This commit is contained in:
commit
7a2f41e7d6
83
.drone.yml
Normal file
83
.drone.yml
Normal file
@ -0,0 +1,83 @@
|
||||
# kubectl create secret generic build-node-secret \
|
||||
# --from-literal=HOST="" \
|
||||
# --from-file=KEY=./*.pem \
|
||||
# --from-literal=PORT="22" \
|
||||
# --from-literal=PATH="" \
|
||||
# --namespace=drone
|
||||
|
||||
kind: pipeline
|
||||
type: kubernetes
|
||||
name: MD BUILD
|
||||
|
||||
trigger:
|
||||
event:
|
||||
include:
|
||||
- custom
|
||||
|
||||
workspace:
|
||||
base: /drone/
|
||||
path: /drone/Kubernetes
|
||||
|
||||
steps:
|
||||
- name: 编译文档正文
|
||||
image: registry.cn-hangzhou.aliyuncs.com/offends/drone:ubuntu-22.04
|
||||
pull: if-not-exists
|
||||
commands:
|
||||
- ./builder.sh
|
||||
- rm -rf ./builder.sh
|
||||
- name: 生产环境部署
|
||||
image: appleboy/drone-scp
|
||||
pull: if-not-exists
|
||||
settings:
|
||||
host:
|
||||
from_secret: HOST
|
||||
key:
|
||||
from_secret: KEY
|
||||
port:
|
||||
from_secret: PORT
|
||||
target:
|
||||
from_secret: PATH
|
||||
user: root
|
||||
source: ../Kubernetes
|
||||
overwrite: true
|
||||
- name: 重启生产博客组件
|
||||
image: registry.cn-hangzhou.aliyuncs.com/offends/drone:ubuntu-22.04
|
||||
volumes:
|
||||
- name: kubectl
|
||||
path: /usr/local/bin
|
||||
- name: config
|
||||
path: /root/.kube
|
||||
commands:
|
||||
- /usr/local/bin/kubectl -n blog rollout restart deployment blog
|
||||
volumes:
|
||||
- name: kubectl
|
||||
host:
|
||||
path: /usr/local/bin
|
||||
type: File
|
||||
- name: config
|
||||
host:
|
||||
path: /root/.kube
|
||||
---
|
||||
kind: secret
|
||||
name: HOST
|
||||
get:
|
||||
path: build-node-secret
|
||||
name: HOST
|
||||
---
|
||||
kind: secret
|
||||
name: KEY
|
||||
get:
|
||||
path: build-node-secret
|
||||
name: KEY
|
||||
---
|
||||
kind: secret
|
||||
name: PORT
|
||||
get:
|
||||
path: build-node-secret
|
||||
name: PORT
|
||||
---
|
||||
kind: secret
|
||||
name: PATH
|
||||
get:
|
||||
path: build-node-secret
|
||||
name: PATH
|
||||
28
.gitignore
vendored
Normal file
28
.gitignore
vendored
Normal file
@ -0,0 +1,28 @@
|
||||
# ---> macOS
|
||||
# General
|
||||
.DS_Store
|
||||
.AppleDouble
|
||||
.LSOverride
|
||||
|
||||
# Icon must end with two \r
|
||||
Icon
|
||||
|
||||
# Thumbnails
|
||||
._*
|
||||
|
||||
# Files that might appear in the root of a volume
|
||||
.DocumentRevisions-V100
|
||||
.fseventsd
|
||||
.Spotlight-V100
|
||||
.TemporaryItems
|
||||
.Trashes
|
||||
.VolumeIcon.icns
|
||||
.com.apple.timemachine.donotpresent
|
||||
|
||||
# Directories potentially created on remote AFP share
|
||||
.AppleDB
|
||||
.AppleDesktop
|
||||
Network Trash Folder
|
||||
Temporary Items
|
||||
.apdisk
|
||||
|
||||
28
CICD/Ansible/.gitignore
vendored
Normal file
28
CICD/Ansible/.gitignore
vendored
Normal file
@ -0,0 +1,28 @@
|
||||
# ---> macOS
|
||||
# General
|
||||
.DS_Store
|
||||
.AppleDouble
|
||||
.LSOverride
|
||||
|
||||
# Icon must end with two \r
|
||||
Icon
|
||||
|
||||
# Thumbnails
|
||||
._*
|
||||
|
||||
# Files that might appear in the root of a volume
|
||||
.DocumentRevisions-V100
|
||||
.fseventsd
|
||||
.Spotlight-V100
|
||||
.TemporaryItems
|
||||
.Trashes
|
||||
.VolumeIcon.icns
|
||||
.com.apple.timemachine.donotpresent
|
||||
|
||||
# Directories potentially created on remote AFP share
|
||||
.AppleDB
|
||||
.AppleDesktop
|
||||
Network Trash Folder
|
||||
Temporary Items
|
||||
.apdisk
|
||||
|
||||
13
CICD/Ansible/Dockerfile
Normal file
13
CICD/Ansible/Dockerfile
Normal file
@ -0,0 +1,13 @@
|
||||
FROM ubuntu:22.04
|
||||
|
||||
VOLUME /root/.ssh
|
||||
|
||||
RUN export DEBIAN_FRONTEND=noninteractive \
|
||||
&& apt update && apt install ansible sshpass -y \
|
||||
&& rm -rf /etc/localtime \
|
||||
&& ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
|
||||
&& mkdir -p /etc/ansible
|
||||
|
||||
VOLUME /etc/ansible
|
||||
|
||||
WORKDIR /etc/ansible
|
||||
88
CICD/Ansible/Docs/Ansible-Hosts文件配置.md
Normal file
88
CICD/Ansible/Docs/Ansible-Hosts文件配置.md
Normal file
@ -0,0 +1,88 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Ansible-Hosts文件配置
|
||||
|
||||
**编写 `/etc/ansible/hosts` 文件**
|
||||
|
||||
- 普通写法
|
||||
|
||||
```bash
|
||||
[group1] # 主机组
|
||||
|
||||
192.168.1.10
|
||||
192.168.1.20
|
||||
|
||||
[group2] # 主机组
|
||||
|
||||
192.168.1.30
|
||||
192.168.1.40
|
||||
```
|
||||
|
||||
- 为主机配置变量参数
|
||||
|
||||
```bash
|
||||
[group1] # 主机组
|
||||
|
||||
192.168.1.10 ansible_ssh_port="22" ansible_ssh_user="root" ansible_ssh_pass=""
|
||||
192.168.1.20 ansible_ssh_port="22" ansible_ssh_user="root" ansible_ssh_pass=""
|
||||
|
||||
[group2] # 主机组
|
||||
|
||||
192.168.1.30 ansible_ssh_port="22" ansible_ssh_user="root" ansible_ssh_pass=""
|
||||
192.168.1.40 ansible_ssh_port="22" ansible_ssh_user="root" ansible_ssh_pass=""
|
||||
```
|
||||
|
||||
- 为主机组配置变量参数
|
||||
|
||||
```bash
|
||||
[group1] # 主机组
|
||||
|
||||
192.168.1.10
|
||||
192.168.1.20
|
||||
|
||||
[group2] # 主机组
|
||||
|
||||
192.168.1.30
|
||||
192.168.1.40
|
||||
|
||||
[group1:vars]
|
||||
|
||||
ansible_ssh_port="22" # 填写服务器端口
|
||||
|
||||
ansible_ssh_user="root" # 填写服务器用户
|
||||
|
||||
ansible_ssh_pass="" # 填写服务器密码
|
||||
|
||||
[group2:vars]
|
||||
|
||||
ansible_ssh_port="22" # 填写服务器端口
|
||||
|
||||
ansible_ssh_user="root" # 填写服务器用户
|
||||
|
||||
ansible_ssh_pass="" # 填写服务器密码
|
||||
```
|
||||
|
||||
- 为所有主机组配置变量参数
|
||||
|
||||
```bash
|
||||
[group1] # 主机组
|
||||
|
||||
192.168.1.10
|
||||
192.168.1.20
|
||||
|
||||
[group2] # 主机组
|
||||
|
||||
192.168.1.30
|
||||
192.168.1.40
|
||||
|
||||
[all:vars] # 指定所有主机组
|
||||
|
||||
ansible_ssh_port="22" # 填写服务器端口
|
||||
|
||||
ansible_ssh_user="root" # 填写服务器用户
|
||||
|
||||
ansible_ssh_pass="" # 填写服务器密码
|
||||
```
|
||||
|
||||
|
||||
|
||||
164
CICD/Ansible/Docs/Ansible加密.md
Normal file
164
CICD/Ansible/Docs/Ansible加密.md
Normal file
@ -0,0 +1,164 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Ansible 加密
|
||||
|
||||
- 创建加密文件
|
||||
|
||||
```bash
|
||||
ansible-vault create password.yml
|
||||
```
|
||||
|
||||
> 示例
|
||||
>
|
||||
> ```bash
|
||||
> [root@offends]# ansible-vault create password.yml
|
||||
> New Vault password: # 输入加密密码
|
||||
> Confirm New Vault password: # 二次输入加密密码
|
||||
> ```
|
||||
|
||||
- 指定文件加密
|
||||
|
||||
```bash
|
||||
ansible-vault encrypt /etc/ansible/hosts
|
||||
```
|
||||
|
||||
- 加密字符串
|
||||
|
||||
```bash
|
||||
ansible-vault encrypt_string 123456
|
||||
```
|
||||
|
||||
- 编辑加密文件
|
||||
|
||||
```bash
|
||||
ansible-vault edit password.yml
|
||||
```
|
||||
|
||||
- 重新加密文件
|
||||
|
||||
```bash
|
||||
ansible-vault rekey password.yml
|
||||
```
|
||||
|
||||
- 文件解密
|
||||
|
||||
```bash
|
||||
ansible-vault decrypt password.yml
|
||||
```
|
||||
|
||||
- 查看加密数据文件原文
|
||||
|
||||
```bash
|
||||
ansible-vault view password.yml
|
||||
```
|
||||
|
||||
# 剧本的使用
|
||||
|
||||
- 编写一份 `demo.yml` 剧本文件
|
||||
|
||||
```bash
|
||||
vi demo.yml
|
||||
```
|
||||
|
||||
```yml
|
||||
---
|
||||
- hosts: node1
|
||||
# 定义变量
|
||||
vars:
|
||||
- user_password: !vault |
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
36616162626462323130626563393433663637383166613262333433313534386561666531633837
|
||||
3663636662663363303463313662333064326537343563340a653566346636333633383163623662
|
||||
37386432626437636464386339316366346665383935336564623630333238353661666566343036
|
||||
3338613861393061320a626464306230626265656163613730303035613161616235373539613333
|
||||
6164
|
||||
|
||||
tasks:
|
||||
- name: display variable from encryption variable
|
||||
ansible.builtin.debug:
|
||||
msg: The user password is {{ user_password }}
|
||||
```
|
||||
|
||||
- 通过询问口令执行剧本
|
||||
|
||||
```bash
|
||||
ansible-playbook demo.yml -v --ask-vault-pass
|
||||
```
|
||||
|
||||
- 从密码文件中读取口令执行剧本
|
||||
|
||||
```bash
|
||||
echo '密钥密码' > .pwdfile && chmod 600 .pwdfile
|
||||
```
|
||||
|
||||
```bash
|
||||
ansible-playbook demo.yml -v --vault-id .pwdfile
|
||||
```
|
||||
|
||||
# 加密用户密码
|
||||
|
||||
- 创建变量文件
|
||||
|
||||
```bash
|
||||
mkdir vars -p
|
||||
vi vars/user_list.yml
|
||||
```
|
||||
|
||||
```yml
|
||||
user_hosts:
|
||||
- all
|
||||
user_info:
|
||||
- user: demo
|
||||
# 密码需要用引号括起来,避免纯数字密码被解析成int类型数字
|
||||
password: "123456"
|
||||
# 备注信息可以使用中文，但尽量不用中文
|
||||
comment: "hello"
|
||||
```
|
||||
|
||||
- 创建剧本文件
|
||||
|
||||
```bash
|
||||
vi user.yml
|
||||
```
|
||||
|
||||
```yml
|
||||
- hosts: "{{ user_hosts }}"
|
||||
vars_files:
|
||||
- demo.yml
|
||||
tasks:
|
||||
- name: display variable from variable list
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
The username is "{{ item.user }}",
|
||||
the password is "{{ item.password }}",
|
||||
the comment is "{{ item.comment }}".
|
||||
loop: "{{ user_info }}"
|
||||
- name: create users
|
||||
ansible.builtin.user:
|
||||
name: "{{ item.user }}"
|
||||
password: "{{ item.password|password_hash('sha512') }}"
|
||||
comment: "{{ item.comment }}"
|
||||
state: present
|
||||
loop: "{{ user_info }}"
|
||||
become: yes
|
||||
```
|
||||
|
||||
- 加密变量文件
|
||||
|
||||
```bash
|
||||
ansible-vault encrypt vars/user_list.yml
|
||||
```
|
||||
|
||||
- 执行剧本
|
||||
|
||||
```bash
|
||||
ansible-playbook user.yml -v --ask-vault-pass
|
||||
```
|
||||
|
||||
- 查看是否创建用户
|
||||
|
||||
```bash
|
||||
tail -n 1 /etc/passwd
|
||||
```
|
||||
|
||||
|
||||
396
CICD/Ansible/Docs/Ansible模块参数解释以及常用命令.md
Normal file
396
CICD/Ansible/Docs/Ansible模块参数解释以及常用命令.md
Normal file
@ -0,0 +1,396 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Ansible模块参数解释以及常用命令
|
||||
|
||||
> 太多了，只记少数吧，累～
|
||||
|
||||
## Ansible 基础命令
|
||||
|
||||
- 查看 Ansible 的可用模块
|
||||
|
||||
```bash
|
||||
ansible-doc -l
|
||||
```
|
||||
|
||||
- 测试主机的连通性
|
||||
|
||||
```bash
|
||||
ansible all -m ping
|
||||
```
|
||||
|
||||
- 查看组下所有的IP
|
||||
|
||||
```bash
|
||||
ansible all --list
|
||||
```
|
||||
|
||||
> 使用 -i 指定 hosts 文件位置
|
||||
>
|
||||
> ```bash
|
||||
> -i /etc/ansible/hosts
|
||||
> ```
|
||||
|
||||
## Ansible-Playbook 命令
|
||||
|
||||
- 执行 Playbook
|
||||
|
||||
```bash
|
||||
ansible-playbook demo.yml
|
||||
```
|
||||
|
||||
- 指定任务执行 Playbook
|
||||
|
||||
```bash
|
||||
ansible-playbook demo.yml --start-at-task="指定任务"
|
||||
```
|
||||
|
||||
## Ansible 常用模块 Command
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| ----------------- | --------------------------------------------------- |
|
||||
| command | 要在远程主机上执行的命令。 |
|
||||
| creates | 如果指定的文件或目录存在，则命令不会被执行。 |
|
||||
| removes | 如果指定的文件或目录不存在，则命令不会被执行。 |
|
||||
| chdir | 在执行命令之前，将当前工作目录更改为指定的目录。 |
|
||||
| executable | 用于执行命令的可执行文件的路径。 |
|
||||
| warn | 控制命令失败时的错误消息显示方式。 |
|
||||
| stdin | 将输入发送到命令的标准输入。 |
|
||||
| stdin_add_newline | 在发送到标准输入之前是否添加新行。 |
|
||||
| strip_empty_ends | 控制在输出中删除空行的方式。 |
|
||||
| free_form | 允许直接传递要执行的命令，无需使用`command`关键字。 |
|
||||
|
||||
- 先切换目录，执行命令
|
||||
|
||||
```bash
|
||||
ansible all -m command -a 'chdir=/mnt ls -la'
|
||||
```
|
||||
|
||||
- 检查节点的内存情况
|
||||
|
||||
```bash
|
||||
ansible -m command -a "free -m " 'all'
|
||||
```
|
||||
|
||||
## Ansible 常用模块 Shell
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| ----------------- | ------------------------------------------------ |
|
||||
| cmd | 要在远程主机上执行的命令。 |
|
||||
| creates | 如果指定的文件或目录存在，则命令不会被执行。 |
|
||||
| removes | 如果指定的文件或目录不存在，则命令不会被执行。 |
|
||||
| chdir | 在执行命令之前，将当前工作目录更改为指定的目录。 |
|
||||
| executable | 用于执行命令的可执行文件的路径。 |
|
||||
| warn | 控制命令失败时的错误消息显示方式。 |
|
||||
| stdin | 将输入发送到命令的标准输入。 |
|
||||
| stdin_add_newline | 在发送到标准输入之前是否添加新行。 |
|
||||
| strip_empty_ends | 控制在输出中删除空行的方式。 |
|
||||
| free_form | 允许直接传递要执行的命令，无需使用`cmd`关键字。 |
|
||||
| executable | 用于执行命令的可执行文件的路径。 |
|
||||
| creates | 如果指定的文件或目录存在，则命令不会被执行。 |
|
||||
| removes | 如果指定的文件或目录不存在，则命令不会被执行。 |
|
||||
|
||||
- 使用 /bin/bash 执行命令
|
||||
|
||||
```bash
|
||||
ansible all -m shell -a 'executable=/bin/bash ls -la /mnt'
|
||||
```
|
||||
|
||||
## Ansible 常用模块 Script
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| ----------------- | ------------------------------------------------------ |
|
||||
| script | 要在远程主机上执行的脚本文件的路径。 |
|
||||
| creates | 如果指定的文件或目录存在，则脚本不会被执行。 |
|
||||
| removes | 如果指定的文件或目录不存在，则脚本不会被执行。 |
|
||||
| chdir | 在执行脚本之前，将当前工作目录更改为指定的目录。 |
|
||||
| warn | 控制脚本失败时的错误消息显示方式。 |
|
||||
| executable | 用于执行脚本的解释器的路径。 |
|
||||
| stdin | 将输入发送到脚本的标准输入。 |
|
||||
| stdin_add_newline | 在发送到标准输入之前是否添加新行。 |
|
||||
| strip_empty_ends | 控制在输出中删除空行的方式。 |
|
||||
| free_form | 允许直接传递要执行的脚本路径，无需使用`script`关键字。 |
|
||||
|
||||
- 编写一个脚本
|
||||
|
||||
```bash
|
||||
cat << EOF > demo.sh
|
||||
date
|
||||
EOF
|
||||
```
|
||||
|
||||
- 执行脚本
|
||||
|
||||
```bash
|
||||
ansible all -m script -a "/etc/ansible/demo.sh"
|
||||
```
|
||||
|
||||
|
||||
## Ansible 常用模块 Copy
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| -------------- | ------------------------------------------------------------ |
|
||||
| src | 源文件路径。 |
|
||||
| dest | 目标文件路径。 |
|
||||
| backup | 是否备份目标文件。 |
|
||||
| remote_src | 如果为true，则从控制节点的文件系统复制文件到远程主机。 |
|
||||
| checksum | 控制是否使用校验和来判断文件是否需要复制。 |
|
||||
| content | 如果为true，则在Ansible控制节点上生成文件内容并将其传输到远程主机上。 |
|
||||
| directory_mode | 在创建目录时设置权限模式。 |
|
||||
| force | 强制复制文件，即使目标文件存在。 |
|
||||
| owner | 设置目标文件的所有者。 |
|
||||
| group | 设置目标文件的所属组。 |
|
||||
| mode | 设置目标文件的权限模式。 |
|
||||
| seuser | 设置目标文件的SELinux用户。 |
|
||||
| serole | 设置目标文件的SELinux角色。 |
|
||||
| setype | 设置目标文件的SELinux类型。 |
|
||||
| selevel | 设置目标文件的SELinux等级。 |
|
||||
| follow | 是否跟随符号链接。 |
|
||||
|
||||
|
||||
- 拷贝文件
|
||||
|
||||
```bash
|
||||
ansible all -m copy -a "src=/etc/ansible/demo.sh owner=root mode=777 dest=/mnt/demo.sh backup=yes"
|
||||
```
|
||||
|
||||
## Ansible 常用模块 File
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| -------------- | ------------------------------------------------------------ |
|
||||
| path | 文件或目录的路径。 |
|
||||
| state | 文件或目录的状态。可选值包括：file、directory、link、hard、absent。 |
|
||||
| owner | 设置文件或目录的所有者。 |
|
||||
| group | 设置文件或目录的所属组。 |
|
||||
| mode | 设置文件或目录的权限模式。 |
|
||||
| dest | 用于创建符号链接的目标文件路径。 |
|
||||
| src | 用于创建硬链接的源文件路径。 |
|
||||
| state | 设置文件或目录的状态。 |
|
||||
| follow | 是否遵循符号链接。 |
|
||||
| recurse | 是否递归操作，用于目录。 |
|
||||
| directory_mode | 用于设置目录的权限模式。 |
|
||||
| force | 是否强制执行。 |
|
||||
| selevel | 设置目标文件的SELinux等级。 |
|
||||
| serole | 设置目标文件的SELinux角色。 |
|
||||
| setype | 设置目标文件的SELinux类型。 |
|
||||
| seuser | 设置目标文件的SELinux用户。 |
|
||||
|
||||
|
||||
- 创建文件
|
||||
|
||||
```bash
|
||||
ansible all -m file -a 'path=/mnt/demofile state=touch'
|
||||
```
|
||||
|
||||
- 创建目录
|
||||
|
||||
```bash
|
||||
ansible all -m file -a 'path=/mnt/demodir state=directory'
|
||||
```
|
||||
|
||||
- 修改文件的所有人
|
||||
|
||||
```bash
|
||||
ansible all -m file -a 'path=/mnt/demofile owner=docker'
|
||||
```
|
||||
|
||||
- 删除文件或目录
|
||||
|
||||
```bash
|
||||
ansible all -m file -a 'path=/mnt/demofile state=absent'
|
||||
ansible all -m file -a 'path=/mnt/demodir state=absent'
|
||||
```
|
||||
|
||||
## Ansible 常用模块 Archive
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| ----------- | ------------------------------------------------------ |
|
||||
| path | 要打包的文件或目录的路径。 |
|
||||
| dest | 打包文件的目标路径，包括文件名和扩展名。 |
|
||||
| format | 打包格式，可选值包括：tar、gz、bz2、tar.gz、tar.bz2。 |
|
||||
| owner | 设置打包文件的所有者。 |
|
||||
| group | 设置打包文件的所属组。 |
|
||||
| mode | 设置打包文件的权限模式。 |
|
||||
| remote_src | 如果为true，则从控制节点的文件系统打包文件到远程主机。 |
|
||||
| remove_path | 在归档中排除的路径的前缀。 |
|
||||
| exclude | 排除指定的文件或目录。 |
|
||||
| extra_opts | 传递给归档命令的额外选项。 |
|
||||
|
||||
- 打包文件
|
||||
|
||||
```bash
|
||||
ansible all -m archive -a "path=/mnt/demo.sh dest=/mnt/demo.gz format=gz"
|
||||
```
|
||||
|
||||
> 解压使用
|
||||
>
|
||||
> ```bash
|
||||
> gzip -d demo.gz
|
||||
> ```
|
||||
|
||||
## Ansible 常用模块 Cron
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| ------------ | ------------------------------------------------------------ |
|
||||
| name | Cron任务的名称。 |
|
||||
| minute | 设置分钟字段。可接受数字（0-59）、星号（*，表示每分钟）或范围（例如：0-30，表示0到30分钟之间）。 |
|
||||
| hour | 设置小时字段。可接受数字（0-23）、星号（*，表示每小时）或范围。 |
|
||||
| day | 设置天字段。可接受数字（1-31）、星号（*，表示每天）或范围。 |
|
||||
| month | 设置月份字段。可接受数字（1-12）、星号（*，表示每月）或范围。 |
|
||||
| weekday | 设置星期字段。可接受数字（0-6，0代表星期日）、星号（*，表示每天）或范围。 |
|
||||
| job | Cron任务要执行的命令或脚本。 |
|
||||
| state | 设置Cron任务的状态。可选值包括：present（存在）或absent（不存在）。 |
|
||||
| disabled | 是否禁用Cron任务。如果设置为yes，则Cron任务将被禁用。 |
|
||||
| user | 设置Cron任务的所有者。 |
|
||||
| minute | 设置分钟字段。 |
|
||||
| hour | 设置小时字段。 |
|
||||
| day | 设置天字段。 |
|
||||
| month | 设置月份字段。 |
|
||||
| weekday | 设置星期字段。 |
|
||||
| special_time | 设置特殊时间值，如@reboot（重启时运行）或@daily（每天运行）。 |
|
||||
|
||||
- 生成定时任务
|
||||
|
||||
```bash
|
||||
ansible all -m cron -a 'job="echo hello" name=demo minute=*/2'
|
||||
```
|
||||
|
||||
- 禁止该定时任务
|
||||
|
||||
```bash
|
||||
ansible all -m cron -a 'job="echo hello" name=demo minute=*/2 disabled=yes'
|
||||
```
|
||||
|
||||
- 重新开启该定时任务
|
||||
|
||||
```bash
|
||||
ansible all -m cron -a 'job="echo hello" name=demo minute=*/2 disabled=no'
|
||||
```
|
||||
|
||||
- 删除定时任务
|
||||
|
||||
```bash
|
||||
ansible all -m cron -a 'job="echo hello" name=demo minute=*/2 state=absent'
|
||||
```
|
||||
|
||||
## Ansible 常用模块 Yum
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| ----------------- | ------------------------------------------------------- |
|
||||
| name | 指定要安装或删除的软件包名称。 |
|
||||
| state | 指定软件包的状态。可选值包括：present、latest、absent。 |
|
||||
| enablerepo | 指定要启用的存储库。 |
|
||||
| disablerepo | 指定要禁用的存储库。 |
|
||||
| disable_excludes | 指定要禁用的软件包类型。 |
|
||||
| update_cache | 是否更新缓存。 |
|
||||
| disable_gpg_check | 是否禁用GPG检查。 |
|
||||
| installroot | 安装软件包的根目录。 |
|
||||
| security | 是否仅安装安全更新。 |
|
||||
| bugfix | 是否只安装修复错误的更新。 |
|
||||
| enhancement | 是否只安装增强更新。 |
|
||||
| ts | 是否使用指定的事务ID。 |
|
||||
|
||||
- 安装软件
|
||||
|
||||
```bash
|
||||
ansible all -m yum -a "name=wget state=present"
|
||||
```
|
||||
|
||||
- 卸载软件
|
||||
|
||||
```bash
|
||||
ansible all -m yum -a "name=wget state=absent"
|
||||
```
|
||||
|
||||
## Ansible 常用模块 Dnf
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| ----------------- | ------------------------------------------------------- |
|
||||
| name | 指定要安装或删除的软件包名称。 |
|
||||
| state | 指定软件包的状态。可选值包括：present、latest、absent。 |
|
||||
| enablerepo | 指定要启用的存储库。 |
|
||||
| disablerepo | 指定要禁用的存储库。 |
|
||||
| disable_excludes | 指定要禁用的软件包类型。 |
|
||||
| update_cache | 是否更新缓存。 |
|
||||
| disable_gpg_check | 是否禁用GPG检查。 |
|
||||
| installroot | 安装软件包的根目录。 |
|
||||
| security | 是否仅安装安全更新。 |
|
||||
| bugfix | 是否只安装修复错误的更新。 |
|
||||
| enhancement | 是否只安装增强更新。 |
|
||||
| ts | 是否使用指定的事务ID。 |
|
||||
|
||||
## Ansible 常用模块 Service
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| ------------- | ------------------------------------------------------------ |
|
||||
| name | 指定要管理的服务名称。 |
|
||||
| state | 指定服务的状态。可选值包括：started、stopped、restarted、reloaded、enabled、disabled。 |
|
||||
| enabled | 是否设置服务开机自启动。 |
|
||||
| pattern | 用于匹配要操作的服务的模式。 |
|
||||
| sleep | 在重新启动服务之前等待的时间（以秒为单位）。 |
|
||||
| arguments | 传递给服务启动脚本的额外参数。 |
|
||||
| runlevel | 设置服务在特定运行级别下的启用状态。 |
|
||||
| daemon_reload | 在重启或重新加载服务之后是否重新加载守护程序。 |
|
||||
| force | 是否强制执行操作。 |
|
||||
|
||||
- 重启服务
|
||||
|
||||
```bash
|
||||
ansible all -m service -a "name=docker state=restarted"
|
||||
```
|
||||
|
||||
## Ansible 常用模块 User
|
||||
|
||||
**常用参数**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| --------------- | ----------------------------------------- |
|
||||
| name | 用户名。 |
|
||||
| state | 用户的状态。可选值包括：present、absent。 |
|
||||
| uid | 用户的UID。 |
|
||||
| password | 用户的密码。 |
|
||||
| group | 用户所属的主组。 |
|
||||
| groups | 用户所属的其他组。 |
|
||||
| append | 是否追加用户到附加的组中。 |
|
||||
| shell | 用户的登录Shell。 |
|
||||
| home | 用户的主目录。 |
|
||||
| move_home | 是否移动用户的主目录。 |
|
||||
| createhome | 是否创建用户主目录。 |
|
||||
| system | 是否创建系统用户。 |
|
||||
| update_password | 是否更新密码。 |
|
||||
| expire | 设置用户的账号过期日期。 |
|
||||
| remove | 是否删除用户的主目录。 |
|
||||
|
||||
- 创建用户
|
||||
|
||||
```bash
|
||||
ansible all -m user -a "name=demo state=present"
|
||||
```
|
||||
|
||||
- 删除用户
|
||||
|
||||
```bash
|
||||
ansible all -m user -a "name=demo state=absent"
|
||||
```
|
||||
|
||||
|
||||
|
||||
19
CICD/Ansible/Docs/Ansible编写与配置.md
Normal file
19
CICD/Ansible/Docs/Ansible编写与配置.md
Normal file
@ -0,0 +1,19 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Ansible编写与配置
|
||||
|
||||
- 第一步禁用SSH主机密钥检查
|
||||
|
||||
```bash
|
||||
vi /etc/ansible/ansible.cfg
|
||||
```
|
||||
|
||||
解除 `host_key_checking` 注释
|
||||
|
||||
```bash
|
||||
[defaults]
|
||||
host_key_checking = False
|
||||
```
|
||||
|
||||
> 通常，当你连接到一个新的SSH主机时，SSH客户端会询问你是否要接受该主机的公钥。这个公钥将被保存到`known_hosts`文件中，以便将来的连接可以验证主机的身份。将`host_key_checking`设置为`False`会关闭这个验证步骤。
|
||||
|
||||
62
CICD/Ansible/Docs/Ansible配置免密.md
Normal file
62
CICD/Ansible/Docs/Ansible配置免密.md
Normal file
@ -0,0 +1,62 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Ansible 配置免密
|
||||
|
||||
**配置主机**
|
||||
|
||||
```bash
|
||||
vi /etc/ansible/hosts
|
||||
```
|
||||
|
||||
```bash
|
||||
[ssh]
|
||||
|
||||
192.168.1.10
|
||||
```
|
||||
|
||||
## SHELL配置免密
|
||||
|
||||
- 执行脚本
|
||||
|
||||
```bash
|
||||
bash /etc/ansible/ssh-copy.sh
|
||||
```
|
||||
|
||||
> 脚本会自动获取 `/etc/ansible/hosts` 内地址信息进行免密
|
||||
|
||||
## YML 配置服务器免密登录
|
||||
|
||||
- 编辑 SSH 主机配置文件填写服务器信息
|
||||
|
||||
```bash
|
||||
vi /etc/ansible/ssh-hosts
|
||||
```
|
||||
|
||||
> 内容如下
|
||||
>
|
||||
> ```yml
|
||||
> [ssh] # 主机组
|
||||
>
|
||||
> # 192.168.1.[10:11] # 批量
|
||||
> # 192.168.1.10 # 单台
|
||||
> 192.168.1.10
|
||||
>
|
||||
> [ssh:vars] # 指定主机组中的共享变量
|
||||
>
|
||||
> ansible_ssh_user="root" # 填写服务器用户
|
||||
>
|
||||
> ansible_ssh_pass="" # 填写服务器密码
|
||||
> ```
|
||||
|
||||
- 执行免密
|
||||
|
||||
```bash
|
||||
ansible-playbook -i /etc/ansible/ssh-hosts /etc/ansible/key.yml
|
||||
```
|
||||
|
||||
- 验证
|
||||
|
||||
```bash
|
||||
ansible all -a ls
|
||||
```
|
||||
|
||||
5
CICD/Ansible/README.md
Normal file
5
CICD/Ansible/README.md
Normal file
@ -0,0 +1,5 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Ansible
|
||||
20
CICD/Ansible/ansible.cfg
Normal file
20
CICD/Ansible/ansible.cfg
Normal file
@ -0,0 +1,20 @@
|
||||
[defaults]
|
||||
host_key_checking = False
|
||||
|
||||
[inventory]
|
||||
|
||||
[privilege_escalation]
|
||||
|
||||
[paramiko_connection]
|
||||
|
||||
[ssh_connection]
|
||||
|
||||
[persistent_connection]
|
||||
|
||||
[accelerate]
|
||||
|
||||
[selinux]
|
||||
|
||||
[colors]
|
||||
|
||||
[diff]
|
||||
1
CICD/Ansible/demo.j2
Normal file
1
CICD/Ansible/demo.j2
Normal file
@ -0,0 +1 @@
|
||||
Hello, {{ name }}!
|
||||
174
CICD/Ansible/demo.yml
Normal file
174
CICD/Ansible/demo.yml
Normal file
@ -0,0 +1,174 @@
|
||||
- name: demo
|
||||
# hosts: master,node # 指定多个主机组
|
||||
hosts: all
|
||||
tasks:
|
||||
#############################################################################################
|
||||
# 拷贝文件
|
||||
#############################################################################################
|
||||
- copy:
|
||||
src: ./demo.tar
|
||||
dest: /root/demo.tar
|
||||
# 强制拷贝
|
||||
force: yes
|
||||
|
||||
#############################################################################################
|
||||
# 执行命令
|
||||
#############################################################################################
|
||||
# 执行命令 getenforce 并将结果保存到 out 变量
|
||||
- shell: getenforce
|
||||
register: out
|
||||
# 引用 out 变量, 输出结果
|
||||
- debug: msg="{{out}}"
|
||||
# 当 out.stdout 不等于 Disabled 时执行命令
|
||||
- shell: mkdir dingh
|
||||
when: out.stdout != "Disabled"
|
||||
|
||||
#############################################################################################
|
||||
# 安装软件
|
||||
#############################################################################################
|
||||
- yum:
|
||||
name: wget
|
||||
# 状态[默认 present], present 安装, absent 卸载, latest 更新
|
||||
state: present
|
||||
|
||||
#############################################################################################
|
||||
# 替换文件内容
|
||||
#############################################################################################
|
||||
- replace:
|
||||
# 文件路径
|
||||
path: /etc/selinux/config
|
||||
# 正则表达式
|
||||
regexp: "SELINUX=enforcing"
|
||||
# 替换内容
|
||||
replace: "SELINUX=disabled"
|
||||
|
||||
#############################################################################################
|
||||
# 管理服务
|
||||
#############################################################################################
|
||||
- service:
|
||||
# 服务名称
|
||||
name: docker
|
||||
# 状态[默认 started], started 启动, stopped 停止, restarted 重启, reloaded 重新加载
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
#############################################################################################
|
||||
# 创建用户
|
||||
#############################################################################################
|
||||
- user:
|
||||
# 用户名
|
||||
name: demo
|
||||
# 状态[默认 present], present 创建, absent 删除
|
||||
state: present
|
||||
|
||||
#############################################################################################
|
||||
# 创建组
|
||||
#############################################################################################
|
||||
- group:
|
||||
# 组名
|
||||
name: demo
|
||||
# 状态[默认 present], present 创建, absent 删除
|
||||
state: present
|
||||
|
||||
#############################################################################################
|
||||
# 创建目录
|
||||
#############################################################################################
|
||||
- file:
|
||||
# 目录路径
|
||||
path: /root/demo
|
||||
# directory 目录
|
||||
state: directory
|
||||
# 权限
|
||||
mode: 0755
|
||||
# 所属用户
|
||||
owner: demo
|
||||
# 所属组
|
||||
group: demo
|
||||
|
||||
#############################################################################################
|
||||
# 创建软连接
|
||||
#############################################################################################
|
||||
- file:
|
||||
# 文件路径
|
||||
path: /etc/localtime
|
||||
# link 链接
|
||||
state: link
|
||||
src: /usr/share/zoneinfo/Asia/Shanghai
|
||||
|
||||
#############################################################################################
|
||||
# 删除软连接
|
||||
#############################################################################################
|
||||
- file:
|
||||
path: /root/demo
|
||||
state: absent # 删除软连接
|
||||
force: yes
|
||||
|
||||
#############################################################################################
|
||||
# 创建文件
|
||||
#############################################################################################
|
||||
- file:
|
||||
# 文件路径
|
||||
path: /root/demo
|
||||
# touch 创建文件
|
||||
state: touch
|
||||
|
||||
#############################################################################################
|
||||
# 引用模板
|
||||
#############################################################################################
|
||||
- template:
|
||||
# 模板文件
|
||||
src: ./demo.j2
|
||||
# 目标文件
|
||||
dest: /root/demo
|
||||
# 权限
|
||||
mode: 0755
|
||||
# 所属用户
|
||||
owner: demo
|
||||
# 所属组
|
||||
group: demo
|
||||
# 变量
|
||||
vars:
|
||||
name: World
|
||||
|
||||
#############################################################################################
|
||||
# 配置环境变量
|
||||
#############################################################################################
|
||||
- lineinfile:
|
||||
# 文件路径
|
||||
path: /etc/profile
|
||||
# 正则表达式
|
||||
regexp: "export PATH"
|
||||
# 插入内容
|
||||
line: "export PATH=$PATH:/usr/local/bin"
|
||||
|
||||
#############################################################################################
|
||||
# 配置 crontab 定时任务
|
||||
#############################################################################################
|
||||
- cron:
|
||||
# 任务名称
|
||||
name: "demo"
|
||||
# 任务内容
|
||||
job: "echo 'hello' > /root/demo.log"
|
||||
# 任务状态[默认 present], present 创建, absent 删除
|
||||
state: present
|
||||
|
||||
#############################################################################################
|
||||
# 忽略错误
|
||||
#############################################################################################
|
||||
- command: echo "hello"
|
||||
# 忽略错误
|
||||
ignore_errors: yes
|
||||
|
||||
#############################################################################################
|
||||
# 调试信息
|
||||
#############################################################################################
|
||||
- debug: msg="hello world"
|
||||
|
||||
#############################################################################################
|
||||
# 循环
|
||||
#############################################################################################
|
||||
- debug: msg="{{ item }}"
|
||||
with_items:
|
||||
- 1
|
||||
- 2
|
||||
- 3
|
||||
3
CICD/Ansible/hosts
Normal file
3
CICD/Ansible/hosts
Normal file
@ -0,0 +1,3 @@
|
||||
[host]
|
||||
|
||||
192.168.1.10
|
||||
7
CICD/Ansible/key.yml
Normal file
7
CICD/Ansible/key.yml
Normal file
@ -0,0 +1,7 @@
|
||||
- hosts: all
|
||||
|
||||
tasks:
|
||||
|
||||
- name: Non secret authentication
|
||||
|
||||
authorized_key: user=root key="{{ lookup('file', '/root/.ssh/id_rsa.pub') }}" state=present
|
||||
30
CICD/Ansible/ssh-copy.sh
Executable file
30
CICD/Ansible/ssh-copy.sh
Executable file
@ -0,0 +1,30 @@
|
||||
#!/bin/bash
|
||||
|
||||
# 填写服务器密码
|
||||
PASSWORD=""
|
||||
|
||||
# 获取需要免密服务器IP地址, 自动排除 hosts 文件内 # [] 行
|
||||
IP_ADDR=$(
|
||||
grep -vE '^\[|\]' /etc/ansible/hosts | grep -v '#' | sed '/^$/d'
|
||||
)
|
||||
|
||||
. /etc/init.d/functions
|
||||
# 一键生成密钥
|
||||
if ! [ -f ~/.ssh/id_rsa.pub ];then
|
||||
ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa >/dev/null 2>&1
|
||||
echo -e "\033[32m======Local=========\033[0m"
|
||||
action "Generate the key!" /bin/true
|
||||
fi
|
||||
|
||||
# 批量发送密钥
|
||||
for i in $IP_ADDR;do
|
||||
sshpass -p$PASSWORD ssh-copy-id -i /root/.ssh/id_rsa.pub -o StrictHostKeyChecking=no ${i} >/dev/null 2>&1
|
||||
|
||||
if [ $? == 0 ];then
|
||||
echo -e "\033[32m=========`ssh $i hostname`==========\033[0m"
|
||||
action "发送成功!!!" /bin/true
|
||||
else
|
||||
echo -e "\033[31m======$i=======\033[0m"
|
||||
action "发送失败!!!" /bin/false
|
||||
fi
|
||||
done
|
||||
10
CICD/Ansible/ssh-hosts
Normal file
10
CICD/Ansible/ssh-hosts
Normal file
@ -0,0 +1,10 @@
|
||||
[ssh]
|
||||
|
||||
# 192.168.1.[10:11] # 批量
|
||||
# 192.168.1.10 # 单台
|
||||
|
||||
[ssh:vars]
|
||||
|
||||
ansible_ssh_user="root" # 用户
|
||||
|
||||
ansible_ssh_pass="" # 密码
|
||||
3
CICD/Drone/Dockerfile
Normal file
3
CICD/Drone/Dockerfile
Normal file
@ -0,0 +1,3 @@
|
||||
FROM busybox:latest
|
||||
|
||||
RUN echo "Hello World!"
|
||||
32
CICD/Drone/Docs/Drone客户端安装.md
Normal file
32
CICD/Drone/Docs/Drone客户端安装.md
Normal file
@ -0,0 +1,32 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Drone客户端安装
|
||||
|
||||
## 开始安装
|
||||
|
||||
[Homebrew官网](https://brew.sh/index_zh-cn)
|
||||
|
||||
- Linux 安装 Homebrew
|
||||
|
||||
```bash
|
||||
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
|
||||
```
|
||||
|
||||
- MAC 使用 Homebrew 安装 Drone命令
|
||||
|
||||
```bash
|
||||
brew tap drone/drone
|
||||
brew install drone
|
||||
```
|
||||
|
||||
## 使用命令触发 Drone 构建
|
||||
|
||||
[Drone 命令官网](https://0-8-0.docs.drone.io/zh/cli-installation/)
|
||||
|
||||
```bash
|
||||
curl -X POST \
|
||||
-H "Authorization: Bearer $YOUR_API_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
https://your.drone.instance/api/repos/用户/仓库名/builds
|
||||
```
|
||||
|
||||
32
CICD/Drone/Docs/README.md
Normal file
32
CICD/Drone/Docs/README.md
Normal file
@ -0,0 +1,32 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Drone的使用
|
||||
|
||||
## 快速启动 Runner 执行端
|
||||
|
||||
```bash
|
||||
docker run --detach \
|
||||
--volume=/var/run/docker.sock:/var/run/docker.sock \
|
||||
--env=DRONE_RPC_PROTO=https \
|
||||
--env=DRONE_RPC_HOST= \
|
||||
--env=DRONE_RPC_SECRET= \
|
||||
--env=DRONE_RUNNER_CAPACITY=4 \
|
||||
--env=DRONE_RUNNER_NAME=runner \
|
||||
--restart=always \
|
||||
--name=runner \
|
||||
drone/drone-runner-docker
|
||||
```
|
||||
|
||||
> Runner 添加标签
|
||||
>
|
||||
> ```bash
|
||||
> --from-literal=DRONE_RUNNER_LABELS=<标签:值> \
|
||||
> ```
|
||||
|
||||
## Kubernetes部署文档
|
||||
|
||||
- [Helm部署Drone](https://gitee.com/offends/Kubernetes/blob/main/Helm/Helm%E9%83%A8%E7%BD%B2Drone.md)
|
||||
- [Helm部署Drone-Runner-Docker](https://gitee.com/offends/Kubernetes/blob/main/Helm/Helm%E9%83%A8%E7%BD%B2Drone-Runner-Docker.md)
|
||||
- [Helm部署Drone-Runner-Kube](https://gitee.com/offends/Kubernetes/blob/main/Helm/Helm%E9%83%A8%E7%BD%B2Drone-Runner-Kube.md)
|
||||
- [Helm部署Drone-Kubernetes-Secrets](https://gitee.com/offends/Kubernetes/blob/main/Helm/Helm%E9%83%A8%E7%BD%B2Drone-Kubernetes-Secrets.md)
|
||||
|
||||
3
CICD/Drone/File/Demo.md
Normal file
3
CICD/Drone/File/Demo.md
Normal file
@ -0,0 +1,3 @@
|
||||
*
|
||||
|
||||
This is a test file
|
||||
27
CICD/Drone/File/admin-user.yaml
Normal file
27
CICD/Drone/File/admin-user.yaml
Normal file
@ -0,0 +1,27 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: admin-user
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: admin-user
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: admin-user
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: admin-token
|
||||
namespace: kube-system
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: admin-user
|
||||
type: kubernetes.io/service-account-token
|
||||
361
CICD/Drone/README.md
Normal file
361
CICD/Drone/README.md
Normal file
@ -0,0 +1,361 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# DronePlugins构建Docker镜像
|
||||
|
||||
## 准备环境
|
||||
|
||||
- 克隆仓库到本地
|
||||
|
||||
```bash
|
||||
git clone https://gitea.offends.cn/offends/Kubernetes.git && cd Kubernetes/CICD/Drone
|
||||
```
|
||||
|
||||
- 修改 Dockerfile 并上传至自己的仓库
|
||||
|
||||
- 进入 Drone Web页面点击 SYNC 同步仓库
|
||||
|
||||
- 点击 ACTIVATE REPOSITORY 激活存储库
|
||||
|
||||
- 点击 Settings 配置 Secrets
|
||||
|
||||
| 变量名 | 解释 | 例 |
|
||||
| :-------------: | :--------------: | :---------------------------------------------------: |
|
||||
| REGISTRY | 镜像仓库地址 | registry.cn-hangzhou.aliyuncs.com |
|
||||
| DOCKER_USERNAME | 镜像仓库登录用户 | |
|
||||
| DOCKER_PASSWORD | 镜像仓库登录密码 | |
|
||||
| REPO | 镜像的仓库名称 | registry.cn-hangzhou.aliyuncs.com/<命名空间>/<镜像名> |
|
||||
|
||||
## 插件 plugins/docker 参数
|
||||
|
||||
[官网文档](https://plugins.drone.io/plugins/docker)
|
||||
|
||||
| 属性 | 类型 | 可选/必选 | 描述 | 默认值 |
|
||||
| ------------------- | ------ | --------- | ------------------------------------------------------------ | ------------ |
|
||||
| registry | 字符串 | 可选 | 身份验证到该注册表的注册表 | 无 |
|
||||
| username | 字符串 | 可选 | 使用此用户名进行身份验证 | 无 |
|
||||
| password | 字符串 | 可选 | 使用此密码进行身份验证 | 推荐使用密钥 |
|
||||
| repo | 字符串 | 可选 | 图像的仓库名称 | 无 |
|
||||
| tags | 数组 | 可选 | 图像的仓库标签 | 无 |
|
||||
| secret | 字符串 | 可选 | 使用buildkit将秘密传递给dockerbuild。例如`id=mysecret，src=secret-file` | 无 |
|
||||
| dockerfile | 字符串 | 可选 | 要使用的Dockerfile | Dockerfile |
|
||||
| dry_run | 字符串 | 可选 | 如果不应在最后推送Docker镜像，则为布尔值 | 无 |
|
||||
| purge | 布尔值 | 可选 | 如果应在最后清理Docker镜像，则为布尔值 | true |
|
||||
| context | 字符串 | 可选 | 要使用的上下文路径，默认为git存储库的根目录 | 无 |
|
||||
| target | 字符串 | 可选 | 要使用的构建目标，必须在Docker文件中定义 | 无 |
|
||||
| force_tag | 布尔值 | 可选 | 替换现有匹配的镜像标签 | false |
|
||||
| insecure | 布尔值 | 可选 | 启用与此注册表的不安全通信 | false |
|
||||
| mirror | 字符串 | 可选 | 使用镜像注册表而不是直接从中央Hub拉取图像 | 无 |
|
||||
| bip | 布尔值 | 可选 | 用于传递桥接IP | false |
|
||||
| custom_dns | 字符串 | 可选 | 为容器设置自定义DNS服务器 | 无 |
|
||||
| custom_dns_search | 字符串 | 可选 | Docker守护程序DNS搜索域 | 无 |
|
||||
| storage_driver | 字符串 | 可选 | 支持`aufs`、`overlay`或`vfs`驱动器 | 无 |
|
||||
| storage_path | 字符串 | 可选 | Docker守护程序存储路径 | 无 |
|
||||
| build_args | 字符串 | 可选 | 传递给docker build的自定义参数 | 无 |
|
||||
| build_args_from_env | 字符串 | 可选 | 将环境变量作为docker build的自定义参数传递 | 无 |
|
||||
| auto_tag | 布尔值 | 可选 | 根据git分支和git标签自动生成标签名称 | false |
|
||||
| auto_tag_suffix | 字符串 | 可选 | 使用此后缀生成标签名称 | 无 |
|
||||
| debug | 布尔值 | 可选 | 以详细调试模式启动docker守护进程 | false |
|
||||
| launch_debug | 布尔值 | 可选 | 以详细调试模式启动docker守护进程 | false |
|
||||
| mtu | 字符串 | 可选 | Docker守护程序自定义MTU设置 | 无 |
|
||||
| ipv6 | 字符串 | 可选 | Docker守护程序IPv6网络 | 无 |
|
||||
| experimental | 布尔值 | 可选 | Docker守护程序实验模式 | false |
|
||||
| daemon_off | 布尔值 | 可选 | 不启动docker守护进程 | false |
|
||||
| cache_from | 字符串 | 可选 | 考虑作为缓存源的镜像 | 无 |
|
||||
| squash | 布尔值 | 可选 | 在构建时压缩层 | false |
|
||||
| pull_image | 布尔值 | 可选 | 强制在构建时拉取基础镜像 | false |
|
||||
| compress | 布尔值 | 可选 | 使用gzip压缩构建上下文 | false |
|
||||
| custom_labels | 字符串 | 可选 | 附加的k=v标签 | 无 |
|
||||
| label_schema | 字符串 | 可选 | label-schema标签 | 无 |
|
||||
| email | 字符串 | 可选 | Docker电子邮件 | 无 |
|
||||
| no_cache | 字符串 | 可选 | 不使用缓存的中间容器 | 无 |
|
||||
| add_host | 字符串 | 可选 | 附加的主机:IP映射 | 无 |
|
||||
| platform | 字符串 | 可选 | 指定构建输出的目标平台，例如`linux/amd64`、`linux/arm64`或`darwin/amd64` | 无 |
|
||||
| ssh-agent-key | 字符串 | 可选 | 用于ssh直通的私钥，参见https://docs.docker.com/engine/reference/commandline/buildx_build/#ssh | 推荐使用密钥 |
|
||||
|
||||
|
||||
|
||||
# Drone Webhook 通知构建结果
|
||||
|
||||
## 准备环境
|
||||
|
||||
- 克隆仓库到本地
|
||||
|
||||
```bash
|
||||
git clone https://gitea.offends.cn/offends/Kubernetes.git && cd Kubernetes/CICD/Drone
|
||||
```
|
||||
|
||||
- 修改 Dockerfile 并上传至自己的仓库
|
||||
|
||||
- 进入 Drone Web页面点击 SYNC 同步仓库
|
||||
|
||||
- 点击 ACTIVATE REPOSITORY 激活存储库
|
||||
|
||||
- 点击 Settings 修改 Configuration,修改后点击 SAVE CHANGES 保存
|
||||
|
||||
```bash
|
||||
.drone-build-webhook.yml
|
||||
```
|
||||
|
||||
- 配置 Secrets
|
||||
|
||||
| 变量名 | 解释 | 例 |
|
||||
| :---------: | :-----------------: | :----------------------------------------------: |
|
||||
| WEBHOOK_URL | 发送 Webhook 的 URL | https://open.feishu.cn/open-apis/bot/v2/hook/*** |
|
||||
|
||||
## 插件 plugins/webhook 参数
|
||||
|
||||
| 属性名 | 类型 | 必需性 | 描述 | 默认值 |
|
||||
| ------------ | ------- | -------- | ------------------------ | ---------------- |
|
||||
| urls | string | required | 发送 Webhook 的 URL | none |
|
||||
| username | string | optional | 用于基本身份验证的用户名 | none |
|
||||
| password | string | optional | 用于基本身份验证的密码 | none |
|
||||
| SECRET | string | | 推荐使用的密钥 | none |
|
||||
| method | string | optional | 请求使用的 HTTP 方法 | POST |
|
||||
| content_type | string | optional | Webhook 的内容类型 | application/json |
|
||||
| template | string | optional | Webhook 的自定义模板 | none |
|
||||
| headers | array | optional | 自定义标头的映射 | none |
|
||||
| skip_verify | boolean | optional | 跳过 SSL 验证 | false |
|
||||
| debug | boolean | optional | 启用调试信息 | false |
|
||||
|
||||
|
||||
|
||||
# Drone Dind 构建 Docker 镜像
|
||||
|
||||
## 准备环境
|
||||
|
||||
- 克隆仓库到本地
|
||||
|
||||
```bash
|
||||
git clone https://gitea.offends.cn/offends/Kubernetes.git && cd Kubernetes/CICD/Drone
|
||||
```
|
||||
|
||||
- 修改 Dockerfile 并上传至自己的仓库
|
||||
|
||||
- 进入 Drone Web页面点击 SYNC 同步仓库
|
||||
|
||||
- 点击 ACTIVATE REPOSITORY 激活存储库
|
||||
|
||||
- 点击 Settings 开启 Trusted (未开启无法挂载Docker守护进程)
|
||||
|
||||
- 修改 Configuration,修改后点击 SAVE CHANGES 保存
|
||||
|
||||
```bash
|
||||
.drone-dind.yml
|
||||
```
|
||||
|
||||
- 配置 Secrets
|
||||
|
||||
| 变量名 | 解释 | 例 |
|
||||
| :-------------: | :--------------: | :-------------------------------: |
|
||||
| REGISTRY | 镜像仓库地址 | registry.cn-hangzhou.aliyuncs.com |
|
||||
| DOCKER_USERNAME | 镜像仓库登录用户 | |
|
||||
| DOCKER_PASSWORD | 镜像仓库登录密码 | |
|
||||
| NAMESPACE | 镜像的仓库名称 | <命名空间> |
|
||||
| IMAGENAME | 镜像名称 | |
|
||||
| IMAGETAG | 镜像标签 | |
|
||||
|
||||
|
||||
|
||||
# Drone 构建多架构 Docker 镜像
|
||||
|
||||
## 准备环境
|
||||
|
||||
- 克隆仓库到本地
|
||||
|
||||
```bash
|
||||
git clone https://gitea.offends.cn/offends/Kubernetes.git && cd Kubernetes/CICD/Drone
|
||||
```
|
||||
|
||||
- 修改 Dockerfile 并上传至自己的仓库
|
||||
|
||||
- 进入 Drone Web页面点击 SYNC 同步仓库
|
||||
|
||||
- 点击 ACTIVATE REPOSITORY 激活存储库
|
||||
|
||||
- 点击 Settings 下 General 修改 Configuration,修改后点击 SAVE CHANGES 保存
|
||||
|
||||
```bash
|
||||
.drone-buildx.yml
|
||||
```
|
||||
|
||||
- 配置 Secrets
|
||||
|
||||
| 变量名 | 解释 | 例 |
|
||||
| :-------------: | :--------------: | :---------------------------: |
|
||||
| REGISTRY | 镜像仓库地址 | docker.io |
|
||||
| DOCKER_USERNAME | 镜像仓库登录用户 | |
|
||||
| DOCKER_PASSWORD | 镜像仓库登录密码 | |
|
||||
| REPO | 镜像的仓库名称 | docker.io/<命名空间>/<镜像名> |
|
||||
|
||||
|
||||
|
||||
# Drone Scp 文件到服务器内
|
||||
|
||||
## 准备环境
|
||||
|
||||
- 克隆仓库到本地
|
||||
|
||||
```bash
|
||||
git clone https://gitea.offends.cn/offends/Kubernetes.git && cd Kubernetes/CICD/Drone
|
||||
```
|
||||
|
||||
- 修改 Dockerfile 并上传至自己的仓库
|
||||
|
||||
- 进入 Drone Web页面点击 SYNC 同步仓库
|
||||
|
||||
- 点击 ACTIVATE REPOSITORY 激活存储库
|
||||
|
||||
- 点击 Settings 下 General 修改 Configuration,修改后点击 SAVE CHANGES 保存
|
||||
|
||||
```bash
|
||||
.drone-scp.yml
|
||||
```
|
||||
|
||||
- 配置 Secrets
|
||||
|
||||
| 变量名 | 解释 | 例 |
|
||||
| :------: | :----------------: | :----------: |
|
||||
| HOST | 目标主机机器 | 192.168.1.10 |
|
||||
| USER | 目标主机机器用户名 | Root |
|
||||
| PASSWORD | 目标主机机器密码 | |
|
||||
| PORT | 目标主机机器端口 | 22 |
|
||||
|
||||
## 插件 appleboy/drone-scp 参数
|
||||
|
||||
[官方文档](https://plugins.drone.io/plugins/scp)
|
||||
|
||||
| 属性名 | 类型 | 是否必需 | 描述 | 默认值 |
|
||||
| -------------------- | ------ | -------- | ---------------------------- | ------ |
|
||||
| host | 字符串 | 必需 | 目标主机机器。 | 无 |
|
||||
| port | 数字 | 可选 | 目标主机机器端口。 | 22 |
|
||||
| username | 字符串 | 必需 | 目标主机机器用户名。 | 无 |
|
||||
| password | 字符串 | 必需 | 目标主机机器密码。 | 无 |
|
||||
| key | 字符串 | 可选 | 目标主机机器私钥。建议保密。 | 无 |
|
||||
| passphrase | 字符串 | 可选 | 私钥密码。建议保密。 | 无 |
|
||||
| target | 字符串 | 必需 | 目标主机机器路径。 | 无 |
|
||||
| source | 字符串 | 必需 | 源文件路径。 | 无 |
|
||||
| rm | 布尔值 | 可选 | 复制后是否删除源文件。 | false |
|
||||
| timeout | 数字 | 可选 | 超时时间（秒）。 | 30 |
|
||||
| command_timeout | 数字 | 可选 | 命令超时时间（分钟）。 | 10 |
|
||||
| strip_components | 数字 | 可选 | 从目标路径中去除的组件数。 | 0 |
|
||||
| tar_tmp_path | 字符串 | 可选 | 用于临时存储tar文件的路径。 | 无 |
|
||||
| tar_exec | 字符串 | 可选 | Tar命令。 | 无 |
|
||||
| overwrite | 布尔值 | 可选 | 如果目标文件存在，是否覆盖。 | false |
|
||||
| proxy_host | 字符串 | 可选 | 代理主机。 | 无 |
|
||||
| proxy_port | 数字 | 可选 | 代理端口。 | 0 |
|
||||
| proxy_username | 字符串 | 可选 | 代理用户名。 | 无 |
|
||||
| proxy_password | 字符串 | 可选 | 代理密码。建议保密。 | 无 |
|
||||
| proxy_key | 字符串 | 可选 | 代理私钥。建议保密。 | 无 |
|
||||
| proxy_key_path | 字符串 | 可选 | 代理私钥路径。 | 无 |
|
||||
| proxy_key_passphrase | 字符串 | 可选 | 代理私钥密码。建议保密。 | 无 |
|
||||
|
||||
|
||||
|
||||
# Drone Ssh 操作服务器
|
||||
|
||||
## 准备环境
|
||||
|
||||
- 克隆仓库到本地
|
||||
|
||||
```bash
|
||||
git clone https://gitea.offends.cn/offends/Kubernetes.git && cd Kubernetes/CICD/Drone
|
||||
```
|
||||
|
||||
- 修改 Dockerfile 并上传至自己的仓库
|
||||
|
||||
- 进入 Drone Web页面点击 SYNC 同步仓库
|
||||
|
||||
- 点击 ACTIVATE REPOSITORY 激活存储库
|
||||
|
||||
- 点击 Settings 下 General 修改 Configuration,修改后点击 SAVE CHANGES 保存
|
||||
|
||||
```bash
|
||||
.drone-ssh.yml
|
||||
```
|
||||
|
||||
- 配置 Secrets
|
||||
|
||||
| 变量名 | 解释 | 例 |
|
||||
| :------: | :----------------: | :----------: |
|
||||
| HOST | 目标主机机器 | 192.168.1.10 |
|
||||
| USER | 目标主机机器用户名 | Root |
|
||||
| PASSWORD | 目标主机机器密码 | |
|
||||
| PORT | 目标主机机器端口 | 22 |
|
||||
|
||||
## 插件 appleboy/drone-ssh 参数
|
||||
|
||||
[官方文档](https://plugins.drone.io/plugins/ssh)
|
||||
|
||||
| 属性名 | 类型 | 是否必须 | 描述 | 默认值 |
|
||||
| --------------- | ------ | -------- | ---------------------------- | -------------- |
|
||||
| host | 字符串 | 必须 | 服务器的主机名或IP地址。 | 无 |
|
||||
| port | 字符串 | 可选 | 服务器的端口。 | 22 |
|
||||
| username | 字符串 | 可选 | 目标主机用户的帐户。 | 无 |
|
||||
| password | 字符串 | 可选 | 登录到服务器的密码。 | 无（建议保密） |
|
||||
| key | 字符串 | 可选 | 用户私钥的明文。 | 无（建议保密） |
|
||||
| key_path | 字符串 | 可选 | 登录到服务器的私钥路径。 | 无 |
|
||||
| envs | 数组 | 可选 | 在脚本部分可用的自定义秘密。 | 无 |
|
||||
| script | 字符串 | 可选 | 在服务器上执行的命令。 | 无 |
|
||||
| script_stop | 布尔值 | 可选 | 在第一次失败后停止脚本执行。 | false |
|
||||
| timeout | 字符串 | 可选 | SSH连接建立的最长时间。 | 30秒 |
|
||||
| command_timeout | 字符串 | 可选 | 执行命令的最长时间。 | 10分钟 |
|
||||
| proxy_host | 字符串 | 可选 | 代理的主机名或IP地址。 | 无 |
|
||||
| proxy_port | 字符串 | 可选 | 代理端口。 | 无 |
|
||||
| proxy_username | 字符串 | 可选 | 代理用户名。 | 无 |
|
||||
| proxy_password | 字符串 | 可选 | 代理密码。 | 无（建议保密） |
|
||||
| proxy_key | 字符串 | 可选 | 代理私钥的明文。 | 无（建议保密） |
|
||||
| proxy_key_path | 字符串 | 可选 | 登录到代理的私钥路径。 | 无 |
|
||||
|
||||
|
||||
|
||||
# Drone Git Push 代码
|
||||
|
||||
> 你不会，俺不会，大家一起都不会！
|
||||
|
||||
## 准备环境
|
||||
|
||||
- 克隆仓库到本地
|
||||
|
||||
```bash
|
||||
git clone https://gitea.offends.cn/offends/Kubernetes.git && cd Kubernetes/CICD/Drone
|
||||
```
|
||||
|
||||
- 修改 Dockerfile 并上传至自己的仓库
|
||||
|
||||
- 进入 Drone Web页面点击 SYNC 同步仓库
|
||||
|
||||
- 点击 ACTIVATE REPOSITORY 激活存储库
|
||||
|
||||
- 点击 Settings 下 General 修改 Configuration,修改后点击 SAVE CHANGES 保存
|
||||
|
||||
```bash
|
||||
.drone-git-push.yml
|
||||
```
|
||||
|
||||
- 配置 Secrets
|
||||
|
||||
| 变量名 | 解释 | 例 |
|
||||
| :-----: | :-------------------: | :-----------------------: |
|
||||
| REMOTE | 目标远程仓库 | <仓库 clone 地址> |
|
||||
| SSH_KEY | 远程机器的私有SSH密钥 | <应该是 .ssh/id_rsa 文件> |
|
||||
|
||||
## 插件 appleboy/drone-git-push 参数
|
||||
|
||||
[官方文档](https://plugins.drone.io/plugins/git-push)
|
||||
|
||||
| 属性名 | 类型 | 是否必须 | 描述 | 默认值 |
|
||||
| -------------- | ------ | -------- | -------------------------------------- | ---------------------------- |
|
||||
| ssh_key | 字符串 | 可选 | 远程机器的私有SSH密钥。 | 无 |
|
||||
| remote | 字符串 | 必须 | 目标远程仓库（如果为空，则假定存在）。 | 无 |
|
||||
| remote_name | 字符串 | 可选 | 用于本地操作的远程的名称。 | deploy |
|
||||
| branch | 字符串 | 可选 | 要推送到的目标分支。 | master |
|
||||
| local_branch | 字符串 | 可选 | 从中推送的本地分支或引用。 | HEAD |
|
||||
| path | 字符串 | 可选 | 仓库的路径。 | 当前仓库 |
|
||||
| force | 布尔值 | 可选 | 使用 --force 标志进行强制推送。 | false |
|
||||
| skip_verify | 布尔值 | 可选 | 跳过HTTPS证书的验证。 | false |
|
||||
| commit | 布尔值 | 可选 | 在推送之前添加并提交仓库的内容。 | false |
|
||||
| commit_message | 字符串 | 可选 | 为提交添加自定义消息。 | [skip ci] Commit dirty state |
|
||||
| empty_commit | 布尔值 | 可选 | 如果没有更改，则创建一个空的提交。 | false |
|
||||
| author_name | 字符串 | 可选 | 提交的作者姓名。 | commiter name |
|
||||
| author_email | 字符串 | 可选 | 提交的作者电子邮件。 | commiter email |
|
||||
| followtags | 布尔值 | 可选 | 使用 --follow-tags 选项推送。 | false |
|
||||
72
CICD/Drone/YML/.drone-build-webhook.yml
Normal file
72
CICD/Drone/YML/.drone-build-webhook.yml
Normal file
@ -0,0 +1,72 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Build Dockerfile
|
||||
|
||||
# 手动触发或接口触发
|
||||
trigger:
|
||||
event:
|
||||
- custom
|
||||
|
||||
# 指定架构,需在 runner 配置环境变量中指定 DRONE_RUNNER_ARCH,或自动获取
|
||||
# platform:
|
||||
# os: linux
|
||||
# arch: amd64
|
||||
|
||||
# 指定运行环境节点,需在 runner 配置环境变量中指定 DRONE_RUNNER_LABELS
|
||||
# node:
|
||||
# 标签:值
|
||||
|
||||
# 使用插件构建镜像
|
||||
steps:
|
||||
- name: Build Dockerfile
|
||||
image: plugins/docker
|
||||
# 仅当本地不存在该镜像时才拉取
|
||||
pull: if-not-exists
|
||||
settings:
|
||||
registry:
|
||||
from_secret: REGISTRY
|
||||
username:
|
||||
from_secret: DOCKER_USERNAME
|
||||
password:
|
||||
from_secret: DOCKER_PASSWORD
|
||||
repo:
|
||||
from_secret: REPO
|
||||
# 是否禁止推送镜像
|
||||
dry_run: false
|
||||
tags:
|
||||
- latest
|
||||
# 要使用的上下文路径，默认为 git 存储库的根目录
|
||||
context: ./
|
||||
# 要使用的 dockerfile 路径，默认为 git 存储库的根目录
|
||||
dockerfile: ./Dockerfile
|
||||
- name: 结果通知
|
||||
image: plugins/webhook
|
||||
depends_on: [Build Dockerfile]
|
||||
settings:
|
||||
urls:
|
||||
from_secret: WEBHOOK_URL
|
||||
|
||||
# # 飞书机器人
|
||||
# 官网飞书机器人使用指南: https://open.feishu.cn/document/client-docs/bot-v3/add-custom-bot
|
||||
# 消息类型指南: https://open.feishu.cn/community/articles/7271149634339422210
|
||||
method: POST
|
||||
content_type: "application/json"
|
||||
# 通知内容,读取上一步执行结果,如果成功则返回构建成功,失败则返回构建失败
|
||||
template: >
|
||||
{
|
||||
"msg_type": "text",
|
||||
"content": {
|
||||
"text":
|
||||
{{#success build.status}}
|
||||
"镜像构建成功"
|
||||
{{else}}
|
||||
"镜像构建失败"
|
||||
{{/success}}
|
||||
}
|
||||
}
|
||||
|
||||
# 无论构建成功或失败都通知
|
||||
when:
|
||||
status:
|
||||
- success
|
||||
- failure
|
||||
38
CICD/Drone/YML/.drone-buildx.yml
Normal file
38
CICD/Drone/YML/.drone-buildx.yml
Normal file
@ -0,0 +1,38 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Build Dockerfile
|
||||
|
||||
# 手动触发或接口触发
|
||||
trigger:
|
||||
event:
|
||||
- custom
|
||||
|
||||
# 指定运行环境节点,需在 runner 配置环境变量中指定 DRONE_RUNNER_LABELS
|
||||
# node:
|
||||
# 标签:值
|
||||
|
||||
# 使用插件构建镜像
|
||||
steps:
|
||||
- name: latest
|
||||
image: thegeeklab/drone-docker-buildx
|
||||
privileged: true
|
||||
settings:
|
||||
registry:
|
||||
from_secret: REGISTRY
|
||||
username:
|
||||
from_secret: DOCKER_USERNAME
|
||||
password:
|
||||
from_secret: DOCKER_PASSWORD
|
||||
repo:
|
||||
from_secret: REPO
|
||||
purge: true
|
||||
compress: true
|
||||
platforms:
|
||||
- linux/amd64
|
||||
- linux/arm64
|
||||
context: ./
|
||||
dockerfile: ./Dockerfile
|
||||
tags: latest
|
||||
when:
|
||||
branch:
|
||||
- main
|
||||
22
CICD/Drone/YML/.drone-deploy.yml
Normal file
22
CICD/Drone/YML/.drone-deploy.yml
Normal file
@ -0,0 +1,22 @@
|
||||
kind: pipeline
|
||||
name: default
|
||||
|
||||
trigger:
|
||||
event:
|
||||
include:
|
||||
- custom
|
||||
|
||||
steps:
|
||||
- name: Update-Deployment
|
||||
image: quay.io/honestbee/drone-kubernetes
|
||||
settings:
|
||||
kubernetes_server:
|
||||
from_secret: KUBERNESTES_SERVER
|
||||
kubernetes_token:
|
||||
from_secret: KUBERNESTES_TOKEN
|
||||
namespace: default
|
||||
deployment: nginx
|
||||
repo: nginx
|
||||
container: nginx
|
||||
tag:
|
||||
- latest
|
||||
61
CICD/Drone/YML/.drone-dind.yml
Normal file
61
CICD/Drone/YML/.drone-dind.yml
Normal file
@ -0,0 +1,61 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Build Dockerfile
|
||||
|
||||
# platform:
|
||||
# os: linux
|
||||
# arch: amd64
|
||||
|
||||
# 手动触发或接口触发
|
||||
trigger:
|
||||
event:
|
||||
- custom
|
||||
|
||||
steps:
|
||||
- name: Dockerfile
|
||||
image: docker:dind
|
||||
|
||||
# 挂载Docker守护进程
|
||||
volumes:
|
||||
- name: dockersock
|
||||
path: /var/run/docker.sock
|
||||
|
||||
# 环境变量
|
||||
environment:
|
||||
DOCKER_USERNAME:
|
||||
from_secret: DOCKER_USERNAME
|
||||
DOCKER_PASSWORD:
|
||||
from_secret: DOCKER_PASSWORD
|
||||
NAMESPACE:
|
||||
from_secret: NAMESPACE
|
||||
# 镜像名
|
||||
IMAGENAME: demo
|
||||
# 镜像标签
|
||||
IMAGETAG: latest
|
||||
# 镜像仓库私有地址
|
||||
REGISTRY:
|
||||
from_secret: REGISTRY
|
||||
|
||||
# 执行命令
|
||||
commands:
|
||||
# 推送镜像至阿里云
|
||||
# - docker build -t registry.cn-hangzhou.aliyuncs.com/$NAMESPACE/$IMAGENAME:$IMAGETAG .
|
||||
# - docker login registry.cn-hangzhou.aliyuncs.com -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
|
||||
# - docker push registry.cn-hangzhou.aliyuncs.com/$NAMESPACE/$IMAGENAME:$IMAGETAG
|
||||
|
||||
# 推送镜像至DockerHub
|
||||
# - docker build -t $DOCKER_USERNAME/$IMAGENAME:$IMAGETAG .
|
||||
# - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
|
||||
# - docker push $DOCKER_USERNAME/$IMAGENAME:$IMAGETAG
|
||||
|
||||
# 推送镜像至私有仓库
|
||||
- docker build -t $REGISTRY/$NAMESPACE/$IMAGENAME:$IMAGETAG .
|
||||
- docker login $REGISTRY -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
|
||||
- docker push $REGISTRY/$NAMESPACE/$IMAGENAME:$IMAGETAG
|
||||
|
||||
|
||||
# 挂载Docker守护进程
|
||||
volumes:
|
||||
- name: dockersock
|
||||
host:
|
||||
path: /var/run/docker.sock
|
||||
24
CICD/Drone/YML/.drone-git-push.yml
Normal file
24
CICD/Drone/YML/.drone-git-push.yml
Normal file
@ -0,0 +1,24 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Git Push
|
||||
|
||||
# 手动触发或接口触发
|
||||
trigger:
|
||||
event:
|
||||
- custom
|
||||
|
||||
steps:
|
||||
- name: Git Push
|
||||
image: appleboy/drone-git-push
|
||||
# 仅当本地不存在该镜像时才拉取
|
||||
pull: if-not-exists
|
||||
settings:
|
||||
branch: main
|
||||
remote:
|
||||
from_secret: REMOTE
|
||||
ssh_key:
|
||||
from_secret: SSH_KEY
|
||||
path:
|
||||
force: false
|
||||
commit: true
|
||||
commit_message: "Update From Drone"
|
||||
31
CICD/Drone/YML/.drone-scp.yml
Normal file
31
CICD/Drone/YML/.drone-scp.yml
Normal file
@ -0,0 +1,31 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Scp File
|
||||
|
||||
# 手动触发或接口触发
|
||||
trigger:
|
||||
event:
|
||||
- custom
|
||||
|
||||
steps:
|
||||
- name: Scp File
|
||||
image: appleboy/drone-scp
|
||||
# 仅当本地不存在该镜像时才拉取
|
||||
pull: if-not-exists
|
||||
settings:
|
||||
host:
|
||||
from_secret: HOST
|
||||
user:
|
||||
from_secret: USER
|
||||
password:
|
||||
from_secret: PASSWORD
|
||||
port:
|
||||
from_secret: PORT
|
||||
# 源文件路径
|
||||
source: File/*
|
||||
strip_components: 1
|
||||
# 目标路径
|
||||
target: /root/
|
||||
when:
|
||||
branch:
|
||||
- main
|
||||
29
CICD/Drone/YML/.drone-ssh.yml
Normal file
29
CICD/Drone/YML/.drone-ssh.yml
Normal file
@ -0,0 +1,29 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Ssh Server
|
||||
|
||||
# 手动触发或接口触发
|
||||
trigger:
|
||||
event:
|
||||
- custom
|
||||
|
||||
steps:
|
||||
- name: Ssh Server
|
||||
image: appleboy/drone-ssh
|
||||
# 仅当本地不存在该镜像时才拉取
|
||||
pull: if-not-exists
|
||||
settings:
|
||||
host:
|
||||
from_secret: HOST
|
||||
user:
|
||||
from_secret: USER
|
||||
password:
|
||||
from_secret: PASSWORD
|
||||
port:
|
||||
from_secret: PORT
|
||||
# 执行命令
|
||||
script:
|
||||
- ls
|
||||
when:
|
||||
branch:
|
||||
- main
|
||||
44
CICD/Drone/YML/.drone.yml
Normal file
44
CICD/Drone/YML/.drone.yml
Normal file
@ -0,0 +1,44 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Build Dockerfile
|
||||
|
||||
# 手动触发或接口触发
|
||||
trigger:
|
||||
event:
|
||||
- custom
|
||||
|
||||
# 指定架构,需在 runner 配置环境变量中指定 DRONE_RUNNER_ARCH,或自动获取
|
||||
# platform:
|
||||
# os: linux
|
||||
# arch: amd64
|
||||
|
||||
# 指定运行环境节点,需在 runner 配置环境变量中指定 DRONE_RUNNER_LABELS
|
||||
# node:
|
||||
# 标签:值
|
||||
|
||||
# 使用插件构建镜像
|
||||
steps:
|
||||
- name: Build Dockerfile
|
||||
image: plugins/docker
|
||||
# 仅当本地不存在该镜像时才拉取
|
||||
pull: if-not-exists
|
||||
settings:
|
||||
registry:
|
||||
from_secret: REGISTRY
|
||||
username:
|
||||
from_secret: DOCKER_USERNAME
|
||||
password:
|
||||
from_secret: DOCKER_PASSWORD
|
||||
repo:
|
||||
from_secret: REPO
|
||||
# 是否禁止推送镜像
|
||||
dry_run: false
|
||||
tags:
|
||||
- latest
|
||||
# 要使用的上下文路径，默认为 git 存储库的根目录
|
||||
context: ./
|
||||
# 要使用的 dockerfile 路径，默认为 git 存储库的根目录
|
||||
dockerfile: ./Dockerfile
|
||||
when:
|
||||
branch:
|
||||
- main
|
||||
7
CICD/Github/.github/workflows/dependabot.yml
vendored
Normal file
7
CICD/Github/.github/workflows/dependabot.yml
vendored
Normal file
@ -0,0 +1,7 @@
|
||||
version: 2
|
||||
updates:
|
||||
- package-ecosystem: npm
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: daily
|
||||
open-pull-requests-limit: 20
|
||||
31
CICD/Github/.github/workflows/images.yml
vendored
Normal file
31
CICD/Github/.github/workflows/images.yml
vendored
Normal file
@ -0,0 +1,31 @@
|
||||
name: Build-Work
|
||||
|
||||
on:
|
||||
repository_dispatch:
|
||||
types:
|
||||
- StartAction-Build-Images
|
||||
|
||||
jobs:
|
||||
Build-Images:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
-
|
||||
name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
-
|
||||
name: Login to Docker Hub
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_HUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
|
||||
-
|
||||
name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v2
|
||||
-
|
||||
name: Build and push image
|
||||
uses: docker/build-push-action@v3
|
||||
with:
|
||||
context: ./
|
||||
file: ./Dockerfile
|
||||
push: true
|
||||
tags: ${{ secrets.DOCKER_HUB_USERNAME }}/demo:v1.0
|
||||
5
CICD/Github/Dockerfile
Normal file
5
CICD/Github/Dockerfile
Normal file
@ -0,0 +1,5 @@
|
||||
FROM busybox:latest
|
||||
|
||||
RUN echo "启动成功" > /file.txt
|
||||
|
||||
CMD ["tail","-f","/file.txt"]
|
||||
189
CICD/Github/README.md
Normal file
189
CICD/Github/README.md
Normal file
@ -0,0 +1,189 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# GithubAction学习
|
||||
|
||||
## 触发Action构建
|
||||
|
||||
```bash
|
||||
curl -X POST https://api.github.com/repos/$用户/$仓库名/dispatches -H "Accept: application/vnd.github.everest-preview+json" -H "Authorization: token $YOUR_API_TOKEN" --data '{"event_type": "StartAction"}'
|
||||
```
|
||||
|
||||
## GITHUB设置Secrets
|
||||
|
||||
网址为：`仓库地址/settings/secrets/actions`
|
||||
|
||||
## 构建示例
|
||||
|
||||
### 构建触发
|
||||
|
||||
```yaml
|
||||
#定时任务触发构建
|
||||
on:
|
||||
schedule:
|
||||
- cron: "0 0 * * *"
|
||||
|
||||
#通过接口触发构建
|
||||
on:
|
||||
repository_dispatch:
|
||||
types:
|
||||
- StartAction
|
||||
|
||||
#通过 push 代码触发构建
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
|
||||
# 当 push 到 master 分支，或者创建以 v 开头的 tag 时触发
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
tags:
|
||||
- v*
|
||||
```
|
||||
|
||||
### 本地执行命令类
|
||||
|
||||
```yaml
|
||||
name: Build
|
||||
|
||||
#本地执行命令类
|
||||
jobs:
|
||||
run-docker-command:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
- name: Run Docker Command
|
||||
run: |
|
||||
docker run --name mysql \
|
||||
-e MYSQL_ROOT_PASSWORD=${{ secrets.PASSWORD }} \
|
||||
${{ secrets.IMAGES }}
|
||||
```
|
||||
|
||||
### 构建Docker镜像
|
||||
|
||||
```yaml
|
||||
name: Build-Images
|
||||
|
||||
# Docker构建镜像并 push 到仓库内
|
||||
jobs:
|
||||
Build-Images-One:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
-
|
||||
name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
-
|
||||
name: Login to Docker Hub
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_HUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
|
||||
-
|
||||
name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v2
|
||||
-
|
||||
name: Build and push image
|
||||
uses: docker/build-push-action@v3
|
||||
with:
|
||||
context: ./
|
||||
file: ./Dockerfile
|
||||
push: true
|
||||
tags: ${{ secrets.DOCKER_HUB_USERNAME }}/${{ secrets.DOCKER_HUB_STASH }}:${{ secrets.TAG }}
|
||||
|
||||
Build--Images-Two:
|
||||
needs: Build-Images-One #等待 One 构建成功后开始执行
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
-
|
||||
name: Check Out
|
||||
uses: actions/checkout@v3
|
||||
-
|
||||
name: Login to Docker Hub
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_HUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
|
||||
-
|
||||
name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v2
|
||||
|
||||
- name: Build and push
|
||||
id: docker_build
|
||||
uses: docker/build-push-action@v3
|
||||
with:
|
||||
context: ./demo/
|
||||
file: ./demo/Dockerfile
|
||||
push: true
|
||||
tags: ${{ secrets.DOCKER_HUB_USERNAME }}/${{ secrets.DOCKER_HUB_STASH }}:${{ secrets.TAG }}
|
||||
```
|
||||
|
||||
### 构建多架构镜像
|
||||
|
||||
[官方Demo](https://docs.docker.com/build/ci/github-actions/multi-platform/)
|
||||
|
||||
```yaml
|
||||
name: ci
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- "main"
|
||||
|
||||
jobs:
|
||||
docker:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
-
|
||||
name: Login to Docker Hub
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
-
|
||||
name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
-
|
||||
name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v2
|
||||
-
|
||||
name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v2
|
||||
-
|
||||
name: Build and push
|
||||
uses: docker/build-push-action@v4
|
||||
with:
|
||||
context: .
|
||||
platforms: linux/amd64,linux/arm64
|
||||
#支持列表：https://github.com/docker-library/official-images#architectures-other-than-amd64
|
||||
#platforms: |
|
||||
#linux/arm64
|
||||
#linux/amd64
|
||||
#linux/arm/v5
|
||||
#linux/arm/v7
|
||||
#linux/386 #适用于 x86 32 位架构的 Docker 镜像
|
||||
#linux/mips64le #适用于 MIPS 64 位架构的 Docker 镜像
|
||||
#linux/ppc64le #适用于 IBM Power 架构的 Docker 镜像
|
||||
#linux/s390x #适用于 IBM Z 架构的 Docker 镜像
|
||||
push: true
|
||||
tags: ${{ secrets.DOCKERHUB_USERNAME }}/demo:latest
|
||||
```
|
||||
|
||||
### Dependabot实现更新项目中的依赖项
|
||||
|
||||
当你在项目中使用很多第三方库（例如JavaScript项目中的npm包）时，这些库会不断更新，有时是为了添加新功能，有时是为了修复安全漏洞。手动跟踪和更新这些库可能既费时又容易出错。这就是Dependabot发挥作用的地方。
|
||||
|
||||
[官方文档](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates)
|
||||
|
||||
```yaml
|
||||
version: 2
|
||||
updates:
|
||||
- package-ecosystem: npm
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: daily
|
||||
open-pull-requests-limit: 20
|
||||
```
|
||||
|
||||
6
CICD/Jenkins/README.md
Normal file
6
CICD/Jenkins/README.md
Normal file
@ -0,0 +1,6 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Jenkins
|
||||
|
||||
38
Containerd/Docs/Ctr基础命令.md
Normal file
38
Containerd/Docs/Ctr基础命令.md
Normal file
@ -0,0 +1,38 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Ctr命令使用
|
||||
|
||||
- 查看镜像
|
||||
|
||||
```bash
|
||||
ctr -n k8s.io images ls
|
||||
```
|
||||
|
||||
- 更改镜像 TAG
|
||||
|
||||
```bash
|
||||
ctr -n k8s.io image tag nginx:v1 nginx:v2
|
||||
```
|
||||
|
||||
- 拉取镜像
|
||||
|
||||
```bash
|
||||
ctr -n k8s.io images pull docker.io/library/nginx:latest
|
||||
```
|
||||
|
||||
**更多参数**
|
||||
|
||||
- `--hosts-dir "/etc/containerd/certs.d"`：指定了包含镜像仓库证书的目录的路径。
|
||||
|
||||
- `-k`：忽略 TLS 验证过程中的证书错误。
|
||||
- `--plain-http=true`：此选项指明在拉取镜像时使用未加密的 HTTP 协议，而不是加密的 HTTPS。
|
||||
|
||||
- 推送镜像
|
||||
|
||||
```bash
|
||||
ctr -n k8s.io image push -u <账户>:<密码> docker.io/library/nginx:latest
|
||||
```
|
||||
|
||||
**更多参数**
|
||||
|
||||
- `--plain-http=true`：此选项指明在拉取镜像时使用未加密的 HTTP 协议，而不是加密的 HTTPS。
|
||||
65
Containerd/Docs/Nerdctl工具.md
Normal file
65
Containerd/Docs/Nerdctl工具.md
Normal file
@ -0,0 +1,65 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Nerdctl工具
|
||||
|
||||
[Github](https://github.com/containerd/nerdctl)
|
||||
|
||||
## 开始安装
|
||||
|
||||
1. 下载软件
|
||||
|
||||
```bash
|
||||
wget https://github.com/containerd/nerdctl/releases/download/v1.7.6/nerdctl-1.7.6-linux-amd64.tar.gz
|
||||
```
|
||||
|
||||
2. 解压文件
|
||||
|
||||
```bash
|
||||
tar -zxvf nerdctl-*-linux-amd64.tar.gz
|
||||
```
|
||||
|
||||
3. 安装
|
||||
|
||||
```bash
|
||||
install -o root -g root -m 0755 nerdctl /usr/local/bin/nerdctl
|
||||
```
|
||||
|
||||
## 基本使用
|
||||
|
||||
- 查看 Containerd 镜像
|
||||
|
||||
```bash
|
||||
nerdctl -n k8s.io images
|
||||
```
|
||||
|
||||
- 登录镜像仓库
|
||||
|
||||
```bash
|
||||
nerdctl -n k8s.io login <仓库地址> -u <账号> -p<密码>
|
||||
```
|
||||
|
||||
- 退出镜像仓库登录
|
||||
|
||||
```bash
|
||||
nerdctl -n k8s.io logout <仓库地址>
|
||||
```
|
||||
|
||||
- 拉取镜像
|
||||
|
||||
```bash
|
||||
nerdctl -n k8s.io pull nginx:latest
|
||||
```
|
||||
|
||||
- 更改镜像 TAG
|
||||
|
||||
```bash
|
||||
nerdctl -n k8s.io tag nginx:v1 nginx:v2
|
||||
```
|
||||
|
||||
- 推送镜像
|
||||
|
||||
```bash
|
||||
nerdctl -n k8s.io push nginx:latest --insecure-registry
|
||||
```
|
||||
|
||||
> `--insecure-registry` 表示目标仓库是一个不安全的私有仓库，不需要进行TLS证书验证
|
||||
94
Containerd/Docs/Ubuntu部署Containerd配置Apt源.md
Normal file
94
Containerd/Docs/Ubuntu部署Containerd配置Apt源.md
Normal file
@ -0,0 +1,94 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
## Ubuntu部署Containerd配置Apt源
|
||||
|
||||
> 我部署 containerd 的时候遇到了各个版本 apt 源无法下载的问题，所以本次记录 Ubuntu 源配置步骤
|
||||
|
||||
### Ubuntu 22.04
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu jammy stable"
|
||||
```
|
||||
|
||||
### Ubuntu 21.10
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu impish stable"
|
||||
```
|
||||
|
||||
### Ubuntu 21.04
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu hirsute stable"
|
||||
```
|
||||
|
||||
### Ubuntu 20.10
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu groovy stable"
|
||||
```
|
||||
|
||||
### Ubuntu 20.04
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable"
|
||||
```
|
||||
|
||||
### Ubuntu 19.10
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu eoan stable"
|
||||
```
|
||||
|
||||
### Ubuntu 19.04
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu disco stable"
|
||||
```
|
||||
|
||||
### Ubuntu 18.10
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu cosmic test"
|
||||
```
|
||||
|
||||
### Ubuntu 18.04
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable"
|
||||
```
|
||||
|
||||
### Ubuntu 17.10
|
||||
|
||||
```bash
|
||||
sudo apt install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu artful stable"
|
||||
```
|
||||
|
||||
### Ubuntu 16.04
|
||||
|
||||
```bash
|
||||
sudo apt-get install apt-transport-https ca-certificates curl software-properties-common
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
|
||||
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu xenial stable"
|
||||
```
|
||||
|
||||
87
Containerd/Docs/二进制安装Containerd.md
Normal file
87
Containerd/Docs/二进制安装Containerd.md
Normal file
@ -0,0 +1,87 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# 二进制安装Containerd
|
||||
|
||||
## 安装 Containerd
|
||||
|
||||
[containerd软件包](https://github.com/containerd/containerd/releases)
|
||||
|
||||
[cni插件包](https://github.com/containernetworking/plugins/releases)
|
||||
|
||||
1. 下载二进制文件
|
||||
|
||||
```bash
|
||||
wget https://github.com/containerd/containerd/releases/download/v1.6.33/cri-containerd-cni-1.6.33-linux-amd64.tar.gz
|
||||
```
|
||||
|
||||
2. 解压
|
||||
|
||||
```bash
|
||||
mkdir containerd
|
||||
tar -zxvf cri-containerd-cni-*-linux-amd64.tar.gz -C containerd
|
||||
cd containerd
|
||||
```
|
||||
|
||||
3. 移动文件至安装目录
|
||||
|
||||
```bash
|
||||
\cp usr/local/bin/* /usr/local/bin/
|
||||
\cp etc/systemd/system/containerd.service /usr/lib/systemd/system/containerd.service
|
||||
mkdir /opt/cni/bin -p
|
||||
\cp /root/containerd/opt/cni/bin/* /opt/cni/bin/
|
||||
```
|
||||
|
||||
4. 备份配置文件
|
||||
|
||||
```bash
|
||||
mkdir /etc/containerd
|
||||
containerd config default > /etc/containerd/config.toml
|
||||
```
|
||||
|
||||
5. 修改驱动和镜像地址
|
||||
|
||||
```bash
|
||||
vi /etc/containerd/config.toml
|
||||
```
|
||||
|
||||
内容如下
|
||||
|
||||
```toml
|
||||
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
|
||||
...
|
||||
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
|
||||
SystemdCgroup = true #修改这里
|
||||
|
||||
[plugins."io.containerd.grpc.v1.cri"]
|
||||
sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9"
|
||||
```
|
||||
|
||||
6. 配置 crictl 配置文件
|
||||
|
||||
```bash
|
||||
curl -so /etc/crictl.yaml https://gitee.com/offends/Kubernetes/raw/main/Containerd/Files/crictl.yaml
|
||||
```
|
||||
|
||||
7. 启动
|
||||
|
||||
```bash
|
||||
systemctl enable containerd
|
||||
systemctl start containerd
|
||||
systemctl status containerd
|
||||
```
|
||||
|
||||
## 安装 RunC
|
||||
|
||||
[Github软件包下载](https://github.com/opencontainers/runc/releases)
|
||||
|
||||
1. 下载
|
||||
|
||||
```bash
|
||||
wget https://github.com/opencontainers/runc/releases/download/v1.1.12/runc.amd64
|
||||
```
|
||||
|
||||
2. 安装
|
||||
|
||||
```bash
|
||||
install -m 755 runc.amd64 /usr/local/bin/runc
|
||||
```
|
||||
69
Containerd/Docs/网络源安装Containerd.md
Normal file
69
Containerd/Docs/网络源安装Containerd.md
Normal file
@ -0,0 +1,69 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
[Github安装文档](https://github.com/containerd/containerd/blob/main/docs/getting-started.md)
|
||||
|
||||
[Containerd软件包](https://github.com/containerd/containerd/releases) [Runc软件包](https://github.com/opencontainers/runc/releases) [Cni插件包](https://github.com/containernetworking/plugins/releases)
|
||||
|
||||
## 网络源安装Containerd
|
||||
|
||||
1. 设置存储库
|
||||
|
||||
[阿里源配置文件](https://developer.aliyun.com/mirror/docker-ce?spm=a2c6h.13651102.0.0.4eac1b11shXBpr)
|
||||
|
||||
```bash
|
||||
yum install -y yum-utils
|
||||
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
|
||||
```
|
||||
|
||||
> 国内
|
||||
>
|
||||
> ```bash
|
||||
> yum install -y yum-utils
|
||||
> yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
|
||||
> ```
|
||||
|
||||
2. 安装
|
||||
|
||||
```bash
|
||||
yum install -y containerd.io
|
||||
```
|
||||
|
||||
3. 备份配置文件
|
||||
|
||||
```bash
|
||||
mv /etc/containerd/config.toml /etc/containerd/config.toml.bak
|
||||
containerd config default > /etc/containerd/config.toml
|
||||
```
|
||||
|
||||
4. 修改驱动和镜像地址
|
||||
|
||||
```bash
|
||||
vi /etc/containerd/config.toml
|
||||
```
|
||||
|
||||
内容如下
|
||||
|
||||
```toml
|
||||
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
|
||||
...
|
||||
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
|
||||
SystemdCgroup = true #修改这里
|
||||
|
||||
[plugins."io.containerd.grpc.v1.cri"]
|
||||
sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9"
|
||||
```
|
||||
|
||||
5. 配置 crictl 配置文件
|
||||
|
||||
```bash
|
||||
curl -so /etc/crictl.yaml https://gitee.com/offends/Kubernetes/raw/main/Containerd/Files/crictl.yaml
|
||||
```
|
||||
|
||||
6. 启动
|
||||
|
||||
```bash
|
||||
systemctl enable containerd
|
||||
systemctl start containerd
|
||||
systemctl status containerd
|
||||
```
|
||||
|
||||
4
Containerd/Files/crictl.yaml
Normal file
4
Containerd/Files/crictl.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
runtime-endpoint: unix:///run/containerd/containerd.sock
|
||||
image-endpoint: unix:///run/containerd/containerd.sock
|
||||
timeout: 10
|
||||
debug: false
|
||||
66
Containerd/README.md
Normal file
66
Containerd/README.md
Normal file
@ -0,0 +1,66 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# 安装Containerd
|
||||
|
||||
| 支持系统 | 支持架构 |
|
||||
| :------: | :--------: |
|
||||
| Centos* | x86、arm64 |
|
||||
| Ubuntu* | x86、arm64 |
|
||||
|
||||
## 极简模式
|
||||
|
||||
> 直接二进制安装最新版 Containerd
|
||||
|
||||
```bash
|
||||
curl -sfL https://gitee.com/offends/Kubernetes/raw/main/Containerd/install.sh | bash -s all_curl
|
||||
```
|
||||
|
||||
## 多功能模式
|
||||
|
||||
```bash
|
||||
git clone https://gitee.com/offends/Kubernetes.git && cd Kubernetes/Containerd
|
||||
```
|
||||
|
||||
**参数解释**
|
||||
|
||||
| 脚本参数 | 作用 | 用法 |
|
||||
| -------------- | ------------------------------ | --------------------------- |
|
||||
| binary | 二进制安装 Containerd 最新版本 | ./install.sh binary |
|
||||
| packagemanager | 网络安装 Containerd 最新版本 | ./install.sh packagemanager |
|
||||
|
||||
**包管理器安装切换网络源加速 ("binary" 和 "packagemanager" 均可使用以下参数)**
|
||||
|
||||
- 使用官方加速
|
||||
|
||||
```bash
|
||||
export INSTALL_NETWORK=default
|
||||
```
|
||||
- 使用阿里国加速 [默认]
|
||||
|
||||
```bash
|
||||
export INSTALL_NETWORK=aliyun
|
||||
```
|
||||
|
||||
**二进制文件下载地址替换 ("binary" 可使用以下参数)**
|
||||
|
||||
> 文件格式需要为 `cri-containerd-*-linux-*.tar.gz` 类似于此格式 * 部分可使用版本和架构补充。
|
||||
|
||||
- 指定版本下载 (默认从 Github 仓库下载, 默认版本为: "1.7.18")
|
||||
|
||||
```bash
|
||||
export CONTAINERD_VERSION="1.7.18"
|
||||
```
|
||||
|
||||
- 指定二进制文件包下载地址
|
||||
|
||||
```bash
|
||||
export OFFENDS_URL=""
|
||||
```
|
||||
|
||||
> 示例
|
||||
>
|
||||
> ```bash
|
||||
> export OFFENDS_URL="https://minio.com/cri-containerd-*-linux-amd64.tar.gz"
|
||||
> ```
|
||||
|
||||
|
||||
220
Containerd/install.sh
Executable file
220
Containerd/install.sh
Executable file
@ -0,0 +1,220 @@
|
||||
#!/bin/bash
|
||||
|
||||
#############################################################################################
|
||||
# 用途: 多功能部署 Containerd 脚本
|
||||
# 作者: 丁辉
|
||||
# 编写时间: 2023-12-29
|
||||
# 更新时间: 2024-01-26
|
||||
#############################################################################################
|
||||
|
||||
# 加载检测脚本
|
||||
source <(curl -sS https://gitee.com/offends/Linux/raw/main/File/Shell/Check_command.sh)
|
||||
CHECK_CPU
|
||||
# 变量
|
||||
SCRIPT_VERSION="1.0.0"
|
||||
INSTALL_NETWORK=${INSTALL_NETWORK:-aliyun}
|
||||
# Containerd 版本
|
||||
CONTAINERD_VERSION=${CONTAINERD_VERSION:-1.7.18}
|
||||
# Github下载加速
|
||||
GIT_PROXY="https://mirror.ghproxy.com"
|
||||
URL="https://github.com/containerd/containerd/releases/download/v${CONTAINERD_VERSION}/cri-containerd-cni-${CONTAINERD_VERSION}-linux-${ARCH_TYPE_2}.tar.gz"
|
||||
|
||||
# --help 帮助信息
|
||||
function HELP(){
|
||||
echo "Usage: script_name [OPTIONS] [ARGUMENTS]"
|
||||
echo ""
|
||||
echo "Description:"
|
||||
echo " Offends"
|
||||
echo ""
|
||||
echo "Options:"
|
||||
echo " -h, --help 显示此帮助信息"
|
||||
echo " -v, --version 显示当前脚本版本号"
|
||||
echo " all_curl 省心网络安装,所有文件都会从网络 curl 下载"
|
||||
echo " binary 二进制安装 Containerd 最新版本"
|
||||
echo " packagemanager 网络安装 Containerd 最新版本"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo " 示例 1: ./install.sh all_curl"
|
||||
echo " 示例 1: ./install.sh binary"
|
||||
echo " 示例 2: ./install.sh packagemanager"
|
||||
exit 0
|
||||
}
|
||||
|
||||
# 在线安装
|
||||
function INSTALL_CONTAINERD(){
|
||||
if [ $# -eq 1 ]; then
|
||||
while true; do
|
||||
case $1 in
|
||||
all_curl)
|
||||
INSTALL_0
|
||||
break
|
||||
;;
|
||||
binary)
|
||||
SEND_INFO "您选择的安装方式为: 二进制安装 Containerd 最新版本"
|
||||
INSTALL_1
|
||||
break
|
||||
;;
|
||||
packagemanager)
|
||||
SEND_INFO "您选择的安装方式为: 网络安装 Containerd 最新版本"
|
||||
INSTALL_2
|
||||
break
|
||||
;;
|
||||
--help|-h)
|
||||
HELP
|
||||
;;
|
||||
--version|-v)
|
||||
SEND_INFO "当前脚本版本号为: $SCRIPT_VERSION"
|
||||
break
|
||||
;;
|
||||
*)
|
||||
SEND_ERROR "参数错误"
|
||||
HELP
|
||||
;;
|
||||
esac
|
||||
done
|
||||
else
|
||||
SEND_ERROR "参数错误"
|
||||
HELP
|
||||
fi
|
||||
}
|
||||
|
||||
function INSTALL_0(){
|
||||
IF_LINUX
|
||||
INIT_CONTAINERD
|
||||
CURL_FILE
|
||||
}
|
||||
|
||||
|
||||
function INSTALL_1(){
|
||||
CHECK_INSTALL wget
|
||||
SEND_INFO "正在下载 Containerd 二进制文件包[Github],网络较慢请稍后..."
|
||||
if [ ${INSTALL_NETWORK} = "default" ]; then
|
||||
SEND_INFO "您选择的网络为: 默认网络"
|
||||
BINARY_URL=${OFFENDS_URL:-$URL}
|
||||
elif [ ${INSTALL_NETWORK} = "aliyun" ]; then
|
||||
SEND_INFO "您选择的网络为: 阿里云网络加速"
|
||||
BINARY_URL=${OFFENDS_URL:-$GIT_PROXY/$URL}
|
||||
fi
|
||||
wget ${BINARY_URL}
|
||||
if [ $? -ne 0 ]; then
|
||||
SEND_ERROR "下载 Containerd 二进制文件包失败,请检查网络"
|
||||
exit 1
|
||||
fi
|
||||
CHECK_DIR "./containerd"
|
||||
CHECK_COMMAND_NULL tar -zxvf cri-containerd-*-linux-*.tar.gz -C containerd
|
||||
BASE_FILES
|
||||
}
|
||||
|
||||
function INSTALL_2(){
|
||||
IF_LINUX
|
||||
INIT_CONTAINERD
|
||||
CP_FILE
|
||||
}
|
||||
|
||||
function BASE_FILES(){
|
||||
SEND_INFO "正在初始化文件"
|
||||
CHECK_COMMAND_NULL \\cp containerd/usr/local/bin/* /usr/local/bin/
|
||||
CHECK_COMMAND_NULL \\cp containerd/etc/systemd/system/containerd.service /usr/lib/systemd/system/containerd.service
|
||||
CHECK_DIR "/opt/cni/bin"
|
||||
# CHECK_COMMAND_NULL \\cp containerd/opt/cni/bin/* /opt/cni/bin/
|
||||
CHECK_DIR "/etc/containerd"
|
||||
CHECK_COMMAND_NULL rm -rf ./containerd
|
||||
CHECK_COMMAND_NULL rm -rf ./cri-containerd-*-linux-*.tar.gz
|
||||
INIT_CONTAINERD
|
||||
CP_FILE
|
||||
}
|
||||
|
||||
function IF_LINUX(){
|
||||
log_file="/tmp/check_install_log"
|
||||
if command -v yum >/dev/null 2>&1; then
|
||||
SEND_INFO "正在准备包,根据网络情况可能需要几分钟,请稍后..."
|
||||
yum install -y yum-utils >>"$log_file" 2>&1
|
||||
if [ $? -ne 0 ]; then
|
||||
SEND_ERROR "安装 yum-utils 失败，请查看日志"
|
||||
tail -n 10 "$log_file" # 输出最后10行日志
|
||||
rm -rf $log_file
|
||||
exit 1
|
||||
fi
|
||||
if [ ${INSTALL_NETWORK} = "default" ]; then
|
||||
SEND_INFO "您选择的网络为: 默认网络"
|
||||
CHECK_COMMAND_NULL yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
|
||||
yum install containerd.io -y
|
||||
elif [ ${INSTALL_NETWORK} = "aliyun" ]; then
|
||||
SEND_INFO "您选择的网络为: 阿里云网络"
|
||||
CHECK_COMMAND_NULL yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
|
||||
yum install containerd.io -y
|
||||
fi
|
||||
elif command -v apt >/dev/null 2>&1; then
|
||||
SEND_INFO "正在准备包,根据网络情况可能需要几分钟,请稍后..."
|
||||
if [ ${INSTALL_NETWORK} = "default" ]; then
|
||||
SEND_INFO "您选择的网络为: 默认网络"
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
||||
CHECK_COMMAND_NULL chmod a+r /etc/apt/keyrings/docker.gpg
|
||||
|
||||
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
|
||||
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
|
||||
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
|
||||
|
||||
CHECK_COMMAND_NULL apt-get update
|
||||
apt-get install containerd.io -y
|
||||
elif [ ${INSTALL_NETWORK} = "aliyun" ]; then
|
||||
SEND_INFO "您选择的网络为: 阿里云网络"
|
||||
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | sudo apt-key add -
|
||||
# add-apt-repository "deb [arch=amd64] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable"
|
||||
# 设置 Docker 源地址
|
||||
docker_repo="deb [arch=amd64] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable"
|
||||
# 添加 Docker 源并自动回车确认
|
||||
echo -e "\n" | sudo add-apt-repository "$docker_repo"
|
||||
CHECK_COMMAND_NULL apt-get update
|
||||
apt-get install containerd.io -y
|
||||
fi
|
||||
else
|
||||
SEND_ERROR "无法识别的系统软件包管理工具"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
function INIT_CONTAINERD(){
|
||||
SEND_INFO "正在初始化 Containerd"
|
||||
CHECK_COMMAND_NULL containerd config default \> /etc/containerd/config.toml
|
||||
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml
|
||||
sed -i 's|sandbox_image[[:space:]]*=[[:space:]]*".*"|sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9"|g' /etc/containerd/config.toml
|
||||
}
|
||||
|
||||
function CP_FILE(){
|
||||
CHECK_COMMAND_NULL \\cp ./Files/crictl.yaml /etc/crictl.yaml
|
||||
}
|
||||
|
||||
function CURL_FILE(){
|
||||
curl -so /etc/crictl.yaml https://gitee.com/offends/Kubernetes/raw/main/Containerd/Files/crictl.yaml
|
||||
}
|
||||
|
||||
function START_CONTAINERD(){
|
||||
SEND_INFO "正在启动 Containerd 服务"
|
||||
CHECK_COMMAND_NULL systemctl daemon-reload
|
||||
CHECK_COMMAND_NULL systemctl enable containerd
|
||||
CHECK_COMMAND_NULL systemctl start containerd
|
||||
SEND_INFO "Containerd 服务启动成功"
|
||||
}
|
||||
|
||||
# 检测某个systemd服务是否存在
|
||||
function CHECK_SYSTEMD(){
|
||||
if ! command -v containerd >/dev/null 2>&1; then
|
||||
INSTALL_CONTAINERD $@
|
||||
START_CONTAINERD
|
||||
else
|
||||
SEND_INFO "Containerd 服务已安装,版本为: $(containerd --version | awk '{print $3}')"
|
||||
if ! systemctl status containerd >/dev/null 2>&1; then
|
||||
SEND_WARN "Containerd 服务未启动,正在启动 Containerd 服务"
|
||||
if ! systemctl start containerd >/dev/null 2>&1; then
|
||||
SEND_ERROR "Containerd 服务启动失败,请检查日志排查错误"
|
||||
exit 1
|
||||
else
|
||||
SEND_INFO "Containerd 服务启动成功"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
CHECK_SYSTEMD $@
|
||||
359
Docker/Builder/Buildkit/README.md
Normal file
359
Docker/Builder/Buildkit/README.md
Normal file
@ -0,0 +1,359 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Buildkit构建镜像
|
||||
|
||||
## 最小化使用 Buildkit 构建镜像
|
||||
|
||||
1. 修改 docker 守护进程配置
|
||||
|
||||
```bash
|
||||
vi /etc/docker/daemon.json
|
||||
```
|
||||
|
||||
2. 加入
|
||||
|
||||
```bash
|
||||
{
|
||||
"features": {
|
||||
"buildkit": true
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
重载 docker
|
||||
|
||||
```bash
|
||||
systemctl daemon-reload && systemctl reload docker
|
||||
```
|
||||
|
||||
> 如果报错提示需要安装 Buildx , 则查看 [BUILDX安装](https://gitee.com/offends/Kubernetes/tree/main/Docker/Builder/Buildx/README.md) 安装一下
|
||||
|
||||
3. 构建镜像
|
||||
|
||||
```bash
|
||||
DOCKER_BUILDKIT=1 docker build --no-cache -t app:v1 .
|
||||
```
|
||||
|
||||
|
||||
## 使用完全体 Buildkit 构建镜像
|
||||
|
||||
[官方文档](https://docs.docker.com/build/buildkit/)
|
||||
|
||||
### 安装
|
||||
|
||||
1. 克隆代码
|
||||
|
||||
```bash
|
||||
git clone https://gitee.com/offends/Kubernetes.git
|
||||
cd Kubernetes/Docker/Builder/Buildkit
|
||||
```
|
||||
|
||||
2. 安装 Buildkit
|
||||
|
||||
> 这里使用 . 执行脚本否则需要手动执行 `source /etc/profile`
|
||||
|
||||
```bash
|
||||
. install.sh
|
||||
```
|
||||
|
||||
3. 安装 Buildx(非必选, 如果不希望安装Buildx, 则直接看文档"基础命令"部分来构建镜像)
|
||||
|
||||
查看此文档: [BUILDX安装](https://gitee.com/offends/Kubernetes/tree/main/Docker/Builder/Buildx/README.md)
|
||||
|
||||
### Dockerfile 写法介绍
|
||||
|
||||
> Dockerfile `# syntax = docker/dockerfile:<声明>` 是必加的
|
||||
|
||||
[官方文档](https://docs.docker.com/build/dockerfile/frontend/#custom-dockerfile-syntax)
|
||||
|
||||
1. `# syntax=docker/dockerfile:1`：
|
||||
|
||||
这个指令指定了 Dockerfile 使用的语法版本。在这个例子中，`:1` 表示使用 Dockerfile 的第一个版本。这个版本引入了基本的 Dockerfile 功能，是最基础的语法规则。它是 Dockerfile 的最低版本，提供了最基本的指令和结构，不包含较新的特性。
|
||||
|
||||
2. `# syntax = docker/dockerfile:experimental`：
|
||||
|
||||
这个语法声明告诉 Docker 使用实验性特性来解析 Dockerfile。`experimental` 标记引入了一些实验性的功能，可能包含一些不稳定或尚未广泛测试的功能，允许使用一些较新的、可能还不是标准的 Dockerfile 特性。使用这个标记可以在 Dockerfile 中尝试新的、实验性的功能。
|
||||
|
||||
### 挂载缓存目录 cache
|
||||
|
||||
> 这里是通过存储 Docker 缓存当中实现的,咱们通过两次构建演示过程
|
||||
|
||||
1. 编写 Dockerfile
|
||||
|
||||
```bash
|
||||
vi Dockerfile
|
||||
```
|
||||
|
||||
- 第一次构建
|
||||
|
||||
```dockerfile
|
||||
# syntax = docker/dockerfile:1
|
||||
FROM alpine
|
||||
|
||||
RUN --mount=type=cache,target=/data,id=file_dir,sharing=locked \
|
||||
echo "hello" >> /data/file.txt
|
||||
```
|
||||
|
||||
- 第二次构建
|
||||
|
||||
```dockerfile
|
||||
# syntax = docker/dockerfile:1
|
||||
FROM alpine
|
||||
|
||||
RUN --mount=type=cache,target=/data,id=file_dir,sharing=locked \
|
||||
echo "hello-2" >> /data/file.txt; \
|
||||
cp /data/file.txt /
|
||||
```
|
||||
|
||||
2. 开始构建
|
||||
|
||||
```bash
|
||||
docker build -t app:v1 .
|
||||
```
|
||||
|
||||
3. 检查结果
|
||||
|
||||
```bash
|
||||
docker run -it --rm app:v1 sh
|
||||
cat file.txt
|
||||
```
|
||||
|
||||
> 发现有两行内容则代表容器第二次构建已经使用到缓存了
|
||||
|
||||
**参数解释**
|
||||
|
||||
| 参数 | 描述 |
|
||||
| ------- | --------------------------------------------------- |
|
||||
| id | 用于标识不同缓存的可选ID。默认为目标值。 |
|
||||
| target1 | 挂载路径。 |
|
||||
| ro | 如果设置，只读。 |
|
||||
| sharing | 其中一个 shared、private 或 locked。默认为 shared。 |
|
||||
| from | 用作缓存挂载基础的构建阶段。默认为空目录。 |
|
||||
| source | 要挂载的源自 from 的子路径。默认为 from 的根目录。 |
|
||||
| mode | 新缓存目录的文件模式（八进制）。默认为 0755。 |
|
||||
| uid | 新缓存目录的用户ID。默认为 0。 |
|
||||
| gid | 新缓存目录的组ID。默认为 0。 |
|
||||
|
||||
**sharing参数**
|
||||
|
||||
1. **Shared (shared)**: 这是默认设置。在共享模式下，多个写入者可以同时使用相同的缓存挂载。这意味着多个构建可以同时读取和写入缓存数据。
|
||||
2. **Private (private)**: 当设置为私有模式时，如果存在多个写入者，它会为每个写入者创建一个新的挂载。这样可以避免并发写入的冲突，但也可能导致存储空间的浪费。
|
||||
3. **Locked (locked)**: 锁定模式会暂停第二个写入者的操作，直到第一个写入者释放挂载。这确保了在任何给定时刻只有一个写入者能够访问缓存挂载，从而避免了并发写入的问题，但也可能导致构建延迟。
|
||||
|
||||
### 挂载文件 bind
|
||||
|
||||
> 将一个镜像或上一构建阶段的文件挂载到指定位置
|
||||
|
||||
1. 编写 Dockerfile
|
||||
|
||||
```bash
|
||||
vi Dockerfile
|
||||
```
|
||||
|
||||
内容如下
|
||||
|
||||
```dockerfile
|
||||
# syntax = docker/dockerfile:1
|
||||
FROM alpine AS builder
|
||||
|
||||
RUN apk add git \
|
||||
&& git clone https://gitee.com/offends/Docs.git \
|
||||
&& tar -cvf Docker-Template.tar ./Docker-Template
|
||||
|
||||
FROM alpine
|
||||
|
||||
# 挂载上一构建阶段文件
|
||||
RUN --mount=type=bind,from=builder,source=/Docker-Template.tar,target=/Docker-Template.tar \
|
||||
cp /Docker-Template.tar /Docker-Template.tar.bak
|
||||
|
||||
# 挂载另一个镜像的文件
|
||||
RUN --mount=type=bind,from=nginx:alpine-slim,source=/etc/nginx/nginx.conf,target=/nginx.conf \
|
||||
cp /nginx.conf /nginx.conf.bak
|
||||
```
|
||||
|
||||
2. 开始构建
|
||||
|
||||
```bash
|
||||
docker build -t app:v1 .
|
||||
```
|
||||
|
||||
3. 检查结果
|
||||
|
||||
```bash
|
||||
docker run -it --rm app:v1 sh
|
||||
ls
|
||||
```
|
||||
|
||||
> / 目录下存在 nginx.conf.bak 和 Docker-Template.tar.bak 则代表成功
|
||||
|
||||
### 挂载文件系统 tmpfs
|
||||
|
||||
> 将文件系统挂载到指定位置
|
||||
|
||||
1. 编写 Dockerfile
|
||||
|
||||
```bash
|
||||
vi Dockerfile
|
||||
```
|
||||
|
||||
内容如下
|
||||
|
||||
```dockerfile
|
||||
# syntax = docker/dockerfile:1
|
||||
FROM alpine
|
||||
|
||||
RUN --mount=type=tmpfs,size=100m,target=/temp \
|
||||
echo "hello" > /temp/file.txt
|
||||
```
|
||||
|
||||
2. 开始构建
|
||||
|
||||
```bash
|
||||
docker build -t app:v1 .
|
||||
```
|
||||
|
||||
3. 检查结果
|
||||
|
||||
```bash
|
||||
docker run -it --rm app:v1 sh
|
||||
ls /temp
|
||||
```
|
||||
|
||||
> 没有文件则正确,因为在 RUN 执行完命令之后挂载的文件系统将会被卸载
|
||||
|
||||
### 加密内容管理
|
||||
|
||||
> 为了更好的看到效果我们拿创建目录 hello-file 举例
|
||||
|
||||
#### 示例一(加密文件挂载)
|
||||
|
||||
[官网文档](https://docs.docker.com/engine/reference/builder/#run---mounttypesecret)
|
||||
|
||||
1. 编写挂载文件
|
||||
|
||||
```bash
|
||||
cat > file_secret <<EOF
|
||||
hello-file
|
||||
EOF
|
||||
```
|
||||
|
||||
2. 编写 Dockerfile
|
||||
|
||||
```bash
|
||||
vi Dockerfile
|
||||
```
|
||||
|
||||
内容如下
|
||||
|
||||
```dockerfile
|
||||
# syntax = docker/dockerfile:1
|
||||
FROM alpine
|
||||
|
||||
RUN --mount=type=secret,id=file_secret,target=/run/secrets/file_secret \
|
||||
mkdir $(cat /run/secrets/file_secret)
|
||||
```
|
||||
|
||||
3. 开始构建
|
||||
|
||||
```bash
|
||||
docker build --no-cache --secret id=file_secret,src=./file_secret -t app:v1 .
|
||||
```
|
||||
|
||||
4. 检验结果
|
||||
|
||||
```bash
|
||||
docker run -it --rm app:v1 sh
|
||||
ls
|
||||
```
|
||||
|
||||
> 看到 / 下存在 hello-file 目录,并且挂载的 file_secret 也消失了，则代表加密内容已成功传入。
|
||||
|
||||
#### 示例二(加密变量传入)
|
||||
|
||||
[官网文档](https://docs.docker.com/engine/reference/commandline/buildx_build/#env)
|
||||
|
||||
1. 编写 Dockerfile
|
||||
|
||||
```bash
|
||||
vi Dockerfile
|
||||
```
|
||||
|
||||
内容如下
|
||||
|
||||
```dockerfile
|
||||
# syntax = docker/dockerfile:1
|
||||
FROM alpine
|
||||
|
||||
RUN --mount=type=secret,id=env_secret,target=/run/secrets/env_secret \
|
||||
mkdir $(cat /run/secrets/env_secret)
|
||||
```
|
||||
|
||||
2. 开始构建
|
||||
|
||||
```bash
|
||||
env_secret=hello-file docker buildx build --no-cache --secret id=env_secret -t app:v1 --load .
|
||||
```
|
||||
|
||||
### SSH 密钥管理
|
||||
|
||||
[官网文档]()
|
||||
|
||||
> gitee 仓库举例
|
||||
|
||||
1. 编写 Dockerfile
|
||||
|
||||
```bash
|
||||
vi Dockerfile
|
||||
```
|
||||
|
||||
内容如下
|
||||
|
||||
```dockerfile
|
||||
# syntax = docker/dockerfile:1
|
||||
FROM alpine
|
||||
|
||||
# 如果是Github 则使用 github.com
|
||||
RUN apk add --no-cache openssh-client git \
|
||||
&& mkdir -p -m 0600 ~/.ssh && ssh-keyscan gitee.com >> ~/.ssh/known_hosts
|
||||
|
||||
RUN --mount=type=ssh git clone git@gitee.com:offends/Docker.git
|
||||
```
|
||||
|
||||
2. 开始构建
|
||||
|
||||
```bash
|
||||
docker build --ssh default=~/.ssh/id_rsa -t app:v1 .
|
||||
```
|
||||
|
||||
# 基础命令
|
||||
|
||||
1. 清理缓存
|
||||
|
||||
```bash
|
||||
docker builder prune
|
||||
```
|
||||
|
||||
2. 构建镜像并打包
|
||||
|
||||
> 镜像不会存在于 docker images 内,用于单纯的打包最好不过了
|
||||
|
||||
```bash
|
||||
buildctl build \
|
||||
--frontend=dockerfile.v0 \
|
||||
--local context=. \
|
||||
--local dockerfile=. \
|
||||
--output type=docker,name=app:v1,dest=image.tar
|
||||
```
|
||||
|
||||
|
||||
**参数解释**
|
||||
|
||||
| 参数 | 描述 |
|
||||
| ----------------------------------------------- | ------------------------------------------------------------ |
|
||||
| --frontend=dockerfile.v0 | 使用的构建前端，这里是 Dockerfile 的版本。 |
|
||||
| --local context=. | 指定本地上下文路径，即构建过程中使用的上下文路径（当前目录）。 |
|
||||
| --local dockerfile=. | 指定本地 Dockerfile 路径，即 Dockerfile 所在的路径（当前目录）。 |
|
||||
| --output type=docker,name=app:v1,dest=image.tar | 输出设置，指定输出的类型为 Docker 镜像（type=docker），镜像的名称为 app:v1（name=app:v1），输出目标为 image.tar 文件（dest=image.tar）。 |
|
||||
|
||||
|
||||
|
||||
13
Docker/Builder/Buildkit/buildkitd.service
Normal file
13
Docker/Builder/Buildkit/buildkitd.service
Normal file
@ -0,0 +1,13 @@
|
||||
[Unit]
|
||||
Description=buildkitd
|
||||
# 指定了在系统启动时该服务应该在 network.target 启动后才启动。这确保了服务在网络可用后才会被启动
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/local/buildkit/bin/buildkitd
|
||||
# ExecStart=/usr/local/bin/buildkitd --oci-worker=false --containerd-worker=true
|
||||
|
||||
[Install]
|
||||
# 指明了在系统进入 multi-user.target 时（通常是完全启动并准备好用户登录的状态）启用这个服务
|
||||
WantedBy=multi-user.target
|
||||
10
Docker/Builder/Buildkit/buildkitd.toml
Normal file
10
Docker/Builder/Buildkit/buildkitd.toml
Normal file
@ -0,0 +1,10 @@
|
||||
[worker.oci]
|
||||
gc = true
|
||||
gckeepstorage = 10000
|
||||
[[worker.oci.gcpolicy]]
|
||||
keepBytes = 512000000
|
||||
keepDuration = 172800
|
||||
filters = [ "type==source.local", "type==exec.cachemount", "type==source.git.checkout"]
|
||||
[[worker.oci.gcpolicy]]
|
||||
all = true
|
||||
keepBytes = 1024000000
|
||||
60
Docker/Builder/Buildkit/install.sh
Executable file
60
Docker/Builder/Buildkit/install.sh
Executable file
@ -0,0 +1,60 @@
|
||||
#!/bin/bash
|
||||
|
||||
#############################################################################################
|
||||
# 用途: 安装 Buildkit 脚本
|
||||
# 作者: 丁辉
|
||||
# 编写时间: 2023-12-05
|
||||
#############################################################################################
|
||||
|
||||
# 加载检测脚本
|
||||
source <(curl -sS https://gitee.com/offends/Linux/raw/main/File/Shell/Check_command.sh)
|
||||
|
||||
function CHECK(){
|
||||
# 官方下载仓库: https://github.com/moby/buildkit/releases/
|
||||
VERSION="v0.12.4"
|
||||
DIR="/usr/local/buildkit"
|
||||
|
||||
URL="https://github.com/moby/buildkit/releases/download/$VERSION/buildkit-$VERSION.linux-$ARCH_TYPE_2.tar.gz"
|
||||
BIN_NAME="Buildkit"
|
||||
CHECK_BIN "$DIR/bin/buildctl"
|
||||
}
|
||||
|
||||
# 引用 check_bin 变量不存在则安装
|
||||
function CHECK_BIN_INSTALL(){
|
||||
if [ "$INSTALL_BIN" = false ]; then
|
||||
CHECK_INSTALL wget
|
||||
SEND_INFO "正在安装 $BIN_NAME,请稍后"
|
||||
CHECK_DIR "$DIR"
|
||||
CHECK_COMMAND_NULL wget $URL
|
||||
CHECK_COMMAND_NULL tar -xf buildkit-v*.linux-$ARCH_TYPE_2.tar.gz -C /usr/local/buildkit
|
||||
CHECK_COMMAND_NULL echo 'export PATH=/usr/local/buildkit/bin:$PATH' \>\> /etc/profile
|
||||
CHECK_COMMAND_NULL source /etc/profile
|
||||
CHECK_SYSTEMD_FILE
|
||||
CHECK_COMMAND_NULL systemctl daemon-reload
|
||||
CHECK_COMMAND_NULL systemctl enable --now buildkitd
|
||||
SEND_INFO "正在清理文件"
|
||||
CHECK_COMMAND_NULL rm -rf buildkit-v*.linux-$ARCH_TYPE_2.tar.gz
|
||||
SEND_INFO "$BIN_NAME 版本: $(buildkitd --version | grep -o 'v[0-9]\+\(\.[0-9]\+\)\{2\}')"
|
||||
|
||||
else
|
||||
SEND_INFO "$BIN_NAME 已安装"
|
||||
CHECK_SYSTEMD buildkitd
|
||||
SEND_INFO "$BIN_NAME 版本: $(buildkitd --version | grep -o 'v[0-9]\+\(\.[0-9]\+\)\{2\}')"
|
||||
fi
|
||||
}
|
||||
|
||||
# 官方 toml 参数文档: https://docs.docker.com/build/buildkit/toml-configuration/
|
||||
function CHECK_SYSTEMD_FILE(){
|
||||
CHECK_COMMAND_NULL \\cp ./buildkitd.service /usr/lib/systemd/system/buildkitd.service
|
||||
CHECK_DIR "/etc/buildkit/"
|
||||
CHECK_COMMAND_NULL \\cp ./buildkitd.toml /etc/buildkit/buildkitd.toml
|
||||
}
|
||||
|
||||
function ALL(){
|
||||
CHECK_SYSTEMD docker
|
||||
CHECK_CPU
|
||||
CHECK
|
||||
CHECK_BIN_INSTALL
|
||||
}
|
||||
|
||||
ALL
|
||||
5
Docker/Builder/Buildx/Dockerfile
Normal file
5
Docker/Builder/Buildx/Dockerfile
Normal file
@ -0,0 +1,5 @@
|
||||
FROM --platform=$TARGETPLATFORM alpine
|
||||
|
||||
RUN echo "Startup success" > /os.txt
|
||||
|
||||
CMD tail -f /os.txt
|
||||
138
Docker/Builder/Buildx/README.md
Normal file
138
Docker/Builder/Buildx/README.md
Normal file
@ -0,0 +1,138 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# BUILDX构建镜像
|
||||
|
||||
## 安装
|
||||
|
||||
1. 克隆代码
|
||||
|
||||
```bash
|
||||
git clone https://gitee.com/offends/Kubernetes.git
|
||||
cd Kubernetes/Docker/Builder/Buildx
|
||||
```
|
||||
|
||||
2. 安装
|
||||
|
||||
```bash
|
||||
./install.sh
|
||||
```
|
||||
|
||||
## 手动构建
|
||||
|
||||
1. 编写 Dockerfile
|
||||
|
||||
```dockerfile
|
||||
# vi Dockerfile
|
||||
FROM --platform=$TARGETPLATFORM alpine
|
||||
|
||||
RUN echo "Startup success" > /os.txt
|
||||
|
||||
CMD tail -f /os.txt
|
||||
```
|
||||
|
||||
2. 创建了一个名为 "buildx" 的构建器
|
||||
|
||||
```bash
|
||||
docker buildx create --use --name=buildx --driver docker-container --driver-opt image=moby/buildkit:buildx-stable-1
|
||||
```
|
||||
|
||||
**参数解释**
|
||||
|
||||
| 参数 | 说明 |
|
||||
| ------------------------------ | ------------------------------------------------------------ |
|
||||
| `--use` | 将新构建器设置为当前活动的构建器(默认构建器) |
|
||||
| `--name=buildx` | 指定新构建器的名称为 "buildx" |
|
||||
| `--driver docker` | 指定使用的驱动程序为 "docker" |
|
||||
| `--driver-opt image=...` | 指定驱动程序选项，此处是指定 BuildKit 镜像的位置为 "moby/buildkit:buildx-stable-1" |
|
||||
| `--config /etc/buildkitd.toml` | 指定配置文件 |
|
||||
|
||||
3. 构建多架构镜像并推送镜像仓库
|
||||
|
||||
**示例**
|
||||
|
||||
> 举例仓库地址为 "offends"
|
||||
|
||||
- 第一种方式(简单)
|
||||
|
||||
```bash
|
||||
docker buildx build --platform linux/amd64,linux/arm/v7 -t offends/app:v1 . --push
|
||||
```
|
||||
|
||||
- 第二种方式
|
||||
|
||||
```bash
|
||||
docker buildx build --platform linux/amd64,linux/arm/v7 -t offends/app:v1 --output type=registry,dest=offends .
|
||||
```
|
||||
|
||||
> 查看 buildx 当前可构建架构
|
||||
>
|
||||
> ```bash
|
||||
> docker buildx ls
|
||||
> ```
|
||||
|
||||
**参数解释**
|
||||
|
||||
| 参数 | 解释 |
|
||||
| -------------------------------------------- | ------------------------------------------------------------ |
|
||||
| `docker buildx build` | 执行 Buildx 构建的命令 |
|
||||
| `--platform linux/amd64,linux/arm/v6` | 指定要构建的目标平台，这里包括 Linux AMD64 和 ARMv6 |
|
||||
| `-t app:v1` | 为构建的镜像设置标签为 "app:v1" |
|
||||
| `-f ./Dockerfile` | 指定要使用的 Dockerfile 文件路径 |
|
||||
| `.` | 构建上下文的路径，表示当前目录是构建上下文，其中包含了构建镜像所需的文件和指令 |
|
||||
| `--output type=local,dest=.docker` | 指定输出类型为本地，并将构建结果输出到名为 `.docker` 的目录中 |
|
||||
| `--output type=oci,dest=<path>` | 将构建结果输出为 OCI 格式的镜像包，并保存到指定路径 |
|
||||
| `--output type=docker,dest=<path>` | 将构建结果输出为 Docker 格式的镜像包，并保存到指定路径 |
|
||||
| `--output type=image,name=<image_name>` | 将构建的镜像推送到指定的镜像仓库，指定镜像名称 |
|
||||
| `--output type=registry,dest=<registry_url>` | 将构建的镜像推送到指定的镜像仓库地址 |
|
||||
| `--push` | 将构建的镜像推送到指定的镜像仓库 |
|
||||
|
||||
### 常用命令
|
||||
|
||||
- 删除构建器
|
||||
|
||||
```bash
|
||||
docker buildx rm <构建器名称>
|
||||
```
|
||||
|
||||
- 设置默认构建器
|
||||
|
||||
```bash
|
||||
docker buildx use <构建器名称>
|
||||
```
|
||||
|
||||
- 检查 Docker Buildx 构建器的详细信息
|
||||
|
||||
```bash
|
||||
docker buildx inspect
|
||||
```
|
||||
|
||||
|
||||
|
||||
# 使用脚本构建镜像并推送仓库
|
||||
|
||||
> 前提条件：
|
||||
>
|
||||
> 1. 已安装 Buildx, 安装脚本: [BUILDX安装](https://gitee.com/offends/Kubernetes/tree/main/Docker/Builder/Buildx/README.md)
|
||||
>
|
||||
> 2. 登录一个可推送镜像的仓库
|
||||
>
|
||||
> ```bash
|
||||
> docker login <仓库地址> -u <用户名> -p<密码>
|
||||
> ```
|
||||
>
|
||||
> 3. 根据自己需求添加架构
|
||||
>
|
||||
> 4. 配置变量
|
||||
|
||||
```bash
|
||||
export PLATFORM="linux/amd64,linux/arm/v6"
|
||||
# 这里的仓库地址需要是一个可推送的镜像仓库才行,否则将推送失败
|
||||
export IMAGE_NAME=<仓库地址>/<镜像名>
|
||||
export IMAGE_TAG=<镜像标签>
|
||||
```
|
||||
|
||||
开始构建
|
||||
|
||||
```bash
|
||||
./build.sh
|
||||
```
|
||||
37
Docker/Builder/Buildx/build.sh
Executable file
37
Docker/Builder/Buildx/build.sh
Executable file
@ -0,0 +1,37 @@
|
||||
#!/bin/bash
|
||||
|
||||
#############################################################################################
|
||||
# 用途: 构建 Dockerfile 脚本
|
||||
# 作者: 丁辉
|
||||
# 编写时间: 2023-11-27
|
||||
#############################################################################################
|
||||
|
||||
# 加载检测脚本
|
||||
source <(curl -sS https://gitee.com/offends/Linux/raw/main/File/Shell/Check_command.sh)
|
||||
|
||||
# 创建 buildx
|
||||
function CREATE_BUILDX(){
|
||||
# 国内镜像
|
||||
# --driver-opt dockerpracticesig/buildkit:master
|
||||
# --driver-opt dockerpracticesig/buildkit:master-tencent
|
||||
CHECK_COMMAND_NULL docker buildx create --use --name=buildx --driver docker-container --driver-opt image=moby/buildkit:buildx-stable-1
|
||||
CHECK_COMMAND_TRUE "创建 buildx 成功" "创建 buildx 失败,请根据错误信息检查"
|
||||
}
|
||||
|
||||
# 开始构建镜像
|
||||
function BUILD_IMAGE(){
|
||||
# 构建镜像
|
||||
CHECK_COMMAND_NULL docker buildx build --platform ${PLATFORM} -t ${IMAGE_NAME}:${IMAGE_TAG} . --push
|
||||
CHECK_COMMAND_TRUE "构建镜像成功" "构建镜像失败,请根据错误信息检查"
|
||||
NULL_TRUE docker buildx rm buildx
|
||||
GREEN_PRINTF "构建镜像完成,查看镜像架构信息: \n$(docker buildx imagetools inspect ${IMAGE_NAME}:${IMAGE_TAG} | grep Platform: | grep -v unknown/unknown | awk -F " " '{print $2}')"
|
||||
}
|
||||
|
||||
function ALL(){
|
||||
# 检测是否安装 Docker
|
||||
CHECK_SYSTEMD docker
|
||||
CREATE_BUILDX
|
||||
BUILD_IMAGE
|
||||
}
|
||||
|
||||
ALL
|
||||
60
Docker/Builder/Buildx/install.sh
Executable file
60
Docker/Builder/Buildx/install.sh
Executable file
@ -0,0 +1,60 @@
|
||||
#!/bin/bash
|
||||
|
||||
#############################################################################################
|
||||
# 用途: 安装 Buildx 脚本
|
||||
# 作者: 丁辉
|
||||
# 编写时间: 2023-11-27
|
||||
#############################################################################################
|
||||
|
||||
# 加载检测脚本
|
||||
source <(curl -sS https://gitee.com/offends/Linux/raw/main/File/Shell/Check_command.sh)
|
||||
|
||||
function CHECK(){
|
||||
# 官方下载仓库: https://github.com/docker/buildx/releases
|
||||
VERSION="v0.12.0"
|
||||
DIR="/root/.docker/cli-plugins"
|
||||
|
||||
URL="https://github.com/docker/buildx/releases/download/$VERSION/buildx-$VERSION.linux-$ARCH_TYPE_2"
|
||||
BIN_NAME="Buildx"
|
||||
CHECK_BIN "$DIR/docker-buildx"
|
||||
}
|
||||
|
||||
# 引用 check_bin 变量不存在则安装
|
||||
function CHECK_BIN_INSTALL(){
|
||||
if [ "$INSTALL_BIN" = false ]; then
|
||||
CHECK_INSTALL wget
|
||||
SEND_INFO "正在安装 $BIN_NAME,请稍后"
|
||||
CHECK_DIR "$DIR"
|
||||
CHECK_COMMAND_NULL wget $URL
|
||||
CHECK_COMMAND_NULL mv buildx-v*.linux-amd64 ~/.docker/cli-plugins/docker-buildx
|
||||
CHECK_COMMAND_NULL chmod +x ~/.docker/cli-plugins/docker-buildx
|
||||
SEND_INFO "Buildx 版本: $(docker buildx version | awk '{print $2}')"
|
||||
|
||||
else
|
||||
SEND_INFO "$BIN_NAME 已安装"
|
||||
SEND_INFO "Buildx 版本: $(docker buildx version | awk '{print $2}')"
|
||||
fi
|
||||
}
|
||||
|
||||
# function CHECK_BIN_INSTALL_MAN(){
|
||||
# export DOCKER_BUILDKIT=1
|
||||
# docker build --platform=local -o . git://github.com/docker/buildx
|
||||
# }
|
||||
|
||||
# 添加模拟架构
|
||||
function RUN_BINFMT(){
|
||||
SEND_INFO "正在添加模拟架构"
|
||||
CHECK_COMMAND_NULL docker run --privileged --rm tonistiigi/binfmt --install all
|
||||
SEND_INFO "添加模拟架构完成,查看架构信息: docker buildx ls"
|
||||
}
|
||||
|
||||
function ALL(){
|
||||
CHECK_SYSTEMD docker
|
||||
CHECK_CPU
|
||||
CHECK
|
||||
CHECK_BIN_INSTALL
|
||||
CHECK_CORE
|
||||
RUN_BINFMT
|
||||
}
|
||||
|
||||
ALL
|
||||
35
Docker/Compose/Docs/Docker-Compose容器安全配置.md
Normal file
35
Docker/Compose/Docs/Docker-Compose容器安全配置.md
Normal file
@ -0,0 +1,35 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Docker-Compose容器安全配置
|
||||
|
||||
- **security_opt**
|
||||
|
||||
`security_opt` 选项用于调整容器的安全配置。这个选项允许管理员覆盖或增加默认的安全设置，提供了更多的安全控制。其中一个常见的用途是 `no-new-privileges` 标志。no-new-privileges: 设置为 `true` 时，这个标志阻止容器获取任何新的权限。这意味着即使容器内的应用或用户尝试通过如 `setuid` 等方式提升权限，也会被系统阻止。这是一个防止权限提升攻击的重要安全措施。例如，如果一个容器运行的应用被攻破，攻击者将不能通过提升权限来进一步控制宿主机或其他容器。
|
||||
|
||||
**示例**
|
||||
|
||||
```bash
|
||||
services:
|
||||
nginx:
|
||||
image: nginx:latest
|
||||
container_name: nginx
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
```
|
||||
|
||||
- **cap_drop**
|
||||
|
||||
`cap_drop` 选项用于删除容器的Linux能力。Linux能力是一种精细控制权限的机制，它允许将传统的root权限分解为更小的单元，每个单元控制一个特定的权限。ALL: 使用 `cap_drop: - ALL` 表示放弃所有预定义的能力。这将限制容器内进程的权限，即使它以 root 用户运行，也不能执行某些特权操作，例如修改系统文件、更改网络配置等。这种做法最大限度地减少了容器被滥用的风险，并增加了攻击者通过容器获得宿主机控制权的难度。
|
||||
|
||||
**示例**
|
||||
|
||||
```bash
|
||||
services:
|
||||
nginx:
|
||||
image: nginx:latest
|
||||
container_name: nginx
|
||||
cap_drop:
|
||||
- ALL
|
||||
```
|
||||
|
||||
通过使用这些选项，Docker管理员可以显著提升容器的安全性，避免容器成为攻击者突破系统安全的突破口。这些措施尤其适用于运行不信任的代码或在多租户环境中运行的容器。
|
||||
111
Docker/Compose/Docs/Docker-Compose部署Simplex服务器SMPXFTP服务.md
Normal file
111
Docker/Compose/Docs/Docker-Compose部署Simplex服务器SMPXFTP服务.md
Normal file
@ -0,0 +1,111 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Docker-Compose部署Simplex服务器SMPXFTP服务
|
||||
|
||||
[官网](https://simplex.chat/) [Github安装文档](https://github.com/simplex-chat/simplex-chat/blob/stable/docs/SERVER.md) [客户端下载](https://simplex.chat/downloads/)
|
||||
|
||||
| 服务器服务 | IP |
|
||||
| :-------------------------------------: | :----------: |
|
||||
| simplex-smp-server、simplex-xftp-server | 192.168.1.10 |
|
||||
|
||||
## 部署SMP/XFTP服务
|
||||
|
||||
1. 创建持久化目录
|
||||
|
||||
```bash
|
||||
mkdir -p /data/simplex/{xftp,smp}/{config,logs} && mkdir -p /data/simplex/xftp/files
|
||||
```
|
||||
|
||||
2. 创建 Docker-Compose Env 文件
|
||||
|
||||
```bash
|
||||
cat << EOF >> .env
|
||||
SIMPLEX_ADDR=192.168.1.10
|
||||
XFTP_ADDR=192.168.1.10
|
||||
EOF
|
||||
```
|
||||
|
||||
3. 创建 Docker-Compose 文件
|
||||
|
||||
```bash
|
||||
vi docker-compose.yaml
|
||||
```
|
||||
|
||||
内容如下
|
||||
|
||||
```bash
|
||||
version: '3'
|
||||
|
||||
networks:
|
||||
simplex:
|
||||
|
||||
services:
|
||||
simplex-smp-server:
|
||||
image: simplexchat/smp-server:latest
|
||||
container_name: simplex-smp-server
|
||||
restart: always
|
||||
ports:
|
||||
- "5223:5223"
|
||||
volumes:
|
||||
- /data/simplex/smp/config:/etc/opt/simplex:Z
|
||||
- /data/simplex/smp/logs:/var/opt/simplex:Z
|
||||
environment:
|
||||
- ADDR=${SIMPLEX_ADDR}
|
||||
# - PASS=""
|
||||
networks:
|
||||
- simplex
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
cap_drop:
|
||||
- ALL
|
||||
|
||||
simplex-xftp-server:
|
||||
image: simplexchat/xftp-server:latest
|
||||
container_name: simplex-xftp-server
|
||||
ports:
|
||||
- "443:443"
|
||||
restart: always
|
||||
volumes:
|
||||
- /data/simplex/xftp/config:/etc/opt/simplex-xftp:Z
|
||||
- /data/simplex/xftp/logs:/var/opt/simplex-xftp:Z
|
||||
- /data/simplex/xftp/files:/srv/xftp:X
|
||||
environment:
|
||||
- ADDR=${XFTP_ADDR}
|
||||
- QUOTA=50gb
|
||||
networks:
|
||||
- simplex
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
cap_drop:
|
||||
- ALL
|
||||
```
|
||||
|
||||
4. 启动
|
||||
|
||||
```bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
5. 查看日志获取链接信息
|
||||
|
||||
```bash
|
||||
docker logs -f simplex-smp-server
|
||||
```
|
||||
|
||||
```bash
|
||||
docker logs -f simplex-xftp-server
|
||||
```
|
||||
|
||||
> 保存以 `smp://` 和 `xftp://` 开头的链接信息
|
||||
|
||||
6. 到客户端点击头像、网络和服务器、SMP服务器/XFTP服务器、添加服务器、填写链接信息并保存
|
||||
|
||||
> 链接信息格式为：
|
||||
>
|
||||
> ```bash
|
||||
> smp://密钥=@访问地址
|
||||
> ```
|
||||
|
||||
**问题记录**
|
||||
|
||||
`simplex-xftp-server` 端口号为 443 会导致有些人的端口冲突，所以我们可以修改 Docker-Compose 文件内的对外端口比如 "5233:443"，启动后我们客户端链接时需要在IP或域名后添加端口号。如：smp://密钥=@访问地址:5233
|
||||
44
Docker/Compose/Docs/Docker-Compose部署Watchtower.md
Normal file
44
Docker/Compose/Docs/Docker-Compose部署Watchtower.md
Normal file
@ -0,0 +1,44 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Docker-Compose部署Watchtower
|
||||
|
||||
[Github仓库](https://github.com/containrrr/watchtower)
|
||||
|
||||
## 介绍
|
||||
|
||||
Watchtower 是一个开源的容器监控和自动更新工具，设计用于Docker容器环境。它可以监控正在运行的容器及其使用的镜像，当发现镜像有更新时，自动拉取新镜像并重新启动容器。这种自动化管理方式有助于确保部署的应用保持最新状态，从而减少安全风险和改进功能。
|
||||
|
||||
## 部署
|
||||
|
||||
1. 创建 Docker-Compose 文件
|
||||
|
||||
```bash
|
||||
vi docker-compose.yaml
|
||||
```
|
||||
|
||||
内容如下
|
||||
|
||||
```bash
|
||||
services:
|
||||
watchtower:
|
||||
image: containrrr/watchtower:latest
|
||||
container_name: watchtower
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
command: --interval 14400
|
||||
```
|
||||
|
||||
**Command参数解释**
|
||||
|
||||
- `--interval 14400`：设置 `watchtower` 检查更新的时间间隔为 14400 秒（即 4 小时）。`watchtower` 将每 4 小时检查一次所有运行的容器是否有可用的镜像更新，并在发现新版本时自动重新部署容器。
|
||||
|
||||
- 其他参数请看此文档
|
||||
|
||||
[Docker部署Watchtower管理容器更新](https://gitee.com/offends/Kubernetes/tree/main/Docker/Docs/Docker%E9%83%A8%E7%BD%B2Watchtower%E7%AE%A1%E7%90%86%E5%AE%B9%E5%99%A8%E6%9B%B4%E6%96%B0.md)
|
||||
|
||||
2. 启动
|
||||
|
||||
```bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
68
Docker/Compose/Docs/Docker-compose安装.md
Normal file
68
Docker/Compose/Docs/Docker-compose安装.md
Normal file
@ -0,0 +1,68 @@
|
||||
> 作者：丁辉
|
||||
|
||||
# Docker-compose安装
|
||||
|
||||
## 网络安装
|
||||
|
||||
> 缺点: 网络安装版本一般过低,大概率为v1
|
||||
|
||||
- Centos
|
||||
|
||||
```bash
|
||||
yum -y install docker-compose
|
||||
```
|
||||
|
||||
- Ubuntu
|
||||
|
||||
```bash
|
||||
apt -y install docker-compose
|
||||
```
|
||||
|
||||
## 二进制安装
|
||||
|
||||
[Github下载](https://github.com/docker/compose/releases)
|
||||
|
||||
1. 下载
|
||||
|
||||
```
|
||||
curl -L "https://github.com/docker/compose/releases/download/v2.23.3/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
|
||||
```
|
||||
|
||||
2. 配置权限
|
||||
|
||||
```bash
|
||||
chmod +x /usr/local/bin/docker-compose
|
||||
```
|
||||
|
||||
3. 配置软连接
|
||||
|
||||
```bash
|
||||
ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
|
||||
```
|
||||
|
||||
4. 查看结果
|
||||
|
||||
```bash
|
||||
docker-compose --version
|
||||
```
|
||||
|
||||
## PIP安装
|
||||
|
||||
- 安装
|
||||
|
||||
```bash
|
||||
pip install -U docker-compose
|
||||
```
|
||||
|
||||
- 卸载
|
||||
|
||||
```bash
|
||||
pip uninstall docker-compose
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
466
Docker/Compose/Docs/Docker-compse部署Harbor.md
Normal file
466
Docker/Compose/Docs/Docker-compse部署Harbor.md
Normal file
@ -0,0 +1,466 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Docker-compse部署Harbor
|
||||
|
||||
[官网](https://goharbor.io/) [包下载位置](https://github.com/goharbor/harbor/releases)
|
||||
|
||||
> 离线版本：harbor-offline-installer-v*.tgz
|
||||
>
|
||||
> 在线版本：harbor-online-installer-v*.tgz
|
||||
|
||||
## 安装Docker-Compose
|
||||
|
||||
- Centos
|
||||
|
||||
```bash
|
||||
yum install docker-compose -y
|
||||
```
|
||||
|
||||
- Ubuntu
|
||||
|
||||
```bash
|
||||
apt install docker-compose -y
|
||||
```
|
||||
|
||||
## 开始安装
|
||||
|
||||
1. 下载软件包
|
||||
|
||||
> 本文以现最新版本 v2.8.3 举例
|
||||
|
||||
```bash
|
||||
wget https://ghproxy.com/https://github.com/goharbor/harbor/releases/download/v2.8.3/harbor-offline-installer-v2.8.3.tgz
|
||||
```
|
||||
|
||||
2. 解压文件
|
||||
|
||||
```bash
|
||||
tar -zxvf harbor-offline-installer-v*.tgz && cd harbor && cp harbor.yml.tmpl harbor.yml
|
||||
```
|
||||
|
||||
3. 更改 harbor.yml 文件
|
||||
|
||||
> 配置 Tcp IP 访问
|
||||
|
||||
```bash
|
||||
vi harbor.yml
|
||||
```
|
||||
|
||||
更改如下内容
|
||||
|
||||
```yml
|
||||
hostname: harbor.store.com
|
||||
http:
|
||||
port: 9000
|
||||
|
||||
#注释域名证书访问
|
||||
#https:
|
||||
#port: 443
|
||||
#certificate: /your/certificate/path
|
||||
#private_key: /your/private/key/path
|
||||
|
||||
harbor_admin_password: Harbor12345
|
||||
|
||||
data_volume: /data
|
||||
```
|
||||
|
||||
4. 初始化配置
|
||||
|
||||
```bash
|
||||
./prepare
|
||||
```
|
||||
|
||||
5. 启动 harbor
|
||||
|
||||
```bash
|
||||
./install.sh
|
||||
```
|
||||
|
||||
6. 安装完成后更新 Docker 配置允许使用私有仓库
|
||||
|
||||
修改 Docker 配置文件
|
||||
|
||||
```bash
|
||||
vi /etc/docker/daemon.json
|
||||
```
|
||||
|
||||
添加如下内容
|
||||
|
||||
```json
|
||||
{
|
||||
"insecure-registries": ["1.1.1.1:9000"]
|
||||
}
|
||||
```
|
||||
|
||||
7. 重载 Docker
|
||||
|
||||
```bash
|
||||
systemctl reload docker
|
||||
```
|
||||
|
||||
8. 登录测试
|
||||
|
||||
```bash
|
||||
docker login 1.1.1.1:9000 -uadmin -pHarbor12345
|
||||
```
|
||||
|
||||
## 配置外部数据库
|
||||
|
||||
更改 harbor.yml 文件, 更改如下内容
|
||||
|
||||
```yml
|
||||
external_database:
|
||||
harbor:
|
||||
host: harbor_db_host
|
||||
port: harbor_db_port
|
||||
db_name: harbor_db_name
|
||||
username: harbor_db_username
|
||||
password: harbor_db_password
|
||||
ssl_mode: disable
|
||||
max_idle_conns: 2
|
||||
max_open_conns: 0
|
||||
notary_signer:
|
||||
host: notary_signer_db_host
|
||||
port: notary_signer_db_port
|
||||
db_name: notary_signer_db_name
|
||||
username: notary_signer_db_username
|
||||
password: notary_signer_db_password
|
||||
ssl_mode: disable
|
||||
notary_server:
|
||||
host: notary_server_db_host
|
||||
port: notary_server_db_port
|
||||
db_name: notary_server_db_name
|
||||
username: notary_server_db_username
|
||||
password: notary_server_db_password
|
||||
ssl_mode: disable
|
||||
|
||||
external_redis:
|
||||
host: redis:6379
|
||||
password:
|
||||
registry_db_index: 1
|
||||
jobservice_db_index: 2
|
||||
trivy_db_index: 5
|
||||
idle_timeout_seconds: 30
|
||||
```
|
||||
|
||||
## 使用 trivy 镜像漏洞检测
|
||||
|
||||
1. 更改 harbor.yml 文件, 更改如下内容
|
||||
|
||||
```bash
|
||||
trivy:
|
||||
ignore_unfixed: false
|
||||
skip_update: true #跳过更新
|
||||
offline_scan: true #离线扫描
|
||||
security_check: vuln
|
||||
insecure: false
|
||||
```
|
||||
|
||||
2. 启动 harbor 是添加 trivy 启动参数
|
||||
|
||||
```bash
|
||||
./install.sh --with-trivy
|
||||
```
|
||||
|
||||
## 离线环境使用 trivy 导入漏洞数据库
|
||||
|
||||
创建持久化目录(如果 harbor 已启动, 则停止后替换目录内容)
|
||||
|
||||
```bash
|
||||
mkdir -p /data/trivy-adapter/trivy/db/
|
||||
```
|
||||
|
||||
### 方法一
|
||||
|
||||
[oras官网下载地址](https://github.com/oras-project/oras/releases)
|
||||
|
||||
1. 下载软件
|
||||
|
||||
```bash
|
||||
wget https://ghproxy.com/https://github.com/oras-project/oras/releases/download/v1.0.1/oras_1.0.1_linux_amd64.tar.gz
|
||||
```
|
||||
|
||||
2. 解压文件
|
||||
|
||||
```bash
|
||||
tar -zxvf oras_*_linux_amd64.tar.gz && mv oras-install/oras /usr/local/bin/
|
||||
```
|
||||
|
||||
3. 下载数据
|
||||
|
||||
```bash
|
||||
oras pull ghcr.io/aquasecurity/trivy-db:2
|
||||
```
|
||||
|
||||
4. 将数据解压到指定目录
|
||||
|
||||
```bash
|
||||
tar -xzvf db.tar.gz -C /data/trivy-adapter/trivy/db/
|
||||
```
|
||||
|
||||
### 方法二
|
||||
|
||||
> 外网搭建 harbor, 上传 Nginx 和 Tomcat 进行检测, 获取数据目录 java-db 和 db
|
||||
|
||||
1. 线上环境打包书库目录
|
||||
|
||||
```bash
|
||||
cd /data/trivy-adapter/
|
||||
tar -zcvf trivy-db-offline.tar.gz trivy
|
||||
```
|
||||
|
||||
2. 在离线环境将数据解压到指定目录
|
||||
|
||||
```bash
|
||||
tar -xzvf trivy-db-offline.tar.gz -C /data/trivy-adapter/trivy/db/
|
||||
```
|
||||
|
||||
3. 授权目录
|
||||
|
||||
```bash
|
||||
chown -R 10000:10000 /data/trivy-adapter/trivy/db/
|
||||
```
|
||||
|
||||
4. 重新启动 harbor 后完成
|
||||
|
||||
## Harbor配置签发Https配置私有证书
|
||||
|
||||
### 方法一(cfssl)
|
||||
|
||||
1. 首先修改 harbor.yml 文件, 配置证书
|
||||
|
||||
```yml
|
||||
hostname: harbor.store.com
|
||||
http:
|
||||
port: 80
|
||||
|
||||
https:
|
||||
port: 443
|
||||
certificate: /data/ssl/harbor/harbor.pem
|
||||
private_key: /data/ssl/harbor/harbor-key.pem
|
||||
|
||||
harbor_admin_password: Harbor12345
|
||||
|
||||
data_volume: /data
|
||||
```
|
||||
|
||||
2. 下载配置证书工具
|
||||
|
||||
[cfssl下载地址](https://github.com/cloudflare/cfssl/releases/)
|
||||
|
||||
```bash
|
||||
wget https://ghproxy.com/https://github.com/cloudflare/cfssl/releases/download/v1.6.3/cfssl_1.6.3_linux_amd64 \ -O /usr/local/bin/cfssl
|
||||
|
||||
wget https://ghproxy.com/https://github.com/cloudflare/cfssl/releases/download/v1.6.3/cfssljson_1.6.3_linux_amd64 \ -O /usr/local/bin/cfssljson
|
||||
|
||||
wget https://ghproxy.com/https://github.com/cloudflare/cfssl/releases/download/v1.6.3/cfssl-certinfo_1.6.3_linux_amd64 \ -O /usr/local/bin/cfssl-certinfo
|
||||
|
||||
chmod +x /usr/local/bin/cfssl*
|
||||
```
|
||||
|
||||
3. 生成并CA配置文件
|
||||
|
||||
```json
|
||||
#cfssl print-defaults config > ca-config.json
|
||||
cat > ca-config.json <<EOF
|
||||
{
|
||||
"signing": {
|
||||
"default": {
|
||||
"expiry": "87600h"
|
||||
},
|
||||
"profiles": {
|
||||
"harbor": {
|
||||
"expiry": "87600h",
|
||||
"usages": [
|
||||
"signing",
|
||||
"key encipherment",
|
||||
"server auth",
|
||||
"client auth"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
```
|
||||
|
||||
> `default.expiry`：默认证书有效期（单位：h）
|
||||
> `profiles.harbor`：为服务使用该配置文件颁发证书的配置模块
|
||||
> signing：签署，表示该证书可用于签名其它证书；生成的 ca.pem 证书中 CA=TRUE
|
||||
> `key encipherment`：密钥加密
|
||||
> `profiles`：指定了不同角色的配置信息；可以定义多个 profiles，分别指定不同的过期时间、使用场景等参数；后续在签名证书时使用某个 profile
|
||||
> `server auth`：服务器身份验证；表示 client 可以用该 CA 对 server 提供的证书进行验证
|
||||
> `client auth`：客户端身份验证；表示 server 可以用该 CA 对 client 提供的证书进行验证
|
||||
|
||||
4. 生成并修改默认csr请求文件
|
||||
|
||||
```json
|
||||
#cfssl print-defaults csr > ca-csr.json
|
||||
cat > ca-csr.json <<EOF
|
||||
{
|
||||
"CN": "harbor",
|
||||
"hosts": [
|
||||
],
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "CN",
|
||||
"ST": "Beijing",
|
||||
"L": "Beijing"
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
```
|
||||
|
||||
> `hosts`：包含的授权范围，不在此范围的的节点或者服务使用此证书就会报证书不匹配错误，证书如果不包含可能会出现无法连接的情况(此处是CA机构的可为空）
|
||||
> `Key`: 指定使用的加密算法，一般使用rsa非对称加密算法（algo:rsa；size:2048）
|
||||
> `CN`：Common Name，kube-apiserver 从证书中提取该字段作为请求的用户名 (User Name)；浏览器使用该字段验证网站是否合法
|
||||
> `CN`是域名，也就是你现在使用什么域名就写什么域名
|
||||
> `O`：Organization，从证书中提取该字段作为请求用户所属的组 (Group)
|
||||
|
||||
5. 初始化CA
|
||||
|
||||
```bash
|
||||
cfssl gencert -initca ca-csr.json | cfssljson -bare ca
|
||||
```
|
||||
|
||||
> 可以看到，当前目录下新生成了`ca.csr`、`ca-key.pem`、`ca.pem`这３个文件。 ca-key.pem、ca.pem这两个是CA相关的证书，通过这个CA来签署服务端证书。
|
||||
|
||||
6. 创建并修改Harbor证书请求文件
|
||||
|
||||
```bash
|
||||
#cfssl print-defaults csr > harbor-csr.json
|
||||
cat > harbor-csr.json <<EOF
|
||||
{
|
||||
"CN": "1.1.1.1",
|
||||
"hosts": [
|
||||
"127.0.0.1",
|
||||
"1.1.1.1"
|
||||
],
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "CN",
|
||||
"ST": "Beijing",
|
||||
"L": "Beijing"
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
```
|
||||
|
||||
7. 使用请求文件根据CA配置颁发证书
|
||||
|
||||
```bash
|
||||
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
|
||||
-config=ca-config.json \
|
||||
-profile=harbor harbor-csr.json | cfssljson -bare harbor
|
||||
```
|
||||
|
||||
8. 拷贝证书到指定目录下
|
||||
|
||||
```bash
|
||||
cp harbor.pem harbor-key.pem /data/ssl/harbor/
|
||||
```
|
||||
|
||||
> `-config`：指定CA证书机构的配置文件
|
||||
> `-profile`：指定使用CA配置文件中的哪个模块（此处harbor对应配置文件中的harbor）
|
||||
> `harbor.pem`：harbor服务的数字证书
|
||||
> `harbor-key`.pem：harbor服务的私钥
|
||||
|
||||
### 方法二(openssl)
|
||||
|
||||
1. 首先修改 harbor.yml 文件, 配置证书
|
||||
|
||||
```yml
|
||||
hostname: harbor.store.com
|
||||
http:
|
||||
port: 80
|
||||
|
||||
https:
|
||||
port: 443
|
||||
certificate: /data/ssl/harbor/harbor.crt
|
||||
private_key: /data/ssl/harbor/harbor-key.key
|
||||
|
||||
harbor_admin_password: Harbor12345
|
||||
|
||||
data_volume: /data
|
||||
```
|
||||
|
||||
2. 创建 ca.key
|
||||
|
||||
```bash
|
||||
openssl genrsa -out ca.key 4096
|
||||
```
|
||||
|
||||
3. 创建 ca.crt
|
||||
|
||||
```bash
|
||||
openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.com" -key ca.key -out ca.crt
|
||||
```
|
||||
|
||||
4. 创建 harbor.key
|
||||
|
||||
```bash
|
||||
openssl genrsa -out harbor.key 4096
|
||||
```
|
||||
|
||||
5. 创建 harbor.csr
|
||||
|
||||
```bash
|
||||
openssl req -sha512 -new -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.com" -key harbor.key -out harbor.csr
|
||||
```
|
||||
|
||||
6. 创建x509 v3 扩展 文件
|
||||
|
||||
```bash
|
||||
cat > v3.ext <<EOF
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
basicConstraints=CA:FALSE
|
||||
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
|
||||
extendedKeyUsage = serverAuth
|
||||
subjectAltName = @alt_names
|
||||
|
||||
[alt_names]
|
||||
DNS.1=harbor.com
|
||||
EOF
|
||||
```
|
||||
|
||||
7. 使用 v3.ext 文件为 harbor 服务器创建证书
|
||||
|
||||
```bash
|
||||
openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in harbor.csr -out harbor.crt
|
||||
```
|
||||
|
||||
### Docker配置证书验证
|
||||
|
||||
1. 创建目录
|
||||
|
||||
```bash
|
||||
mkdir -p /etc/docker/certs.d/harbor.com
|
||||
```
|
||||
|
||||
2. 将 crt 文件转换为 cert 文件
|
||||
|
||||
```bash
|
||||
openssl x509 -inform PEM -in harbor.crt -out harbor.cert
|
||||
```
|
||||
|
||||
3. 将 cert 和 key 放在对应目录下
|
||||
|
||||
```bash
|
||||
cp harbor.cert harbor.key ca.crt /etc/docker/certs.d/harbor.com/
|
||||
```
|
||||
|
||||
4. 重启docker
|
||||
|
||||
```bash
|
||||
systemctl restart docker
|
||||
```
|
||||
25
Docker/Compose/Docs/更新Docker-compose部署的应用.md
Normal file
25
Docker/Compose/Docs/更新Docker-compose部署的应用.md
Normal file
@ -0,0 +1,25 @@
|
||||
> 作者：丁辉
|
||||
|
||||
# 更新Docker-compose部署的应用
|
||||
|
||||
> 进入到你 docker-compose 所在的文件夹下，执行
|
||||
|
||||
1. 拉取最新镜像
|
||||
|
||||
```bash
|
||||
docker-compose pull
|
||||
```
|
||||
|
||||
2. 使用新镜像重启容器
|
||||
|
||||
```bash
|
||||
docker-compose up -d --remove-orphans
|
||||
```
|
||||
|
||||
3. 清理旧容器残留镜像
|
||||
|
||||
```bash
|
||||
docker image prune
|
||||
```
|
||||
|
||||
|
||||
92
Docker/Compose/README.md
Normal file
92
Docker/Compose/README.md
Normal file
@ -0,0 +1,92 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Docker-compose使用示例
|
||||
|
||||
**前提：**
|
||||
|
||||
1. 克隆代码
|
||||
|
||||
```bash
|
||||
git clone https://gitee.com/offends/Kubernetes.git
|
||||
cd Kubernetes/Docker/Compose
|
||||
```
|
||||
|
||||
2. 进入示例目录
|
||||
|
||||
```bash
|
||||
cd /Yml
|
||||
```
|
||||
|
||||
## 构建镜像
|
||||
|
||||
```bash
|
||||
docker-compose -f build-compose.yml build
|
||||
```
|
||||
|
||||
**参数解释**
|
||||
|
||||
| 参数 | 描述 |
|
||||
| ------------ | --------------------------------------------------------- |
|
||||
| `build` | 定义服务的构建方式 |
|
||||
| `context` | 构建上下文的路径，`.` 表示使用当前目录 |
|
||||
| `dockerfile` | 指定用于构建镜像的 Dockerfile 文件的路径 |
|
||||
| `args` | 定义构建参数的键值对，这里的 `buildno: 1` 是一个构建参数 |
|
||||
| `labels` | 为构建的镜像添加标签，这里添加了一个名为 "offends" 的标签 |
|
||||
| `target` | 指定构建阶段的目标，这里设置为 `prod` |
|
||||
|
||||
## 安装 Gitlab
|
||||
|
||||
- 指定文件名启动
|
||||
|
||||
```bash
|
||||
docker-compose -f gitlab-compose.yml up -d
|
||||
```
|
||||
|
||||
- 停止
|
||||
|
||||
```bash
|
||||
docker-compose -f gitlab-compose.yml down
|
||||
```
|
||||
|
||||
## 示例模版演示
|
||||
|
||||
- ```bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
**YML参数解释**
|
||||
|
||||
[Docker从入门到实践](https://yeasy.gitbook.io/docker_practice/compose/compose_file) [菜鸟教学](https://www.runoob.com/docker/docker-compose.html)
|
||||
|
||||
**Docker-compose命令参数解释**
|
||||
|
||||
| 命令 | 描述 |
|
||||
| ------- | ------------------------------------------------- |
|
||||
| build | 构建或重建服务 |
|
||||
| config | 解析、解决并渲染规范格式的Compose文件 |
|
||||
| cp | 在服务容器和本地文件系统之间复制文件/文件夹 |
|
||||
| create | 为一个服务创建容器 |
|
||||
| down | 停止并移除容器和网络 |
|
||||
| events | 接收来自容器的实时事件 |
|
||||
| exec | 在运行中的容器中执行命令 |
|
||||
| images | 列出由创建的容器使用的镜像 |
|
||||
| kill | 强制停止服务容器 |
|
||||
| logs | 查看容器输出 |
|
||||
| ls | 列出运行中的Compose项目 |
|
||||
| pause | 暂停服务 |
|
||||
| port | 打印端口绑定的公共端口 |
|
||||
| ps | 列出容器 |
|
||||
| pull | 拉取服务镜像 |
|
||||
| push | 推送服务镜像 |
|
||||
| restart | 重启服务容器 |
|
||||
| rm | 删除已停止的服务容器 |
|
||||
| run | 在一个服务上运行一次性命令 |
|
||||
| scale | 缩放服务 |
|
||||
| start | 启动服务 |
|
||||
| stop | 停止服务 |
|
||||
| top | 显示运行中的进程 |
|
||||
| unpause | 恢复暂停的服务 |
|
||||
| up | 创建并启动容器 |
|
||||
| version | 显示 Docker Compose 版本信息 |
|
||||
| wait | 阻塞直到第一个服务容器停止 |
|
||||
| watch | 监视服务的构建环境，当文件更新时重新构建/刷新容器 |
|
||||
5
Docker/Compose/Yml/Dockerfile
Normal file
5
Docker/Compose/Yml/Dockerfile
Normal file
@ -0,0 +1,5 @@
|
||||
FROM busybox:latest AS prod
|
||||
|
||||
RUN echo "启动成功" > /file.txt
|
||||
|
||||
CMD ["tail","-f","/file.txt"]
|
||||
16
Docker/Compose/Yml/build-compose.yml
Normal file
16
Docker/Compose/Yml/build-compose.yml
Normal file
@ -0,0 +1,16 @@
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
webapp:
|
||||
build: ./
|
||||
|
||||
# services:
|
||||
# webapp:
|
||||
# build:
|
||||
# context: ./
|
||||
# dockerfile: Dockerfile
|
||||
# args:
|
||||
# buildno: 1
|
||||
# labels:
|
||||
# - "offends"
|
||||
# target: prod
|
||||
7
Docker/Compose/Yml/docker-compose.yml
Normal file
7
Docker/Compose/Yml/docker-compose.yml
Normal file
@ -0,0 +1,7 @@
|
||||
version: "3"
|
||||
|
||||
services:
|
||||
nginx:
|
||||
image: nginx:latest
|
||||
ports:
|
||||
- "80:80"
|
||||
52
Docker/Compose/Yml/gitlab-compose.yml
Normal file
52
Docker/Compose/Yml/gitlab-compose.yml
Normal file
@ -0,0 +1,52 @@
|
||||
version: "3"
|
||||
|
||||
services:
|
||||
gitlab:
|
||||
depends_on:
|
||||
- redis
|
||||
- postgresql
|
||||
restart: always
|
||||
image: sameersbn/gitlab:latest
|
||||
environment:
|
||||
- DEBUG=false
|
||||
- TZ=Asia/Shanghai
|
||||
- GITLAB_TIMEZONE=Beijing
|
||||
- REDIS_HOST=redis
|
||||
- REDIS_PORT=6379
|
||||
- DB_ADAPTER=postgresql
|
||||
- DB_HOST=postgresql
|
||||
- DB_PORT=5432
|
||||
- DB_USER=gitlab
|
||||
- DB_PASS=gitlab
|
||||
- DB_NAME=gitlabhq_production
|
||||
- GITLAB_SECRETS_DB_KEY_BASE=long-and-random-alphanumeric-string
|
||||
- GITLAB_SECRETS_OTP_KEY_BASE=long-and-random-alphanumeric-string
|
||||
- GITLAB_SECRETS_SECRET_KEY_BASE=long-and-random-alphanumeric-string
|
||||
- GITLAB_HOST=192.168.1.10
|
||||
- GITLAB_PORT=80
|
||||
- GITLAB_SSH_HOST=192.168.1.10
|
||||
- GITLAB_SSH_PORT=222
|
||||
ports:
|
||||
- "222:22"
|
||||
- "80:80"
|
||||
volumes:
|
||||
- /data/gitlab/data:/home/git/data:Z
|
||||
- /data/gitlab/node_modules:/home/git/gitlab/node_modules:Z
|
||||
- /data/gitlab/log:/var/log/gitlab:Z
|
||||
|
||||
redis:
|
||||
restart: always
|
||||
image: sameersbn/redis:latest
|
||||
volumes:
|
||||
- /data/gitlab/redis:/var/lib/redis:Z
|
||||
|
||||
postgresql:
|
||||
restart: always
|
||||
image: sameersbn/postgresql:14
|
||||
environment:
|
||||
- DB_EXTENSION=pg_trgm,btree_gist
|
||||
- DB_USER=gitlab
|
||||
- DB_PASS=gitlab
|
||||
- DB_NAME=gitlabhq_production
|
||||
volumes:
|
||||
- /data/gitlab/postgresql:/var/lib/postgresql:Z
|
||||
33
Docker/Compose/install.sh
Executable file
33
Docker/Compose/install.sh
Executable file
@ -0,0 +1,33 @@
|
||||
#!/bin/bash
|
||||
|
||||
#############################################################################################
|
||||
# 用途: 安装 Docker Compose
|
||||
# 作者: 丁辉
|
||||
# 编写时间: 2023-12-27
|
||||
#############################################################################################
|
||||
|
||||
# 加载检测脚本
|
||||
source <(curl -sS https://gitee.com/offends/Linux/raw/main/File/Shell/Check_command.sh)
|
||||
|
||||
# 定义变量
|
||||
VERSION="v2.23.3"
|
||||
|
||||
# 安装 Docker Compose
|
||||
# 检测某个systemd服务是否存在
|
||||
function CHECK_SYSTEMD(){
|
||||
if ! command -v docker-compose >/dev/null 2>&1; then
|
||||
INSTALL_DOCKER_COMPOSE
|
||||
else
|
||||
SEND_INFO "Docker-compose 服务已安装,版本为: $(docker-compose --version | grep -oP 'v\d+\.\d+\.\d+')"
|
||||
fi
|
||||
}
|
||||
|
||||
function INSTALL_DOCKER_COMPOSE(){
|
||||
SEND_INFO "开始安装 Docker Compose"
|
||||
curl -L "https://github.com/docker/compose/releases/download/$VERSION/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
|
||||
NULL_TRUE chmod +x /usr/local/bin/docker-compose
|
||||
NULL_TRUE ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
|
||||
SEND_INFO "Docker Compose 安装完成,版本为: $(docker-compose --version | grep -oP 'v\d+\.\d+\.\d+')"
|
||||
}
|
||||
|
||||
CHECK_SYSTEMD
|
||||
15
Docker/Dockerfile/Aliyun-dns-sync/Dockerfile
Normal file
15
Docker/Dockerfile/Aliyun-dns-sync/Dockerfile
Normal file
@ -0,0 +1,15 @@
|
||||
FROM python:3
|
||||
|
||||
RUN pip install aliyun-python-sdk-core -i https://pypi.tuna.tsinghua.edu.cn/simple \
|
||||
&& sleep 2 \
|
||||
&& pip install aliyun-python-sdk-alidns -i https://pypi.tuna.tsinghua.edu.cn/simple
|
||||
|
||||
RUN touch /var/log/python.log \
|
||||
&& sed -i s@/deb.debian.org/@/mirrors.aliyun.com/@g /etc/apt/sources.list.d/debian.sources \
|
||||
&& apt-get update \
|
||||
&& apt-get -y install cron \
|
||||
&& echo '*/1 * * * * sh /aliyun-dns-sync/cron.sh' | crontab
|
||||
|
||||
COPY ./File/* /aliyun-dns-sync/
|
||||
|
||||
CMD [ "bash", "/aliyun-dns-sync/start.sh" ]
|
||||
141
Docker/Dockerfile/Aliyun-dns-sync/File/aliyun-dns-sync.py
Normal file
141
Docker/Dockerfile/Aliyun-dns-sync/File/aliyun-dns-sync.py
Normal file
@ -0,0 +1,141 @@
|
||||
#!/usr/bin/env python
|
||||
#coding=utf-8
|
||||
|
||||
# 加载核心SDK
|
||||
#from aliyunsdkcore import client
|
||||
#from aliyunsdksts.request.v20150401 import AssumeRoleRequest
|
||||
#import json
|
||||
#import oss2
|
||||
|
||||
from aliyunsdkcore.client import AcsClient
|
||||
from aliyunsdkcore.acs_exception.exceptions import ClientException
|
||||
from aliyunsdkcore.acs_exception.exceptions import ServerException
|
||||
|
||||
# 加载获取 、 新增、 更新、 删除接口
|
||||
from aliyunsdkalidns.request.v20150109 import DescribeSubDomainRecordsRequest, AddDomainRecordRequest, UpdateDomainRecordRequest, DeleteDomainRecordRequest
|
||||
|
||||
# 加载内置模块
|
||||
import json,urllib
|
||||
|
||||
# AccessKey 和 Secret 建议使用 RAM 子账户的 KEY 和 SECRET 增加安全性
|
||||
ID = ''
|
||||
SECRET = ''
|
||||
|
||||
# 地区节点 可选地区取决于你的阿里云帐号等级，普通用户只有四个，分别是杭州、上海、深圳、河北，具体参考官网API
|
||||
regionId = 'cn-hangzhou'
|
||||
|
||||
# 配置认证信息
|
||||
client = AcsClient(ID, SECRET, regionId)
|
||||
|
||||
# 设置主域名
|
||||
DomainName = ''
|
||||
|
||||
# 子域名列表 列表参数可根据实际需求增加或减少值
|
||||
SubDomainList = ['@','www']
|
||||
|
||||
# 获取外网IP 三个地址返回的ip地址格式各不相同，3322 的是最纯净的格式， 备选1为 json格式 备选2 为curl方式获取 两个备选地址都需要对获取值作进一步处理才能使用
|
||||
def getIp():
|
||||
# 备选地址: 1. http://pv.sohu.com/cityjson?ie=utf-8 2. curl -L tool.lu/ip
|
||||
with urllib.request.urlopen('http://www.3322.org/dyndns/getip') as response:
|
||||
html = response.read()
|
||||
ip = str(html, encoding='utf-8').replace("\n", "")
|
||||
return ip
|
||||
|
||||
# 查询记录
|
||||
def getDomainInfo(SubDomain):
|
||||
request = DescribeSubDomainRecordsRequest.DescribeSubDomainRecordsRequest()
|
||||
request.set_accept_format('json')
|
||||
|
||||
# 设置要查询的记录类型为 A记录 官网支持A / CNAME / MX / AAAA / TXT / NS / SRV / CAA / URL隐性(显性)转发 如果有需要可将该值配置为参数传入
|
||||
request.set_Type("A")
|
||||
#request.set_Type("www")
|
||||
# 指定查记的域名 格式为 'test.binghe.com'
|
||||
request.set_SubDomain(SubDomain)
|
||||
|
||||
response = client.do_action_with_exception(request)
|
||||
response = str(response, encoding='utf-8')
|
||||
|
||||
# 将获取到的记录转换成json对象并返回
|
||||
return json.loads(response)
|
||||
|
||||
# 新增记录 (默认都设置为A记录，通过配置set_Type可设置为其他记录)
|
||||
def addDomainRecord(client,value,rr,domainname):
|
||||
request = AddDomainRecordRequest.AddDomainRecordRequest()
|
||||
request.set_accept_format('json')
|
||||
|
||||
# request.set_Priority('1') # MX 记录时的必选参数
|
||||
request.set_TTL('600') # 可选值的范围取决于你的阿里云账户等级，免费版为 600 - 86400 单位为秒
|
||||
request.set_Value(value) # 新增的 ip 地址
|
||||
request.set_Type('A') # 记录类型
|
||||
request.set_RR(rr) # 子域名名称
|
||||
request.set_DomainName(domainname) #主域名
|
||||
|
||||
# 获取记录信息，返回信息中包含 TotalCount 字段，表示获取到的记录条数 0 表示没有记录， 其他数字为多少表示有多少条相同记录，正常有记录的值应该为1，如果值大于1则应该检查是不是重复添加了相同的记录
|
||||
response = client.do_action_with_exception(request)
|
||||
response = str(response, encoding='utf-8')
|
||||
relsult = json.loads(response)
|
||||
return relsult
|
||||
|
||||
# 更新记录
|
||||
def updateDomainRecord(client,value,rr,record_id):
|
||||
request = UpdateDomainRecordRequest.UpdateDomainRecordRequest()
|
||||
request.set_accept_format('json')
|
||||
|
||||
# request.set_Priority('1')
|
||||
request.set_TTL('600')
|
||||
request.set_Value(value) # 新的ip地址
|
||||
request.set_Type('A')
|
||||
request.set_RR(rr)
|
||||
request.set_RecordId(record_id) # 更新记录需要指定 record_id ，该字段为记录的唯一标识，可以在获取方法的返回信息中得到该字段的值
|
||||
|
||||
response = client.do_action_with_exception(request)
|
||||
response = str(response, encoding='utf-8')
|
||||
return response
|
||||
|
||||
# 删除记录
|
||||
def delDomainRecord(client,subdomain):
|
||||
info = getDomainInfo(subdomain)
|
||||
if info['TotalCount'] == 0:
|
||||
print('没有相关的记录信息，删除失败！')
|
||||
elif info["TotalCount"] == 1:
|
||||
print('准备删除记录')
|
||||
request = DeleteDomainRecordRequest.DeleteDomainRecordRequest()
|
||||
request.set_accept_format('json')
|
||||
|
||||
record_id = info["DomainRecords"]["Record"][0]["RecordId"]
|
||||
request.set_RecordId(record_id) # 删除记录需要指定 record_id ，该字段为记录的唯一标识，可以在获取方法的返回信息中得到该字段的值
|
||||
result = client.do_action_with_exception(request)
|
||||
print('删除成功，返回信息：')
|
||||
print(result)
|
||||
else:
|
||||
# 正常不应该有多条相同的记录，如果存在这种情况，应该手动去网站检查核实是否有操作失误
|
||||
print("存在多个相同子域名解析记录值，请核查后再操作！")
|
||||
|
||||
# 有记录则更新，没有记录则新增
|
||||
def setDomainRecord(client,value,rr,domainname):
|
||||
info = getDomainInfo(rr + '.' + domainname)
|
||||
if info['TotalCount'] == 0:
|
||||
print('准备添加新记录')
|
||||
add_result = addDomainRecord(client,value,rr,domainname)
|
||||
print(add_result)
|
||||
elif info["TotalCount"] == 1:
|
||||
print('准备更新已有记录')
|
||||
record_id = info["DomainRecords"]["Record"][0]["RecordId"]
|
||||
cur_ip = getIp()
|
||||
old_ip = info["DomainRecords"]["Record"][0]["Value"]
|
||||
if cur_ip == old_ip:
|
||||
print ("新ip与原ip相同,不更新!")
|
||||
else:
|
||||
update_result = updateDomainRecord(client,value,rr,record_id)
|
||||
print('更新成功，返回信息：')
|
||||
print(update_result)
|
||||
else:
|
||||
# 正常不应该有多条相同的记录，如果存在这种情况，应该手动去网站检查核实是否有操作失误
|
||||
print("存在多个相同子域名解析记录值，请核查删除后再操作!")
|
||||
|
||||
|
||||
IP = getIp()
|
||||
|
||||
# 循环子域名列表进行批量操作
|
||||
for x in SubDomainList:
|
||||
setDomainRecord(client,IP,x,DomainName)
|
||||
4
Docker/Dockerfile/Aliyun-dns-sync/File/cron.sh
Executable file
4
Docker/Dockerfile/Aliyun-dns-sync/File/cron.sh
Executable file
@ -0,0 +1,4 @@
|
||||
#!/bin/bash
|
||||
|
||||
# 启动同步
|
||||
/usr/local/bin/python /aliyun-dns-sync/aliyun-dns-sync.py > /var/log/python.log
|
||||
7
Docker/Dockerfile/Aliyun-dns-sync/File/start.sh
Executable file
7
Docker/Dockerfile/Aliyun-dns-sync/File/start.sh
Executable file
@ -0,0 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
# 启动 cron
|
||||
service cron start
|
||||
|
||||
# 查看日志
|
||||
tail -f /var/log/python.log
|
||||
15
Docker/Dockerfile/Aliyun-dns-sync/README.md
Normal file
15
Docker/Dockerfile/Aliyun-dns-sync/README.md
Normal file
@ -0,0 +1,15 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# 通过脚本调用阿里云接口实现动态公网IP实时与阿里云域名解析同步
|
||||
|
||||
> 使用前修改 Python 脚本内如下参数
|
||||
|
||||
```bash
|
||||
ID = '' #AccessKey ID
|
||||
SECRET = '' #AccessKey Secret
|
||||
regionId = '' #地域
|
||||
DomainName = '' #域名
|
||||
```
|
||||
|
||||
5
Docker/Dockerfile/Busybox/Dockerfile
Normal file
5
Docker/Dockerfile/Busybox/Dockerfile
Normal file
@ -0,0 +1,5 @@
|
||||
FROM busybox:latest
|
||||
|
||||
RUN echo "启动成功" > /file.txt
|
||||
|
||||
CMD ["tail","-f","/file.txt"]
|
||||
7
Docker/Dockerfile/Busybox/README.md
Normal file
7
Docker/Dockerfile/Busybox/README.md
Normal file
@ -0,0 +1,7 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Busybox
|
||||
|
||||
> 此应用于容器启动测试
|
||||
6
Docker/Dockerfile/Cache-Registry/Dockerfile
Normal file
6
Docker/Dockerfile/Cache-Registry/Dockerfile
Normal file
@ -0,0 +1,6 @@
|
||||
FROM registry:latest
|
||||
|
||||
ENV PROXY_REMOTE_URL="" \
|
||||
DELETE_ENABLED="true"
|
||||
|
||||
COPY ./entrypoint.sh /entrypoint.sh
|
||||
51
Docker/Dockerfile/Cache-Registry/README.md
Normal file
51
Docker/Dockerfile/Cache-Registry/README.md
Normal file
@ -0,0 +1,51 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# 镜像仓库代理服务
|
||||
|
||||
## 镜像仓库地址
|
||||
|
||||
| 站点名 | URL | 备注 |
|
||||
| :---------: | :--------------------------: | :--------------------------------------------------------: |
|
||||
| DockerHub | https://registry-1.docker.io | 拉取镜像需要带上 `library` (可能就我有这情况吧,没仔细深究) |
|
||||
| Quay | https://quay.io | |
|
||||
| Gcr | https://gcr.io | |
|
||||
| Ghcr | https://ghcr.io | |
|
||||
| K8sgcr | https://k8s.gcr.io | |
|
||||
| Registryk8s | https://registry.k8s.io | |
|
||||
|
||||
## 已构建好的镜像
|
||||
|
||||
```bash
|
||||
hub.offends.cn/registry-proxy:latest
|
||||
```
|
||||
|
||||
## 启动容器
|
||||
|
||||
[仓库地址](https://gitee.com/offends/Kubernetes/tree/main/Docker/Dockerfile/Cache-Registry)
|
||||
|
||||
- Docker
|
||||
|
||||
```bash
|
||||
docker run -itd \
|
||||
--restart always \
|
||||
-p 5000:5000 \
|
||||
-v "/etc/localtime:/etc/localtime" \
|
||||
-v "/var/lib/registryproxy:/var/lib/registry" \
|
||||
-e PROXY_REMOTE_URL="" \
|
||||
--name=registryproxy \
|
||||
hub.offends.cn/registry-proxy:latest
|
||||
```
|
||||
|
||||
- Docker-compose
|
||||
|
||||
> 文件在本仓库当前目录下, 修改 `PROXY_REMOTE_URL` 参数后即可使用
|
||||
|
||||
```bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
- Kubernetes
|
||||
|
||||
**查看此篇文档**
|
||||
|
||||
[Kubernetes部署Registry镜像仓库缓存服务](https://gitee.com/offends/Kubernetes/tree/main/Docker/Dockerfile/Cache-Registry/README.md)
|
||||
13
Docker/Dockerfile/Cache-Registry/docker-compose.yaml
Normal file
13
Docker/Dockerfile/Cache-Registry/docker-compose.yaml
Normal file
@ -0,0 +1,13 @@
|
||||
version: "3"
|
||||
services:
|
||||
registryproxy:
|
||||
image: "hub.offends.cn/registry-proxy:latest"
|
||||
container_name: "registryproxy"
|
||||
restart: "always"
|
||||
volumes:
|
||||
- "/etc/localtime:/etc/localtime"
|
||||
- "/var/lib/registryproxy:/var/lib/registry"
|
||||
environment:
|
||||
- "PROXY_REMOTE_URL=http://registry:5000"
|
||||
ports:
|
||||
- "5000:5000"
|
||||
37
Docker/Dockerfile/Cache-Registry/entrypoint.sh
Executable file
37
Docker/Dockerfile/Cache-Registry/entrypoint.sh
Executable file
@ -0,0 +1,37 @@
|
||||
#!/bin/sh
|
||||
|
||||
#############################################################################################
|
||||
# 用途: 定制缓存 Registry 镜像
|
||||
# 作者: 丁辉
|
||||
# 编写时间: 2024-06-29
|
||||
#############################################################################################
|
||||
|
||||
set -e
|
||||
|
||||
# 配置 Headers
|
||||
sed -i "/headers:/a\ Access-Control-Allow-Origin: ['*']" /etc/docker/registry/config.yml
|
||||
sed -i "/headers:/a\ Access-Control-Allow-Methods: ['HEAD', 'GET', 'OPTIONS', 'DELETE']" /etc/docker/registry/config.yml
|
||||
sed -i "/headers:/a\ Access-Control-Expose-Headers: ['Docker-Content-Digest']" /etc/docker/registry/config.yml
|
||||
|
||||
# 检查环境变量PROXY_REMOTE_URL是否非空, 检查配置文件中变量出现的次数是否为0
|
||||
if [ -n "$PROXY_REMOTE_URL" ] && [ $(grep -c "$PROXY_REMOTE_URL" "/etc/docker/registry/config.yml") -eq 0 ]; then
|
||||
echo "proxy:" >> /etc/docker/registry/config.yml
|
||||
echo " remoteurl: $PROXY_REMOTE_URL" >> /etc/docker/registry/config.yml
|
||||
# 可以提供用户名和密码保持私密
|
||||
# echo " username: $PROXY_USERNAME" >> /etc/docker/registry/config.yml
|
||||
# echo " password: $PROXY_PASSWORD" >> /etc/docker/registry/config.yml
|
||||
echo "----- Enabled Proxy To Remote -----"
|
||||
fi
|
||||
# 判断是否开启 Registry 镜像镜像清理
|
||||
if [ "$DELETE_ENABLED" = "true" ] && [ $(grep -c "delete:" /etc/docker/registry/config.yml) -eq 0 ]; then
|
||||
sed -i '/rootdirectory:/a\ delete:' /etc/docker/registry/config.yml
|
||||
sed -i '/delete:/a\ enabled: true' /etc/docker/registry/config.yml
|
||||
echo "----- Enabled Local Storage Delete -----"
|
||||
fi
|
||||
|
||||
case "$1" in
|
||||
*.yaml|*.yml) set -- registry serve "$@" ;;
|
||||
serve|garbage-collect|help|-*) set -- registry "$@" ;;
|
||||
esac
|
||||
|
||||
exec "$@"
|
||||
5
Docker/Dockerfile/Centos/Dockerfile
Normal file
5
Docker/Dockerfile/Centos/Dockerfile
Normal file
@ -0,0 +1,5 @@
|
||||
FROM scratch
|
||||
|
||||
ADD ./centos/rootfs /
|
||||
|
||||
CMD /bin/bash
|
||||
10
Docker/Dockerfile/Centos/README.md
Normal file
10
Docker/Dockerfile/Centos/README.md
Normal file
@ -0,0 +1,10 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Centos 镜像构建
|
||||
|
||||
```bash
|
||||
./build.sh
|
||||
```
|
||||
|
||||
72
Docker/Dockerfile/Centos/build.sh
Executable file
72
Docker/Dockerfile/Centos/build.sh
Executable file
@ -0,0 +1,72 @@
|
||||
#!/bin/bash
|
||||
|
||||
#############################################################################################
|
||||
# 用途: 构建 Centos 系统 Docker 镜像的脚本
|
||||
# 作者: 丁辉
|
||||
# 编写时间: 2023-11-27
|
||||
#############################################################################################
|
||||
|
||||
# 镜像地址
|
||||
# 阿里云: https://mirrors.aliyun.com/centos/
|
||||
# 官方: https://www.centos.org/
|
||||
# 其他: https://vault.centos.org/
|
||||
|
||||
VERSION="7.9.2009"
|
||||
|
||||
CENTOS_VERSION="7"
|
||||
URL="https://mirrors.aliyun.com/centos/$VERSION/os/x86_64/Packages"
|
||||
RPM_VERSION="centos-release-7-9.2009.0.el7.centos.x86_64.rpm"
|
||||
|
||||
CENTOS_URL="$URL/$RPM_VERSION"
|
||||
|
||||
# 加载检测脚本
|
||||
source <(curl -sS https://gitee.com/offends/Linux/raw/main/File/Shell/Check_command.sh)
|
||||
|
||||
function INSTALL_WGET(){
|
||||
CHECK_INSTALL wget
|
||||
}
|
||||
|
||||
# 初始化目录和文件
|
||||
function INIT_DIR(){
|
||||
CHECK_DIR ./centos/rootfs && cd ./centos
|
||||
CHECK_COMMAND_NULL rpm --root $PWD/rootfs --initdb
|
||||
SEND_INFO "初始化目录和文件完成"
|
||||
SEND_INFO "正在获取RPM文件"
|
||||
CHECK_COMMAND_NULL wget $CENTOS_URL
|
||||
|
||||
CHECK_FILE "centos-release-7-9.2009.0.el7.centos.x86_64.rpm"
|
||||
NULL_TRUE rpm -ivh --nodeps --root $PWD/rootfs --package ./$RPM_VERSION
|
||||
|
||||
# #在无法获取到软件包源的情况下使用
|
||||
# SEND_INFO "正在备份 YUM 源文件"
|
||||
# CHECK_DIR /etc/yum.repos.d/Offends
|
||||
# CHECK_COMMAND_NULL \cp -r /etc/yum.repos.d/epel.repo /etc/yum.repos.d/Offends && \cp -r /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/Offends
|
||||
# # 获取需要的软件包源
|
||||
# SEND_INFO "正在获取软件包源"
|
||||
# CHECK_COMMAND_NULL wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-$CENTOS_VERSION.repo
|
||||
# CHECK_COMMAND_NULL wget -O /etc/yum.repos.d/epel.repo https://mirrors.aliyun.com/repo/epel-$CENTOS_VERSION.repo
|
||||
# # 清除缓存
|
||||
# SEND_INFO "正在清除缓存"
|
||||
# CHECK_COMMAND_NULL yum makecache
|
||||
# # 根据自己需求修改
|
||||
# CHECK_COMMAND_NULL sed -i 's@baseurl=.*@baseurl=https://mirrors.aliyun.com/centos/7.9.2009/os/x86_64/@' /etc/yum.repos.d/*.repo
|
||||
|
||||
SEND_INFO "正在安装基础软件包,拉取过程较慢请稍后"
|
||||
CHECK_COMMAND_NULL yum --installroot=$PWD/rootfs install yum --nogpgcheck -y
|
||||
SEND_INFO "开始构建镜像"
|
||||
CHECK_COMMAND_NULL cd .. && docker build -t centos:$VERSION .
|
||||
SEND_INFO "构建完成,镜像名称: centos:$VERSION"
|
||||
|
||||
# # 恢复 YUM 源文件
|
||||
# SEND_INFO "正在恢复 YUM 源文件"
|
||||
# CHECK_COMMAND_NULL rm -rf /etc/yum.repos.d/CentOS-Base.repo && rm -rf /etc/yum.repos.d/epel.repo
|
||||
# CHECK_COMMAND_NULL cp -r /etc/yum.repos.d/Offends/* /etc/yum.repos.d/
|
||||
}
|
||||
|
||||
|
||||
function ALL(){
|
||||
INSTALL_WGET
|
||||
INIT_DIR
|
||||
}
|
||||
|
||||
ALL
|
||||
5
Docker/Dockerfile/Debain/Dockerfile
Normal file
5
Docker/Dockerfile/Debain/Dockerfile
Normal file
@ -0,0 +1,5 @@
|
||||
FROM scratch
|
||||
|
||||
ADD rootfs.tar.xz /
|
||||
|
||||
CMD /bin/bash
|
||||
10
Docker/Dockerfile/Debain/README.md
Normal file
10
Docker/Dockerfile/Debain/README.md
Normal file
@ -0,0 +1,10 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Debain 镜像构建
|
||||
|
||||
```bash
|
||||
./build.sh
|
||||
```
|
||||
|
||||
48
Docker/Dockerfile/Debain/build.sh
Executable file
48
Docker/Dockerfile/Debain/build.sh
Executable file
@ -0,0 +1,48 @@
|
||||
#!/bin/bash
|
||||
|
||||
#############################################################################################
|
||||
# 用途: 构建 Debian 系统 Docker 镜像的脚本
|
||||
# 作者: 丁辉
|
||||
# 编写时间: 2023-11-27
|
||||
#############################################################################################
|
||||
|
||||
# 镜像地址
|
||||
# https://docker.debian.net/
|
||||
|
||||
ROOTFS="https://github.com/debuerreotype/docker-debian-artifacts/raw"
|
||||
|
||||
VERSION="1f1e36af44a355418661956f15e39f5b04b848b6"
|
||||
|
||||
FILE="stable/rootfs.tar.xz"
|
||||
|
||||
DEBAIN=$ROOTFS/$VERSION/$FILE
|
||||
|
||||
# 加载检测脚本
|
||||
source <(curl -sS https://gitee.com/offends/Linux/raw/main/File/Shell/Check_command.sh)
|
||||
|
||||
function INSTALL_WGET(){
|
||||
CHECK_INSTALL wget
|
||||
}
|
||||
|
||||
function INSTALL(){
|
||||
SEND_INFO "正在下载资源文件,请稍等..."
|
||||
CHECK_COMMAND_NULL wget $DEBAIN
|
||||
BUILD
|
||||
}
|
||||
|
||||
# 构建 Debian 系统
|
||||
function BUILD(){
|
||||
CHECK_FILE "rootfs.tar.xz"
|
||||
SEND_INFO "正在构建 Debian 系统,请稍等..."
|
||||
CHECK_COMMAND_NULL docker import rootfs.tar.xz debian:stable
|
||||
# docker build -t debian:stable .
|
||||
CHECK_COMMAND_NULL rm -rf rootfs.tar.xz
|
||||
SEND_INFO "构建完成,镜像名称: debian:stable"
|
||||
}
|
||||
|
||||
function ALL(){
|
||||
INSTALL_WGET
|
||||
INSTALL
|
||||
}
|
||||
|
||||
ALL
|
||||
5
Docker/Dockerfile/Drone-Images/Dockerfile-git
Normal file
5
Docker/Dockerfile/Drone-Images/Dockerfile-git
Normal file
@ -0,0 +1,5 @@
|
||||
FROM alpine/git
|
||||
|
||||
LABEL maintainer="Offends <offends4@163.com>"
|
||||
|
||||
RUN apk add --no-cache bash
|
||||
10
Docker/Dockerfile/Drone-Images/Dockerfile-minio
Normal file
10
Docker/Dockerfile/Drone-Images/Dockerfile-minio
Normal file
@ -0,0 +1,10 @@
|
||||
FROM alpine:latest
|
||||
|
||||
LABEL maintainer="Offends <offends4@163.com>"
|
||||
|
||||
COPY ./mc.sh .
|
||||
|
||||
RUN apk add --no-cache --virtual .build-deps \
|
||||
curl \
|
||||
&& sh ./mc.sh \
|
||||
&& apk del .build-deps
|
||||
11
Docker/Dockerfile/Drone-Images/Dockerfile-oss
Normal file
11
Docker/Dockerfile/Drone-Images/Dockerfile-oss
Normal file
@ -0,0 +1,11 @@
|
||||
FROM alpine:latest
|
||||
|
||||
LABEL maintainer="Offends <offends4@163.com>"
|
||||
|
||||
RUN apk add --no-cache --virtual .build-deps \
|
||||
unzip \
|
||||
bash \
|
||||
curl \
|
||||
&& curl -O https://gosspublic.alicdn.com/ossutil/install.sh \
|
||||
&& bash install.sh && rm -rf install.sh \
|
||||
&& apk del .build-deps
|
||||
14
Docker/Dockerfile/Drone-Images/README.md
Normal file
14
Docker/Dockerfile/Drone-Images/README.md
Normal file
@ -0,0 +1,14 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Drone 基础镜像构建
|
||||
|
||||
> Dockerfile示例
|
||||
|
||||
| 文件名 | 镜像功能 | 构建示例 |
|
||||
| :--------------: | :-------------------------: | :-----------------------------------------------: |
|
||||
| Dockerfile-git | 最小化 Git 容器 | docker build -t 镜像名:标签 -f Dockerfile-git . |
|
||||
| Dockerfile-minio | 容器内自带 Minio 客户端命令 | docker build -t 镜像名:标签 -f Dockerfile-minio . |
|
||||
| Dockerfile-oss | 容器内自带 oss 客户端命令 | docker build -t 镜像名:标签 -f Dockerfile-oss . |
|
||||
|
||||
25
Docker/Dockerfile/Drone-Images/mc.sh
Executable file
25
Docker/Dockerfile/Drone-Images/mc.sh
Executable file
@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
|
||||
#############################################################################################
|
||||
# 用途: 部署 MinIO 客户端工具 mc
|
||||
# 作者: 丁辉
|
||||
# 编写时间: 2024-02-14
|
||||
#############################################################################################
|
||||
|
||||
# 判断系统架构
|
||||
if [ $(arch) = "x86_64" ] || [ $(arch) = "amd64" ]; then
|
||||
ARCH_TYPE=linux-amd64
|
||||
elif [ $(arch) = "aarch64" ] || [ $(arch) = "arm64" ]; then
|
||||
ARCH_TYPE=linux-arm64
|
||||
else
|
||||
echo "无法识别的系统架构: $(arch)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 变量定义
|
||||
URL="https://dl.min.io/client/mc/release/$ARCH_TYPE"
|
||||
|
||||
# 下载文件
|
||||
curl -so /usr/local/bin/mc https://dl.min.io/client/mc/release/linux-amd64/mc
|
||||
# 添加执行权限
|
||||
chmod 777 /usr/local/bin/mc
|
||||
3
Docker/Dockerfile/Fio/Dockerfile
Normal file
3
Docker/Dockerfile/Fio/Dockerfile
Normal file
@ -0,0 +1,3 @@
|
||||
FROM alpine:latest
|
||||
|
||||
RUN apk add fio
|
||||
7
Docker/Dockerfile/Fio/README.md
Normal file
7
Docker/Dockerfile/Fio/README.md
Normal file
@ -0,0 +1,7 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Fio
|
||||
|
||||
> 此应用于磁盘读写性能测试
|
||||
128
Docker/Dockerfile/Frp/.drone.yml
Normal file
128
Docker/Dockerfile/Frp/.drone.yml
Normal file
@ -0,0 +1,128 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Build Frps
|
||||
|
||||
# 手动触发或接口触发
|
||||
trigger:
|
||||
event:
|
||||
- custom
|
||||
|
||||
# 指定架构,需在 runner 配置环境变量中指定 DRONE_RUNNER_ARCH,或自动获取
|
||||
platform:
|
||||
os: linux
|
||||
arch: amd64
|
||||
|
||||
# 指定运行环境节点,需在 runner 配置环境变量中指定 DRONE_RUNNER_LABELS
|
||||
node:
|
||||
City: abroad
|
||||
|
||||
# 使用插件构建镜像
|
||||
steps:
|
||||
- name: Build Frps
|
||||
image: plugins/docker
|
||||
# 仅当本地不存在该镜像时才拉取
|
||||
pull: if-not-exists
|
||||
settings:
|
||||
registry:
|
||||
from_secret: REGISTRY
|
||||
username:
|
||||
from_secret: DOCKER_USERNAME
|
||||
password:
|
||||
from_secret: DOCKER_PASSWORD
|
||||
repo:
|
||||
from_secret: REPO
|
||||
# 是否禁止推送镜像
|
||||
dry_run: false
|
||||
tags:
|
||||
- frps
|
||||
# 要使用的上下文路径，默认为 git 存储库的根目录
|
||||
context: ./frps
|
||||
# 要使用的 dockerfile 路径，默认为 git 存储库的根目录
|
||||
dockerfile: ./frps/Dockerfile
|
||||
when:
|
||||
branch:
|
||||
- main
|
||||
---
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Build Frpc
|
||||
|
||||
# 手动触发或接口触发
|
||||
trigger:
|
||||
event:
|
||||
- custom
|
||||
|
||||
# 指定架构,需在 runner 配置环境变量中指定 DRONE_RUNNER_ARCH,或自动获取
|
||||
platform:
|
||||
os: linux
|
||||
arch: amd64
|
||||
|
||||
# 指定运行环境节点,需在 runner 配置环境变量中指定 DRONE_RUNNER_LABELS
|
||||
node:
|
||||
City: abroad
|
||||
|
||||
# 使用插件构建镜像
|
||||
steps:
|
||||
- name: Build Frpc
|
||||
image: plugins/docker
|
||||
# 仅当本地不存在该镜像时才拉取
|
||||
pull: if-not-exists
|
||||
settings:
|
||||
registry:
|
||||
from_secret: REGISTRY
|
||||
username:
|
||||
from_secret: DOCKER_USERNAME
|
||||
password:
|
||||
from_secret: DOCKER_PASSWORD
|
||||
repo:
|
||||
from_secret: REPO
|
||||
# 是否禁止推送镜像
|
||||
dry_run: false
|
||||
tags:
|
||||
- frpc
|
||||
# 要使用的上下文路径，默认为 git 存储库的根目录
|
||||
context: ./frpc
|
||||
# 要使用的 dockerfile 路径，默认为 git 存储库的根目录
|
||||
dockerfile: ./frpc/Dockerfile
|
||||
when:
|
||||
branch:
|
||||
- main
|
||||
---
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: Sync Ipsec Vpn Image
|
||||
|
||||
trigger:
|
||||
event:
|
||||
include:
|
||||
- custom
|
||||
|
||||
# 指定运行环境节点,需在 runner 配置环境变量中指定 DRONE_RUNNER_LABELS
|
||||
node:
|
||||
City: abroad
|
||||
|
||||
steps:
|
||||
- name: Sync Ipsec Vpn Image
|
||||
image: docker:dind
|
||||
volumes:
|
||||
- name: dockersock
|
||||
path: /var/run/docker.sock
|
||||
environment:
|
||||
DOCKER_USERNAME:
|
||||
from_secret: DOCKER_USERNAME
|
||||
DOCKER_PASSWORD:
|
||||
from_secret: DOCKER_PASSWORD
|
||||
REGISTRY:
|
||||
from_secret: REGISTRY
|
||||
REPO:
|
||||
from_secret: REPO
|
||||
commands:
|
||||
- docker pull hwdsl2/ipsec-vpn-server
|
||||
- docker login $REGISTRY -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
|
||||
- docker tag hwdsl2/ipsec-vpn-server $REPO:ipsec-vpn-server
|
||||
- docker push $REPO:ipsec-vpn-server
|
||||
|
||||
volumes:
|
||||
- name: dockersock
|
||||
host:
|
||||
path: /var/run/docker.sock
|
||||
13
Docker/Dockerfile/Frp/Drone构建参数解释.md
Normal file
13
Docker/Dockerfile/Frp/Drone构建参数解释.md
Normal file
@ -0,0 +1,13 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
## Drone构建参数解释
|
||||
|
||||
| 变量名 | 变量值 | 备注 |
|
||||
| :-------------: | :---------------------------------------------------: | :------------: |
|
||||
| DOCKER_USERNAME | | 镜像仓库账号 |
|
||||
| DOCKER_PASSWORD | | 镜像仓库密码 |
|
||||
| REGISTRY | registry.cn-hangzhou.aliyuncs.com | 镜像仓库地址 |
|
||||
| REPO | registry.cn-hangzhou.aliyuncs.com/<命名空间>/<镜像名> | 镜像的仓库名称 |
|
||||
|
||||
27
Docker/Dockerfile/Frp/frpc/Dockerfile
Normal file
27
Docker/Dockerfile/Frp/frpc/Dockerfile
Normal file
@ -0,0 +1,27 @@
|
||||
FROM alpine:latest
|
||||
|
||||
LABEL maintainer="Offends <offends4@163.com>"
|
||||
|
||||
ARG VERSION_ARG
|
||||
|
||||
ENV VERSION=${VERSION_ARG:-0.53.2}
|
||||
|
||||
RUN if [ $(arch) = "x86_64" ] || [ $(arch) = "amd64" ]; then \
|
||||
ARCH_TYPE="amd64"; \
|
||||
elif [ $(arch) = "aarch64" ] || [ $(arch) = "arm64" ]; then \
|
||||
ARCH_TYPE="arm"; \
|
||||
else \
|
||||
ARCH_TYPE="amd64"; \
|
||||
fi \
|
||||
&& wget https://github.com/fatedier/frp/releases/download/v${VERSION}/frp_${VERSION}_linux_${ARCH_TYPE}.tar.gz \
|
||||
&& tar -zvxf frp_${VERSION}_linux_${ARCH_TYPE}.tar.gz \
|
||||
&& cp -r frp_${VERSION}_linux_${ARCH_TYPE} frp \
|
||||
&& mv /frp/frpc /usr/local/bin/ \
|
||||
&& rm -rf /frp/frps* /frp/LICENSE \
|
||||
&& rm -rf /frp_${VERSION}_linux_${ARCH_TYPE}*
|
||||
|
||||
COPY ./frpc.ini /frp/frpc.ini
|
||||
|
||||
WORKDIR /frp
|
||||
|
||||
CMD /usr/local/bin/frpc -c /frp/frpc.ini
|
||||
24
Docker/Dockerfile/Frp/frpc/README.md
Normal file
24
Docker/Dockerfile/Frp/frpc/README.md
Normal file
@ -0,0 +1,24 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# **Frpc内网穿透**
|
||||
|
||||
> Frpc 为内网穿透客户端
|
||||
>
|
||||
|
||||
## Docker构建
|
||||
|
||||
构建镜像
|
||||
|
||||
> 默认构建 0.53.2 版本
|
||||
|
||||
```bash
|
||||
docker build -t registry.cn-hangzhou.aliyuncs.com/offends/frp:frpc .
|
||||
```
|
||||
|
||||
> 手动选择构建版本
|
||||
|
||||
```bash
|
||||
docker build --build-arg VERSION_ARG=0.53.2 -t registry.cn-hangzhou.aliyuncs.com/offends/frp:frpc .
|
||||
```
|
||||
8
Docker/Dockerfile/Frp/frpc/frpc.bat
Normal file
8
Docker/Dockerfile/Frp/frpc/frpc.bat
Normal file
@ -0,0 +1,8 @@
|
||||
@echo off
|
||||
if "%1" == "h" goto begin
|
||||
mshta vbscript:createobject("wscript.shell").run("""%~nx0"" h",0)(window.close)&&exit
|
||||
:begin
|
||||
REM
|
||||
cd C:\frpc
|
||||
frpc -c frpc.ini
|
||||
exit
|
||||
30
Docker/Dockerfile/Frp/frpc/frpc.ini
Normal file
30
Docker/Dockerfile/Frp/frpc/frpc.ini
Normal file
@ -0,0 +1,30 @@
|
||||
[common]
|
||||
server_addr = {{ .Envs.FRP_SERVER_ADDR }}
|
||||
server_port = 7000
|
||||
token = 12345678
|
||||
|
||||
[windows]
|
||||
type = tcp
|
||||
local_ip = {{ .Envs.FRP_WINDOWS_IP }}
|
||||
local_port = {{ .Envs.FRP_WINDOWS_PORT }}
|
||||
remote_port = 3389
|
||||
|
||||
#liunx tcp 端口写法
|
||||
; [liunx]
|
||||
; type = tcp
|
||||
; local_ip = 127.0.0.1
|
||||
; local_port = 22
|
||||
; remote_port = 22
|
||||
|
||||
#esxi 端口写法
|
||||
; [esxi-web]
|
||||
; type = tcp
|
||||
; local_ip = {{ .Envs.FRP_ESXI_WEB__ADDR }}
|
||||
; local_port = 443
|
||||
; remote_port = 20000
|
||||
|
||||
; [esxi-902]
|
||||
; type = tcp
|
||||
; local_ip = {{ .Envs.FRP_ESXI_VSPHERE_API_ADDR }}
|
||||
; local_port = 902
|
||||
; remote_port = 902
|
||||
21
Docker/Dockerfile/Frp/frps/404.html
Normal file
21
Docker/Dockerfile/Frp/frps/404.html
Normal file
@ -0,0 +1,21 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>链接失败</title>
|
||||
<style>
|
||||
body {
|
||||
width: 35em;
|
||||
margin: 0 auto;
|
||||
font-family: Tahoma, Verdana, Arial, sans-serif;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>请联系管理人员 Mr .Ding</h1>
|
||||
<p>实在抱歉一定要抓紧联系(家里停电｜屋子着火｜----).<br/>
|
||||
请一定要联系我.</p>
|
||||
<p>我需要知道家里的状况 <a>哈哈</a>.</p>
|
||||
<p><em>感谢您的配合.</em></p>
|
||||
</body>
|
||||
</html>
|
||||
35
Docker/Dockerfile/Frp/frps/Dockerfile
Normal file
35
Docker/Dockerfile/Frp/frps/Dockerfile
Normal file
@ -0,0 +1,35 @@
|
||||
FROM alpine:latest
|
||||
|
||||
LABEL maintainer="Offends <offends4@163.com>"
|
||||
|
||||
ARG VERSION_ARG
|
||||
|
||||
ENV VERSION=${VERSION_ARG:-0.53.2}
|
||||
|
||||
RUN if [ $(arch) = "x86_64" ] || [ $(arch) = "amd64" ]; then \
|
||||
ARCH_TYPE="amd64"; \
|
||||
elif [ $(arch) = "aarch64" ] || [ $(arch) = "arm64" ]; then \
|
||||
ARCH_TYPE="arm"; \
|
||||
else \
|
||||
ARCH_TYPE="amd64"; \
|
||||
fi \
|
||||
&& wget https://github.com/fatedier/frp/releases/download/v${VERSION}/frp_${VERSION}_linux_${ARCH_TYPE}.tar.gz \
|
||||
&& tar -zvxf frp_${VERSION}_linux_${ARCH_TYPE}.tar.gz \
|
||||
&& cp -r frp_${VERSION}_linux_${ARCH_TYPE} frp \
|
||||
&& mv /frp/frps /usr/local/bin/ \
|
||||
&& rm -rf /frp/frpc* /frp/LICENSE \
|
||||
&& rm -rf /frp_${VERSION}_linux_${ARCH_TYPE}*
|
||||
|
||||
COPY ./frps.ini /frp/frps.ini
|
||||
|
||||
COPY ./404.html /frp/404.html
|
||||
|
||||
WORKDIR /frp
|
||||
|
||||
#客户端连接端口
|
||||
EXPOSE 7000
|
||||
|
||||
#frp Web端
|
||||
EXPOSE 7500
|
||||
|
||||
CMD /usr/local/bin/frps -c /frp/frps.ini
|
||||
23
Docker/Dockerfile/Frp/frps/README.md
Normal file
23
Docker/Dockerfile/Frp/frps/README.md
Normal file
@ -0,0 +1,23 @@
|
||||
*
|
||||
|
||||
> 本文作者：丁辉
|
||||
|
||||
# **Frps内网穿透**
|
||||
|
||||
> Frps为内网穿透服务端
|
||||
|
||||
## Docker构建
|
||||
|
||||
构建镜像
|
||||
|
||||
> 默认构建 0.53.2 版本
|
||||
|
||||
```bash
|
||||
docker build -t registry.cn-hangzhou.aliyuncs.com/offends/frp:frps .
|
||||
```
|
||||
|
||||
> 手动选择构建版本
|
||||
|
||||
```bash
|
||||
docker build --build-arg VERSION_ARG=0.53.2 -t registry.cn-hangzhou.aliyuncs.com/offends/frp:frps .
|
||||
```
|
||||
10
Docker/Dockerfile/Frp/frps/frps.ini
Normal file
10
Docker/Dockerfile/Frp/frps/frps.ini
Normal file
@ -0,0 +1,10 @@
|
||||
[common]
|
||||
bind_port = 7000
|
||||
dashboard_port = 7500
|
||||
token = 12345678
|
||||
dashboard_user = admin
|
||||
dashboard_pwd = admin
|
||||
#vhost_http_port = 80
|
||||
#vhost_https_port = 443
|
||||
custom_404_page = /frp/404.html
|
||||
max_pool_count = 5
|
||||
20
Docker/Dockerfile/Mysql/Dockerfile
Normal file
20
Docker/Dockerfile/Mysql/Dockerfile
Normal file
@ -0,0 +1,20 @@
|
||||
FROM mysql:5.7
|
||||
# FROM mysql:8
|
||||
|
||||
ENV MYSQL_USER=demo \
|
||||
MYSQL_PASSWORD=demo \
|
||||
MYSQL_DATABASE=demo \
|
||||
MYSQL_ROOT_PASSWORD=root
|
||||
|
||||
COPY ./sql/* /docker-entrypoint-initdb.d/
|
||||
|
||||
# 更改配置文件
|
||||
#COPY ./my.cnf /etc/my.cnf
|
||||
|
||||
CMD ["mysqld", "--character-set-server=utf8mb4", "--collation-server=utf8mb4_unicode_ci"]
|
||||
|
||||
# 旧加密方式
|
||||
# --default-authentication-plugin=mysql_native_password
|
||||
# 是一种基本的身份验证插件，它使用经典的 MySQL 加密方法来存储和验证用户的密码。这意味着用户的密码以散列形式存储在数据库中，而在用户登录时，其密码将与存储的散列进行比较。
|
||||
# 新加密方式
|
||||
# --default-authentication-plugin=caching_sha2_password
|
||||
14
Docker/Dockerfile/Mysql/Dockerfile-secrets
Normal file
14
Docker/Dockerfile/Mysql/Dockerfile-secrets
Normal file
@ -0,0 +1,14 @@
|
||||
FROM mysql:5.7
|
||||
# FROM mysql:8
|
||||
|
||||
ENV MYSQL_ROOT_PASSWORD_FILE=/run/secrets/mysql-root-pass \
|
||||
MYSQL_USER=demo \
|
||||
MYSQL_DATABASE=demo \
|
||||
MYSQL_PASSWORD_FILE=/run/secrets/mysql-demo-pass
|
||||
|
||||
COPY ./sql/* /docker-entrypoint-initdb.d/
|
||||
|
||||
# 更改配置文件
|
||||
#COPY ./my.cnf /etc/my.cnf
|
||||
|
||||
CMD ["mysqld", "--character-set-server=utf8mb4", "--collation-server=utf8mb4_unicode_ci"]
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user