grub
reboot

GRUB_CMDLINE_LINUX="... rd.lvm.lv=rl_bogon/swap cgroup_enable=memory swapaccount=1"

grub2-mkconfig -o /boot/grub2/grub.cfg
reboot

docker info | grep -i driver
ls /var/lib/docker
ls /var/lib/docker/overlay2
ls /var/lib/docker/overlay2/l

Storage Driver: overlay2
Logging Driver: json-file
Cgroup Driver: systemd

buildkit containers engine-id image network overlay2 plugins runtimes swarm tmp volumes

/var/lib/docker/overlay2/:
backingFsBlockDev l

fdisk -l | grep dev

/dev/nvme0n1                 200 GiB   214748364800 bytes   419430400 sectors
/dev/nvme0n1p1               2048 .. 2099199       1G Linux
/dev/nvme0n1p2               2099200 .. 419430399 199G Linux LVM
/dev/mapper/rl_bogon-root    70 GiB    75161927680 bytes
/dev/mapper/rl_bogon-swap    2.02 GiB  2164260864 bytes
/dev/mapper/rl_bogon-home    126.98 GiB 136344240128 bytes
/dev/sda                     20 GiB   21474836480 bytes   41943040 sectors

# 仅对应已核实为空的实验盘
mkfs.xfs -n ftype=1 /dev/sda

meta-data=/dev/sda  isize=512 agcount=4 agsize=1310720 blks
                 sectsz=512 attr=2 projid32bit=1
                 crc=1 finobt=1 sparse=1 rmapbt=0
                 reflink=1 bigtime=1 inobtcount=1 nrext64=0
data             bsize=4096 blocks=5242880 imaxpct=25
                 sunit=0 swidth=0 blks
naming=version 2 bsize=4096 ascii-ci=0 ftype=1
log=internal log bsize=4096 blocks=16384 version=2
                 sectsz=512 sunit=0 blks lazy-count=1
realtime=none    extsz=4096 blocks=0 rtextents=0

systemctl stop docker.service docker.socket
mount /dev/sda /var/lib/docker
ls /var/lib/docker

{
  "registry-mirrors": ["https://docker.xuanyuan.me"],
  "storage-driver": "vfs"
}

systemctl start docker
docker info | grep -i driver
ls /var/lib/docker
ls /var/lib/docker/vfs
docker pull busybox
ls /var/lib/docker/vfs
ls /var/lib/docker/vfs/dir

Storage Driver: vfs
Logging Driver: json-file
Cgroup Driver: systemd

buildkit containers engine-id image network plugins runtimes swarm tmp vfs volumes

# 拉取前 vfs 中
backingFsBlockDev

Using default tag: latest
latest: Pulling from library/busybox
90b9666d4aed: Pull complete
Digest: sha256:f85340bf132ae937d2c2a763b8335c9bab35d6e8293f70f606b9c6178d84f42b
Status: Downloaded newer image for busybox:latest
docker.io/library/busybox:latest

# 拉取后
backingFsBlockDev dir

e8b88f6b47377e7803c60bcb49815b57298772515980f50d25f8f239291fbe86

ls /var/lib/docker/vfs/dir/e8b88f6b47377e7803c60bcb49815b57298772515980f50d25f8f239291fbe86/
ls -l /var/lib/docker/vfs
du -sh /var/lib/docker/vfs
docker images

bin dev etc home lib lib64 root tmp usr var

brw-------. 1 root root 8,0 ... backingFsBlockDev
drwx--x---. 3 root root 78  ... dir

4.2M /var/lib/docker/vfs
REPOSITORY   TAG      IMAGE ID       CREATED       SIZE
busybox      latest   6d3e4188a38a   9 months ago  4.28MB

umount: /var/lib/docker/: 目标忙.

systemctl stop docker.service docker.socket
umount /var/lib/docker

{
  "registry-mirrors": ["https://docker.xuanyuan.me"]
}

systemctl start docker
docker info | grep -i driver
ls /var/lib/docker

PROXY_SERVER_IP=10.0.0.1
PROXY_PORT=10809
mkdir -p /etc/systemd/system/containerd.service.d
cat > /etc/systemd/system/containerd.service.d/http-proxy.conf <<PROXYCONF
[Service]
Environment="HTTP_PROXY=http://${PROXY_SERVER_IP}:${PROXY_PORT}/"
Environment="HTTPS_PROXY=http://${PROXY_SERVER_IP}:${PROXY_PORT}/"
Environment="NO_PROXY=localhost,127.0.0.0/8,172.17.0.0/16,10.0.0.0/24,10.244.0.0/16,192.168.0.0/16,wang.org,cluster.local"
PROXYCONF
systemctl daemon-reload
systemctl restart containerd.service

{
  "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"]
}

[Service]
ExecStart=/usr/bin/dockerd -H unix:///var/run/docker.sock -H tcp://0.0.0.0:2375

docker --help
dockerd --help
man docker
man dockerd

mkdir -p /etc/systemd/system/docker.service.d
cat > /etc/systemd/system/docker.service.d/remote-api.conf <<'UNITCONF'
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd --containerd=/run/containerd/containerd.sock
UNITCONF

{
  "registry-mirrors": ["https://docker.xuanyuan.me"],
  "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"]
}

systemctl daemon-reload
systemctl restart docker
ss -lntp
docker info

tcp6 0 0 :::2375 :::* LISTEN 2990/dockerd

[DEPRECATION NOTICE]: API is accessible on http://0.0.0.0:2375 without encryption.
Access to the remote API is equivalent to root access on the host.
In future versions this will be a hard failure preventing the daemon from starting!

# 服务器本地 Unix socket
docker -H unix:///var/run/docker.sock ps

# 原实验中另一台主机访问 TCP API
docker -H tcp://10.0.0.12:2375 version

ssh-keygen
ssh-copy-id root@10.0.0.12
docker -H ssh://root@10.0.0.12 version

[Service]
ExecStart=
ExecStart=/data/server/docker/dockerd -H unix:///var/run/docker.sock -H tcp://0.0.0.0:2375

systemctl daemon-reload
systemctl restart docker.service
ss -lntp

tcp6 0 0 :::2375 :::* LISTEN 3180/dockerd

docker -H tcp://10.0.0.13:2375 version

apt install -y jq
# 明确连接本机地址，不使用 0.0.0.0 作为目标
curl -s http://127.0.0.1:2375/version | jq

# 不开 TCP 监听也可查询本地 API
curl --unix-socket /var/run/docker.sock http://localhost/version | jq

{
  "Platform": {"Name": "Docker Engine - Community"},
  "Components": [{"Name": "Engine"}],
  "Version": "28.3.0",
  "ApiVersion": "1.51",
  "MinAPIVersion": "1.24",
  "GitCommit": "265f709",
  "GoVersion": "go1.24.4",
  "Os": "linux",
  "Arch": "amd64",
  "KernelVersion": "6.11.0-28-generic",
  "BuildTime": "2025-06-24T15:44:12.000000000+00:00"
}

/bin/bash deploy_docker_tls.sh server 10.0.0.12

正在生成 TLS 证书...
Certificate request self-signature ok
subject=CN=*
Certificate request self-signature ok
subject=CN=client
证书生成完成！
正在配置 Docker 守护进程...
重启 Docker 服务...
Docker 服务已重启！

/bin/bash deploy_docker_tls.sh client 10.0.0.13

正在配置客户端...
Docker服务器地址是(10.0.0.12):
请复制如下命令进行测试

ssh root@10.0.0.13 mkdir -p /root/.docker
scp /etc/docker/certs.d/{ca.pem,cert.pem,key.pem} root@10.0.0.13:/root/.docker/

docker --tlsverify \
  --tlscacert=/root/.docker/ca.pem \
  --tlscert=/root/.docker/cert.pem \
  --tlskey=/root/.docker/key.pem \
  -H tcp://10.0.0.12:2375 info

docker images
docker pull nginx
docker images
docker history nginx
docker image inspect nginx

Using default tag: latest
latest: Pulling from library/nginx
dad67da3f26b: Pull complete
4eb3a9835b30: Pull complete
021db26e13de: Pull complete
397cc88dcd41: Pull complete
5f4a88bd8474: Pull complete
66467f827546: Pull complete
f05e87039331: Pull complete
Digest: sha256:dc53c8f25a10f9109190ed5b59bda2d707a3bde0e45857ce9e1efaa32ff9cbc1
Status: Downloaded newer image for nginx:latest
docker.io/library/nginx:latest

REPOSITORY   TAG      IMAGE ID       CREATED     SIZE
nginx        latest   9a9a9fd723f1   2 days ago  192MB

{
  "Id": "sha256:9a9a9fd723f1d2ba52b914ece050f298eec04ef490a9065c52805e46779c4c43",
  "RepoTags": ["nginx:latest"],
  "RepoDigests": ["nginx@sha256:dc53c8f25a10f9109190ed5b59bda2d707a3bde0e45857ce9e1efaa32ff9cbc1"],
  "Parent": "",
  "Comment": "buildkit.dockerfile.v0",
  "Created": "2025-06-24T20:52:14Z",
  "DockerVersion": "",
  "Author": "",
  "Config": {
    "ExposedPorts": {"80/tcp": {}},
    "Env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
      "NGINX_VERSION=1.29.0",
      "NJS_VERSION=0.9.0",
      "NJS_RELEASE=1~bookworm",
      "PKG_RELEASE=1~bookworm",
      "DYNPKG_RELEASE=1~bookworm"
    ],
    "Entrypoint": ["/docker-entrypoint.sh"],
    "Cmd": ["nginx", "-g", "daemon off;"],
    "Labels": {"maintainer": "NGINX Docker Maintainers <docker-maint@nginx.com>"},
    "StopSignal": "SIGQUIT"
  },
  "Architecture": "amd64",
  "Os": "linux",
  "Size": 192226221,
  "RootFS": {
    "Type": "layers",
    "Layers": [
      "sha256:7fb72a7d1a8e984ccd01277432de660162a547a00de77151518dc9033cfb8cb4",
      "sha256:151f9feea56362593fb4b85e2020dc8c8b69d33703c6d5cf2c8769b190cc54b3",
      "sha256:13fcb2d303e83bc04c39fdd29bd0df540067619915b5deac96fc853d5c404c47",
      "sha256:6380429cac565ac597936095d7643e6fca83c978bf2ea73078e54ed571c99d2f",
      "sha256:126eaee18409d97a383bda20c227c11cbae5a58cf204af68721dac5e0dd2be53",
      "sha256:d35594dd7e6de0e30f5d19afb38855299aec1ef5cbb70f97539eca365cab1e46",
      "sha256:cd38dca3d98283db306a43da1a7e80d6bcb722ca701ce01b91dadc6baabf8235"
    ]
  },
  "Metadata": {"LastTagTime": "0001-01-01T00:00:00Z"}
}

{
  "Name": "overlay2",
  "Data": {
    "LowerDir": "/var/lib/docker/overlay2/45b817b58eb9ec12d1c6d5db87d8dec3580fca2c8b1c2bc7083562e367f74098/diff:/var/lib/docker/overlay2/2aa20330c6f353ce7faf6a6faf67c415f6709bc5ee0f2cadaa8894863c692c34/diff:/var/lib/docker/overlay2/8af8b0582053d09e6f0ccab76ec2acbdbbd52902cdbf1534452ba9ae0c1a20dc/diff:/var/lib/docker/overlay2/f4eaea38d360fa0330a71c44256b5a65c8a4393bfa8da1b679cad1d5e11acaa2/diff:/var/lib/docker/overlay2/8e189bb1298b2644b58ba1595b589211c82d771bd67e434918af59e99613540a/diff:/var/lib/docker/overlay2/49e54dd7c264c9b30d25883ce5f065804d0934b342051faf268428ecdf227777/diff",
    "MergedDir": "/var/lib/docker/overlay2/fec9ac6936916cf7f2b89976fcdc089cb86788c51e588110c8de46b4aad62d47/merged",
    "UpperDir": "/var/lib/docker/overlay2/fec9ac6936916cf7f2b89976fcdc089cb86788c51e588110c8de46b4aad62d47/diff",
    "WorkDir": "/var/lib/docker/overlay2/fec9ac6936916cf7f2b89976fcdc089cb86788c51e588110c8de46b4aad62d47/work"
  }
}

docker save -o nginx.tar nginx
mkdir -p data
tar xf nginx.tar -C data
ls -l data
ls -l data/blobs
ls -l data/blobs/sha256

docker save nginx | gzip > nginx.tar.gz

drwxr-xr-x. 3 root root   20 ... blobs
-rw-r--r--. 1 root root  362 ... index.json
-rw-r--r--. 1 root root 2286 ... manifest.json
-rw-r--r--. 1 root root   31 ... oci-layout
-rw-r--r--. 1 root root   88 ... repositories

blobs/:
drwxr-xr-x. 2 root root 4096 ... sha256

blobs/sha256/:
-rw-r--r--. 1 root root 1127 ... 0ca7b78ec97fca54170e751d074142fa02f5ec6669df8048adf0bfc292b5d42c
...
-rw-r--r--. 1 root root 482 ... fcd3176f43badcbf6aa68dd3eb303c36fade3a26eeb7ab4d045e4bcd038d6c16

docker tag nginx:latest nginx:

Error parsing reference: "nginx:" is not a valid repository/tag: invalid reference format

docker images --format '{{.Repository}}\t{{.Tag}}\t{{.Size}}'
docker images --format '{{.CreatedAt}}\t{{.Repository}}:{{.Tag}}' | sort -k1 -r
docker images --format '{{.Repository}}:{{.Tag}}'

nginx:latest
alpine:latest
redis:latest
busybox:latest
web-tomcat:v1
web-django:v1
web-nginx:v1

docker images --format '{{.Repository}}:{{.Tag}}\t{{.Size}}\t{{.CreatedAt}}'

nginx:latest    192MB   2025-06-25 04:52:14 +0800 CST
alpine:latest   8.31MB  2025-05-31 00:20:41 +0800 CST
redis:latest    128MB   2025-05-30 00:02:07 +0800 CST
busybox:latest  4.28MB  2024-09-27 05:31:42 +0800 CST
web-tomcat:v1   458MB   2024-01-16 09:09:19 +0800 CST
web-django:v1   436MB   2024-01-15 22:51:50 +0800 CST
web-nginx:v1    187MB   2024-01-15 22:50:23 +0800 CST

docker images --format 'table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}'

REPOSITORY   TAG      IMAGE ID       SIZE
nginx        latest   9592f5595f2b   192MB
alpine       latest   cea2ff433c61   8.31MB
redis        latest   ed3a2af6d0d4   128MB
busybox      latest   6d3e4188a38a   4.28MB
web-tomcat   v1       299452ffece3   458MB
web-django   v1       d001c15a4640   436MB
web-nginx    v1       48d5de12bb81   187MB

docker images --format '{"name":"{{.Repository}}","tag":"{{.Tag}}","size":"{{.Size}}"}'
docker images --format '{"name":"{{.Repository}}","tag":"{{.Tag}}"}' | jq .

{"name":"nginx","tag":"latest","size":"192MB"}
{"name":"alpine","tag":"latest","size":"8.31MB"}
{"name":"redis","tag":"latest","size":"128MB"}
{"name":"busybox","tag":"latest","size":"4.28MB"}
{"name":"web-tomcat","tag":"v1","size":"458MB"}
{"name":"web-django","tag":"v1","size":"436MB"}
{"name":"web-nginx","tag":"v1","size":"187MB"}

docker images --format '{{.Size}}'
docker system df
docker system df -v

# 仅能演示这个“所有值都为 MB”的样本求和，不能作为通用磁盘统计
# docker images --format '{{.Size}}' | awk -F'M' '{sum+=$1} END {print sum "MB"}'

docker images --filter 'dangling=true'
docker images -f 'dangling=false'

REPOSITORY   TAG      IMAGE ID       CREATED          SIZE
<none>       <none>   e395fa7ced4e   28 minutes ago   631MB
<none>       <none>   0b75057d6a95   28 minutes ago   631MB
<none>       <none>   82053db84dd7   32 minutes ago   627MB
<none>       <none>   c173bb524ea7   32 minutes ago   627MB
<none>       <none>   ed55b7e58a39   32 minutes ago   627MB
<none>       <none>   46c144c7b667   32 minutes ago   627MB
<none>       <none>   cff6fceebb23   33 minutes ago   627MB

create → start → running
running → pause → paused → unpause → running
running → 主进程退出/stop/kill → exited
exited → start → running
created/exited → rm → 删除
running → rm -f → 强制终止并删除

docker run [OPTIONS] IMAGE [COMMAND] [ARG...]

docker ps -a
docker ps -q
docker ps -a -q
docker ps -aq
docker ps -l
docker ps --latest

CONTAINER ID   IMAGE   COMMAND                  CREATED         STATUS                     PORTS   NAMES
f5229c2e1d2d   nginx   "/docker-entrypoint.…"   51 seconds ago  Up 50 seconds              80/tcp  inspiring_wright
407ab2601c03   nginx   "/docker-entrypoint.…"   2 minutes ago   Exited (0) About a minute ago       loving_ishizaka

# docker ps -q
f5229c2e1d2d
# docker ps -aq
f5229c2e1d2d
407ab2601c03

docker ps --filter 'status=running'
docker ps -a --filter 'status=exited'
docker ps -a --filter 'status=created'
docker ps --filter 'name=web'
docker ps --filter 'name=^/web$'
docker ps --filter 'label=app=web'
docker ps --filter 'label=app'
docker ps -a --filter 'since=nginx'
docker ps -a --filter 'before=db'
docker ps --filter 'status=running' --filter 'label=env=prod'
docker ps -f 'name=inspiring_wright'

# 会删除满足条件的已停止容器；它不是只读查询
docker container prune --filter 'until=24h'

docker ps --format 'table {{.ID}}\t{{.Names}}\t{{.Status}}\t{{.Ports}}'
docker ps --format '{{.ID}}: {{.Names}} ({{.Status}})'
docker ps --format json
docker ps --format json | jq

CONTAINER ID   NAMES          STATUS        PORTS
f73428f6a34e   modest_kilby   Up 3 minutes  80/tcp
f73428f6a34e: modest_kilby (Up 4 minutes)

{
  "Command": "\"/docker-entrypoint.…\"",
  "CreatedAt": "2025-07-08 15:07:59 +0800 CST",
  "ID": "f73428f6a34e",
  "Image": "nginx",
  "Labels": "maintainer=NGINX Docker Maintainers <docker-maint@nginx.com>",
  "LocalVolumes": "0",
  "Mounts": "",
  "Names": "modest_kilby",
  "Networks": "bridge",
  "Platform": null,
  "Ports": "80/tcp",
  "RunningFor": "4 minutes ago",
  "Size": "0B",
  "State": "running",
  "Status": "Up 4 minutes"
}

docker inspect [OPTIONS] NAME|ID [NAME|ID...]

docker inspect sharp_gates

docker inspect -f '{{.NetworkSettings.Networks.bridge.IPAddress}}' sharp_gates
docker inspect -f '{{(index .NetworkSettings.Networks "app-net").IPAddress}}' sharp_gates

docker inspect --format '{{.Created}}' sharp_gates

2025-07-08T09:55:58.998837931Z

docker inspect -f '{{.Config.Cmd}}' sharp_gates

[nginx -g daemon off;]

docker image inspect --format '{{json .RootFS.Layers}}' nginx | jq

[
  "sha256:1bb35e8b4de116e84b2ccf614cce4e309b6043bf2cd35543d8394edeaeb587e3",
  "sha256:1bf33238ab09f13272838701bf1b0a795f1ca25a4197d6df0e9e1033ce9f66c0",
  "sha256:81a9d30670ecf867ffd9c7b952444efce07b8712a597e6009c9188e6ec223c1f",
  "sha256:f941308035cf657934e5dbf83c5c18819c2f9aa2ed687152caec85b3774cf223",
  "sha256:e6c40b7bdc831f8cbb96c77ce6b826b7e4442373542111e0f224d60c7a9b7870",
  "sha256:de2ef8ceb76a4bcd39a8a60962963c8aee0a0460eb57e4ca1bb5107e2b826b4a",
  "sha256:07eaefc6ebf2f83b1da015d65d9179f5b952f20b670a1da6aec9a63811bb5734"
]

docker network ls
docker network inspect bridge --format '{{json .IPAM.Config}}' | jq
docker inspect sharp_gates | jq '.[0].HostConfig.NetworkMode'
docker inspect sharp_gates | jq -r '.[0].NetworkSettings.Networks.bridge.IPAddress'

NETWORK ID     NAME    DRIVER  SCOPE
89e043ba18dc   bridge  bridge  local
44cae059432e   host    host    local
68539ce0cbce   none    null    local

[{"Subnet":"172.17.0.0/16","Gateway":"172.17.0.1"}]
"bridge"
172.17.0.2

docker logs [OPTIONS] CONTAINER

docker ps --format 'table {{.ID}}\t{{.Image}}\t{{.Command}}\t{{.Names}}'
docker logs sharp_gates

CONTAINER ID   IMAGE   COMMAND                  NAMES
43007f11dfe8   nginx   "/docker-entrypoint.…"   upbeat_goldberg
145b5a7f6b84   nginx   "/docker-entrypoint.…"   sharp_gates

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2025/07/08 09:55:59 [notice] 1#1: using the "epoll" event method
2025/07/08 09:55:59 [notice] 1#1: nginx/1.29.0
2025/07/08 09:55:59 [notice] 1#1: built by gcc 12.2.0 (Debian 12.2.0-14+deb12u1)
2025/07/08 09:55:59 [notice] 1#1: OS: Linux 5.14.0-427.13.1.el9_4.x86_64
2025/07/08 09:55:59 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1073741816:1073741816
2025/07/08 09:55:59 [notice] 1#1: start worker processes
2025/07/08 09:55:59 [notice] 1#1: start worker process 29
2025/07/08 09:55:59 [notice] 1#1: start worker process 30
2025/07/08 09:55:59 [notice] 1#1: start worker process 31
2025/07/08 09:55:59 [notice] 1#1: start worker process 32

docker logs --tail 5 sharp_gates
docker logs --tail 5 -t sharp_gates
docker stop sharp_gates
docker logs sharp_gates
docker start sharp_gates
docker logs -f sharp_gates

2025-07-08T09:55:59.183974909Z 2025/07/08 09:55:59 [notice] 1#1: start worker processes
2025-07-08T09:55:59.184280893Z 2025/07/08 09:55:59 [notice] 1#1: start worker process 29
2025-07-08T09:55:59.184294912Z 2025/07/08 09:55:59 [notice] 1#1: start worker process 30
2025-07-08T09:55:59.184386036Z 2025/07/08 09:55:59 [notice] 1#1: start worker process 31
2025-07-08T09:55:59.184619227Z 2025/07/08 09:55:59 [notice] 1#1: start worker process 32

docker inspect --format '{{json .HostConfig.LogConfig}}' sharp_gates | jq
docker run --log-opt max-size=10m --log-opt max-file=3 -d --name nginx-log nginx
docker inspect --format '{{json .HostConfig.LogConfig}}' nginx-log | jq
docker run --log-driver=syslog -d --name nginx-driver nginx
docker inspect --format '{{json .HostConfig.LogConfig}}' nginx-driver | jq

{"Type":"json-file","Config":{}}

{"Type":"json-file","Config":{"max-file":"3","max-size":"10m"}}

{"Type":"syslog","Config":{}}

docker logs nginx-driver
ls /var/lib/docker/containers
ls /var/lib/docker/containers/ee99e9380ab9ee0f221819fafe1dc1642c6cc264c36c025b0665925572211346/

checkpoints config.v2.json container-cached.log hostconfig.json hostname
hosts mounts resolv.conf resolv.conf.hash

docker attach [OPTIONS] CONTAINER

docker run -d --name nginx-attatch nginx
docker inspect -f '{{.NetworkSettings.Networks.bridge.IPAddress}}' nginx-attatch
# A 终端
docker attach nginx-attatch
# B 终端
curl -I 172.17.0.2

HTTP/1.1 200 OK
Server: nginx/1.29.0
Date: Wed, 09 Jul 2025 13:24:55 GMT
Content-Type: text/html
Content-Length: 615
Last-Modified: Tue, 24 Jun 2025 17:22:41 GMT
Connection: keep-alive
ETag: "685adee1-267"
Accept-Ranges: bytes

172.17.0.1 - - [09/Jul/2025:13:24:55 +0000] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.76.1" "-"

^C
2025/07/09 13:26:45 [notice] 1#1: signal 2 (SIGINT) received, exiting
2025/07/09 13:26:45 [notice] 33#33: exiting
2025/07/09 13:26:45 [notice] 33#33: exit
2025/07/09 13:26:45 [notice] 30#30: exiting
2025/07/09 13:26:45 [notice] 30#30: exit
2025/07/09 13:26:45 [notice] 31#31: exiting
2025/07/09 13:26:45 [notice] 31#31: exit
2025/07/09 13:26:45 [notice] 32#32: exiting
2025/07/09 13:26:45 [notice] 32#32: exit
2025/07/09 13:26:45 [notice] 1#1: signal 17 (SIGCHLD) received from 32
2025/07/09 13:26:45 [notice] 1#1: worker process 32 exited with code 0
2025/07/09 13:26:45 [notice] 1#1: signal 29 (SIGIO) received
2025/07/09 13:26:45 [notice] 1#1: signal 17 (SIGCHLD) received from 31
2025/07/09 13:26:45 [notice] 1#1: worker process 30 exited with code 0
2025/07/09 13:26:45 [notice] 1#1: worker process 31 exited with code 0
2025/07/09 13:26:45 [notice] 1#1: worker process 33 exited with code 0
2025/07/09 13:26:45 [notice] 1#1: exit

docker start nginx-attatch
docker attach nginx-attatch
docker attach --detach-keys='ctrl-e,ctrl-d' nginx-attatch

docker run -d nginx
docker port heuristic_bose

23c2ea030423   heuristic_bose   80/tcp

docker run -d -P nginx
docker port zen_kirch

6755c0badab7   zen_kirch   0.0.0.0:32768->80/tcp, [::]:32768->80/tcp
80/tcp -> 0.0.0.0:32768
80/tcp -> [::]:32768

docker run -p [宿主机IP:]宿主机端口:容器端口[/协议] [其他参数] 镜像

docker run -p -d nginx

docker: invalid containerPort: -d
Run 'docker run --help' for more information

docker run -p :80 -d nginx

10afe1b4f165   clever_colden   0.0.0.0:32769->80/tcp, [::]:32769->80/tcp

docker run -p 80:80 -d nginx

4f1e58ff9bc8   flamboyant_jang   0.0.0.0:80->80/tcp, [::]:80->80/tcp

docker run -p 10.0.0.12:81:80 -d nginx

451f797d618c   priceless_panini   10.0.0.12:81->80/tcp

docker container update --help

docker inspect priceless_panini
docker stop priceless_panini
docker rename priceless_panini priceless_panini-old
docker run -d --name priceless_panini -p 10.0.0.12:88:80 nginx

{
  "NetworkMode": "bridge",
  "PortBindings": {
    "80/tcp": [{"HostIp":"10.0.0.12","HostPort":"81"}]
  }
}

451f797d618c   priceless_panini   10.0.0.12:88->80/tcp

netstat -tnulp
iptables -vnL DOCKER
iptables -t nat -vnL DOCKER

tcp  0 0 0.0.0.0:32768 ... LISTEN 5150/docker-proxy
tcp6 0 0 :::32768      ... LISTEN 5156/docker-proxy

Chain DOCKER
ACCEPT tcp -- !docker0 docker0 0.0.0.0/0 172.17.0.3 tcp dpt:80
DROP   all -- !docker0 docker0 0.0.0.0/0 0.0.0.0/0

docker run -d -P nginx

13b17803d487   angry_proskuriakova   0.0.0.0:32769->80/tcp, [::]:32769->80/tcp
6755c0badab7   zen_kirch             0.0.0.0:32768->80/tcp, [::]:32768->80/tcp
23c2ea030423   heuristic_bose        80/tcp

# 错误思路示范
docker run -P --env DOCKER_PROXY=false nginx

{
  "registry-mirrors": [
    "https://docker.xuanyuan.me",
    "https://82ue03hk.mirror.aliyuncs.com"
  ],
  "userland-proxy": false
}

systemctl restart docker
docker run -d -P nginx
docker port compassionate_elbakyan
netstat -tnulp | grep docker
iptables -vnL DOCKER
iptables -t nat -vnL DOCKER

98ac63968f90   compassionate_elbakyan   0.0.0.0:32768->80/tcp
80/tcp -> 0.0.0.0:32768

tcp 0 0 0.0.0.0:32768 0.0.0.0:* LISTEN 7456/dockerd

# filter DOCKER
ACCEPT tcp -- !docker0 docker0 0.0.0.0/0 172.17.0.2 tcp dpt:80
DROP   all -- !docker0 docker0 0.0.0.0/0 0.0.0.0/0

# nat DOCKER
DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:32768 to:172.17.0.2:80

systemctl restart docker

docker run -d nginx
docker exec practical_mendel cat /etc/hosts

127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00:: ip6-localnet
ff00:: ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2 b4fc910af29a

docker run --add-host myserver:10.0.0.100 -d nginx
docker exec unruffled_lovelace cat /etc/hosts

10.0.0.100 myserver
172.17.0.2 e1ef9f794280

docker run --add-host myserver1:10.0.0.100 \
  --add-host myserver2:10.0.0.101 -d nginx
docker exec adoring_shirley cat /etc/hosts

10.0.0.100 myserver1
10.0.0.101 myserver2
172.17.0.3 ffd55c3ba78e

cat /etc/resolv.conf
docker exec adoring_shirley cat /etc/resolv.conf

# 宿主机：Generated by NetworkManager
nameserver 10.0.0.2

# 容器：Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it has been modified.
nameserver 10.0.0.2
# Based on host file: '/etc/resolv.conf' (legacy)
# Overrides: []

docker exec adoring_shirley bash -c 'echo "nameserver 8.8.8.8" >> /etc/resolv.conf'
docker exec adoring_shirley cat /etc/resolv.conf

docker stop adoring_shirley
docker start adoring_shirley
docker exec adoring_shirley cat /etc/resolv.conf

docker run --dns 8.8.8.8 --dns 2.2.2.2 -d nginx
docker exec admiring_varahamihira cat /etc/resolv.conf

nameserver 8.8.8.8
nameserver 2.2.2.2
# Overrides: [nameservers]

{
  "registry-mirrors": [
    "https://docker.xuanyuan.me",
    "https://82ue03hk.mirror.aliyuncs.com"
  ],
  "dns": ["114.114.114.114", "8.8.8.8"]
}

systemctl restart docker
docker run -d nginx:latest
docker exec adoring_stonebraker cat /etc/resolv.conf

nameserver 114.114.114.114
nameserver 8.8.8.8
# Overrides: [nameservers]

docker run -d --dns 2.2.2.2 nginx:latest
docker exec brave_newton grep nameserver /etc/resolv.conf

docker cp [OPTIONS] CONTAINER:SRC_PATH DEST_PATH
docker cp [OPTIONS] SRC_PATH CONTAINER:DEST_PATH

docker run -d --name zealous_hofstadter nginx:latest
docker exec zealous_hofstadter bash -c 'mkdir -p /data/server/dir{1..3}'
mkdir -p /tmp/docker-copy-lab

docker cp zealous_hofstadter:/data/server/ /tmp/docker-copy-lab/
ls /tmp/docker-copy-lab
ls /tmp/docker-copy-lab/server

Successfully copied 3.07kB ...
server
dir1 dir2 dir3

docker cp zealous_hofstadter:/data/server /tmp/docker-copy-lab

docker cp zealous_hofstadter:/data/server/. /tmp/docker-copy-lab/

docker cp zealous_hofstadter:/etc/hosts /tmp/docker-copy-lab/
docker cp zealous_hofstadter:/etc/hosts /tmp/docker-copy-lab/hosts-con
ls /tmp/docker-copy-lab

docker exec zealous_hofstadter stat /etc/hosts
docker cp -a zealous_hofstadter:/etc/hosts /tmp/docker-copy-lab/hosts-attr
stat /tmp/docker-copy-lab/hosts-attr

docker exec zealous_hofstadter ls -l /etc/localtime
ls -l /etc/localtime

docker run -d --name naughty_engelbart nginx:latest
docker cp /etc/hosts naughty_engelbart:/tmp/
docker exec naughty_engelbart cat /tmp/hosts
mkdir -p /tmp/docker-copy-lab/server/dir{1..3}
docker cp /tmp/docker-copy-lab/server naughty_engelbart:/tmp/
docker exec naughty_engelbart ls /tmp/
docker exec naughty_engelbart ls /tmp/server

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6

touch /tmp/docker-copy-lab/sswang.txt
chown sswang:sswang /tmp/docker-copy-lab/sswang.txt
id sswang
docker cp -a /tmp/docker-copy-lab/sswang.txt naughty_engelbart:/tmp/
docker exec naughty_engelbart ls -l /tmp/sswang.txt

用户id=1000(sswang) 组id=1000(sswang) 组=1000(sswang),10(wheel)
-rw-r--r-- 1 1000 1000 0 Jul 10 08:40 /tmp/sswang.txt

docker exec naughty_engelbart grep nginx /etc/passwd
# 原样本：nginx:x:101:101:nginx user:/nonexistent:/bin/false
getent passwd 101

docker exec naughty_engelbart touch /tmp/nginx.txt
docker exec naughty_engelbart chown nginx:nginx /tmp/nginx.txt
docker exec naughty_engelbart chmod +x /tmp/nginx.txt
docker exec naughty_engelbart ls -l /tmp/nginx.txt
docker cp naughty_engelbart:/tmp/nginx.txt /tmp/docker-copy-lab/
ls -l /tmp/docker-copy-lab/nginx.txt

-rwxr-xr-x 1 nginx nginx 0 Jul 10 08:48 /tmp/nginx.txt

-rwxr-xr-x 1 root root 0 Jul 10 16:48 /tmp/nginx.txt

su - sswang
sudo docker cp naughty_engelbart:/tmp/nginx.txt /tmp/nginx-sswang.txt
ls -l /tmp/nginx-sswang.txt

docker run -d --name silly_leakey -e TZ=Asia/Shanghai nginx
docker exec silly_leakey printenv TZ
docker exec silly_leakey ls -l /etc/localtime
docker exec silly_leakey cat /etc/timezone

Asia/Shanghai
/etc/localtime -> /usr/share/zoneinfo/Etc/UTC
Etc/UTC

docker run -d --name angry_kilby \
  -v /etc/localtime:/etc/localtime:ro -e TZ=Asia/Shanghai nginx
docker exec angry_kilby ls -l /etc/localtime
date
docker exec angry_kilby date
docker exec angry_kilby md5sum /etc/localtime
md5sum /etc/localtime
docker exec angry_kilby printenv TZ

2025年 07月 10日 星期四 16:06:40 CST
Thu Jul 10 16:06:40 CST 2025
09dd479d2f22832ce98c27c4db7ab97c /etc/localtime
09dd479d2f22832ce98c27c4db7ab97c /etc/localtime
Asia/Shanghai

docker system prune
docker system df
docker system prune -a

WARNING! This will remove:
 - all stopped containers
 - all networks not used by at least one container
 - all dangling images
 - unused build cache
Are you sure you want to continue? [y/N] y
Deleted build cache objects:
ufaaz35mq69lnxqz7nbevigo1
6tc9414h9feyp6mxn67wwzk08
Total reclaimed space: 19B

TYPE           TOTAL ACTIVE SIZE     RECLAIMABLE
Images         9     1      2.838GB  2.721GB (95%)
Containers     1     1      1.253kB  0B (0%)
Local Volumes  7     0      1.134GB  1.134GB (100%)
Build Cache    1     0      0B       0B

ls ./*.tar
for archive in ./*.tar; do
  [ -f "$archive" ] || continue
  docker load -i "$archive"
done
/bin/bash get_ali_images.sh -a
docker images

REPOSITORY TAG             IMAGE ID       CREATED       SIZE
debian     latest          b3a422523a11   10 days ago   117MB
nginx      latest          9592f5595f2b   2 weeks ago   192MB
wordpress  php8.4-apache   d65e5ede33da   4 weeks ago   715MB
alpine     latest          cea2ff433c61   5 weeks ago   8.31MB
redis      latest          ed3a2af6d0d4   5 weeks ago   128MB
ubuntu     latest          bf16bdcff9c9   6 weeks ago   78.1MB
mysql      oraclelinux9    6f11f923fa04   2 months ago  859MB
busybox    latest          6d3e4188a38a   9 months ago  4.28MB

docker export -o container_fs.tar my_container
docker export my_container | gzip > container_fs.tar.gz
docker import container_fs.tar my_new_image:latest
gunzip -c container_fs.tar.gz | docker import - my_new_image:latest

docker export [OPTIONS] CONTAINER
docker import [OPTIONS] FILE|URL|- [REPOSITORY[:TAG]]
docker commit [OPTIONS] CONTAINER [REPOSITORY[:TAG]]

docker run -d --name determined_hoover nginx:latest
dcn determined_hoover
docker exec -it determined_hoover bash

ls /usr/share/nginx/html
history -c
echo 'Nginx Web Page by sswang' > /usr/share/nginx/html/index.html
exit

curl 172.17.0.2

Nginx Web Page by sswang

docker export -o my_nginx.tar determined_hoover
ls -lh my_nginx.tar
tar -tvf my_nginx.tar | head -n5
docker import my_nginx.tar mynginx:v1
docker images mynginx
docker history mynginx:v1

-rw------- 1 root root 186M Jul 10 17:55 my_nginx.tar

-rwxr-xr-x 0/0 0 2025-07-10 17:45 .dockerenv
lrwxrwxrwx 0/0 0 2025-06-30 08:00 bin -> usr/bin
drwxr-xr-x 0/0 0 2025-05-09 22:50 boot/
drwxr-xr-x 0/0 0 2025-07-10 17:45 dev/
-rwxr-xr-x 0/0 0 2025-07-10 17:45 dev/console

sha256:2ad366d4f19db4704a6278dbd78817990ef24acf756ec1e0cff1ed331822a716
REPOSITORY TAG IMAGE ID      CREATED        SIZE
mynginx    v1  2ad366d4f19d 23 seconds ago 191MB

IMAGE        CREATED         CREATED BY SIZE   COMMENT
2ad366d4f19d 44 seconds ago              191MB  Imported from -

docker run -d --name mynginx mynginx:v1

docker: Error response from daemon: no command specified
Run 'docker run --help' for more information

docker run -d --name mynginx mynginx:v1 nginx -g 'daemon off;'
dcn mynginx
curl 172.17.0.3
docker rm -f mynginx

docker exec determined_hoover bash -c "echo 'Nginx Web Page by sswang with commit' > /usr/share/nginx/html/index.html"
docker commit -a 'sswang' -m 'new image' determined_hoover mynginx:v2
docker images mynginx
docker run -d --name mynginx mynginx:v2
dcn mynginx
curl 172.17.0.3

sha256:7e1858cc3051d2078f765d2692085b41bffc341e6394bf1447e4559d6b47d2fa
REPOSITORY TAG IMAGE ID      CREATED         SIZE
mynginx    v2  7e1858cc3051 7 seconds ago   192MB
mynginx    v1  2ad366d4f19d 29 minutes ago  191MB

Nginx Web Page by sswang with commit

docker rm -f mynginx determined_hoover

docker checkpoint create CONTAINER CHECKPOINT
docker checkpoint ls CONTAINER
docker checkpoint rm CONTAINER CHECKPOINT
docker start --checkpoint CHECKPOINT CONTAINER

yum install -y criu
criu --version
criu check
grep CHECKPOINT "/boot/config-$(uname -r)"

Version: 3.19
Warn (criu/kerndat.c:1593): CRIU was built without libnftables support
Looks good.
CONFIG_CHECKPOINT_RESTORE=y

yum install -y yum-utils
yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum makecache
yum install -y docker-ce docker-ce-cli containerd.io

add-apt-repository ppa:criu/ppa -y
apt update
apt install criu
criu --version
criu check
grep CHECKPOINT "/boot/config-$(uname -r)"

Version: 4.1
Looks good.
CONFIG_CHECKPOINT_RESTORE=y

apt-get update
apt-get install -y ca-certificates curl gnupg
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg \
  | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
  > /etc/apt/sources.list.d/docker.list
apt update
apt install -y docker-ce docker-ce-cli containerd.io

{
  "registry-mirrors": [
    "https://docker.xuanyuan.me",
    "https://82ue03hk.mirror.aliyuncs.com"
  ],
  "experimental": true
}

systemctl restart docker
docker checkpoint

docker checkpoint is only supported on a Docker daemon with experimental features enabled

Usage: docker checkpoint COMMAND
Manage checkpoints
Commands:
 create  Create a checkpoint from a running container
 ls      List checkpoints for a container
 rm      Remove a checkpoint

docker load -i busybox.tar
docker run --name cr -d --network host --security-opt seccomp=unconfined \
  busybox /bin/sh -c 'i=0; while true; do echo "$i $(date +%F_%T)"; i=$((i + 1)); sleep 1; done'
docker ps
docker logs cr

0 2025-07-15_02:17:51
1 2025-07-15_02:17:52
2 2025-07-15_02:17:53
3 2025-07-15_02:17:54
4 2025-07-15_02:17:55
...

scp root@10.0.0.12:busybox.tar ./
docker load -i busybox.tar
docker images
docker create --name cr --network host --security-opt seccomp=unconfined \
  busybox /bin/sh -c 'i=0; while true; do echo "$i $(date +%F_%T)"; i=$((i + 1)); sleep 1; done'
docker ps -a

65014c70e84b: Loading layer 4.516MB/4.516MB
Loaded image: busybox:latest
REPOSITORY TAG    IMAGE ID       CREATED       SIZE
busybox    latest 6d3e4188a38a   9 months ago  4.28MB

# Ubuntu
917ded84818e   busybox   "/bin/sh -c 'i=0; wh…"   Created   cr
# Rocky2
c4afb52c5b8b   busybox   "/bin/sh -c 'i=0; wh…"   Created   cr

mkdir -p /data/server/srv
docker checkpoint create --checkpoint-dir /data/server/srv cr checkpoint1
ls /data/server/srv
du -sh /data/server/srv
ls /data/server/srv/checkpoint1
docker checkpoint ls cr
docker checkpoint ls --checkpoint-dir /data/server/srv cr
docker ps -a
docker logs cr | tail -n2

cgroup.img core-1.img core-624.img descriptors.json fdinfo-2.img fdinfo-3.img
files.img fs-1.img fs-624.img ids-1.img ids-624.img inventory.img ipcns-var-11.img
mm-1.img mm-624.img mountpoints-13.img pagemap-1.img pagemap-624.img
pages-1.img pages-2.img pstree.img seccomp.img timens-0.img
utsns-12.img tmpfs-dev-50.tar.gz.img tmpfs-dev-53.tar.gz.img
tmpfs-dev-54.tar.gz.img tmpfs-dev-55.tar.gz.img tmpfs-dev-56.tar.gz.img
tmpfs-dev-57.tar.gz.img

cr   Exited (137) 38 seconds ago
23 2025-07-15_02:18:15
24 2025-07-15_02:18:16

mkdir -p /data/server/srv
scp -r root@10.0.0.12:/data/server/srv/checkpoint1 /data/server/srv/
du -sh /data/server/srv/checkpoint1
docker checkpoint ls --checkpoint-dir /data/server/srv cr
docker start --checkpoint-dir /data/server/srv --checkpoint checkpoint1 cr
docker logs cr

/var/lib/docker/containers/917ded84818e4e6566c1700cadc0239a6477cef6d4c07c70ff93aea4c197c45b/checkpoints/

25 2025-07-15_02:21:35
26 2025-07-15_02:21:36
27 2025-07-15_02:21:37
28 2025-07-15_02:21:38
29 2025-07-15_02:21:39
30 2025-07-15_02:21:40

mkdir -p /data/server/srv
scp -r root@10.0.0.12:/data/server/srv/checkpoint1 /data/server/srv/
docker checkpoint ls --checkpoint-dir /data/server/srv cr
docker start --checkpoint-dir /data/server/srv --checkpoint checkpoint1 cr
docker ps
docker logs cr

/var/lib/docker/containers/c4afb52c5b8b907409826424fe7034f93ae07d8617772f3514d731687a7f9722/checkpoints/

25 2025-07-15_02:23:04
26 2025-07-15_02:23:05
27 2025-07-15_02:23:06
28 2025-07-15_02:23:07
29 2025-07-15_02:23:08
30 2025-07-15_02:23:09
31 2025-07-15_02:23:10
32 2025-07-15_02:23:11

Error response from daemon: bind-mount /proc/0/ns/net ->
/var/run/docker/netns/9aef6091180e: no such file or directory

journalctl -u docker.service | tail -n20

2025-07-15T10:09:53.643257910+08:00 level=error msg="copy stream failed" error="reading from a closed fifo" stream=stdout
2025-07-15T10:09:53.643329889+08:00 level=error msg="copy stream failed" error="reading from a closed fifo" stream=stderr
2025-07-15T10:09:53.655749638+08:00 level=info msg="ignoring event"
container=fed1cee27ad98bae4440eb67db809c4ed52faf449eb3beaaa1fc9efdaaf74453
module=libcontainerd namespace=moby topic=/tasks/delete type="*events.TaskDelete"
2025-07-15T10:09:53.685333795+08:00 level=error
msg="Handler for POST /v1.51/containers/cr/start returned error: bind-mount /proc/0/ns/net -> /var/run/docker/netns/9aef6091180e: no such file or directory"

CONTAINER_ID=$(docker inspect -f '{{.Id}}' cr)
NS_PATH=$(docker inspect -f '{{.NetworkSettings.SandboxKey}}' cr)
CONTAINER_PID=$(docker inspect -f '{{.State.Pid}}' cr)

ENTRYPOINT ["httpd"]
CMD ["-D", "FOREGROUND"]

ENTRYPOINT ["/usr/sbin/nginx", "-g", "daemon off;"]

#!/bin/bash
exec haproxy -db -f /etc/haproxy/haproxy.cfg

CMD ["run_haproxy.sh"]

docker tag myimage:latest username/myimage:v1.0
docker push username/myimage:v1.0
docker pull username/myimage:v1.0
docker run -p 80:80 nginx
docker save -o backup.tar myimage:latest
docker load -i backup.tar
docker rmi myimage:latest

docker run -d --name loving_chaum nginx:latest
dcn loving_chaum
docker exec loving_chaum bash -c "echo 'Nginx Web Page by sswang' > /usr/share/nginx/html/index.html"
curl 172.17.0.2

docker commit -a 'sswang' -m 'new image' loving_chaum
docker images

sha256:81a1bc8dd2f69893c1f7f7c092424a2590b480069d0a6c9b2b3001117993e33e
REPOSITORY TAG    IMAGE ID       CREATED         SIZE
<none>     <none> 81a1bc8dd2f6   44 seconds ago  192MB

docker exec loving_chaum bash -c "echo 'Nginx Web Page by sswang with commit-1' > /usr/share/nginx/html/index.html"
docker commit -a 'sswang' -m 'new image' loving_chaum mynginx
docker images

sha256:0942a94177dd47854fdc1adc4744ae73f9ea2f63cf415b13ae6206ef073007b3
REPOSITORY TAG    IMAGE ID       CREATED        SIZE
mynginx    latest 0942a94177dd   4 seconds ago  192MB
<none>     <none> 81a1bc8dd2f6   2 minutes ago  192MB

docker exec loving_chaum bash -c "echo 'Nginx Web Page by sswang with commit-2' > /usr/share/nginx/html/index.html"
docker commit -a 'sswang' -m 'new image' loving_chaum mynginx:v2
docker images

sha256:1124dae0cf712ae4f8fb8adc3f92eb8ad2af5bc12abae313a1d8ca1d793833c1
REPOSITORY TAG    IMAGE ID       CREATED            SIZE
mynginx    v2     1124dae0cf71   4 seconds ago      192MB
mynginx    latest 0942a94177dd   About a minute ago 192MB
<none>     <none> 81a1bc8dd2f6   4 minutes ago      192MB

docker run --name mynginx1 -d 81a1bc8dd2f6
dcn mynginx1
curl 172.17.0.3

docker run --name mynginx2 -d mynginx
dcn mynginx2
curl 172.17.0.4

docker run --name mynginx3 -d mynginx:v2
dcn mynginx3
curl 172.17.0.5

docker images ubuntu
docker run -it -p 80 --name nginx_ubuntu ubuntu bash

cat /etc/os-release
ls -l /etc/apt/sources.list
cat /etc/apt/sources.list
grep -v '^#' /etc/apt/sources.list.d/ubuntu.sources

PRETTY_NAME="Ubuntu 24.04.2 LTS"
NAME="Ubuntu"
VERSION_ID="24.04"
VERSION="24.04.2 LTS (Noble Numbat)"
VERSION_CODENAME=noble
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=noble
LOGO=ubuntu-logo

Types: deb
URIs: http://archive.ubuntu.com/ubuntu/
Suites: noble noble-updates noble-backports
Components: main universe restricted multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Types: deb
URIs: http://security.ubuntu.com/ubuntu/
Suites: noble-security
Components: main universe restricted multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

sed -i 's/archive\.ubuntu\.com/mirrors.ustc.edu.cn/g' /etc/apt/sources.list.d/ubuntu.sources
sed -i 's/security\.ubuntu\.com/mirrors.ustc.edu.cn/g' /etc/apt/sources.list.d/ubuntu.sources
apt update
apt install -y nginx
nginx -v
grep include /etc/nginx/nginx.conf
grep root /etc/nginx/sites-enabled/default | grep -v '#'
echo 'Nginx Web Page by sswang' > /var/www/html/index.nginx-debian.html
nginx -g 'daemon off;'

include /etc/nginx/modules-enabled/*.conf;
include /etc/nginx/mime.types;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
root /var/www/html;

dps
dcn nginx_ubuntu
curl 172.17.0.2
docker commit -m 'ubuntu-nginx' -a 'sswang' nginx_ubuntu ubuntu_nginx:v1
docker run --name nginx -d ubuntu_nginx:v1 nginx -g 'daemon off;'
dcn nginx
curl 172.17.0.3

sha256:e9b18e63cd632ff0a509a03993ceef81f24474795d3f1e750ebe3e379e5868c8

docker commit -a 'sswang' -m 'new image' \
  -c 'ENTRYPOINT ["/usr/sbin/nginx", "-g", "daemon off;"]' \
  -c 'CMD []' nginx_ubuntu ubuntu_nginx:v2

docker history ubuntu_nginx:v2
docker inspect --format '{{.Config.Entrypoint}}' ubuntu_nginx:v2
docker inspect ubuntu_nginx:v2 | jq '.[0].Config.Entrypoint'
docker run -d --name nginx-2 ubuntu_nginx:v2
dcn nginx-2
curl 172.17.0.5

74db7f31add6  2 minutes ago  bash                                 65.8MB  new image
bf16bdcff9c9  6 weeks ago    /bin/sh -c #(nop) CMD ["/bin/bash"]    0B
<missing>     6 weeks ago    /bin/sh -c #(nop) ADD file:598ca...     78.1MB
<missing>     6 weeks ago    /bin/sh -c #(nop) LABEL ...            0B
<missing>     6 weeks ago    /bin/sh -c #(nop) LABEL ...            0B
<missing>     6 weeks ago    /bin/sh -c #(nop) ARG LAUNCHPAD_BUILD_ARCH 0B
<missing>     6 weeks ago    /bin/sh -c #(nop) ARG RELEASE          0B

["/usr/sbin/nginx", "-g", "daemon off;"]

docker images rockylinux
docker run -it -p 80 --name nginx_rocky rockylinux:9 bash

yum install -y gcc make pcre2-devel zlib-devel wget tar gzip
wget https://nginx.org/download/nginx-1.29.0.tar.gz
tar xf nginx-1.29.0.tar.gz
cd nginx-1.29.0
./configure --prefix=/data/server/nginx
make && make install
echo 'Nginx Web Page from Rocky' > /data/server/nginx/html/index.html
/data/server/nginx/sbin/nginx -g 'daemon off;'

dcn nginx_rocky
curl 172.17.0.2

cd /
rm -rf nginx-1.29.0*
yum autoremove

docker commit -a 'sswang' -m 'new image' \
  -c 'ENTRYPOINT ["/data/server/nginx/sbin/nginx", "-g", "daemon off;"]' \
  -c 'CMD []' nginx_rocky rocky_nginx:v1

docker run -d --name nginx-3 rocky_nginx:v1
dcn nginx-3
curl 172.17.0.2

docker exec -it nginx_rocky bash

#!/bin/bash
set -e
ln -sf /dev/stdout /data/server/nginx/logs/access.log
ln -sf /dev/stderr /data/server/nginx/logs/error.log
exec /data/server/nginx/sbin/nginx -g 'daemon off;'

chmod +x /start.sh
exit

docker commit -a 'sswang' -m 'new image' \
  -c 'ENTRYPOINT ["/start.sh"]' -c 'CMD []' nginx_rocky rocky_nginx:v2
docker images rocky_nginx
docker run -d --name nginx-4 rocky_nginx:v2
dcn nginx-4
curl 172.17.0.4
docker logs nginx-4

REPOSITORY  TAG IMAGE ID      CREATED         SIZE
rocky_nginx v2  9d9c02097518 12 seconds ago  563MB
rocky_nginx v1  779073b2ad87 28 minutes ago  563MB

172.17.0.1 - - [15/Jul/2025:05:58:27 +0000] "GET / HTTP/1.1" 200 26 "-" "curl/7.76.1"
172.17.0.1 - - [15/Jul/2025:06:28:24 +0000] "GET / HTTP/1.1" 200 26 "-" "curl/7.76.1"
172.17.0.1 - - [15/Jul/2025:06:34:21 +0000] "GET / HTTP/1.1" 200 26 "-" "curl/7.76.1"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

SHELL ["powershell", "-Command"]

SHELL ["/bin/bash", "-c"]
RUN echo "Hello" | cat -
RUN ["/bin/sh", "-c", "echo 'Hello' | cat -"]

SHELL ["/bin/bash", "-c"]
RUN echo "Using bash"
SHELL ["/bin/sh", "-c"]
RUN echo "Using sh"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN apt-get update && apt-get install -y curl | tee /tmp/packages.log

MAINTAINER John Doe <john.doe@example.com>

LABEL maintainer="John Doe <john.doe@example.com>"

HEALTHCHECK [选项] CMD <命令>

HEALTHCHECK NONE

HEALTHCHECK --interval=5s --timeout=3s \
    CMD curl -f http://localhost/ || exit 1
EXPOSE 80

HEALTHCHECK --interval=10s --timeout=5s --retries=3 \
    CMD mysqladmin -u root -p"$MYSQL_ROOT_PASSWORD" ping || exit 1

COPY healthcheck.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/healthcheck.sh
HEALTHCHECK --interval=1m --timeout=10s \
    CMD /usr/local/bin/healthcheck.sh || exit 1

STOPSIGNAL SIGTERM

STOPSIGNAL SIGQUIT

alias dps='docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Ports}}"'
alias dcn='docker inspect --format "{{.NetworkSettings.Networks.bridge.IPAddress}}"'
alias dka='cs=$(docker ps -aq); [ -z "$cs" ] || docker rm -f $cs'