From 30e251902861c118e7e250864ff6d9bdedcb9e18 Mon Sep 17 00:00:00 2001 From: eleutherius Date: Thu, 19 Jul 2018 00:43:03 +0300 Subject: [PATCH 1/9] =?UTF-8?q?=09=D0=BD=D0=BE=D0=B2=D1=8B=D0=B9=20=D1=84?= =?UTF-8?q?=D0=B0=D0=B9=D0=BB:=20=20=20=20ru/README.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ru/README.md | 815 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 815 insertions(+) create mode 100644 ru/README.md diff --git a/ru/README.md b/ru/README.md new file mode 100644 index 0000000..a481abb --- /dev/null +++ b/ru/README.md @@ -0,0 +1,815 @@ +# Docker Cheat Sheet + +**Want to improve this cheat sheet? See the [Contributing](#contributing) section!** + +## Содержание + +* [Почему Docker](#why-docker) +* [Предпосылки](#prerequisites) +* [Установка](#installation) +* [Контейнеры](#containers) +* [Образы](#images) +* [Сеть](#networks) +* [Реестр и репозиторий](#registry--repository) +* [Dockerfile](#dockerfile) +* [Слои](#layers) +* [Ссылка](#links) +* [Тома](#volumes) +* [Отображение портов](#exposing-ports) +* [Лучшая практика](#best-practices) +* [Безопасность](#security) +* [Советы](#tips) +* [Содействие](#contributing) + +## Почему Docker + +"С Docker разработчики могут создавать любое приложение на любом языке, используя любую инструментальную цепочку. Приложения помещаются в контейнер - становятся полностью переносимы и могут работать где угодно - на компьютерах под управлением OS X и Windows, серверах QA, работающих под управлением Ubuntu в облаке, и виртуальных машинах производственного центра обработки данных Red Hat. + +Разработчики могут быстро начать работу, начиная с одного из 13 000 приложений, доступных на Docker Hub. Docker управляет и отслеживает изменения и зависимости, что облегчает для системных администраторов понимание того, как работают приложения, созданные разработчиками. И с Docker Hub разработчики могут автоматизировать свой процес сборки и совместно использовать артефакты с сотрудниками через публичные или частные репозитории. + +Docker помогает разработчикам создавать и отправлять более качественные приложения быстрее " -- [Что такое Docker](https://www.docker.com/what-docker#copy1) + +## Предпосылки + +I use [Oh My Zsh](https://github.com/robbyrussell/oh-my-zsh) with the [Docker plugin](https://github.com/robbyrussell/oh-my-zsh/wiki/Plugins#docker) for autocompletion of docker commands. YMMV. + +### Linux + +The 3.10.x kernel is [the minimum requirement](https://docs.docker.com/engine/installation/binaries/#check-kernel-dependencies) for Docker. + +### MacOS + + 10.8 “Mountain Lion” or newer is required. + +## Installation + +### Linux + +Quick and easy install script provided by Docker: + +``` +curl -sSL https://get.docker.com/ | sh +``` + +If you're not willing to run a random shell script, please see the [installation](https://docs.docker.com/engine/installation/linux/) instructions for your distribution. + +If you are a complete Docker newbie, you should follow the [series of tutorials](https://docs.docker.com/engine/getstarted/) now. + +### macOS +Download and install [Docker Community Edition](https://www.docker.com/community-edition). if you have Homebrew-Cask, just type `brew cask install docker`. Or Download and install [Docker Toolbox](https://docs.docker.com/toolbox/overview/). [Docker For Mac](https://docs.docker.com/docker-for-mac/) is nice, but it's not quite as finished as the VirtualBox install. [See the comparison](https://docs.docker.com/docker-for-mac/docker-toolbox/). + +> **NOTE** Docker Toolbox is legacy. you should to use Docker Community Edition, See (Docker Toolbox)[https://docs.docker.com/toolbox/overview/] + +Once you've installed Docker Community Edition, click the docker icon in Launchpad. Then start up a container: + +``` +docker run hello-world +``` + +That's it, you have a running Docker container. + +If you are a complete Docker newbie, you should probably follow the [series of tutorials](https://docs.docker.com/engine/getstarted/) now. + +## Containers + +[Your basic isolated Docker process](http://etherealmind.com/basics-docker-containers-hypervisors-coreos/). Containers are to Virtual Machines as threads are to processes. Or you can think of them as chroots on steroids. + +### Lifecycle + +* [`docker create`](https://docs.docker.com/engine/reference/commandline/create) creates a container but does not start it. +* [`docker rename`](https://docs.docker.com/engine/reference/commandline/rename/) allows the container to be renamed. +* [`docker run`](https://docs.docker.com/engine/reference/commandline/run) creates and starts a container in one operation. +* [`docker rm`](https://docs.docker.com/engine/reference/commandline/rm) deletes a container. +* [`docker update`](https://docs.docker.com/engine/reference/commandline/update/) updates a container's resource limits. + +Normally if you run a container without options it will start and stop immediately, if you want keep it running you can use the command, `docker run -td container_id` this will use the option `-t` that will allocate a pseudo-TTY session and `-d` that will detach automatically the container (run container in background and print container ID). + +If you want a transient container, `docker run --rm` will remove the container after it stops. + +If you want to map a directory on the host to a docker container, `docker run -v $HOSTDIR:$DOCKERDIR`. Also see [Volumes](https://github.com/wsargent/docker-cheat-sheet/#volumes). + +If you want to remove also the volumes associated with the container, the deletion of the container must include the `-v` switch like in `docker rm -v`. + +There's also a [logging driver](https://docs.docker.com/engine/admin/logging/overview/) available for individual containers in docker 1.10. To run docker with a custom log driver (i.e., to syslog), use `docker run --log-driver=syslog`. + +Another useful option is `docker run --name yourname docker_image` because when you specify the `--name` inside the run command this will allow you to start and stop a container by calling it with the name the you specified when you created it. + +### Starting and Stopping + +* [`docker start`](https://docs.docker.com/engine/reference/commandline/start) starts a container so it is running. +* [`docker stop`](https://docs.docker.com/engine/reference/commandline/stop) stops a running container. +* [`docker restart`](https://docs.docker.com/engine/reference/commandline/restart) stops and starts a container. +* [`docker pause`](https://docs.docker.com/engine/reference/commandline/pause/) pauses a running container, "freezing" it in place. +* [`docker unpause`](https://docs.docker.com/engine/reference/commandline/unpause/) will unpause a running container. +* [`docker wait`](https://docs.docker.com/engine/reference/commandline/wait) blocks until running container stops. +* [`docker kill`](https://docs.docker.com/engine/reference/commandline/kill) sends a SIGKILL to a running container. +* [`docker attach`](https://docs.docker.com/engine/reference/commandline/attach) will connect to a running container. + +If you want to integrate a container with a [host process manager](https://docs.docker.com/engine/admin/host_integration/), start the daemon with `-r=false` then use `docker start -a`. + +If you want to expose container ports through the host, see the [exposing ports](#exposing-ports) section. + +Restart policies on crashed docker instances are [covered here](http://container42.com/2014/09/30/docker-restart-policies/). + +#### CPU Constraints + +You can limit CPU, either using a percentage of all CPUs, or by using specific cores. + +For example, you can tell the [`cpu-shares`](https://docs.docker.com/engine/reference/run/#/cpu-share-constraint) setting. The setting is a bit strange -- 1024 means 100% of the CPU, so if you want the container to take 50% of all CPU cores, you should specify 512. See https://goldmann.pl/blog/2014/09/11/resource-management-in-docker/#_cpu for more: + +``` +docker run -ti --c 512 agileek/cpuset-test +``` + +You can also only use some CPU cores using [`cpuset-cpus`](https://docs.docker.com/engine/reference/run/#/cpuset-constraint). See https://agileek.github.io/docker/2014/08/06/docker-cpuset/ for details and some nice videos: + +``` +docker run -ti --cpuset-cpus=0,4,6 agileek/cpuset-test +``` + +Note that Docker can still **see** all of the CPUs inside the container -- it just isn't using all of them. See https://github.com/docker/docker/issues/20770 for more details. + +#### Memory Constraints + +You can also set [memory constraints](https://docs.docker.com/engine/reference/run/#/user-memory-constraints) on Docker: + +``` +docker run -it -m 300M ubuntu:14.04 /bin/bash +``` + +#### Capabilities + +Linux capabilities can be set by using `cap-add` and `cap-drop`. See https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities for details. This should be used for greater security. + +To mount a FUSE based filesystem, you need to combine both --cap-add and --device: + +``` +docker run --rm -it --cap-add SYS_ADMIN --device /dev/fuse sshfs +``` + +Give access to a single device: + +``` +docker run -it --device=/dev/ttyUSB0 debian bash +``` + +Give access to all devices: + +``` +docker run -it --privileged -v /dev/bus/usb:/dev/bus/usb debian bash +``` + +more info about privileged containers [here]( +https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities) + + +### Info + +* [`docker ps`](https://docs.docker.com/engine/reference/commandline/ps) shows running containers. +* [`docker logs`](https://docs.docker.com/engine/reference/commandline/logs) gets logs from container. (You can use a custom log driver, but logs is only available for `json-file` and `journald` in 1.10). +* [`docker inspect`](https://docs.docker.com/engine/reference/commandline/inspect) looks at all the info on a container (including IP address). +* [`docker events`](https://docs.docker.com/engine/reference/commandline/events) gets events from container. +* [`docker port`](https://docs.docker.com/engine/reference/commandline/port) shows public facing port of container. +* [`docker top`](https://docs.docker.com/engine/reference/commandline/top) shows running processes in container. +* [`docker stats`](https://docs.docker.com/engine/reference/commandline/stats) shows containers' resource usage statistics. +* [`docker diff`](https://docs.docker.com/engine/reference/commandline/diff) shows changed files in the container's FS. + +`docker ps -a` shows running and stopped containers. + +`docker stats --all` shows a running list of containers. + +### Import / Export + +* [`docker cp`](https://docs.docker.com/engine/reference/commandline/cp) copies files or folders between a container and the local filesystem. +* [`docker export`](https://docs.docker.com/engine/reference/commandline/export) turns container filesystem into tarball archive stream to STDOUT. + +### Executing Commands + +* [`docker exec`](https://docs.docker.com/engine/reference/commandline/exec) to execute a command in container. + +To enter a running container, attach a new shell process to a running container called foo, use: `docker exec -it foo /bin/bash`. + +## Images + +Images are just [templates for docker containers](https://docs.docker.com/engine/understanding-docker/#how-does-a-docker-image-work). + +### Lifecycle + +* [`docker images`](https://docs.docker.com/engine/reference/commandline/images) shows all images. +* [`docker import`](https://docs.docker.com/engine/reference/commandline/import) creates an image from a tarball. +* [`docker build`](https://docs.docker.com/engine/reference/commandline/build) creates image from Dockerfile. +* [`docker commit`](https://docs.docker.com/engine/reference/commandline/commit) creates image from a container, pausing it temporarily if it is running. +* [`docker rmi`](https://docs.docker.com/engine/reference/commandline/rmi) removes an image. +* [`docker load`](https://docs.docker.com/engine/reference/commandline/load) loads an image from a tar archive as STDIN, including images and tags (as of 0.7). +* [`docker save`](https://docs.docker.com/engine/reference/commandline/save) saves an image to a tar archive stream to STDOUT with all parent layers, tags & versions (as of 0.7). + +### Info + +* [`docker history`](https://docs.docker.com/engine/reference/commandline/history) shows history of image. +* [`docker tag`](https://docs.docker.com/engine/reference/commandline/tag) tags an image to a name (local or registry). + +## Checking Docker Version + +It is very important that you always know the current version of Docker you are currently running on at any point in time.This is very helpful because you get to know what features are compatible with what you have running. This is also important because you know what containers to run from the docker store when you are trying to get template containers. That said let see how to know what version of docker we have running currently + +* ['docker version'](https://docs.docker.com/engine/reference/commandline/version/) check what version of docker you have running +* [docker version [OPTIONS]] + +Get the server version +$ docker version --format '{{.Server.Version}}' + +1.8.0 +Dump raw JSON data +$ docker version --format '{{json .}}' + +{"Client":{"Version":"1.8.0","ApiVersion":"1.20","GitCommit":"f5bae0a","GoVersion":"go1.4.2","Os":"linux","Arch":"am"} + +### Cleaning up + +While you can use the `docker rmi` command to remove specific images, there's a tool called [docker-gc](https://github.com/spotify/docker-gc) that will safely clean up images that are no longer used by any containers. + +### Load/Save image + +Load an image from file: +``` +docker load < my_image.tar.gz +``` + +Save an existing image: +``` +docker save my_image:my_tag | gzip > my_image.tar.gz +``` + +### Import/Export container + +Import a container as an image from file: +``` +cat my_container.tar.gz | docker import - my_image:my_tag +``` + +Export an existing container: +``` +docker export my_container | gzip > my_container.tar.gz +``` + +### Difference between loading a saved image and importing an exported container as an image + +Loading an image using the `load` command creates a new image including its history. +Importing a container as an image using the `import` command creates a new image excluding the history which results in a smaller image size compared to loading an image. + +## Networks + +Docker has a [networks](https://docs.docker.com/engine/userguide/networking/) feature. Not much is known about it, so this is a good place to expand the cheat sheet. There is a note saying that it's a good way to configure docker containers to talk to each other without using ports. See [working with networks](https://docs.docker.com/engine/userguide/networking/work-with-networks/) for more details. + +### Lifecycle + +* [`docker network create`](https://docs.docker.com/engine/reference/commandline/network_create/) +* [`docker network rm`](https://docs.docker.com/engine/reference/commandline/network_rm/) + +### Info + +* [`docker network ls`](https://docs.docker.com/engine/reference/commandline/network_ls/) +* [`docker network inspect`](https://docs.docker.com/engine/reference/commandline/network_inspect/) + +### Connection + +* [`docker network connect`](https://docs.docker.com/engine/reference/commandline/network_connect/) +* [`docker network disconnect`](https://docs.docker.com/engine/reference/commandline/network_disconnect/) + +You can specify a [specific IP address for a container](https://blog.jessfraz.com/post/ips-for-all-the-things/): + +``` +# create a new bridge network with your subnet and gateway for your ip block +docker network create --subnet 203.0.113.0/24 --gateway 203.0.113.254 iptastic + +# run a nginx container with a specific ip in that block +$ docker run --rm -it --net iptastic --ip 203.0.113.2 nginx + +# curl the ip from any other place (assuming this is a public ip block duh) +$ curl 203.0.113.2 +``` + +## Registry & Repository + +A repository is a *hosted* collection of tagged images that together create the file system for a container. + +A registry is a *host* -- a server that stores repositories and provides an HTTP API for [managing the uploading and downloading of repositories](https://docs.docker.com/engine/tutorials/dockerrepos/). + +Docker.com hosts its own [index](https://hub.docker.com/) to a central registry which contains a large number of repositories. Having said that, the central docker registry [does not do a good job of verifying images](https://titanous.com/posts/docker-insecurity) and should be avoided if you're worried about security. + +* [`docker login`](https://docs.docker.com/engine/reference/commandline/login) to login to a registry. +* [`docker logout`](https://docs.docker.com/engine/reference/commandline/logout) to logout from a registry. +* [`docker search`](https://docs.docker.com/engine/reference/commandline/search) searches registry for image. +* [`docker pull`](https://docs.docker.com/engine/reference/commandline/pull) pulls an image from registry to local machine. +* [`docker push`](https://docs.docker.com/engine/reference/commandline/push) pushes an image to the registry from local machine. + +### Run local registry + +You can run a local registry by using the [docker distribution](https://github.com/docker/distribution) project and looking at the [local deploy](https://github.com/docker/docker.github.io/blob/master/registry/deploying.md) instructions. + +Also see the [mailing list](https://groups.google.com/a/dockerproject.org/forum/#!forum/distribution). + +## Dockerfile + +[The configuration file](https://docs.docker.com/engine/reference/builder/). Sets up a Docker container when you run `docker build` on it. Vastly preferable to `docker commit`. + +Here are some common text editors and their syntax highlighting modules you could use to create Dockerfiles: +* If you use [jEdit](http://jedit.org), I've put up a syntax highlighting module for [Dockerfile](https://github.com/wsargent/jedit-docker-mode) you can use. +* [Sublime Text 2](https://packagecontrol.io/packages/Dockerfile%20Syntax%20Highlighting) +* [Atom](https://atom.io/packages/language-docker) +* [Vim](https://github.com/ekalinin/Dockerfile.vim) +* [Emacs](https://github.com/spotify/dockerfile-mode) +* [TextMate](https://github.com/docker/docker/tree/master/contrib/syntax/textmate) +* [VS Code](https://github.com/Microsoft/vscode-docker) +* Also see [Docker meets the IDE](https://domeide.github.io/) + +### Instructions + +* [.dockerignore](https://docs.docker.com/engine/reference/builder/#dockerignore-file) +* [FROM](https://docs.docker.com/engine/reference/builder/#from) Sets the Base Image for subsequent instructions. +* [MAINTAINER (deprecated - use LABEL instead)](https://docs.docker.com/engine/reference/builder/#maintainer-deprecated) Set the Author field of the generated images. +* [RUN](https://docs.docker.com/engine/reference/builder/#run) execute any commands in a new layer on top of the current image and commit the results. +* [CMD](https://docs.docker.com/engine/reference/builder/#cmd) provide defaults for an executing container. +* [EXPOSE](https://docs.docker.com/engine/reference/builder/#expose) informs Docker that the container listens on the specified network ports at runtime. NOTE: does not actually make ports accessible. +* [ENV](https://docs.docker.com/engine/reference/builder/#env) sets environment variable. +* [ADD](https://docs.docker.com/engine/reference/builder/#add) copies new files, directories or remote file to container. Invalidates caches. Avoid `ADD` and use `COPY` instead. +* [COPY](https://docs.docker.com/engine/reference/builder/#copy) copies new files or directories to container. Note that this only copies as root, so you have to chown manually regardless of your USER / WORKDIR setting. See https://github.com/moby/moby/issues/30110 +* [ENTRYPOINT](https://docs.docker.com/engine/reference/builder/#entrypoint) configures a container that will run as an executable. +* [VOLUME](https://docs.docker.com/engine/reference/builder/#volume) creates a mount point for externally mounted volumes or other containers. +* [USER](https://docs.docker.com/engine/reference/builder/#user) sets the user name for following RUN / CMD / ENTRYPOINT commands. +* [WORKDIR](https://docs.docker.com/engine/reference/builder/#workdir) sets the working directory. +* [ARG](https://docs.docker.com/engine/reference/builder/#arg) defines a build-time variable. +* [ONBUILD](https://docs.docker.com/engine/reference/builder/#onbuild) adds a trigger instruction when the image is used as the base for another build. +* [STOPSIGNAL](https://docs.docker.com/engine/reference/builder/#stopsignal) sets the system call signal that will be sent to the container to exit. +* [LABEL](https://docs.docker.com/engine/userguide/labels-custom-metadata/) apply key/value metadata to your images, containers, or daemons. + +### Tutorial + +* [Flux7's Dockerfile Tutorial](http://flux7.com/blogs/docker/docker-tutorial-series-part-3-automation-is-the-word-using-dockerfile/) + +### Examples + +* [Examples](https://docs.docker.com/engine/reference/builder/#dockerfile-examples) +* [Best practices for writing Dockerfiles](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/) +* [Michael Crosby](http://crosbymichael.com/) has some more [Dockerfiles best practices](http://crosbymichael.com/dockerfile-best-practices.html) / [take 2](http://crosbymichael.com/dockerfile-best-practices-take-2.html). +* [Building Good Docker Images](http://jonathan.bergknoff.com/journal/building-good-docker-images) / [Building Better Docker Images](http://jonathan.bergknoff.com/journal/building-better-docker-images) +* [Managing Container Configuration with Metadata](https://speakerdeck.com/garethr/managing-container-configuration-with-metadata) +* [How to write excellent Dockerfiles](https://rock-it.pl/how-to-write-excellent-dockerfiles/) + +## Layers + +The versioned filesystem in Docker is based on layers. They're like [git commits or changesets for filesystems](https://docs.docker.com/engine/userguide/storagedriver/imagesandcontainers/). + +## Links + +Links are how Docker containers talk to each other [through TCP/IP ports](https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/). [Linking into Redis](https://docs.docker.com/engine/examples/running_redis_service/) and [Atlassian](https://blogs.atlassian.com/2013/11/docker-all-the-things-at-atlassian-automation-and-wiring/) show worked examples. You can also resolve [links by hostname](https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/#/updating-the-etchosts-file). + +This has been deprected to some extent by [user-defined networks](https://docs.docker.com/engine/userguide/networking/#user-defined-networks). + +NOTE: If you want containers to ONLY communicate with each other through links, start the docker daemon with `-icc=false` to disable inter process communication. + +If you have a container with the name CONTAINER (specified by `docker run --name CONTAINER`) and in the Dockerfile, it has an exposed port: + +``` +EXPOSE 1337 +``` + +Then if we create another container called LINKED like so: + +``` +docker run -d --link CONTAINER:ALIAS --name LINKED user/wordpress +``` + +Then the exposed ports and aliases of CONTAINER will show up in LINKED with the following environment variables: + +``` +$ALIAS_PORT_1337_TCP_PORT +$ALIAS_PORT_1337_TCP_ADDR +``` + +And you can connect to it that way. + +To delete links, use `docker rm --link`. + +Generally, linking between docker services is a subset of "service discovery", a big problem if you're planning to use Docker at scale in production. Please read [The Docker Ecosystem: Service Discovery and Distributed Configuration Stores](https://www.digitalocean.com/community/tutorials/the-docker-ecosystem-service-discovery-and-distributed-configuration-stores) for more info. + +## Volumes + +Docker volumes are [free-floating filesystems](https://docs.docker.com/engine/tutorials/dockervolumes/). They don't have to be connected to a particular container. You should use volumes mounted from [data-only containers](https://medium.com/@ramangupta/why-docker-data-containers-are-good-589b3c6c749e) for portability. + +### Lifecycle + +* [`docker volume create`](https://docs.docker.com/engine/reference/commandline/volume_create/) +* [`docker volume rm`](https://docs.docker.com/engine/reference/commandline/volume_rm/) + +### Info + +* [`docker volume ls`](https://docs.docker.com/engine/reference/commandline/volume_ls/) +* [`docker volume inspect`](https://docs.docker.com/engine/reference/commandline/volume_inspect/) + +Volumes are useful in situations where you can't use links (which are TCP/IP only). For instance, if you need to have two docker instances communicate by leaving stuff on the filesystem. + +You can mount them in several docker containers at once, using `docker run --volumes-from`. + +Because volumes are isolated filesystems, they are often used to store state from computations between transient containers. That is, you can have a stateless and transient container run from a recipe, blow it away, and then have a second instance of the transient container pick up from where the last one left off. + +See [advanced volumes](http://crosbymichael.com/advanced-docker-volumes.html) for more details. Container42 is [also helpful](http://container42.com/2014/11/03/docker-indepth-volumes/). + +You can [map MacOS host directories as docker volumes](https://docs.docker.com/engine/tutorials/dockervolumes/#mount-a-host-directory-as-a-data-volume): + +``` +docker run -v /Users/wsargent/myapp/src:/src +``` + +You can use remote NFS volumes if you're [feeling brave](https://docs.docker.com/engine/tutorials/dockervolumes/#/mount-a-shared-storage-volume-as-a-data-volume). + +You may also consider running data-only containers as described [here](http://container42.com/2013/12/16/persistent-volumes-with-docker-container-as-volume-pattern/) to provide some data portability. + +[Be aware that you can mount files as volumes.](#volumes-can-be-files) + +## Exposing ports + +Exposing incoming ports through the host container is [fiddly but doable](https://docs.docker.com/engine/reference/run/#expose-incoming-ports). + +This is done by mapping the container port to the host port (only using localhost interface) using `-p`: + +``` +docker run -p 127.0.0.1:$HOSTPORT:$CONTAINERPORT --name CONTAINER -t someimage +``` + +You can tell Docker that the container listens on the specified network ports at runtime by using [EXPOSE](https://docs.docker.com/engine/reference/builder/#expose): + +``` +EXPOSE +``` + +Note that EXPOSE does not expose the port itself -- only `-p` will do that. To expose the container's port on your localhost's port: + +``` +iptables -t nat -A DOCKER -p tcp --dport -j DNAT --to-destination : +``` + +If you're running Docker in Virtualbox, you then need to forward the port there as well, using [forwarded_port](https://docs.vagrantup.com/v2/networking/forwarded_ports.html). Define a range of ports in your Vagrantfile like this so you can dynamically map them: + +``` +Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| + ... + + (49000..49900).each do |port| + config.vm.network :forwarded_port, :host => port, :guest => port + end + + ... +end +``` + +If you forget what you mapped the port to on the host container, use `docker port` to show it: + +``` +docker port CONTAINER $CONTAINERPORT +``` + +## Best Practices + +This is where general Docker best practices and war stories go: + +* [The Rabbit Hole of Using Docker in Automated Tests](http://gregoryszorc.com/blog/2014/10/16/the-rabbit-hole-of-using-docker-in-automated-tests/) +* [Bridget Kromhout](https://twitter.com/bridgetkromhout) has a useful blog post on [running Docker in production](http://sysadvent.blogspot.co.uk/2014/12/day-1-docker-in-production-reality-not.html) at Dramafever. +* There's also a best practices [blog post](http://developers.lyst.com/devops/2014/12/08/docker/) from Lyst. +* [Building a Development Environment With Docker](https://tersesystems.com/2013/11/20/building-a-development-environment-with-docker/) +* [Discourse in a Docker Container](https://samsaffron.com/archive/2013/11/07/discourse-in-a-docker-container) + +## Security + +This is where security tips about Docker go. The Docker [security](https://docs.docker.com/engine/security/security/) page goes into more detail. + +First things first: Docker runs as root. If you are in the `docker` group, you effectively [have root access](http://reventlov.com/advisories/using-the-docker-command-to-root-the-host). If you expose the docker unix socket to a container, you are giving the container [root access to the host](https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container.html). + +Docker should not be your only defense. You should secure and harden it. + +For an understanding of what containers leave exposed, you should read [Understanding and Hardening Linux Containers](https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/2016/april/ncc_group_understanding_hardening_linux_containers-1-1.pdf) by [Aaron Grattafiori](https://twitter.com/dyn___). This is a complete and comprehensive guide to the issues involved with containers, with a plethora of links and footnotes leading on to yet more useful content. The security tips following are useful if you've already hardened containers in the past, but are not a substitute for understanding. + +### Security Tips + +For greatest security, you want to run Docker inside a virtual machine. This is straight from the Docker Security Team Lead -- [slides](http://www.slideshare.net/jpetazzo/linux-containers-lxc-docker-and-security) / [notes](http://www.projectatomic.io/blog/2014/08/is-it-safe-a-look-at-docker-and-security-from-linuxcon/). Then, run with AppArmor / seccomp / SELinux / grsec etc to [limit the container permissions](http://linux-audit.com/docker-security-best-practices-for-your-vessel-and-containers/). See the [Docker 1.10 security features](https://blog.docker.com/2016/02/docker-engine-1-10-security/) for more details. + +Docker image ids are [sensitive information](https://medium.com/@quayio/your-docker-image-ids-are-secrets-and-its-time-you-treated-them-that-way-f55e9f14c1a4) and should not be exposed to the outside world. Treat them like passwords. + +See the [Docker Security Cheat Sheet](https://github.com/konstruktoid/Docker/blob/master/Security/CheatSheet.adoc) by [Thomas Sjögren](https://github.com/konstruktoid): some good stuff about container hardening in there. + +Check out the [docker bench security script](https://github.com/docker/docker-bench-security), download the [white papers](https://blog.docker.com/2015/05/understanding-docker-security-and-best-practices/) and subscribe to the [mailing lists](https://www.docker.com/docker-security) (unfortunately Docker does not have a unique mailing list, only dev / user). + +You should start off by using a kernel with unstable patches for grsecurity / pax compiled in, such as [Alpine Linux](https://en.wikipedia.org/wiki/Alpine_Linux). If you are using grsecurity in production, you should spring for [commercial support](https://grsecurity.net/business_support.php) for the [stable patches](https://grsecurity.net/announce.php), same as you would do for RedHat. It's $200 a month, which is nothing to your devops budget. + +Since docker 1.11 you can easily limit the number of active processes running inside a container to prevent fork bombs. This requires a linux kernel >= 4.3 with CGROUP_PIDS=y to be in the kernel configuration. + +``` +docker run --pids-limit=64 +``` + +Also available since docker 1.11 is the ability to prevent processes from gaining new privileges. This feature have been in the linux kernel since version 3.5. You can read more about it in [this](http://www.projectatomic.io/blog/2016/03/no-new-privs-docker/) blog post. + +``` +docker run --security-opt=no-new-privileges +``` + +From the [Docker Security Cheat Sheet](http://container-solutions.com/content/uploads/2015/06/15.06.15_DockerCheatSheet_A2.pdf) (it's in PDF which makes it hard to use, so copying below) by [Container Solutions](http://container-solutions.com/is-docker-safe-for-production/): + +Turn off interprocess communication with: + +``` +docker -d --icc=false --iptables +``` + +Set the container to be read-only: + +``` +docker run --read-only +``` + +Verify images with a hashsum: + +``` +docker pull debian@sha256:a25306f3850e1bd44541976aa7b5fd0a29be +``` + +Set volumes to be read only: + +``` +docker run -v $(pwd)/secrets:/secrets:ro debian +``` + +Define and run a user in your Dockerfile so you don't run as root inside the container: + +``` +RUN groupadd -r user && useradd -r -g user user +USER user +``` + +### User Namespaces + +There's also work on [user namespaces](https://s3hh.wordpress.com/2013/07/19/creating-and-using-containers-without-privilege/) -- it is in 1.10 but is not enabled by default. + +To enable user namespaces ("remap the userns") in Ubuntu 15.10, [follow the blog example](https://raesene.github.io/blog/2016/02/04/Docker-User-Namespaces/). + +### Security Videos + +* [Using Docker Safely](https://youtu.be/04LOuMgNj9U) +* [Securing your applications using Docker](https://youtu.be/KmxOXmPhZbk) +* [Container security: Do containers actually contain?](https://youtu.be/a9lE9Urr6AQ) +* [Linux Containers: Future or Fantasy?](https://www.youtube.com/watch?v=iN6QbszB1R8) + +### Security Roadmap + +The Docker roadmap talks about [seccomp support](https://github.com/docker/docker/blob/master/ROADMAP.md#11-security). +There is an AppArmor policy generator called [bane](https://github.com/jfrazelle/bane), and they're working on [security profiles](https://github.com/docker/docker/issues/17142). + +## Tips + +Sources: + +* [15 Docker Tips in 5 minutes](http://sssslide.com/speakerdeck.com/bmorearty/15-docker-tips-in-5-minutes) +* [CodeFresh Everyday Hacks Docker](https://codefresh.io/blog/everyday-hacks-docker/) + +### Prune + +The new [Data Management Commands](https://github.com/docker/docker/pull/26108) have landed as of Docker 1.13: + +* `docker system prune` +* `docker volume prune` +* `docker network prune` +* `docker container prune` +* `docker image prune` + +### df + +`docker system df` presents a summary of the space currently used by different docker objects. + +### Heredoc Docker Container + +``` +docker build -t htop - << EOF +FROM alpine +RUN apk --no-cache add htop +EOF +``` + +### Last Ids + +``` +alias dl='docker ps -l -q' +docker run ubuntu echo hello world +docker commit $(dl) helloworld +``` + +### Commit with command (needs Dockerfile) + +``` +docker commit -run='{"Cmd":["postgres", "-too -many -opts"]}' $(dl) postgres +``` + +### Get IP address + +``` +docker inspect $(dl) | grep -wm1 IPAddress | cut -d '"' -f 4 +``` + +or install [jq](https://stedolan.github.io/jq/): + +``` +docker inspect $(dl) | jq -r '.[0].NetworkSettings.IPAddress' +``` + +or using a [go template](https://docs.docker.com/engine/reference/commandline/inspect): + +``` +docker inspect -f '{{ .NetworkSettings.IPAddress }}' +``` + +or when building an image from Dockerfile, when you want to pass in a build argument: + +``` +DOCKER_HOST_IP=`ifconfig | grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep -v 127.0.0.1 | awk '{ print $2 }' | cut -f2 -d: | head -n1` +echo DOCKER_HOST_IP = $DOCKER_HOST_IP +docker build \ + --build-arg ARTIFACTORY_ADDRESS=$DOCKER_HOST_IP + -t sometag \ + some-directory/ + ``` + +### Get port mapping + +``` +docker inspect -f '{{range $p, $conf := .NetworkSettings.Ports}} {{$p}} -> {{(index $conf 0).HostPort}} {{end}}' +``` + +### Find containers by regular expression + +``` +for i in $(docker ps -a | grep "REGEXP_PATTERN" | cut -f1 -d" "); do echo $i; done +``` + +### Get Environment Settings + +``` +docker run --rm ubuntu env +``` + +### Kill running containers + +``` +docker kill $(docker ps -q) +``` + +### Delete all containers (force!! running or stopped containers) + +``` +docker rm -f $(docker ps -qa) +``` + +### Delete old containers + +``` +docker ps -a | grep 'weeks ago' | awk '{print $1}' | xargs docker rm +``` + +### Delete stopped containers + +``` +docker rm -v $(docker ps -a -q -f status=exited) +``` + +### Delete containers after stopping + +``` +docker stop $(docker ps -aq) && docker rm -v $(docker ps -aq) +``` + +### Delete dangling images + +``` +docker rmi $(docker images -q -f dangling=true) +``` + +### Delete all images + +``` +docker rmi $(docker images -q) +``` + +### Delete dangling volumes + +As of Docker 1.9: + +``` +docker volume rm $(docker volume ls -q -f dangling=true) +``` + +In 1.9.0, the filter `dangling=false` does _not_ work - it is ignored and will list all volumes. + +### Show image dependencies + +``` +docker images -viz | dot -Tpng -o docker.png +``` + +### Slimming down Docker containers + +- Cleaning APT in a RUN layer + +This should be done in the same layer as other apt commands. +Otherwise, the previous layers still persist the original information and your images will still be fat. + +``` +RUN {apt commands} \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* +``` + +- Flatten an image +``` +ID=$(docker run -d image-name /bin/bash) +docker export $ID | docker import – flat-image-name +``` + +- For backup +``` +ID=$(docker run -d image-name /bin/bash) +(docker export $ID | gzip -c > image.tgz) +gzip -dc image.tgz | docker import - flat-image-name +``` + +### Monitor system resource utilization for running containers + +To check the CPU, memory, and network I/O usage of a single container, you can use: + +``` +docker stats +``` + +For all containers listed by id: + +``` +docker stats $(docker ps -q) +``` + +For all containers listed by name: + +``` +docker stats $(docker ps --format '{{.Names}}') +``` + +For all containers listed by image: + +``` +docker ps -a -f ancestor=ubuntu +``` + +Remove all untagged images +``` +docker rmi $(docker images | grep “^” | awk '{split($0,a," "); print a[3]}') +``` + +Remove container by a regular expression +``` +docker ps -a | grep wildfly | awk '{print $1}' | xargs docker rm -f +``` +Remove all exited containers +``` +docker rm -f $(docker ps -a | grep Exit | awk '{ print $1 }') +``` + +### Volumes can be files + +Be aware that you can mount files as volumes. For example you can inject a configuration file like this: + +``` bash +# copy file from container +docker run --rm httpd cat /usr/local/apache2/conf/httpd.conf > httpd.conf + +# edit file +vim httpd.conf + +# start container with modified configuration +docker run --rm -ti -v "$PWD/httpd.conf:/usr/local/apache2/conf/httpd.conf:ro" -p "80:80" httpd +``` + +## Contributing + +Here's how to contribute to this cheat sheet. + +### Open README.md + +Click [README.md](https://github.com/wsargent/docker-cheat-sheet/blob/master/README.md) <-- this link + +![Click This](images/click.png) + +### Edit Page + +![Edit This](images/edit.png) + +### Make Changes and Commit + +![Change This](images/change.png) + +![Commit](images/commit.png) From a7f483e9db00e8ab84ae7e8cb4fafbcf3ac25f19 Mon Sep 17 00:00:00 2001 From: eleutherius Date: Thu, 19 Jul 2018 00:47:10 +0300 Subject: [PATCH 2/9] =?UTF-8?q?=09=D0=B8=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5?= =?UTF-8?q?=D0=BD=D0=BE:=20=20=20=20=20=20ru/README.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ru/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ru/README.md b/ru/README.md index a481abb..d9f7fa6 100644 --- a/ru/README.md +++ b/ru/README.md @@ -5,7 +5,7 @@ ## Содержание * [Почему Docker](#why-docker) -* [Предпосылки](#prerequisites) +* [Предпосылки](#Предпосылки) * [Установка](#installation) * [Контейнеры](#containers) * [Образы](#images) From bb815908601efd6c2df5bd74344326bb0c6ab72a Mon Sep 17 00:00:00 2001 From: eleutherius Date: Thu, 19 Jul 2018 01:45:54 +0300 Subject: [PATCH 3/9] =?UTF-8?q?=09=D0=B8=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5?= =?UTF-8?q?=D0=BD=D0=BE:=20=20=20=20=20=20ru/README.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ru/README.md | 81 ++++++++++++++++++++++++++++------------------------ 1 file changed, 43 insertions(+), 38 deletions(-) diff --git a/ru/README.md b/ru/README.md index d9f7fa6..08ffd7a 100644 --- a/ru/README.md +++ b/ru/README.md @@ -4,10 +4,10 @@ ## Содержание -* [Почему Docker](#why-docker) +* [Почему Docker](#Почему-Docker) * [Предпосылки](#Предпосылки) -* [Установка](#installation) -* [Контейнеры](#containers) +* [Установка](#Установка) +* [Контейнеры](#Контейнеры) * [Образы](#images) * [Сеть](#networks) * [Реестр и репозиторий](#registry--repository) @@ -31,79 +31,84 @@ Docker помогает разработчикам создавать и отп ## Предпосылки -I use [Oh My Zsh](https://github.com/robbyrussell/oh-my-zsh) with the [Docker plugin](https://github.com/robbyrussell/oh-my-zsh/wiki/Plugins#docker) for autocompletion of docker commands. YMMV. +Я использую [Oh My Zsh](https://github.com/robbyrussell/oh-my-zsh) вместе с [Docker plugin](https://github.com/robbyrussell/oh-my-zsh/wiki/Plugins#docker) для автозаполнения команд docker. Возможно у вас другой подход. ### Linux -The 3.10.x kernel is [the minimum requirement](https://docs.docker.com/engine/installation/binaries/#check-kernel-dependencies) for Docker. +Ядро 3.10.x [минимальное требование] (https://docs.docker.com/engine/installation/binaries/#check-kernel-dependencies) для Docker. ### MacOS - 10.8 “Mountain Lion” or newer is required. + 10.8 “Mountain Lion” или более новый. -## Installation +## Установка ### Linux -Quick and easy install script provided by Docker: +Быстрый и простой скрипт установки, предоставляемый Docker: ``` curl -sSL https://get.docker.com/ | sh ``` -If you're not willing to run a random shell script, please see the [installation](https://docs.docker.com/engine/installation/linux/) instructions for your distribution. +Если вы не хотите запускать случайный сценарий оболочки, см. [Инструкции](https://docs.docker.com/engine/installation/linux/) по установке на ваш дистрибутив. -If you are a complete Docker newbie, you should follow the [series of tutorials](https://docs.docker.com/engine/getstarted/) now. +Если вы являетесь полноправным новичком Docker, вы должны следовать [сериям учебников] (https://docs.docker.com/engine/getstarted/) сейчас. ### macOS -Download and install [Docker Community Edition](https://www.docker.com/community-edition). if you have Homebrew-Cask, just type `brew cask install docker`. Or Download and install [Docker Toolbox](https://docs.docker.com/toolbox/overview/). [Docker For Mac](https://docs.docker.com/docker-for-mac/) is nice, but it's not quite as finished as the VirtualBox install. [See the comparison](https://docs.docker.com/docker-for-mac/docker-toolbox/). +Скачать и установить [Docker Community Edition](https://www.docker.com/community-edition). если у вас есть Homebrew-Cask, просто введите `brew cask install docker`. +Или загрузите и установите [Docker Toolbox](https://docs.docker.com/toolbox/overview/). [Docker для Mac](https://docs.docker.com/docker-for-mac/) это хорошо, но это не совсем так, как установка VirtualBox. [ +См. Сравнение](https://docs.docker.com/docker-for-mac/docker-toolbox/). -> **NOTE** Docker Toolbox is legacy. you should to use Docker Community Edition, See (Docker Toolbox)[https://docs.docker.com/toolbox/overview/] +> ** ПРИМЕЧАНИЕ ** Docker Toolbox является устаревшим. вы должны использовать Docker Community Edition, см. (Docker Toolbox)[https://docs.docker.com/toolbox/overview/] -Once you've installed Docker Community Edition, click the docker icon in Launchpad. Then start up a container: +После установки Docker Community Edition щелкните значок докера. Затем запустите контейнер: ``` docker run hello-world ``` -That's it, you have a running Docker container. +Вот и все, у вас есть работающий контейнер Docker. -If you are a complete Docker newbie, you should probably follow the [series of tutorials](https://docs.docker.com/engine/getstarted/) now. -## Containers +Если вы являетесь полноправным новичком докеров, вы должны, вероятно, исследовать [серию учебников] (https://docs.docker.com/engine/getstarted/) сейчас. -[Your basic isolated Docker process](http://etherealmind.com/basics-docker-containers-hypervisors-coreos/). Containers are to Virtual Machines as threads are to processes. Or you can think of them as chroots on steroids. +## Контейнеры -### Lifecycle +[Ваш основной изолированный процесс Докера](http://etherealmind.com/basics-docker-containers-hypervisors-coreos/). Контейнеры - это виртуальные машины, поскольку потоки относятся к процессам. Или вы можете думать о них как о chroot на стероидах. -* [`docker create`](https://docs.docker.com/engine/reference/commandline/create) creates a container but does not start it. -* [`docker rename`](https://docs.docker.com/engine/reference/commandline/rename/) allows the container to be renamed. -* [`docker run`](https://docs.docker.com/engine/reference/commandline/run) creates and starts a container in one operation. -* [`docker rm`](https://docs.docker.com/engine/reference/commandline/rm) deletes a container. -* [`docker update`](https://docs.docker.com/engine/reference/commandline/update/) updates a container's resource limits. +### Жизненный цикл -Normally if you run a container without options it will start and stop immediately, if you want keep it running you can use the command, `docker run -td container_id` this will use the option `-t` that will allocate a pseudo-TTY session and `-d` that will detach automatically the container (run container in background and print container ID). -If you want a transient container, `docker run --rm` will remove the container after it stops. +* [`docker create`](https://docs.docker.com/engine/reference/commandline/create) создает контейнер, но не запускает его. +* [`docker rename`](https://docs.docker.com/engine/reference/commandline/rename/) позволяет переименовать контейнер. +* [`docker run`](https://docs.docker.com/engine/reference/commandline/run) создает и запускает контейнер за одну операцию. +* [`docker rm`](https://docs.docker.com/engine/reference/commandline/rm) удаляет контейнер. +* [`docker update`](https://docs.docker.com/engine/reference/commandline/update/) обновляет ограничения ресурсов контейнера. -If you want to map a directory on the host to a docker container, `docker run -v $HOSTDIR:$DOCKERDIR`. Also see [Volumes](https://github.com/wsargent/docker-cheat-sheet/#volumes). +Обычно, если вы запускаете контейнер без параметров, он запускается и останавливается немедленно, если вы хотите его запустить, вы можете использовать команду, `docker run -td container_id` это будет использовать опцию `-t` который будет выделять псевдо-TTY сессию и `-d` который автоматически отсоединяет контейнер (запускает контейнер в фоновом режиме и показыват ID контейнера). -If you want to remove also the volumes associated with the container, the deletion of the container must include the `-v` switch like in `docker rm -v`. +Если вам нужен переходный контейнер, `docker run --rm` удалит контейнер после его остановки. -There's also a [logging driver](https://docs.docker.com/engine/admin/logging/overview/) available for individual containers in docker 1.10. To run docker with a custom log driver (i.e., to syslog), use `docker run --log-driver=syslog`. +Если вы хотите сопоставить каталог на хосте с контейнером докера, `docker run -v $HOSTDIR:$DOCKERDIR`. Также смотрите [Тома](https://github.com/wsargent/docker-cheat-sheet/#volumes). -Another useful option is `docker run --name yourname docker_image` because when you specify the `--name` inside the run command this will allow you to start and stop a container by calling it with the name the you specified when you created it. +Если вы хотите удалить также тома, связанные с контейнером, удаление контейнера должно включать `-v` измените примерно так `docker rm -v`. -### Starting and Stopping +Существует также [логирование](https://docs.docker.com/engine/admin/logging/overview/) доступны для отдельных контейнеров в докерах 1.10. Чтобы запустить докер с помощью специального лог журнала (например, в syslog), используйте `docker run --log-driver=syslog`. -* [`docker start`](https://docs.docker.com/engine/reference/commandline/start) starts a container so it is running. -* [`docker stop`](https://docs.docker.com/engine/reference/commandline/stop) stops a running container. -* [`docker restart`](https://docs.docker.com/engine/reference/commandline/restart) stops and starts a container. -* [`docker pause`](https://docs.docker.com/engine/reference/commandline/pause/) pauses a running container, "freezing" it in place. -* [`docker unpause`](https://docs.docker.com/engine/reference/commandline/unpause/) will unpause a running container. -* [`docker wait`](https://docs.docker.com/engine/reference/commandline/wait) blocks until running container stops. -* [`docker kill`](https://docs.docker.com/engine/reference/commandline/kill) sends a SIGKILL to a running container. -* [`docker attach`](https://docs.docker.com/engine/reference/commandline/attach) will connect to a running container. +Другим полезным вариантом является `docker run --name yourname docker_image` потому что, когда вы укажете `--name` внутри команды run это позволит вам запускать и останавливать контейнер, вызывая его с именем, которое вы указали при его создании. + +### Запуск и остановка + +* [`docker start`](https://docs.docker.com/engine/reference/commandline/start) запускает контейнер, чтобы он работал. +* [`docker stop`](https://docs.docker.com/engine/reference/commandline/stop) останавливает запущенный контейнер. +* [`docker restart`](https://docs.docker.com/engine/reference/commandline/restart) останавливается и запускает контейнер. +* [`docker pause`](https://docs.docker.com/engine/reference/commandline/pause/) +приостанавливает работу контейнера, "замораживает" его на месте. +* [`docker unpause`](https://docs.docker.com/engine/reference/commandline/unpause/) снимает "заморозку" контейнера. +* [`docker wait`](https://docs.docker.com/engine/reference/commandline/wait) блокирует до остановки контейнера. +* [`docker kill`](https://docs.docker.com/engine/reference/commandline/kill) посылает SIGKILL к запущеннному контейнеру. +* [`docker attach`](https://docs.docker.com/engine/reference/commandline/attach) будет подключаться к работающему контейнеру. If you want to integrate a container with a [host process manager](https://docs.docker.com/engine/admin/host_integration/), start the daemon with `-r=false` then use `docker start -a`. From bfae89bd1509744575a05c62c03dc8da75c2bea3 Mon Sep 17 00:00:00 2001 From: eleutherius Date: Thu, 19 Jul 2018 01:49:39 +0300 Subject: [PATCH 4/9] =?UTF-8?q?=09=D0=B8=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5?= =?UTF-8?q?=D0=BD=D0=BE:=20=20=20=20=20=20ru/README.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ru/README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ru/README.md b/ru/README.md index 08ffd7a..99a6bc4 100644 --- a/ru/README.md +++ b/ru/README.md @@ -807,14 +807,14 @@ Here's how to contribute to this cheat sheet. Click [README.md](https://github.com/wsargent/docker-cheat-sheet/blob/master/README.md) <-- this link -![Click This](images/click.png) +![Click This](../images/click.png) ### Edit Page -![Edit This](images/edit.png) +![Edit This](../images/edit.png) ### Make Changes and Commit -![Change This](images/change.png) +![Change This](../images/change.png) -![Commit](images/commit.png) +![Commit](../images/commit.png) From bc3f25523c7c454dfc4c45028d101d14c15ee821 Mon Sep 17 00:00:00 2001 From: eleutherius Date: Fri, 20 Jul 2018 16:00:32 +0300 Subject: [PATCH 5/9] =?UTF-8?q?=09=D0=B8=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5?= =?UTF-8?q?=D0=BD=D0=BE:=20=20=20=20=20=20ru/README.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ru/README.md | 104 +++++++++++++++++++++++++++------------------------ 1 file changed, 55 insertions(+), 49 deletions(-) diff --git a/ru/README.md b/ru/README.md index 99a6bc4..4e7cfc4 100644 --- a/ru/README.md +++ b/ru/README.md @@ -110,117 +110,121 @@ docker run hello-world * [`docker kill`](https://docs.docker.com/engine/reference/commandline/kill) посылает SIGKILL к запущеннному контейнеру. * [`docker attach`](https://docs.docker.com/engine/reference/commandline/attach) будет подключаться к работающему контейнеру. -If you want to integrate a container with a [host process manager](https://docs.docker.com/engine/admin/host_integration/), start the daemon with `-r=false` then use `docker start -a`. -If you want to expose container ports through the host, see the [exposing ports](#exposing-ports) section. +Если вы хотите интегрировать контейнер с [диспетчером хостов](https://docs.docker.com/engine/admin/host_integration/), запустите демона с помощью `-r = false`, а затем используйте` docker start -a `. -Restart policies on crashed docker instances are [covered here](http://container42.com/2014/09/30/docker-restart-policies/). +Если вы хотите открыть порты контейнера через хост, см. Раздел [раскрытие портов](#открытие-портов). -#### CPU Constraints +Перезагрузка политик в разбитых экземплярах докеров [рассматривается здесь] (http://container42.com/2014/09/30/docker-restart-policies/). -You can limit CPU, either using a percentage of all CPUs, or by using specific cores. +#### Ограничения процессора + +Вы можете ограничить процессор, используя либо процент от всех процессоров, либо используя определенные ядра. + +Например, вы можете указать параметр [`cpu-shares`](https://docs.docker.com/engine/reference/run/#/cpu-share-constraint). Параметр немного странный - 1024 означает 100% CPU, поэтому, если вы хотите, чтобы контейнер занимал 50% всех ядер процессора, вы должны указать 512. См. https://goldmann.pl/blog/2014/09/11/resource-management-in-docker/#_cpu для получения дополнительной информации: -For example, you can tell the [`cpu-shares`](https://docs.docker.com/engine/reference/run/#/cpu-share-constraint) setting. The setting is a bit strange -- 1024 means 100% of the CPU, so if you want the container to take 50% of all CPU cores, you should specify 512. See https://goldmann.pl/blog/2014/09/11/resource-management-in-docker/#_cpu for more: ``` docker run -ti --c 512 agileek/cpuset-test ``` +Вы также можете использовать только некоторые ядра процессора, используя [`cpuset-cpus`](https://docs.docker.com/engine/reference/run/#/cpuset-constraint). См. https://agileek.github.io/docker/2014/08/06/docker-cpuset/ для получения дополнительной информации: -You can also only use some CPU cores using [`cpuset-cpus`](https://docs.docker.com/engine/reference/run/#/cpuset-constraint). See https://agileek.github.io/docker/2014/08/06/docker-cpuset/ for details and some nice videos: ``` docker run -ti --cpuset-cpus=0,4,6 agileek/cpuset-test ``` +Обратите внимание, что Docker все еще может **видеть** все процессоры внутри контейнера -- он просто не использует все из них. Подробнее см. https://github.com/docker/docker/issues/20770. -Note that Docker can still **see** all of the CPUs inside the container -- it just isn't using all of them. See https://github.com/docker/docker/issues/20770 for more details. -#### Memory Constraints +#### Ограничения памяти -You can also set [memory constraints](https://docs.docker.com/engine/reference/run/#/user-memory-constraints) on Docker: +Вы также можете установить [ограничения памяти](https://docs.docker.com/engine/reference/run/#/user-memory-constraints) на Docker: ``` docker run -it -m 300M ubuntu:14.04 /bin/bash ``` -#### Capabilities +#### Возможности -Linux capabilities can be set by using `cap-add` and `cap-drop`. See https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities for details. This should be used for greater security. +Возможности Linux можно установить, используя `cap-add` и `cap-drop`. См. https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities для подробностей. Это должно использоваться для большей безопасности. -To mount a FUSE based filesystem, you need to combine both --cap-add and --device: +Чтобы подключить файловую систему на основе FUSE, вам необходимо объединить оба --cap-add и --device: ``` docker run --rm -it --cap-add SYS_ADMIN --device /dev/fuse sshfs ``` -Give access to a single device: +Обеспечить доступ к одному устройству: ``` docker run -it --device=/dev/ttyUSB0 debian bash ``` -Give access to all devices: +Обеспечить доступ ко всем устройствам: ``` docker run -it --privileged -v /dev/bus/usb:/dev/bus/usb debian bash ``` -more info about privileged containers [here]( +подробнее о привилегированных контейнерах [здесь]( https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities) ### Info -* [`docker ps`](https://docs.docker.com/engine/reference/commandline/ps) shows running containers. -* [`docker logs`](https://docs.docker.com/engine/reference/commandline/logs) gets logs from container. (You can use a custom log driver, but logs is only available for `json-file` and `journald` in 1.10). -* [`docker inspect`](https://docs.docker.com/engine/reference/commandline/inspect) looks at all the info on a container (including IP address). -* [`docker events`](https://docs.docker.com/engine/reference/commandline/events) gets events from container. -* [`docker port`](https://docs.docker.com/engine/reference/commandline/port) shows public facing port of container. -* [`docker top`](https://docs.docker.com/engine/reference/commandline/top) shows running processes in container. -* [`docker stats`](https://docs.docker.com/engine/reference/commandline/stats) shows containers' resource usage statistics. -* [`docker diff`](https://docs.docker.com/engine/reference/commandline/diff) shows changed files in the container's FS. +* [`docker ps`](https://docs.docker.com/engine/reference/commandline/ps) показывает запущенные контейнеры. +* [`docker logs`](https://docs.docker.com/engine/reference/commandline/logs) получает журналы из контейнера. (Вы можете использовать собственный драйвер журнала, но журналы доступны только для `json-file` и `journald` в 1.10). +* [`docker inspect`](https://docs.docker.com/engine/reference/commandline/inspect) просматривает всю информацию о контейнере (включая IP-адрес). +* [`docker events`](https://docs.docker.com/engine/reference/commandline/events) получает события из контейнера. +* [`docker port`](https://docs.docker.com/engine/reference/commandline/port) показывает открытый порт контейнера. +* [`docker top`](https://docs.docker.com/engine/reference/commandline/top) показывает запущенные процессы в контейнере. +* [`docker stats`](https://docs.docker.com/engine/reference/commandline/stats) показывает статистику использования ресурсов контейнеров. +* [`docker diff`](https://docs.docker.com/engine/reference/commandline/diff) показывает измененные файлы в FS контейнера. -`docker ps -a` shows running and stopped containers. +`docker ps -a` показывает запущенные и остановленные контейнеры. -`docker stats --all` shows a running list of containers. +`docker stats --all` показывает текущий список контейнеров. -### Import / Export +### Импорт / Экспорт -* [`docker cp`](https://docs.docker.com/engine/reference/commandline/cp) copies files or folders between a container and the local filesystem. -* [`docker export`](https://docs.docker.com/engine/reference/commandline/export) turns container filesystem into tarball archive stream to STDOUT. +* [`docker cp`](https://docs.docker.com/engine/reference/commandline/cp) копирует файлы или папки между контейнером и локальной файловой системой. +* [`docker export`](https://docs.docker.com/engine/reference/commandline/export) экспортировать файловую систему контейнера в качестве tar-архива. -### Executing Commands +### Выполнение команд -* [`docker exec`](https://docs.docker.com/engine/reference/commandline/exec) to execute a command in container. +* [`docker exec`](https://docs.docker.com/engine/reference/commandline/exec) для выполнения команды в контейнере. -To enter a running container, attach a new shell process to a running container called foo, use: `docker exec -it foo /bin/bash`. -## Images +Чтобы войти в запущенный контейнер, присоедините новый процесс оболочки к запущенному контейнеру с именем foo, используйте:`docker exec -it foo /bin/bash`. -Images are just [templates for docker containers](https://docs.docker.com/engine/understanding-docker/#how-does-a-docker-image-work). +## Образы -### Lifecycle +Образы - это просто [шаблоны для docker контейнеров](https://docs.docker.com/engine/understanding-docker/#how-does-a-docker-image-work). -* [`docker images`](https://docs.docker.com/engine/reference/commandline/images) shows all images. -* [`docker import`](https://docs.docker.com/engine/reference/commandline/import) creates an image from a tarball. -* [`docker build`](https://docs.docker.com/engine/reference/commandline/build) creates image from Dockerfile. -* [`docker commit`](https://docs.docker.com/engine/reference/commandline/commit) creates image from a container, pausing it temporarily if it is running. -* [`docker rmi`](https://docs.docker.com/engine/reference/commandline/rmi) removes an image. -* [`docker load`](https://docs.docker.com/engine/reference/commandline/load) loads an image from a tar archive as STDIN, including images and tags (as of 0.7). -* [`docker save`](https://docs.docker.com/engine/reference/commandline/save) saves an image to a tar archive stream to STDOUT with all parent layers, tags & versions (as of 0.7). +### Жизненный цикл + +* [`docker images`](https://docs.docker.com/engine/reference/commandline/images) показывает все образы. +* [`docker import`](https://docs.docker.com/engine/reference/commandline/import) создает образ из архива. +* [`docker build`](https://docs.docker.com/engine/reference/commandline/build) создает образ из Dockerfile. +* [`docker commit`](https://docs.docker.com/engine/reference/commandline/commit) создает образ из контейнера, временно приостанавливая его, если он запущен. +* [`docker rmi`](https://docs.docker.com/engine/reference/commandline/rmi) удаляет образ. +* [`docker load`](https://docs.docker.com/engine/reference/commandline/load) загружает образ из архива tar в качестве STDIN, включая образы и теги (начиная с 0.7). +* [`docker save`](https://docs.docker.com/engine/reference/commandline/save) сохраняет образ в поток архива tar в STDOUT со всеми родительскими слоями, тегами и версиями (начиная с 0,7). ### Info -* [`docker history`](https://docs.docker.com/engine/reference/commandline/history) shows history of image. -* [`docker tag`](https://docs.docker.com/engine/reference/commandline/tag) tags an image to a name (local or registry). +* [`docker history`](https://docs.docker.com/engine/reference/commandline/history) показывает историю образа. +* [`docker tag`](https://docs.docker.com/engine/reference/commandline/tag) теги образа к имени (локальному или реестру). -## Checking Docker Version +## Проверка версии Docker -It is very important that you always know the current version of Docker you are currently running on at any point in time.This is very helpful because you get to know what features are compatible with what you have running. This is also important because you know what containers to run from the docker store when you are trying to get template containers. That said let see how to know what version of docker we have running currently +Очень важно, чтобы вы всегда знали текущую версию Docker, в которой вы сейчас работаете, в любой момент времени. Это очень полезно, потому что вы узнаете, какие функции совместимы с тем, что вы используете. Это также важно, потому что вы знаете, какие контейнеры запускать из хранилища докеров, когда вы пытаетесь получить контейнеры шаблонов. Это говорит о том, как узнать, какая версия докера у нас работает в настоящее время: -* ['docker version'](https://docs.docker.com/engine/reference/commandline/version/) check what version of docker you have running + +* ['docker version'](https://docs.docker.com/engine/reference/commandline/version/) проверьте, какая версия докера у вас запущена. * [docker version [OPTIONS]] -Get the server version +Получить версию сервера $ docker version --format '{{.Server.Version}}' 1.8.0 @@ -432,7 +436,9 @@ You may also consider running data-only containers as described [here](http://co [Be aware that you can mount files as volumes.](#volumes-can-be-files) -## Exposing ports + +## Открытие портов + Exposing incoming ports through the host container is [fiddly but doable](https://docs.docker.com/engine/reference/run/#expose-incoming-ports). From 7d7cf95626de36ad75532626f8c788fee557d720 Mon Sep 17 00:00:00 2001 From: eleutherius Date: Sat, 21 Jul 2018 23:00:01 +0300 Subject: [PATCH 6/9] =?UTF-8?q?=09=D0=B8=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5?= =?UTF-8?q?=D0=BD=D0=BE:=20=20=20=20=20=20ru/README.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ru/README.md | 111 +++++++++++++++++++++++++-------------------------- 1 file changed, 55 insertions(+), 56 deletions(-) diff --git a/ru/README.md b/ru/README.md index 4e7cfc4..c637647 100644 --- a/ru/README.md +++ b/ru/README.md @@ -234,43 +234,41 @@ $ docker version --format '{{json .}}' {"Client":{"Version":"1.8.0","ApiVersion":"1.20","GitCommit":"f5bae0a","GoVersion":"go1.4.2","Os":"linux","Arch":"am"} ### Cleaning up +Хотя вы можете использовать команду `docker rmi` для удаления определенных образов, есть инструмент под названием [docker-gc](https://github.com/spotify/docker-gc), который будет безопасно очищать образы, которые больше не используются любыми контейнерами. -While you can use the `docker rmi` command to remove specific images, there's a tool called [docker-gc](https://github.com/spotify/docker-gc) that will safely clean up images that are no longer used by any containers. +### Загрузка/Сохранение образов -### Load/Save image - -Load an image from file: +Загрузите образ из файла: ``` docker load < my_image.tar.gz ``` -Save an existing image: +Сохранить существующий образ: ``` docker save my_image:my_tag | gzip > my_image.tar.gz ``` +### Импорт/Экспорт контейнера -### Import/Export container - -Import a container as an image from file: +Импортировать контейнер как образ из файла: ``` cat my_container.tar.gz | docker import - my_image:my_tag ``` -Export an existing container: +Экспортировать существующий контейнер: ``` docker export my_container | gzip > my_container.tar.gz ``` -### Difference between loading a saved image and importing an exported container as an image -Loading an image using the `load` command creates a new image including its history. -Importing a container as an image using the `import` command creates a new image excluding the history which results in a smaller image size compared to loading an image. +### Разница между загрузкой сохраненного образа и импортом экспортированного контейнера в качестве образа -## Networks +Загрузка изображения с помощью команды `load` создает новый образ, включая его историю. +Импорт контейнера в качестве образа с помощью команды `import` создает новый образ, исключая историю, которая приводит к меньшему размеру образов по сравнению с загрузкой образа. -Docker has a [networks](https://docs.docker.com/engine/userguide/networking/) feature. Not much is known about it, so this is a good place to expand the cheat sheet. There is a note saying that it's a good way to configure docker containers to talk to each other without using ports. See [working with networks](https://docs.docker.com/engine/userguide/networking/work-with-networks/) for more details. +## Сети +Docker имеет функцию [network](https://docs.docker.com/engine/userguide/networking/). Об этом мало что известно, поэтому это хорошее место для расширения чит-листа. Существует примечание, в котором говорится, что это хороший способ настроить контейнеры докеров, чтобы разговаривать друг с другом без использования портов. Подробнее см. [Работа с сетями](https://docs.docker.com/engine/userguide/networking/work-with-networks/). -### Lifecycle +### Жизненный цикл * [`docker network create`](https://docs.docker.com/engine/reference/commandline/network_create/) * [`docker network rm`](https://docs.docker.com/engine/reference/commandline/network_rm/) @@ -285,81 +283,82 @@ Docker has a [networks](https://docs.docker.com/engine/userguide/networking/) fe * [`docker network connect`](https://docs.docker.com/engine/reference/commandline/network_connect/) * [`docker network disconnect`](https://docs.docker.com/engine/reference/commandline/network_disconnect/) -You can specify a [specific IP address for a container](https://blog.jessfraz.com/post/ips-for-all-the-things/): +Вы можете указать [конкретный IP-адрес для контейнера](https://blog.jessfraz.com/post/ips-for-all-the-things/): ``` -# create a new bridge network with your subnet and gateway for your ip block +# создать новую сеть bridge с вашей подсетью и шлюзом для вашего ip-блока docker network create --subnet 203.0.113.0/24 --gateway 203.0.113.254 iptastic -# run a nginx container with a specific ip in that block +# запустите контейнер nginx с определенным ip в этом блоке $ docker run --rm -it --net iptastic --ip 203.0.113.2 nginx -# curl the ip from any other place (assuming this is a public ip block duh) +# curl ip из любого другого места (при условии, что это общедоступный ip-блок) $ curl 203.0.113.2 ``` -## Registry & Repository +## Реестр и репозиторий -A repository is a *hosted* collection of tagged images that together create the file system for a container. +Репозиторий - это * размещенная * коллекция помеченных образов, которые вместе создают файловую систему для контейнера. -A registry is a *host* -- a server that stores repositories and provides an HTTP API for [managing the uploading and downloading of repositories](https://docs.docker.com/engine/tutorials/dockerrepos/). +Реестр - это * хост * - сервер, который хранит репозитории и предоставляет HTTP API для [управления загрузкой и загрузкой репозиториев](https://docs.docker.com/engine/tutorials/dockerrepos/). -Docker.com hosts its own [index](https://hub.docker.com/) to a central registry which contains a large number of repositories. Having said that, the central docker registry [does not do a good job of verifying images](https://titanous.com/posts/docker-insecurity) and should be avoided if you're worried about security. +Docker.com размещает свой собственный [index](https://hub.docker.com/) в центральном реестре, который содержит большое количество репозиториев. Сказав это, центральный реестр докеров (не делает хорошую работу по проверке образов)(https://titanous.com/posts/docker-insecurity), и его следует избегать, если вас беспокоит безопасность. -* [`docker login`](https://docs.docker.com/engine/reference/commandline/login) to login to a registry. -* [`docker logout`](https://docs.docker.com/engine/reference/commandline/logout) to logout from a registry. -* [`docker search`](https://docs.docker.com/engine/reference/commandline/search) searches registry for image. -* [`docker pull`](https://docs.docker.com/engine/reference/commandline/pull) pulls an image from registry to local machine. -* [`docker push`](https://docs.docker.com/engine/reference/commandline/push) pushes an image to the registry from local machine. +* [`docker login`](https://docs.docker.com/engine/reference/commandline/login) для входа в реестр. +* [`docker logout`](https://docs.docker.com/engine/reference/commandline/logout) для выхода из реестра. +* [`docker search`](https://docs.docker.com/engine/reference/commandline/search) ищет реестр для образа. +* [`docker pull`](https://docs.docker.com/engine/reference/commandline/pull) вытаскивает образ из реестра на локальный компьютер. +* [`docker push`](https://docs.docker.com/engine/reference/commandline/push) толкает образ в реестр с локальной машины. -### Run local registry +### Запуск локального реестра -You can run a local registry by using the [docker distribution](https://github.com/docker/distribution) project and looking at the [local deploy](https://github.com/docker/docker.github.io/blob/master/registry/deploying.md) instructions. +Вы можете запустить локальный реестр с помощью проекта [docker distribution](https://github.com/docker/distribution) и посмотреть на [локальное развертывание](https://github.com/docker/docker.github.io/blob/master/registry/deploying.md) инструкци. -Also see the [mailing list](https://groups.google.com/a/dockerproject.org/forum/#!forum/distribution). +Также см. [Список рассылки](https://groups.google.com/a/dockerproject.org/forum/#!forum/distribution). ## Dockerfile -[The configuration file](https://docs.docker.com/engine/reference/builder/). Sets up a Docker container when you run `docker build` on it. Vastly preferable to `docker commit`. +[Файл конфигурации](https://docs.docker.com/engine/reference/builder/). Устанавливает контейнер Docker, когда вы запускаете на нем `docker build`. Крайне предпочтительнее `docker commit`. -Here are some common text editors and their syntax highlighting modules you could use to create Dockerfiles: -* If you use [jEdit](http://jedit.org), I've put up a syntax highlighting module for [Dockerfile](https://github.com/wsargent/jedit-docker-mode) you can use. +Вот некоторые распространенные текстовые редакторы и их модули подсветки синтаксиса, которые вы могли бы использовать для создания Dockerfiles: +* Если вы используете [jEdit](http://jedit.org), я установил модуль подсветки синтаксиса для [Dockerfile](https://github.com/wsargent/jedit-docker-mode) вы можете использовать. * [Sublime Text 2](https://packagecontrol.io/packages/Dockerfile%20Syntax%20Highlighting) * [Atom](https://atom.io/packages/language-docker) * [Vim](https://github.com/ekalinin/Dockerfile.vim) * [Emacs](https://github.com/spotify/dockerfile-mode) * [TextMate](https://github.com/docker/docker/tree/master/contrib/syntax/textmate) * [VS Code](https://github.com/Microsoft/vscode-docker) -* Also see [Docker meets the IDE](https://domeide.github.io/) +* Также см. [Docker meets the IDE](https://domeide.github.io/) -### Instructions +### Инструкции * [.dockerignore](https://docs.docker.com/engine/reference/builder/#dockerignore-file) -* [FROM](https://docs.docker.com/engine/reference/builder/#from) Sets the Base Image for subsequent instructions. -* [MAINTAINER (deprecated - use LABEL instead)](https://docs.docker.com/engine/reference/builder/#maintainer-deprecated) Set the Author field of the generated images. -* [RUN](https://docs.docker.com/engine/reference/builder/#run) execute any commands in a new layer on top of the current image and commit the results. -* [CMD](https://docs.docker.com/engine/reference/builder/#cmd) provide defaults for an executing container. -* [EXPOSE](https://docs.docker.com/engine/reference/builder/#expose) informs Docker that the container listens on the specified network ports at runtime. NOTE: does not actually make ports accessible. -* [ENV](https://docs.docker.com/engine/reference/builder/#env) sets environment variable. -* [ADD](https://docs.docker.com/engine/reference/builder/#add) copies new files, directories or remote file to container. Invalidates caches. Avoid `ADD` and use `COPY` instead. -* [COPY](https://docs.docker.com/engine/reference/builder/#copy) copies new files or directories to container. Note that this only copies as root, so you have to chown manually regardless of your USER / WORKDIR setting. See https://github.com/moby/moby/issues/30110 -* [ENTRYPOINT](https://docs.docker.com/engine/reference/builder/#entrypoint) configures a container that will run as an executable. -* [VOLUME](https://docs.docker.com/engine/reference/builder/#volume) creates a mount point for externally mounted volumes or other containers. -* [USER](https://docs.docker.com/engine/reference/builder/#user) sets the user name for following RUN / CMD / ENTRYPOINT commands. -* [WORKDIR](https://docs.docker.com/engine/reference/builder/#workdir) sets the working directory. -* [ARG](https://docs.docker.com/engine/reference/builder/#arg) defines a build-time variable. -* [ONBUILD](https://docs.docker.com/engine/reference/builder/#onbuild) adds a trigger instruction when the image is used as the base for another build. -* [STOPSIGNAL](https://docs.docker.com/engine/reference/builder/#stopsignal) sets the system call signal that will be sent to the container to exit. -* [LABEL](https://docs.docker.com/engine/userguide/labels-custom-metadata/) apply key/value metadata to your images, containers, or daemons. +* [FROM](https://docs.docker.com/engine/reference/builder/#from) Устанавливает базовое изображение для последующих инструкций. +* [MAINTAINER (устаревший - вместо этого используйте LABEL)](https://docs.docker.com/engine/reference/builder/#maintainer-deprecated) Задайте поле Author созданных образов. +* [RUN](https://docs.docker.com/engine/reference/builder/#run) выполнять любые команды в новом слое поверх текущего образа и фиксировать результаты. +* [CMD](https://docs.docker.com/engine/reference/builder/#cmd) предоставлять значения по умолчанию для исполняемого контейнера. +* [EXPOSE](https://docs.docker.com/engine/reference/builder/#expose) сообщает Docker, что контейнер прослушивает указанные сетевые порты во время выполнения. ПРИМЕЧАНИЕ: на самом деле не делает доступными порты. +* [ENV](https://docs.docker.com/engine/reference/builder/#env) устанавливает переменную среды. +* [ADD](https://docs.docker.com/engine/reference/builder/#add) копирует в контейнер новые файлы, каталоги или удаленный файл. Недействительный кеш. Избегайте `ADD` и вместо этого используйте` COPY`. +* [COPY](https://docs.docker.com/engine/reference/builder/#copy) копирует в контейнер новые файлы или каталоги. Обратите внимание, что это копируется только с правами root, поэтому вы должны вручную управлять вне зависимости от настроек USER / WORKDIR. См. https://github.com/moby/moby/issues/30110 +* [ENTRYPOINT](https://docs.docker.com/engine/reference/builder/#entrypoint) настраивает контейнер, который будет запускаться как исполняемый файл. +* [VOLUME](https://docs.docker.com/engine/reference/builder/#volume) создает точку монтирования для внешних томов или других контейнеров. +* [USER](https://docs.docker.com/engine/reference/builder/#user) задает имя пользователя для следующих команд RUN / CMD / ENTRYPOINT. +* [WORKDIR](https://docs.docker.com/engine/reference/builder/#workdir) устанавливает рабочий каталог. +* [ARG](https://docs.docker.com/engine/reference/builder/#arg) определяет переменную времени сборки. +* [ONBUILD](https://docs.docker.com/engine/reference/builder/#onbuild) добавляет инструкцию триггера, когда изображение используется в качестве основы для другой сборки. +* [STOPSIGNAL](https://docs.docker.com/engine/reference/builder/#stopsignal) устанавливает сигнал системного вызова, который будет отправлен в контейнер для выхода. +* [LABEL](https://docs.docker.com/engine/userguide/labels-custom-metadata/) устанавливает сигнал системного вызова, который будет отправлен в контейнер для выхода. ### Tutorial -* [Flux7's Dockerfile Tutorial](http://flux7.com/blogs/docker/docker-tutorial-series-part-3-automation-is-the-word-using-dockerfile/) +* [Учебник Flux7's Dockerfile +](http://flux7.com/blogs/docker/docker-tutorial-series-part-3-automation-is-the-word-using-dockerfile/) -### Examples +### Примеры -* [Examples](https://docs.docker.com/engine/reference/builder/#dockerfile-examples) -* [Best practices for writing Dockerfiles](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/) +* [Примеры](https://docs.docker.com/engine/reference/builder/#dockerfile-examples) +* [Рекомендации по написанию Dockerfiles](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/) * [Michael Crosby](http://crosbymichael.com/) has some more [Dockerfiles best practices](http://crosbymichael.com/dockerfile-best-practices.html) / [take 2](http://crosbymichael.com/dockerfile-best-practices-take-2.html). * [Building Good Docker Images](http://jonathan.bergknoff.com/journal/building-good-docker-images) / [Building Better Docker Images](http://jonathan.bergknoff.com/journal/building-better-docker-images) * [Managing Container Configuration with Metadata](https://speakerdeck.com/garethr/managing-container-configuration-with-metadata) From 4701b2688887b265028424575d1e5deac3cdec9d Mon Sep 17 00:00:00 2001 From: eleutherius Date: Mon, 24 Sep 2018 23:05:15 +0300 Subject: [PATCH 7/9] modified: ru/README.md --- ru/README.md | 123 ++++++++++++++++++++++++++------------------------- 1 file changed, 62 insertions(+), 61 deletions(-) diff --git a/ru/README.md b/ru/README.md index c637647..26833ac 100644 --- a/ru/README.md +++ b/ru/README.md @@ -360,15 +360,15 @@ Docker.com размещает свой собственный [index](https://hu * [Примеры](https://docs.docker.com/engine/reference/builder/#dockerfile-examples) * [Рекомендации по написанию Dockerfiles](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/) * [Michael Crosby](http://crosbymichael.com/) has some more [Dockerfiles best practices](http://crosbymichael.com/dockerfile-best-practices.html) / [take 2](http://crosbymichael.com/dockerfile-best-practices-take-2.html). -* [Building Good Docker Images](http://jonathan.bergknoff.com/journal/building-good-docker-images) / [Building Better Docker Images](http://jonathan.bergknoff.com/journal/building-better-docker-images) -* [Managing Container Configuration with Metadata](https://speakerdeck.com/garethr/managing-container-configuration-with-metadata) -* [How to write excellent Dockerfiles](https://rock-it.pl/how-to-write-excellent-dockerfiles/) +* [Building Good Docker Images](http://jonathan.bergknoff.com/journal/building-good-docker-images) / [Создание лучших образов docker](http://jonathan.bergknoff.com/journal/building-better-docker-images) +* [Управление конфигурацией контейнера с метаданными](https://speakerdeck.com/garethr/managing-container-configuration-with-metadata) +* [ Как написать отличный Dockerfiles](https://rock-it.pl/how-to-write-excellent-dockerfiles/) -## Layers +## Слои -The versioned filesystem in Docker is based on layers. They're like [git commits or changesets for filesystems](https://docs.docker.com/engine/userguide/storagedriver/imagesandcontainers/). +Файловая система с версией в Docker основана на слоях. Они похожи на [git комиты или измекнения для файловой системы](https://docs.docker.com/engine/userguide/storagedriver/imagesandcontainers/). -## Links +## Связи Links are how Docker containers talk to each other [through TCP/IP ports](https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/). [Linking into Redis](https://docs.docker.com/engine/examples/running_redis_service/) and [Atlassian](https://blogs.atlassian.com/2013/11/docker-all-the-things-at-atlassian-automation-and-wiring/) show worked examples. You can also resolve [links by hostname](https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/#/updating-the-etchosts-file). @@ -525,31 +525,31 @@ docker run --security-opt=no-new-privileges From the [Docker Security Cheat Sheet](http://container-solutions.com/content/uploads/2015/06/15.06.15_DockerCheatSheet_A2.pdf) (it's in PDF which makes it hard to use, so copying below) by [Container Solutions](http://container-solutions.com/is-docker-safe-for-production/): -Turn off interprocess communication with: +Отключите межпроцессное взаимодействие с: ``` docker -d --icc=false --iptables ``` -Set the container to be read-only: +Установите контейнер только для чтения: ``` docker run --read-only ``` -Verify images with a hashsum: +Проверьте образы с помощью хэш-функции: ``` docker pull debian@sha256:a25306f3850e1bd44541976aa7b5fd0a29be ``` -Set volumes to be read only: +Установить тома только для чтения: ``` docker run -v $(pwd)/secrets:/secrets:ro debian ``` -Define and run a user in your Dockerfile so you don't run as root inside the container: +Определите и запустите пользователя в вашем файле Docker, чтобы вы не запускались как root внутри контейнера: ``` RUN groupadd -r user && useradd -r -g user user @@ -571,19 +571,19 @@ To enable user namespaces ("remap the userns") in Ubuntu 15.10, [follow the blog ### Security Roadmap -The Docker roadmap talks about [seccomp support](https://github.com/docker/docker/blob/master/ROADMAP.md#11-security). -There is an AppArmor policy generator called [bane](https://github.com/jfrazelle/bane), and they're working on [security profiles](https://github.com/docker/docker/issues/17142). +В дорожной карте docker говорится о [поддержке seccomp]https://github.com/docker/docker/blob/master/ROADMAP.md#11-security). +Существует генератор политики AppArmor, называемый [bane](https://github.com/jfrazelle/bane), и они работают над [профилями безопасности](https://github.com/docker/docker/issues/17142). -## Tips +## Советы -Sources: +Источники: -* [15 Docker Tips in 5 minutes](http://sssslide.com/speakerdeck.com/bmorearty/15-docker-tips-in-5-minutes) +* [15 Советы docker за 5 минут](http://sssslide.com/speakerdeck.com/bmorearty/15-docker-tips-in-5-minutes) * [CodeFresh Everyday Hacks Docker](https://codefresh.io/blog/everyday-hacks-docker/) ### Prune -The new [Data Management Commands](https://github.com/docker/docker/pull/26108) have landed as of Docker 1.13: +Новые [Команды управления данными](https://github.com/docker/docker/pull/26108) Появились с Docker 1.13: * `docker system prune` * `docker volume prune` @@ -595,7 +595,7 @@ The new [Data Management Commands](https://github.com/docker/docker/pull/26108) `docker system df` presents a summary of the space currently used by different docker objects. -### Heredoc Docker Container +### Контейнер для докеров Heredoc ``` docker build -t htop - << EOF @@ -604,7 +604,7 @@ RUN apk --no-cache add htop EOF ``` -### Last Ids +### Последние идентификаторы ``` alias dl='docker ps -l -q' @@ -612,31 +612,31 @@ docker run ubuntu echo hello world docker commit $(dl) helloworld ``` -### Commit with command (needs Dockerfile) +### Commit с командой (требуется Dockerfile) ``` docker commit -run='{"Cmd":["postgres", "-too -many -opts"]}' $(dl) postgres ``` -### Get IP address +### Получить IP-адрес ``` docker inspect $(dl) | grep -wm1 IPAddress | cut -d '"' -f 4 ``` -or install [jq](https://stedolan.github.io/jq/): +или установите [jq](https://stedolan.github.io/jq/): ``` docker inspect $(dl) | jq -r '.[0].NetworkSettings.IPAddress' ``` -or using a [go template](https://docs.docker.com/engine/reference/commandline/inspect): +или используя [go шаблон](https://docs.docker.com/engine/reference/commandline/inspect): ``` docker inspect -f '{{ .NetworkSettings.IPAddress }}' ``` -or when building an image from Dockerfile, when you want to pass in a build argument: +или при создании обрзов из файла Docker, когда вы хотите передать аргумент построения: ``` DOCKER_HOST_IP=`ifconfig | grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}" | grep -v 127.0.0.1 | awk '{ print $2 }' | cut -f2 -d: | head -n1` @@ -647,88 +647,89 @@ docker build \ some-directory/ ``` -### Get port mapping +### Получить сопоставление портов ``` docker inspect -f '{{range $p, $conf := .NetworkSettings.Ports}} {{$p}} -> {{(index $conf 0).HostPort}} {{end}}' ``` -### Find containers by regular expression +### Поиск контейнеров путем регулярного выражения ``` for i in $(docker ps -a | grep "REGEXP_PATTERN" | cut -f1 -d" "); do echo $i; done ``` -### Get Environment Settings +### Получить настройки среды ``` docker run --rm ubuntu env ``` -### Kill running containers +### Убить запущенные контейнеры ``` docker kill $(docker ps -q) ``` -### Delete all containers (force!! running or stopped containers) +### Удалите все контейнеры (принудительные или запущенные контейнеры) ``` docker rm -f $(docker ps -qa) ``` -### Delete old containers +### Удалить старые контейнеры ``` docker ps -a | grep 'weeks ago' | awk '{print $1}' | xargs docker rm ``` -### Delete stopped containers +### Удалить остановленные контейнеры ``` docker rm -v $(docker ps -a -q -f status=exited) ``` -### Delete containers after stopping +### Удаление контейнеров после остановки ``` docker stop $(docker ps -aq) && docker rm -v $(docker ps -aq) ``` -### Delete dangling images +### Удалить оборванные образы ``` docker rmi $(docker images -q -f dangling=true) ``` -### Delete all images +### Удалить все образы ``` docker rmi $(docker images -q) ``` -### Delete dangling volumes +### Удалить оборванные тома -As of Docker 1.9: +Начиная с Docker 1.9: ``` docker volume rm $(docker volume ls -q -f dangling=true) ``` In 1.9.0, the filter `dangling=false` does _not_ work - it is ignored and will list all volumes. +В 1.9.0, фильтр `dangling=false` _не_ работает - он игнорируется и будет перечислять все тома. -### Show image dependencies +### Показать зависимости образов ``` docker images -viz | dot -Tpng -o docker.png ``` -### Slimming down Docker containers +### Похудение Docker контейнеров -- Cleaning APT in a RUN layer +- Очистка APT на уровне RUN -This should be done in the same layer as other apt commands. -Otherwise, the previous layers still persist the original information and your images will still be fat. +Это должно быть сделано в том же слое, что и другие команды apt. +В противном случае предыдущие слои по-прежнему сохраняют исходную информацию, и ваши образы будут по-прежнему жирными. ``` RUN {apt commands} \ @@ -736,89 +737,89 @@ RUN {apt commands} \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* ``` -- Flatten an image +- Сгладить образ ``` ID=$(docker run -d image-name /bin/bash) docker export $ID | docker import – flat-image-name ``` -- For backup +- Для резервного копирования ``` ID=$(docker run -d image-name /bin/bash) (docker export $ID | gzip -c > image.tgz) gzip -dc image.tgz | docker import - flat-image-name ``` -### Monitor system resource utilization for running containers +### Мониторинг использования ресурсов системы для запуска контейнеров -To check the CPU, memory, and network I/O usage of a single container, you can use: +Чтобы проверить использование ЦП, памяти и сетевого ввода-вывода в одном контейнере, вы можете использовать: ``` docker stats ``` -For all containers listed by id: +Для всех контейнеров, перечисленных в id: ``` docker stats $(docker ps -q) ``` -For all containers listed by name: +Для всех контейнеров, перечисленных по имени: ``` docker stats $(docker ps --format '{{.Names}}') ``` -For all containers listed by image: +Для всех контейнеров, перечисленных по образам: ``` docker ps -a -f ancestor=ubuntu ``` -Remove all untagged images +Удалить все непомеченные образы ``` docker rmi $(docker images | grep “^” | awk '{split($0,a," "); print a[3]}') ``` -Remove container by a regular expression +Удалить контейнер с помощью регулярного выражения ``` docker ps -a | grep wildfly | awk '{print $1}' | xargs docker rm -f ``` -Remove all exited containers +Удалить все завершенные контейнеры ``` docker rm -f $(docker ps -a | grep Exit | awk '{ print $1 }') ``` -### Volumes can be files +### Томы могут быть файлами -Be aware that you can mount files as volumes. For example you can inject a configuration file like this: +Имейте в виду, что вы можете монтировать файлы в виде томов. Например, вы можете ввести файл конфигурации следующим образом: ``` bash -# copy file from container +# копировать файл из контейнера docker run --rm httpd cat /usr/local/apache2/conf/httpd.conf > httpd.conf -# edit file +# редактировать файл vim httpd.conf -# start container with modified configuration +# запускать контейнер с измененной конфигурацией docker run --rm -ti -v "$PWD/httpd.conf:/usr/local/apache2/conf/httpd.conf:ro" -p "80:80" httpd ``` -## Contributing +## Содействие -Here's how to contribute to this cheat sheet. +Вот как внести свой вклад в этот чит-лист. -### Open README.md +### Открыть README.md Click [README.md](https://github.com/wsargent/docker-cheat-sheet/blob/master/README.md) <-- this link ![Click This](../images/click.png) -### Edit Page +### Отредактировать страницу ![Edit This](../images/edit.png) -### Make Changes and Commit +### Внести изменения и зафиксировать ![Change This](../images/change.png) From 61a36e8f1dca11cb184fe7d711b69e7cc7c66f14 Mon Sep 17 00:00:00 2001 From: eleutherius Date: Mon, 24 Sep 2018 23:52:39 +0300 Subject: [PATCH 8/9] modified: ru/README.md --- ru/README.md | 34 ++++++++++++++++------------------ 1 file changed, 16 insertions(+), 18 deletions(-) diff --git a/ru/README.md b/ru/README.md index 26833ac..0d6d88f 100644 --- a/ru/README.md +++ b/ru/README.md @@ -369,43 +369,40 @@ Docker.com размещает свой собственный [index](https://hu Файловая система с версией в Docker основана на слоях. Они похожи на [git комиты или измекнения для файловой системы](https://docs.docker.com/engine/userguide/storagedriver/imagesandcontainers/). ## Связи +Ссылки, как контейнеры Docker общаются друг с другом [через порты TCP/IP](https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/). [Связь с Redis](https://docs.docker.com/engine/examples/running_redis_service/) и [Atlassian](https://blogs.atlassian.com/2013/11/docker-all-the-things-at-atlassian-automation-and-wiring/) показать приведенные примеры. Вы также можете разрешить [ссылки по имени хоста](https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/#/updating-the-etchosts-file). -Links are how Docker containers talk to each other [through TCP/IP ports](https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/). [Linking into Redis](https://docs.docker.com/engine/examples/running_redis_service/) and [Atlassian](https://blogs.atlassian.com/2013/11/docker-all-the-things-at-atlassian-automation-and-wiring/) show worked examples. You can also resolve [links by hostname](https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/#/updating-the-etchosts-file). +Это в некоторой степени устарело [сетями определяемыми пользователем](https://docs.docker.com/engine/userguide/networking/#user-defined-networks). -This has been deprected to some extent by [user-defined networks](https://docs.docker.com/engine/userguide/networking/#user-defined-networks). +ПРИМЕЧАНИЕ. Если вы хотите, чтобы контейнеры ТОЛЬКО связывались друг с другом по ссылкам, запустите демон docker с помощью `-icc = false`, чтобы отключить межпроцессное общение. -NOTE: If you want containers to ONLY communicate with each other through links, start the docker daemon with `-icc=false` to disable inter process communication. - -If you have a container with the name CONTAINER (specified by `docker run --name CONTAINER`) and in the Dockerfile, it has an exposed port: +Если у вас есть контейнер с именем CONTAINER (указанный `docker run -name CONTAINER`) и в Dockerfile, он имеет открытый порт: ``` EXPOSE 1337 ``` - -Then if we create another container called LINKED like so: +Тогда, если мы создадим еще один контейнер LINKED, например: ``` docker run -d --link CONTAINER:ALIAS --name LINKED user/wordpress ``` - -Then the exposed ports and aliases of CONTAINER will show up in LINKED with the following environment variables: +Затем открытые порты и псевдонимы CONTAINER будут отображаться в LINKED со следующими переменными среды: ``` $ALIAS_PORT_1337_TCP_PORT $ALIAS_PORT_1337_TCP_ADDR ``` -And you can connect to it that way. +И вы можете подключиться к нему таким образом. -To delete links, use `docker rm --link`. +Чтобы удалить ссылки, используйте `docker rm --link`. -Generally, linking between docker services is a subset of "service discovery", a big problem if you're planning to use Docker at scale in production. Please read [The Docker Ecosystem: Service Discovery and Distributed Configuration Stores](https://www.digitalocean.com/community/tutorials/the-docker-ecosystem-service-discovery-and-distributed-configuration-stores) for more info. +Как правило, связи между контейнерами Docker является подмножеством «обнаружения сервисов», что является большой проблемой, если вы планируете использовать Docker в производстве. Пожалуйста, прочитайте [The Docker Ecosystem: Service Discovery and Distributed Configuration Stores](https://www.digitalocean.com/community/tutorials/the-docker-ecosystem-service-discovery-and-distributed-configuration-stores) или большей информации. -## Volumes +## Тома -Docker volumes are [free-floating filesystems](https://docs.docker.com/engine/tutorials/dockervolumes/). They don't have to be connected to a particular container. You should use volumes mounted from [data-only containers](https://medium.com/@ramangupta/why-docker-data-containers-are-good-589b3c6c749e) for portability. +Тома Docker - [свободно плавающие файловые системы](https://docs.docker.com/engine/tutorials/dockervolumes/).Они не обязательно должны быть подключены к конкретному контейнеру. Вы должны использовать тома, примонированные из [контейнеров только для данных](https://medium.com/@ramangupta/why-docker-data-containers-are-good-589b3c6c749e) для переносимости. -### Lifecycle +### Жизненный цикл * [`docker volume create`](https://docs.docker.com/engine/reference/commandline/volume_create/) * [`docker volume rm`](https://docs.docker.com/engine/reference/commandline/volume_rm/) @@ -415,11 +412,12 @@ Docker volumes are [free-floating filesystems](https://docs.docker.com/engine/tu * [`docker volume ls`](https://docs.docker.com/engine/reference/commandline/volume_ls/) * [`docker volume inspect`](https://docs.docker.com/engine/reference/commandline/volume_inspect/) -Volumes are useful in situations where you can't use links (which are TCP/IP only). For instance, if you need to have two docker instances communicate by leaving stuff on the filesystem. +Тома полезны в ситуациях, когда вы не можете использовать ссылки (которые только TCP / IP). Например, если вам нужно, чтобы два экземпляра docker обменивались данными, оставив результат в файловой системе. -You can mount them in several docker containers at once, using `docker run --volumes-from`. +Вы можете смонтировать их в нескольких контейнерах докеров сразу, используя `docker run --volumes-from`. + +Поскольку тома являются изолированными файловыми системами, они часто используются для хранения состояния из вычислений между переходными контейнерами. То есть, у вас может быть контейнер без учета состояния и переходный процесс, запускаемый из скрипта, сдуть его, а затем добавить второй экземпляр переходного контейнера, откуда он остановился. -Because volumes are isolated filesystems, they are often used to store state from computations between transient containers. That is, you can have a stateless and transient container run from a recipe, blow it away, and then have a second instance of the transient container pick up from where the last one left off. See [advanced volumes](http://crosbymichael.com/advanced-docker-volumes.html) for more details. Container42 is [also helpful](http://container42.com/2014/11/03/docker-indepth-volumes/). From d712676618f919262227b00077bc92b622d9f2ee Mon Sep 17 00:00:00 2001 From: eleutherius Date: Tue, 25 Sep 2018 03:18:10 +0300 Subject: [PATCH 9/9] modified: ru/README.md --- ru/README.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/ru/README.md b/ru/README.md index 0d6d88f..3996ce6 100644 --- a/ru/README.md +++ b/ru/README.md @@ -8,8 +8,8 @@ * [Предпосылки](#Предпосылки) * [Установка](#Установка) * [Контейнеры](#Контейнеры) -* [Образы](#images) -* [Сеть](#networks) +* [Образы](#Образы) +* [Сеть](#Сеть) * [Реестр и репозиторий](#registry--repository) * [Dockerfile](#dockerfile) * [Слои](#layers) @@ -35,7 +35,7 @@ Docker помогает разработчикам создавать и отп ### Linux -Ядро 3.10.x [минимальное требование] (https://docs.docker.com/engine/installation/binaries/#check-kernel-dependencies) для Docker. +Ядро 3.10.x [минимальное требование](https://docs.docker.com/engine/installation/binaries/#check-kernel-dependencies) для Docker. ### MacOS @@ -53,7 +53,7 @@ curl -sSL https://get.docker.com/ | sh Если вы не хотите запускать случайный сценарий оболочки, см. [Инструкции](https://docs.docker.com/engine/installation/linux/) по установке на ваш дистрибутив. -Если вы являетесь полноправным новичком Docker, вы должны следовать [сериям учебников] (https://docs.docker.com/engine/getstarted/) сейчас. +Если вы являетесь полноправным новичком Docker, вы должны следовать [сериям учебников](https://docs.docker.com/engine/getstarted/) сейчас. ### macOS Скачать и установить [Docker Community Edition](https://www.docker.com/community-edition). если у вас есть Homebrew-Cask, просто введите `brew cask install docker`. @@ -115,7 +115,7 @@ docker run hello-world Если вы хотите открыть порты контейнера через хост, см. Раздел [раскрытие портов](#открытие-портов). -Перезагрузка политик в разбитых экземплярах докеров [рассматривается здесь] (http://container42.com/2014/09/30/docker-restart-policies/). +Перезагрузка политик в разбитых экземплярах докеров [рассматривается здесь](http://container42.com/2014/09/30/docker-restart-policies/). #### Ограничения процессора @@ -419,7 +419,7 @@ $ALIAS_PORT_1337_TCP_ADDR Поскольку тома являются изолированными файловыми системами, они часто используются для хранения состояния из вычислений между переходными контейнерами. То есть, у вас может быть контейнер без учета состояния и переходный процесс, запускаемый из скрипта, сдуть его, а затем добавить второй экземпляр переходного контейнера, откуда он остановился. -See [advanced volumes](http://crosbymichael.com/advanced-docker-volumes.html) for more details. Container42 is [also helpful](http://container42.com/2014/11/03/docker-indepth-volumes/). +См. [Расширенные тома](http://crosbymichael.com/advanced-docker-volumes.html) для больших подробностей. Container42 is [also helpful](http://container42.com/2014/11/03/docker-indepth-volumes/). You can [map MacOS host directories as docker volumes](https://docs.docker.com/engine/tutorials/dockervolumes/#mount-a-host-directory-as-a-data-volume): @@ -431,7 +431,7 @@ You can use remote NFS volumes if you're [feeling brave](https://docs.docker.com You may also consider running data-only containers as described [here](http://container42.com/2013/12/16/persistent-volumes-with-docker-container-as-volume-pattern/) to provide some data portability. -[Be aware that you can mount files as volumes.](#volumes-can-be-files) +[Вы можете [сопоставлять каталоги хостов MacOS в виде докеровских томов]](#volumes-can-be-files) ## Открытие портов @@ -477,7 +477,7 @@ If you forget what you mapped the port to on the host container, use `docker por docker port CONTAINER $CONTAINERPORT ``` -## Best Practices +## Лучша практика This is where general Docker best practices and war stories go: @@ -487,7 +487,7 @@ This is where general Docker best practices and war stories go: * [Building a Development Environment With Docker](https://tersesystems.com/2013/11/20/building-a-development-environment-with-docker/) * [Discourse in a Docker Container](https://samsaffron.com/archive/2013/11/07/discourse-in-a-docker-container) -## Security +## Безопасность This is where security tips about Docker go. The Docker [security](https://docs.docker.com/engine/security/security/) page goes into more detail. @@ -497,7 +497,7 @@ Docker should not be your only defense. You should secure and harden it. For an understanding of what containers leave exposed, you should read [Understanding and Hardening Linux Containers](https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/2016/april/ncc_group_understanding_hardening_linux_containers-1-1.pdf) by [Aaron Grattafiori](https://twitter.com/dyn___). This is a complete and comprehensive guide to the issues involved with containers, with a plethora of links and footnotes leading on to yet more useful content. The security tips following are useful if you've already hardened containers in the past, but are not a substitute for understanding. -### Security Tips +### Советы по безопасности For greatest security, you want to run Docker inside a virtual machine. This is straight from the Docker Security Team Lead -- [slides](http://www.slideshare.net/jpetazzo/linux-containers-lxc-docker-and-security) / [notes](http://www.projectatomic.io/blog/2014/08/is-it-safe-a-look-at-docker-and-security-from-linuxcon/). Then, run with AppArmor / seccomp / SELinux / grsec etc to [limit the container permissions](http://linux-audit.com/docker-security-best-practices-for-your-vessel-and-containers/). See the [Docker 1.10 security features](https://blog.docker.com/2016/02/docker-engine-1-10-security/) for more details.