Docker 简明教程

Docker - Daemon Configuration

Docker 守护程序，通常称为“ dockerd ”，是 Docker 平台的核心元素。它负责管理 Docker 对象，如卷、网络、映像和容器。它处理来自 Docker 客户端和其他 Docker 组件的请求，同时在主机计算机上持续在后台运行。

Docker Daemon, commonly referred to as "dockerd", is the core element of the Docker platform. It is in charge of overseeing Docker objects like volumes, networks, images, and containers. It handles requests from the Docker client and other Docker components while running continuously in the background on a host computer.

守护程序具有资源隔离、网络和容器生命周期管理等功能，对于使用 Docker 开发、执行和管理容器化应用至关重要。

With features like resource isolation, networking, and container lifecycle management, the daemon is indispensable for developing, executing, and managing containerized apps with Docker.

Docker 守护程序的主要职责之一是执行通过 Docker 客户端发送的用户命令，将它们转换为操作，如从注册表中提取容器映像、创建和维护容器，以及与多个容器联网。它还控制容器如何与主机系统通信，从而保证有效地使用和隔离资源。

Among the main responsibilities of the Docker Daemon is to carry out user commands sent through the Docker client, converting them into actions like pulling container images from registries, creating and maintaining containers, and networking with multiple containers. It also controls how containers communicate with the host system, which guarantees effective resource use and isolation.

守护程序是 Docker 生态系统的核心组件，它抽象化了容器化的复杂性，这样开发人员和系统管理员可以专注于轻松创建和部署应用程序。

The daemon is the central component of the Docker ecosystem, abstracting away the complexity of containerization so that developers and system administrators can concentrate on easily creating and deploying applications.

Key Components of Docker Daemon

Docker 守护程序由几个关键组件组成，它们协同工作以实现容器化−

The Docker daemon comprises several key components that work together to enable containerization −

Docker Engine

它是平台的核心组件，负责创建、执行和管理容器的任务。它由几个较小的部分组成−

It is the central component of the platform, handling the tasks of creating, executing, and overseeing containers. It is made up of several smaller parts −

Containerd − Manages the lifecycle of containers, including their creation, run, pause, and stop.
Runc − Complies with OCI (Open Container Initiative) specifications to implement the container runtime.
libnetwork − Provides networking support for containers, allowing them to communicate with one another and with external networks.
SwarmKit − Provides orchestration functionalities to oversee a cluster of Docker hosts, enabling robust and scalable container deployments.

Docker REST API

提供用于连接到 Docker 守护程序的端点集合。通过 API，用户可以以编程方式通过与 Docker 交互来管理容器、映像、网络和卷。

Provides a collection of endpoints for connecting to the Docker daemon. Programmatically, users can manage containers, images, networks, and volumes by interacting with Docker through the API.

Docker CLI

Docker 守护程序可以通过命令行界面（CLI）轻松进行交互。CLI 允许用户通过发布命令来构建、运行、检查和管理 Docker 对象，包括容器。

The Docker daemon can be easily interacted with through the command-line interface (CLI). The CLI allows users to build, run, inspect, and manage Docker objects, including containers, by issuing commands.

Docker Registry

Docker 容器是打包的、可移植的单元，包含库、依赖项、运行时和应用程序代码。Docker 映像存储在 Docker 注册表中。该注册表充当一个存储库，可以从中推送和拉取映像，从而使共享和分发容器化的应用程序变得更加容易。

Docker containers are packaged, portable units that contain libraries, dependencies, runtime, and application code. Docker images are stored in the Docker Registry. The registry acts as a repository from which images can be pushed and pulled, making it easier to share and distribute applications that are containerized.

How to Configure Docker Daemon?

配置 Docker 守护程序对于控制容器化环境的行为和性能至关重要。通过了解如何启动、停止和配置 Docker 守护程序，可以确保优化资源利用、安全性、和可扩展性。

Configuring the Docker Daemon is essential to controlling how your containerization environment behaves and performs. Optimizing resource utilization, security, and scalability can be ensured by knowing how to start, stop, and configure Docker Daemon.

为了帮助您成功导航 Docker 守护程序配置，我们将在本指南中逐步引导您完成每个过程，并提供命令和详尽的解释。

To help you successfully navigate Docker Daemon configuration, we’ll walk you through each step of the process in this guide, complete with commands and thorough explanations.

Starting Docker Daemon

在了解如何配置 Docker 守护程序以获得最佳实践之前，您应该确保守护程序正在您的主机上运行。启动 Docker 守护程序的过程可能因主机机器操作系统而略有不同。

Before understanding how to configure Docker Daemon for best practices, you should ensure that the Daemon is running on your host machine. The process to start Docker Daemon might vary slightly depending on the host machine OS.

要检查 Docker 守护程序是否在您的系统上运行，可以使用 systemctl status 命令。

To check whether Docker Daemon is running on your system, you can use the systemctl status command.

$ sudo systemctl start docker

Starting Docker Daemon on Linux

要在 Linux 中手动启动 Docker Daemon，您可以使用以下命令：

To start Docker Daemon manually on Linux, you can use the following command −

$ sudo systemctl start docker

Starting Docker Daemon on Windows / macOS

在 Windows 和 Mac 主机系统上安装 Docker Desktop 是自动启动和使用 Docker 的最简单方法。它提供了用户友好的界面来管理 Docker。要启动 Docker Daemon，您只需启动 Docker Desktop。

The easiest way to automatically start and use Docker is by installing Docker Desktop on Windows and Mac host systems. It provides a user-friendly interface to manage Docker. To start Docker Daemon, you can simply launch Docker Desktop.

Configuring Docker Daemon

您可以通过在守护程序文件中设置自定义选项来自定义 Docker 容器化环境。此文件通常是 JSON 文件，通常位于 Linux 系统上的“/etc/docker/daemon.json”。

You can customize the Docker containerization environments by setting custom options in the daemon file. This file is typically a JSON file, commonly located at "/etc/docker/daemon.json" on Linux.

How to edit the Daemon Configuration File?

您可以使用文本编辑器打开 Docker Daemon 配置文件。在 Linux 系统中，您可以使用 vi 或 nano 命令。例如：

You can open the Docker Daemon configuration file using a text editor. In Linux, you can use the vi or nano commands. For example −

$ sudo nano /etc/docker/daemon.json
$ sudo vi /etc/docker/daemon.json

How to Set Daemon Options?

您可以更改上述 Docker Daemon JSON 文件来设置守护程序选项。例如，如果您要更新日志记录驱动程序和日志记录级别，则可以使用以下行：

You can make the change in the above-mentioned Docker Daemon JSON file to set Daemon options. For example, if you want to update the logging driver and log level, you can use the following lines −

{
   "log-driver": "json-file",
   "log-level": "debug"
}

How to Configure Network Settings in Docker?

您可以使用 Docker Daemon 配置容器通信的网络设置。例如，如果您要为 Docker 的默认网桥网络指定自定义子网，则可以使用以下行：

You can use Docker Daemon to configure network settings for container communication. For example, if you want to specify a custom subnet for Docker’s default bridge network, you can use the below lines.

{
   "bip": "172.20.0.1/16"
}

How to Change Default CPU and Memory in Docker Daemon?

必须为容器强制执行资源约束，以防止 Docker 争用。例如，您可以添加以下行来限制每个容器的最大 CPU 数量和内存使用量：

To prevent Docker contention, you must enforce resource constraints on containers. For example, you can add the below lines to restrict the maximum number of CPUs and memory usage per container −

{
   "default-cpus": "2",
   "default-memory": "2G"
}

How to Securing Docker Daemon?

您可以通过启用 TLS 认证、限制对 Docker API 的访问以及为增强安全配置用户命名空间来增强 Docker Daemon 的安全性。您可以使用以下配置来执行此操作：

You can enhance the security of Docker Daemon by enabling TLS authentication, restricting access to Docker API, and configuring user namespaces for enhanced security. You can do so by using configurations like below −

{
   "tls": true,
   "tlscacert": "/path/to/ca.pem",
   "tlscert": "/path/to/cert.pem",
   "tlskey": "/path/to/key.pem"
}

Common Issues Faced While Using Docker Daemon

让我们解决 Docker 用户面临的一些常见问题或进行故障排除以及解决这些问题的步骤。

Let’s address or troubleshoot a few common issues faced by Docker users and the steps to resolve them.

Issue 1. Docker Daemon Not Starting or Crashing

当 Docker Daemon 意外崩溃或无法启动时，用户经常会遇到“无法连接到 Docker 守护程序”等错误。解决此问题的第一个步骤是查找 Docker Daemon 日志（在 Linux 上为 “ journalctl -u docker.service ”）中启动期间发生的特定错误消息。

Errors such as "Cannot connect to the Docker daemon" are frequently encountered by users when the Docker Daemon unexpectedly crashes or fails to start. The first step in fixing this is to look through the Docker Daemon logs ("journalctl -u docker.service" on Linux) to find specific error messages that occurred during startup.

尝试在 Windows/macOS 上使用 Docker Desktop 或在 Linux 上使用 “ systemctl restart docker ” 重新启动 Docker 服务。确保 Docker Daemon 需要的服务没有使用相同的端口或发生资源冲突。如果问题仍然存在，重新安装 Docker 可能有助于解决任何可能的冲突。

Try utilizing Docker Desktop on Windows/macOS or "systemctl restart docker" on Linux to restart the Docker service. Make sure that no services that Docker Daemon requires are using the same ports or resources in conflict. Reinstalling Docker might help to fix any possible conflicts if the issue continues.

Issue 2. Resource Exhaustion

CPU、内存或磁盘空间不足是可能导致系统挂起、容器崩溃或性能缓慢的资源示例。使用 Docker 状态或系统监控实用程序等工具来监控资源使用情况，以便解决此问题。

CPU, memory, or disk space exhaustion are examples of resources that can cause system hangs, container crashes, or sluggish performance. Use tools such as Docker stats or system monitoring utilities to keep an eye on resource usage in order to address this.

要避免资源争用，请使用 Docker Compose 配置或 Docker 运行标志（--cpu、--memory）设置容器的资源限制。检查容器配置以有效使用资源，并考虑增加主机资源或在多个主机之间拆分工作负载。

To avoid resource contention, set resource limits for containers using the Docker Compose configuration or the Docker run flags (--cpu, --memory). Examine container configurations for effective resource use, and think about increasing host machine resources or splitting up the workload among several hosts.

Issue 3. Networking Problems

在 Docker 环境中，网络问题可能表现为端口冲突、DNS 解析问题或 “ Connection refused ” 等连接错误。使用 “ docker network inspect ” 和 “ docker network ls ” 检查 Docker 网络配置的准确性以进行故障排除。

In Docker environments, networking problems can appear as port conflicts, DNS resolution issues, or connectivity errors such as "Connection refused". Check the accuracy of the Docker network configurations using "docker network inspect" and "docker network ls" to troubleshoot.

检查防火墙规则以确保必要的端口开放且可访问。要更新网络设置，请重新启动 Docker 网络（“ sudo systemctl restart docker ”）。要查找并修复网络问题，请使用 docker network diagnose 或 docker network inspect 等 Docker 网络故障排除工具。

Make sure the necessary ports are open and accessible by checking the firewall rules. To update network settings, restart Docker networking ("sudo systemctl restart docker"). To find and fix network problems, use Docker network troubleshooting tools like docker network diagnose or docker network inspect.

Issue 4. Permission Errors

在运行 Docker 命令、访问 Docker 套接字或装载卷时，经常会遇到权限拒绝错误。要解决此问题，请确保运行 Docker 命令的用户拥有适当的权限。通常，您可以通过将用户添加到 Docker 组（“ sudo usermod -aG docker <username> ”）来执行此操作。

When running Docker commands, accessing Docker sockets, or mounting volumes, permission denied errors are frequently encountered. To fix this, make sure the person running the Docker commands has the appropriate permissions. Usually, you can do this by adding the user to the Docker group ("sudo usermod -aG docker <username>").

修改与 Docker 相关的任何文件或目录的权限，例如 Docker 套接字（“ /var/run/docker.sock ”）。在进行权限更改后，重新启动 Docker 服务（在 Linux 上为 “ sudo systemctl restart docker ”）。如有需要，您还可以考虑使用 sudo 或提升特权。

Modify the permissions of any files or directories connected to Docker, such as the Docker socket ("/var/run/docker.sock"). After making permission changes, restart the Docker service ("sudo systemctl restart docker" on Linux). If required, you can also think about using sudo or elevating privileges.

Issue 5. Security Vulnerabilities

Docker 环境中的安全漏洞会带来重大风险，例如未经授权的访问或恶意映像利用。配置 TLS 证书并启用 TLS 认证以确保 Docker Daemon 之间的安全通信。通过限制容器权限并定期更新 Docker 映像和依赖项来修补漏洞，您可以实施最小权限原则。

Significant risks arise from security vulnerabilities in Docker environments, such as unauthorized access or malicious image exploits. Configure TLS certificates and enable TLS authentication to ensure secure communication between Docker Daemons. By restricting container permissions and routinely updating Docker images and dependencies to patch vulnerabilities, you can implement the least privilege principle.

使用容器安全工具，例如 Docker Security Scanning、Docker Bench for Security 或 Clair 来查找并修复安全缺陷。遵循 Docker 安全最佳实践，例如映像签名、验证和容器强化，以有效降低安全风险。

Employ container security tools such as Docker Security Scanning, Docker Bench for Security, or Clair to find and fix security flaws. Adhere to Docker security best practices, such as image signing, verification, and container hardening, to efficiently reduce security risks.

Conclusion

为了充分利用容器化技术并为应用提供一个可靠、安全、有效环境，Docker Daemon 的适当配置至关重要。通过了解如何管理 Docker Daemon，用户可以避开频繁出现的故障，例如启动问题、资源耗尽、网络问题、权限错误和安全漏洞。如果不加以解决，每个问题都会对容器化应用的稳定性和性能产生重大影响。

In order to fully utilize containerization technology and provide a reliable, safe, and effective environment for your applications, proper Docker Daemon configuration is essential. Users can steer clear of frequent pitfalls like startup issues, resource exhaustion, networking issues, permission errors, and security vulnerabilities by knowing how to manage the Docker Daemon. If not properly addressed, each of these issues can have a major effect on the dependability and performance of your containerized applications.

在本章中，我们涵盖了配置 Docker Daemon 的所有重要方面，从设定适当的资源限制到保护通信并优化网络配置。通过应用这些最佳实践和见解，用户可以通过优化 Docker 环境实现改善的资源管理、更高的安全性以及更加顺畅的操作。

In this chapter, we have covered all the important aspects of configuring Docker Daemon, from setting appropriate resource limits to securing communications and optimizing network configurations. Through the application of these best practices and insights, users can achieve improved resource management, increased security, and more seamless operations by optimizing their Docker environments.

除了持续的学习和适应之外，如果您使用社区资源和 Docker 官方文档，那么您的容器化基础设施将保持可靠和有效。使用这些 Daemon 配置最大程度地发挥 Docker 的潜力，并推动您的容器化应用走向成功。

Your containerized infrastructure will stay reliable and effective if you use community resources and official Docker documentation in addition to constant learning and adaptation. Use these Daemon configurations to maximize Docker’s potential and propel your containerized apps to success.

FAQs

Q1. How can I troubleshoot Docker Daemon issues?

从使用命令 - “@{s0}” 在 Linux 上查看日志开始，诊断 Docker Daemon 问题。寻找突出显示问题的特定警告或错误信息。常见的故障排除程序涉及查找配置文件中的错误、确保系统有足够的资源，以及确认没有服务或端口冲突。

Start by reviewing the logs using the command - "journalctl -u docker.service" on Linux to diagnose Docker Daemon problems. Look for particular warnings or error messages that highlight the issue. Typical troubleshooting procedures involve looking for errors in configuration files, making sure the system has enough resources, and confirming that no services or ports are in conflict.

其他修复持续问题的方法包括重新启动 Docker 服务，如果需要，则重新安装 Docker。通过使用诸如 Docker 的诊断命令之类的工具，可以获取有关影响 Docker Daemon 的问题的其他信息。

Other fixes for persistent problems include restarting the Docker service and, if required, reinstalling the Docker. Additional information about the issues affecting the Docker Daemon can be obtained by using tools such as Docker’s diagnostic commands.

Q2. How can I limit the resources used by Docker containers?

可以通过设置 @{s1} 文件中的选项来限制 Docker 容器的资源。使用 @{s2} 和 @{s3} 等选项，您可以使用 JSON 设置 CPU 和内存的默认限制。或者，您可以使用 @{s4} 和 @{s5} 标志在运行容器时设置限制。

Docker containers' resources can be restricted by setting options in the daemon.json file. With options like "default-cpus":"2" and "default-memory":"2G", you can set default limits for CPU and memory in JSON. As an alternative, you can set limits while running a container by using the --cpus and --memory flags.

例如，@{s6}。这些限制有助于防止容器耗尽太多资源并降低主机系统的性能。

For instance, docker run --cpus="1.5" --memory="1g". These restrictions help prevent containers from using up too many resources and degrading the performance of the host system.

Q3. How do I change the default storage driver for Docker Daemon?

您可以指定 daemon.json 文件中的所需驱动程序以修改默认存储驱动程序。使用文本编辑器打开文件，并使用 “@{s9}” 选项添加所需的驱动程序（例如 "@{s7}" 或 "@{s8}"）。

You can specify the desired driver in the daemon.json file to modify the default storage driver. Using a text editor, open the file and add the desired driver (such as "aufs" or "overlay2") using the "storage-driver" option.

例如，@{s10}。保存更改后，您可以使用 “@{s11}” 重新启动 Docker Daemon。在此更改之前，请确保备份任何关键数据，因为它可能需要迁移当前容器和映像才能更改存储驱动程序。

For example, {"storage-driver":"overlay2"}. You can use "sudo systemctl restart docker" to restart the Docker Daemon after saving the changes. Make sure you backup any crucial data before making this change, as it might necessitate migrating current containers and images in order to change the storage driver.