本記事はCentOS 7.6にDocker CE(Community Edition)のインストールし、コンテナを実行するまでの流れをまとめたものです。
CentOS 7.6はOSインストール後から何も設定していない状態です。
本環境構築日は 2019/3/15 です。
※知見無く、備忘録としての記載のため、誤りある可能性がありますことご留意くださいm(__)m
構築環境について
OS : CentOS 7.6 on VMware Player
[root@machipon23-docker ~]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
[root@machipon23-docker ~]# uname -r
3.10.0-957.el7.x86_64
docker : 18.09.3
[root@machipon23-docker ~]# docker --version
Docker version 18.09.3, build 774a1f4
[root@machipon23-docker ~]# docker version
Client:
Version: 18.09.3
API version: 1.39
Go version: go1.10.8
Git commit: 774a1f4
Built: Thu Feb 28 06:33:21 2019
OS/Arch: linux/amd64
Experimental: false
Server: Docker Engine - Community
Engine:
Version: 18.09.3
API version: 1.39 (minimum version 1.12)
Go version: go1.10.8
Git commit: 774a1f4
Built: Thu Feb 28 06:02:24 2019
OS/Arch: linux/amd64
Experimental: false
参考サイト
・docker docs
https://docs.docker.com/install/linux/docker-ce/centos/
https://docs.docker.com/install/linux/linux-postinstall/
インストール前準備
以下の要件を満たす必要があります。
- centos-extras リポジトリ有効化
⇒ デフォルトで有効化されている - overlay2 storage driver 使用推奨
⇒ デフォルトで overlay カーネルモジュールが存在している。
また、デフォルトでoverlay2ドライバが適用される
centos-extras リポジトリ有効化確認
[root@machipon23-docker ~]# yum repolist
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: ftp.iij.ad.jp
* extras: ftp.iij.ad.jp
* updates: ftp.iij.ad.jp
repo id repo name status
base/7/x86_64 CentOS-7 - Base 10,019
extras/7/x86_64 CentOS-7 - Extras 371
updates/7/x86_64 CentOS-7 - Updates 1,163
repolist: 11,553
overlay カーネルモジュール存在確認
[root@machipon23-docker ~]# lsmod | grep overlay
overlay 71964 0
[root@machipon23-docker ~]# modinfo overlay
filename: /lib/modules/3.10.0-957.el7.x86_64/kernel/fs/overlayfs/overlay.ko.xz
alias: fs-overlay
license: GPL
description: Overlay filesystem
author: Miklos Szeredi <miklos@szeredi.hu>
retpoline: Y
rhelversion: 7.6
srcversion: 1CF79904F61F2BFDF6F89EC
depends:
intree: Y
vermagic: 3.10.0-957.el7.x86_64 SMP mod_unload modversions
signer: CentOS Linux kernel signing key
sig_key: B7:0D:CF:0D:F2:D9:B7:F2:91:59:24:82:49:FD:6F:E8:7B:78:14:27
sig_hashalgo: sha256
parm: check_copy_up:uint
parm: ovl_check_copy_up:Warn on copy-up when causing process also has a R/O fd open
parm: redirect_max:ushort
parm: ovl_redirect_max:Maximum length of absolute redirect xattr value
parm: redirect_dir:bool
parm: ovl_redirect_dir_def:Default to on or off for the redirect_dir feature
parm: redirect_always_follow:bool
parm: ovl_redirect_always_follow:Follow redirects even if redirect_dir feature is turned off
parm: index:bool
parm: ovl_index_def:Default to on or off for the inodes index feature
⇒ overlay モジュールが存在しないと、docker サービスの起動ができません。
bridge情報を確認するためにインストール(実施する必要はない)
[root@machipon23-docker ~]# yum install -y bridge-utils tcpdump
インストール開始
docker-ce.repoを追加しdocker-ceをインストール
[root@machipon23-docker ~]# yum install -y yum-utils device-mapper-persistent-data lvm2
[root@machipon23-docker ~]# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
[root@machipon23-docker ~]# yum install -y docker-ce docker-ce-cli containerd.io
dockerサービス起動
[root@machipon23-docker ~]# systemctl start docker
[root@machipon23-docker ~]# systemctl enable docker
Created symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.
コンテナ実行
hello-worldコンテナ実行
[root@machipon23-docker ~]# docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
1b930d010525: Pull complete
Digest: sha256:2557e3c07ed1e38f26e389462d03ed943586f744621577a99efb77324b0fe535
Status: Downloaded newer image for hello-world:latest
Hello from Docker!
This message shows that your installation appears to be working correctly.
To generate this message, Docker took the following steps:
1. The Docker client contacted the Docker daemon.
2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
(amd64)
3. The Docker daemon created a new container from that image which runs the
executable that produces the output you are currently reading.
4. The Docker daemon streamed that output to the Docker client, which sent it
to your terminal.
To try something more ambitious, you can run an Ubuntu container with:
$ docker run -it ubuntu bash
Share images, automate workflows, and more with a free Docker ID:
https://hub.docker.com/
For more examples and ideas, visit:
https://docs.docker.com/get-started/
コンテナ確認
[root@machipon23-docker ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
984557c7d945 hello-world "/hello" 3 minutes ago Exited (0) 8 seconds ago jovial_clarke
dockerの全般情報を表示
[root@machipon23-docker ~]# docker info
Containers: 1
Running: 0
Paused: 0
Stopped: 1
Images: 1
Server Version: 18.09.3
Storage Driver: overlay2
Backing Filesystem: xfs
Supports d_type: true
Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: e6b3f5632f50dbc4e9cb6288d911bf4f5e95b18e
runc version: 6635b4f0c6af3810594d2770f662f34ddc15b40d
init version: fec3683
Security Options:
seccomp
Profile: default
Kernel Version: 3.10.0-957.el7.x86_64
Operating System: CentOS Linux 7 (Core)
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 1.934GiB
Name: machipon23-docker
ID: DNQZ:5FEI:BVCN:OKRN:ZNKG:HLSK:JLNO:CLZE:6LJR:KWVQ:JXXD:NSFE
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
Product License: Community Engine
ubuntu コンテナを起動してみる
イメージが存在しないため、https://index.docker.io/v1/ からダウンロードされる。
[root@machipon23-docker ~]# docker run -it ubuntu bash
Unable to find image 'ubuntu:latest' locally
latest: Pulling from library/ubuntu
Status: Downloaded newer image for ubuntu:latest
自動起動するためログアウトする
root@365bda9f414d:/# root@365bda9f414d:/# ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 5.2 0.0 18496 2012 pts/0 Ss 16:04 0:00 bash
root 11 0.0 0.0 34388 1456 pts/0 R+ 16:04 0:00 ps aux
root@365bda9f414d:/# exit
ログアウトすると、コンテナは停止状態になります。
[root@machipon23-docker ~]# docker container ls --all
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
365bda9f414d ubuntu "bash" 29 seconds ago Exited (0) 9 seconds ago serene_bell
984557c7d945 hello-world "/hello" 5 minutes ago Exited (0) 2 minutes ago jovial_clarke
[root@machipon23-docker ~]# docker image ls
REPOSITORY TAG IMAGE ID CREATED SIZE
ubuntu latest 94e814e2efa8 3 days ago 88.9MB
hello-world latest fce289e99eb9 2 months ago 1.84kB
ログアウト後も起動状態にしておきたい場合はバックグラウンド(-dオプション)で起動する必要がある
[root@machipon23-docker ~]# docker run -itd centos bash
[root@machipon23-docker ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4ae1371a0f98 centos "bash" 28 seconds ago Up 27 seconds recursing_albattani
4a62398eadd6 ubuntu "bash" 15 minutes ago Exited (0) About a minute ago happy_engelbart
8a28bb1c5c01 ubuntu "bash" 8 hours ago Exited (0) About an hour ago frosty_mendel
26d3abc8ab66 hello-world "/hello" 8 hours ago Exited (0) 8 hours ago nifty_murdock
[root@machipon23-docker ~]# docker exec -it 4ae1371a0f98 bash
[root@4ae1371a0f98 /]# exit
[root@machipon23-docker ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4ae1371a0f98 centos "bash" 2 minutes ago Up 2 minutes recursing_albattani
4a62398eadd6 ubuntu "bash" 17 minutes ago Exited (0) 3 minutes ago happy_engelbart
8a28bb1c5c01 ubuntu "bash" 8 hours ago Exited (0) About an hour ago frosty_mendel
26d3abc8ab66 hello-world "/hello" 8 hours ago Exited (0) 8 hours ago nifty_murdock
インストールは以上となります。
とても簡単ですね！
docker構築前と構築後のOS差分について
パッケージインストール後に変更される項目
グループは追加されるけど、ユーザは何も追加されない
[root@machipon23-docker ~]# tail /etc/group
cgred:x:996:
docker:x:995:
[root@machipon23-docker ~]# egrep '995|996' /etc/passwd
dockerサービス起動後に変更される項目
iptables に IPマスカレード等が設定されます。
[root@machipon23-docker ~]# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DOCKER all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DOCKER all -- 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 0.0.0.0/0
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
IPマスカレード有効化するために 0 から 1 に変更されています。
[root@machipon23-docker ~]# cat /proc/sys/net/ipv4/ip_forward
1
docker0 ブリッジが設定されています。コンテナを起動すると docker0 ブリッジに veth が接続されます。
[root@machipon23-docker ~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.02427f4e027f no
・コンテナ起動後
[root@machipon23-docker ~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.02429b7b62fd no vethc610beb
vethfa78fc2
以下のカーネルパラメータが変更されていました。
"<"がdocker構築前、">"がdocker構築後パラメータ
< fs.dentry-state = 35619 19953 45 0 0 0
---
> fs.dentry-state = 77806 56614 45 0 0 0
< fs.file-nr = 1152 0 197426
< fs.inode-nr = 29550 317
< fs.inode-state = 29550 317 0 0 0 0 0
---
> fs.file-nr = 1216 0 197426
> fs.inode-nr = 38805 302
> fs.inode-state = 38805 302 0 0 0 0 0
< fs.may_detach_mounts = 0
---
> fs.may_detach_mounts = 1
< kernel.ns_last_pid = 15060
---
> kernel.ns_last_pid = 15551
< kernel.random.entropy_avail = 771
---
> kernel.random.entropy_avail = 992
< kernel.random.uuid = c9f802f9-7012-457e-92e8-bfcda9aa0ebb
---
> kernel.random.uuid = bd770926-b945-463d-b7d3-92bb9be1e8b9
< kernel.sched_domain.cpu0.domain0.max_newidle_lb_cost = 49006
---
> kernel.sched_domain.cpu0.domain0.max_newidle_lb_cost = 355932
< kernel.sched_domain.cpu1.domain0.max_newidle_lb_cost = 20214
---
> kernel.sched_domain.cpu1.domain0.max_newidle_lb_cost = 45446
< kernel.tainted = 0
---
> kernel.tainted = 536870912
< net.ipv4.conf.all.accept_redirects = 1
---
> net.ipv4.conf.all.accept_redirects = 0
291c297
< net.ipv4.conf.all.forwarding = 0
---
> net.ipv4.conf.all.forwarding = 1
317c323
< net.ipv4.conf.default.forwarding = 0
---
> net.ipv4.conf.default.forwarding = 1
330a337,362
< net.ipv4.conf.ens33.forwarding = 0
---
> net.ipv4.conf.ens33.forwarding = 1
369c401
< net.ipv4.conf.lo.forwarding = 0
---
> net.ipv4.conf.lo.forwarding = 1
402c434
< net.ipv4.ip_forward = 0
---
> net.ipv4.ip_forward = 1
429a462,474
< net.netfilter.nf_conntrack_count = 41
---
> net.netfilter.nf_conntrack_count = 48
> net.ipv4.conf.docker0.accept_local = 0
> net.ipv4.conf.docker0.accept_redirects = 1
> net.ipv4.conf.docker0.accept_source_route = 0
> net.ipv4.conf.docker0.arp_accept = 0
> net.ipv4.conf.docker0.arp_announce = 0
> net.ipv4.conf.docker0.arp_filter = 0
> net.ipv4.conf.docker0.arp_ignore = 0
> net.ipv4.conf.docker0.arp_notify = 0
> net.ipv4.conf.docker0.bootp_relay = 0
> net.ipv4.conf.docker0.disable_policy = 0
> net.ipv4.conf.docker0.disable_xfrm = 0
> net.ipv4.conf.docker0.force_igmp_version = 0
> net.ipv4.conf.docker0.forwarding = 1
> net.ipv4.conf.docker0.log_martians = 0
> net.ipv4.conf.docker0.mc_forwarding = 0
> net.ipv4.conf.docker0.medium_id = 0
> net.ipv4.conf.docker0.promote_secondaries = 1
> net.ipv4.conf.docker0.proxy_arp = 0
> net.ipv4.conf.docker0.proxy_arp_pvlan = 0
> net.ipv4.conf.docker0.route_localnet = 0
> net.ipv4.conf.docker0.rp_filter = 1
> net.ipv4.conf.docker0.secure_redirects = 1
> net.ipv4.conf.docker0.send_redirects = 1
> net.ipv4.conf.docker0.shared_media = 1
> net.ipv4.conf.docker0.src_valid_mark = 0
> net.ipv4.conf.docker0.tag = 0
> net.ipv4.neigh.docker0.anycast_delay = 100
> net.ipv4.neigh.docker0.app_solicit = 0
> net.ipv4.neigh.docker0.base_reachable_time_ms = 30000
> net.ipv4.neigh.docker0.delay_first_probe_time = 5
> net.ipv4.neigh.docker0.gc_stale_time = 60
> net.ipv4.neigh.docker0.locktime = 100
> net.ipv4.neigh.docker0.mcast_solicit = 3
> net.ipv4.neigh.docker0.proxy_delay = 80
> net.ipv4.neigh.docker0.proxy_qlen = 64
> net.ipv4.neigh.docker0.retrans_time_ms = 1000
> net.ipv4.neigh.docker0.ucast_solicit = 3
> net.ipv4.neigh.docker0.unres_qlen = 31
> net.ipv4.neigh.docker0.unres_qlen_bytes = 65536
> net.ipv6.conf.docker0.accept_dad = 1
> net.ipv6.conf.docker0.accept_ra = 1
> net.ipv6.conf.docker0.accept_ra_defrtr = 1
> net.ipv6.conf.docker0.accept_ra_pinfo = 1
> net.ipv6.conf.docker0.accept_ra_rt_info_max_plen = 0
> net.ipv6.conf.docker0.accept_ra_rtr_pref = 1
> net.ipv6.conf.docker0.accept_redirects = 1
> net.ipv6.conf.docker0.accept_source_route = 0
> net.ipv6.conf.docker0.autoconf = 1
> net.ipv6.conf.docker0.dad_transmits = 1
> net.ipv6.conf.docker0.disable_ipv6 = 0
> net.ipv6.conf.docker0.enhanced_dad = 1
> net.ipv6.conf.docker0.force_mld_version = 0
> net.ipv6.conf.docker0.force_tllao = 0
> net.ipv6.conf.docker0.forwarding = 0
> net.ipv6.conf.docker0.hop_limit = 64
> net.ipv6.conf.docker0.keep_addr_on_down = 0
> net.ipv6.conf.docker0.max_addresses = 16
> net.ipv6.conf.docker0.max_desync_factor = 600
> net.ipv6.conf.docker0.mc_forwarding = 0
> net.ipv6.conf.docker0.mldv1_unsolicited_report_interval = 10000
> net.ipv6.conf.docker0.mldv2_unsolicited_report_interval = 1000
> net.ipv6.conf.docker0.mtu = 1500
> net.ipv6.conf.docker0.ndisc_notify = 0
> net.ipv6.conf.docker0.optimistic_dad = 0
> net.ipv6.conf.docker0.proxy_ndp = 0
> net.ipv6.conf.docker0.regen_max_retry = 3
> net.ipv6.conf.docker0.router_probe_interval = 60
> net.ipv6.conf.docker0.router_solicitation_delay = 1
> net.ipv6.conf.docker0.router_solicitation_interval = 4
> net.ipv6.conf.docker0.router_solicitations = 3
> net.ipv6.conf.docker0.temp_prefered_lft = 86400
> net.ipv6.conf.docker0.temp_valid_lft = 604800
> net.ipv6.conf.docker0.use_optimistic = 0
> net.ipv6.conf.docker0.use_tempaddr = 0
> net.ipv6.neigh.docker0.anycast_delay = 100
> net.ipv6.neigh.docker0.app_solicit = 0
> net.ipv6.neigh.docker0.base_reachable_time_ms = 30000
> net.ipv6.neigh.docker0.delay_first_probe_time = 5
> net.ipv6.neigh.docker0.gc_stale_time = 60
> net.ipv6.neigh.docker0.locktime = 0
> net.ipv6.neigh.docker0.mcast_solicit = 3
> net.ipv6.neigh.docker0.proxy_delay = 80
> net.ipv6.neigh.docker0.proxy_qlen = 64
> net.ipv6.neigh.docker0.retrans_time_ms = 1000
> net.ipv6.neigh.docker0.ucast_solicit = 3
> net.ipv6.neigh.docker0.unres_qlen = 31
> net.ipv6.neigh.docker0.unres_qlen_bytes = 65536
> net.bridge.bridge-nf-call-arptables = 1
> net.bridge.bridge-nf-call-ip6tables = 1
> net.bridge.bridge-nf-call-iptables = 1
> net.bridge.bridge-nf-filter-pppoe-tagged = 0
> net.bridge.bridge-nf-filter-vlan-tagged = 0
> net.bridge.bridge-nf-pass-vlan-input-dev = 0
以上