login Log in to a Docker registry logout Log out from a Docker registry pull Pull an image or a repository from a registry push Push an image or a repository to a registry search Search the Docker Hub for images tag Tag an image into a repository
login和logout
这两个命令主要是用于登录和退出Docker registry的，比较简单，这里只给出基本用法。
login命令
1 2 3 4 5 6 7 8
Usage: docker login [OPTIONS] [SERVER]
Log in to a Docker registry server, if no server is specified "https://index.docker.io/v1/" is the default.
$ docker search --stars=3 busybox NAME DESCRIPTION STARS OFFICIAL AUTOMATED busybox Busybox base image. 325 [OK] progrium/busybox 50 [OK] radial/busyboxplus Full-chain, Internet enabled, busybox made... 8 [OK]
这里stars表示该镜像在Docker Hub上被人关注的次数。
查询自动构建的镜像
1 2 3 4
$ docker search --stars=3 --automated busybox NAME DESCRIPTION STARS OFFICIAL AUTOMATED progrium/busybox 50 [OK] radial/busyboxplus Full-chain, Internet enabled, busybox made... 8 [OK]
automated感觉用来标识非官方镜像
查询未截断描述的镜像
1 2 3 4 5
$ docker search --stars=3 --no-trunc busybox NAME DESCRIPTION STARS OFFICIAL AUTOMATED busybox Busybox base image. 325 [OK] progrium/busybox 50 [OK] radial/busyboxplus Full-chain, Internet enabled, busybox made from scratch. Comes in git and cURL flavors. 8 [OK]
tag
tag命令用于修改镜像的仓库名和tag
1 2 3 4 5
Usage: docker tag [OPTIONS] IMAGE[:TAG] [REGISTRYHOST/][USERNAME/]NAME[:TAG]
--build-arg=[] Set build-time variables --cpu-shares CPU Shares (relative weight) --cgroup-parent="" Optional parent cgroup for the container --cpu-period=0 Limit the CPU CFS (Completely Fair Scheduler) period --cpu-quota=0 Limit the CPU CFS (Completely Fair Scheduler) quota --cpuset-cpus="" CPUs inwhich to allow execution, e.g. `0-3`, `0,1` --cpuset-mems="" MEMs inwhich to allow execution, e.g. `0-3`, `0,1` --disable-content-trust=true Skip image verification -f, --file="" Name of the Dockerfile (Default is 'PATH/Dockerfile') --force-rm Always remove intermediate containers --help Print usage --isolation="" Container isolation technology --label=[] Set metadata for an image -m, --memory="" Memory limitfor all build containers --memory-swap="" A positive integer equal to memory plus swap. Specify -1 to enable unlimited swap. --no-cache Do not use cache when building the image --pull Always attempt to pull a newer version of the image -q, --quiet Suppress the build output and print image ID on success --rm=true Remove intermediate containers after a successful build --shm-size=[] Size of `/dev/shm`. The format is `<number><unit>`. `number` must be greater than `0`. Unit is optional and can be `b` (bytes), `k` (kilobytes), `m` (megabytes), or `g` (gigabytes). If you omit the unit, the system uses bytes. If you omit the size entirely, the system uses `64m`. -t, --tag=[] Name and optionally a tag in the 'name:tag' format --ulimit=[] Ulimit options
Create a new image from a container's changes -a, --author="" Author (e.g., "John Hannibal Smith <hannibal@a-team.com>") -c, --change=[] Apply specified Dockerfile instructions while committing the image --help Print usage -m, --message="" Commit message -p, --pause=true Pause container during commit
--help Print usage -i, --input="" Read from a tar archive file, instead of STDIN. The tarball may be compressed with gzip, bzip, or xz -q, --quiet Suppress the load output. Without this option, a progress bar is displayed.
Export the contents of a container's filesystem as a tar archive --help Print usage -o, --output="" Write to a file, instead of STDOUT
两种用法：
docker export hexo > myhexo.tar
docker export –output=”myhexo.tar” hexo
注： export不导出数据卷的内容
save命令：把一个或者多个镜像导出到tar文件。
1 2 3 4 5 6
Usage: docker save [OPTIONS] IMAGE [IMAGE...]
Save one or more images to a tar archive (streamed to STDOUT by default)
--help Print usage -o, --output="" Write to a file, instead of STDOUT
注：save会把所有父层以及name:tag导出，除非重名name:tag。 几种用法：
使用标准输出导出一个镜像： docker save busybox > busybox.tar
指定输出流导出一个镜像：docker save –output busybox.tar busybox
导出整个repository：docker save -o fedora-all.tar fedora
export和save都是导出容器镜像，区别在：
export是导出容器的文件系统
save是保存加载的容器镜像
查看镜像列表
1 2 3 4 5 6 7 8 9 10 11
Usage: docker images [OPTIONS] [REPOSITORY[:TAG]]
List images
-a, --all Show all images (default hides intermediate images) --digests Show digests -f, --filter=[] Filter output based on conditions provided --format Pretty-print images using a Go template --help Print usage --no-trunc Don't truncate output -q, --quiet Only show numeric IDs
--config=~/.docker Location of client config files -D, --debug Enable debug mode -H, --host=[] Daemon socket(s) to connect to -h, --help Print usage -l, --log-level=info Set the logging level --tls Use TLS; implied by --tlsverify --tlscacert=~/.docker/ca.pem Trust certs signed only by this CA --tlscert=~/.docker/cert.pem Path to TLS certificate file --tlskey=~/.docker/key.pem Path to TLS key file --tlsverify Use TLS and verify the remote -v, --version Print version information and quit
Commands: accel Manage docker accelerators attach Attach to a running container build Build an image from a Dockerfile commit Create a new image from a container's changes cp Copy files/folders between a container and the local filesystem create Create a new container diff Inspect changes on a container's filesystem events Get real time events from the server exec Run a commandin a running container export Export a container's filesystem as a tar archive history Show the history of an image images List images import Import the contents from a tarball to create a filesystem image info Display system-wide information inspect Return low-level information on a container or image kill Kill a running container load Load an image from a tar archive or STDIN login Log in to a Docker registry logout Log out from a Docker registry logs Fetch the logs of a container network Manage Docker networks pause Pause all processes within a container port List port mappings or a specific mapping for the CONTAINER ps List containers pull Pull an image or a repository from a registry push Push an image or a repository to a registry rename Rename a container restart Restart a container rm Remove one or more containers rmi Remove one or more images run Run a command in a new container save Save one or more images to a tar archive search Search the Docker Hub for images start Start one or more stopped containers stats Display a live stream of container(s) resource usage statistics stop Stop a running container tag Tag an image into a repository top Display the running processes of a container unpause Unpause all processes within a container update Update configuration of one or more containers version Show the Docker version information volume Manage Docker volumes wait Block until a container stops, then print its exit code Run 'docker COMMAND --help' for more information on a command.
--config=~/.docker client配置文件的路径 -D, --debug 使能debug模式 -H, --host=[] docker daemon的socket文件路径 -h, --help 帮助手册 -l, --log-level=info 设置日志级别 --tls Use TLS; implied by --tlsverify --tlscacert=~/.docker/ca.pem Trust certs signed only by this CA --tlscert=~/.docker/cert.pem Path to TLS certificate file --tlskey=~/.docker/key.pem Path to TLS key file --tlsverify Use TLS and verify the remote -v, --version 打印版本信息
DOCKER_RAMDISK – If set this will disable ‘pivot_root’.
DOCKER_TLS_VERIFY – 设置是否使用TLS并验证远端服务
DOCKER_CONTENT_TRUST – When set Docker uses notary to sign and verify images. Equates to –disable-content-trust=false for build, create, pull, push, run.
DOCKER_CONTENT_TRUST_SERVER – The URL of the Notary server to use. This defaults to the same URL as the registry.
Plugin "vieux/sshfs" is requesting the following privileges: - network: [host] - capabilities: [CAP_SYS_ADMIN] Do you grant the above permissions? [y/N] y
vieux/sshfs
$ docker plugin ls
ID NAME TAG DESCRIPTION ENABLED 69553ca1d789 vieux/sshfs latest the `sshfs` plugin true
使用sshfs插件创建数据卷：
1 2 3 4 5 6 7 8 9 10
$ docker volume create -d vieux/sshfs -o sshcmd=<user@host:path> -o password=<password> sshvolume sshvolume $ docker volume ls DRIVER VOLUME NAME local 2d75de358a70ba469ac968ee852efd4234b9118b7722ee26a1c5a90dcaea6751 local 842a765a9bb11e234642c933b3dfc702dee32b73e0cf7305239436a145b89017 local 9d72c664cbd20512d4e3d5bb9b39ed11e4a632c386447461d48ed84731e44034 local be9632386a2d396d438c9707e261f86fd9f5e72a7319417901d84041c8f14a4d local e1496dfe4fa27b39121e4383d1b16a0a7510f0de89f05b336aab3c0deb4dda0e vieux/sshfs sshvolume
Behavior inside PID namespaces Since Linux 3.4, when reboot() is called from a PID namespace (see pid_namespaces(7)) other than the initial PID namespace, the effect of the call is to send a signal to the namespace "init" process. The LINUX_REBOOT_CMD_RESTART and LINUX_REBOOT_CMD_RESTART2 cmd values cause a SIGHUP signal to be sent. The LINUX_REBOOT_CMD_POWER_OFF and LINUX_REBOOT_CMD_HALT cmd values cause a SIGINT signal to be sent. For the other cmd values, -1 is returned and errno is set to EINVAL.
/* We only trust the superuser with rebooting the system. */ if (!ns_capable(pid_ns->user_ns, CAP_SYS_BOOT)) return -EPERM;
/* For safety, we require "magic" arguments. */ if (magic1 != LINUX_REBOOT_MAGIC1 || (magic2 != LINUX_REBOOT_MAGIC2 && magic2 != LINUX_REBOOT_MAGIC2A && magic2 != LINUX_REBOOT_MAGIC2B && magic2 != LINUX_REBOOT_MAGIC2C)) return -EINVAL;
/* * If pid namespaces are enabled and the current task is in a child * pid_namespace, the command is handled by reboot_pid_ns() which will * call do_exit(). */ ret = reboot_pid_ns(pid_ns, cmd); if (ret) return ret; ... ...
文件句柄： A file handle is a pointer to an actual data structure
文件描述符： A file descriptor is a just an abstract key for accessing the file
因此，文件句柄和文件描述符是不一样的。
相关函数简介
函数getdtablesize，获取文件描述符表格的大小。
1 2 3 4 5 6 7 8
getdtablesize() returns the maximum number of files a process can have open, one more than the largest possible value for a file descriptor. 系统调用如下： SYSCALL_DEFINE0(getdtablesize) { return sysctl_nr_open; }
# cat /proc/self/limits Limit Soft Limit Hard Limit Units Max cpu time unlimited unlimited seconds Max file size unlimited unlimited bytes Max data size unlimited unlimited bytes Max stack size 8388608 unlimited bytes Max core file size unlimited unlimited bytes Max resident set unlimited unlimited bytes Max processes 1048576 1048576 processes
Max open files 64000 64000 files
Max locked memory 65536 65536 bytes Max address space unlimited unlimited bytes Max file locks unlimited unlimited locks Max pending signals 10546 10546 signals Max msgqueue size 819200 819200 bytes Max nice priority 0 0 Max realtime priority 0 0 Max realtime timeout unlimited unlimited us
wget --no-check-certificate https://github.com/libevent/libevent/releases/download/release-2.0.22-stable/libevent-2.0.22-stable.tar.gz tar -zxf libevent-2.0.22-stable.tar.gz cd libevent-2.0.22-stable ./configure -prefix=/usr make -j4 make install
安装ncurses
tmux依赖ncurses，因此需要先安装ncurses，同样通过源码安装，脚本如下：
1 2 3 4 5 6
wget http://invisible-island.net/datafiles/release/ncurses.tar.gz tar -zxf ncurses.tar.gz cd ncurses-5.9/ ./configure make -j4 make install
安装tmux
1 2 3 4 5 6 7
$ apt-get install automake #依赖aclocal命令 $ git clone https://github.com/tmux/tmux.git $ cd tmux $ sh autogen.sh $ ./configure -prefix=/usr #注意prefix，不然安装到/usr/local/bin目录，可能执行不了 $ make $ make install
Jun 1 11:07:44 ws systemd: Unit hello-kitty.mount is bound to inactive unit dev-littlecat.device. Stopping, too. Jun 1 11:07:44 ws systemd: Unmounting /hello/kitty... Jun 1 11:07:44 ws systemd: Unmounted /hello/kitty.
if (!mount->is_mounted) { + /* A mount point is gone */ + mount->from_proc_self_mountinfo = false; switch (mount->state) { @@ -1710,13 +1715,17 @@ static int mount_dispatch_io(sd_event_source *source, int fd, uint32_t revents, break; } - if (mount->parameters_proc_self_mountinfo.what) - (void) device_found_node(m, mount->parameters_proc_self_mountinfo.what, false, DEVICE_FOUND_MOUNT, true); + /* Remember that this device might just have disappeared */ + if (mount->parameters_proc_self_mountinfo.what) { + if (set_ensure_allocated(&gone, &string_hash_ops) < 0 || + set_put(gone, mount->parameters_proc_self_mountinfo.what) < 0) + log_oom(); /* we don't care too much about OOM here... */ + } } else if (mount->just_mounted || mount->just_changed) { - /* New or changed mount entry */ + /* A mount point was added or changed */ switch (mount->state) { @@ -1741,12 +1750,27 @@ static int mount_dispatch_io(sd_event_source *source, int fd, uint32_t revents, mount_set_state(mount, mount->state); break; } + + if (mount->parameters_proc_self_mountinfo.what) { + + if (set_ensure_allocated(&around, &string_hash_ops) < 0 || + set_put(around, mount->parameters_proc_self_mountinfo.what) < 0) + log_oom(); + } }
触发不在around中的device的Unmount流程：
1 2 3 4 5 6 7
+ SET_FOREACH(what, gone, i) { + if (set_contains(around, what)) + continue; + + /* Let the device units know that the device is no longer mounted */ + (void) device_found_node(m, what, false, DEVICE_FOUND_MOUNT, true); + }