如何在CentOS上手动安装Docker

一、环境描述

1. 虚拟机配置

  • CPU:单核
  • 内存:2 GB
  • 硬盘:120 GB
  • IP:192.168.190.128

2. 操作系统

  • 版本:CentOS 7.3 x86_64 (1611)
  • 安装方式:Minimal

3. 宿主机环境

  • Windows 10 Enterprise
  • VMware Workstation 12.5.2

4. Docker

  • 版本:docker-17.03.1-ce.tgz
  • 安装方式:TGZ压缩包

二、安装Docker

1. 下载Docker压缩包

在Shell中运行以下命令,下载tgz格式的压缩包:

  1. yum install -y wget
  2. cd /root/Downloads
  3. wget https://download.docker.com/linux/static/stable/x86_64/docker-17.03.1-ce.tgz

2. 解压安装Docker

在Shell中运行以下命令,解压和安装Docker:

  1. tar xvzf docker-17.03.1-ce.tgz
  2. mv docker /usr/local/

3. 设置环境变量

在Shell中运行以下命令,设置PATH环境变量:

  1. vi /etc/profile

在上述文件的最后,新建一行,然后输入以下内容:

  1. export PATH=$PATH:/usr/local/docker

使PATH环境变量立即生效:

  1. source /etc/profile

4. 添加用户和组

在Shell中运行以下命令,添加docker用户和组:

  1. groupadd docker
  2. usermod -aG docker $USER

5. 设置自启动

在Shell中运行以下命令,创建systemd的service文件:

  1. vi /usr/lib/systemd/system/docker.service

上述文件的内容如下所示:

  1. [Unit]
  2. Description=Docker Application Container Engine
  3. Documentation=https://docs.docker.com
  4. After=network.target firewalld.service
  5. [Service]
  6. Environment="PATH=/usr/sbin:/usr/local/docker"
  7. Type=notify
  8. # the default is not to use systemd for cgroups because the delegate issues still
  9. # exists and systemd currently does not support the cgroup feature set required
  10. # for containers run by docker
  11. ExecStart=/usr/local/docker/dockerd
  12. ExecReload=/bin/kill -s HUP $MAINPID
  13. # Having non-zero Limit*s causes performance problems due to accounting overhead
  14. # in the kernel. We recommend using cgroups to do container-local accounting.
  15. LimitNOFILE=infinity
  16. LimitNPROC=infinity
  17. LimitCORE=infinity
  18. # Uncomment TasksMax if your systemd version supports it.
  19. # Only systemd 226 and above support this version.
  20. #TasksMax=infinity
  21. TimeoutStartSec=0
  22. # set delegate yes so that systemd does not reset the cgroups of docker containers
  23. Delegate=yes
  24. # kill only the docker process, not all processes in the cgroup
  25. KillMode=process
  26. [Install]
  27. WantedBy=multi-user.target

重新加载systemd,并且将docker服务设置为开机自启动:

  1. systemctl daemon-reload
  2. systemctl enable docker.service

三、验证安装

1. 内核兼容性测试

如果宿主机的Linux内核早于3.10版本,或者宿主机系统缺少某些模块,那么Docker就不能正确地运行。如果要检查内核的兼容性,那么可以创建以下的check-compatibility.sh脚本:

  1. cd /root/Downloads
  2. vi check-compatibility.sh

这个脚本文件的内容如下所示:

  1. #!/usr/bin/env bash
  2. set -e
  3. EXITCODE=0
  4. # bits of this were adapted from lxc-checkconfig
  5. # see also https://github.com/lxc/lxc/blob/lxc-1.0.2/src/lxc/lxc-checkconfig.in
  6. possibleConfigs=(
  7. '/proc/config.gz'
  8. "/boot/config-$(uname -r)"
  9. "/usr/src/linux-$(uname -r)/.config"
  10. '/usr/src/linux/.config'
  11. )
  12. if [ $# -gt 0 ]; then
  13. CONFIG="$1"
  14. else
  15. : ${CONFIG:="${possibleConfigs[0]}"}
  16. fi
  17. if ! command -v zgrep &> /dev/null; then
  18. zgrep() {
  19. zcat "$2" | grep "$1"
  20. }
  21. fi
  22. kernelVersion="$(uname -r)"
  23. kernelMajor="${kernelVersion%%.*}"
  24. kernelMinor="${kernelVersion#$kernelMajor.}"
  25. kernelMinor="${kernelMinor%%.*}"
  26. is_set() {
  27. zgrep "CONFIG_$1=[y|m]" "$CONFIG" > /dev/null
  28. }
  29. is_set_in_kernel() {
  30. zgrep "CONFIG_$1=y" "$CONFIG" > /dev/null
  31. }
  32. is_set_as_module() {
  33. zgrep "CONFIG_$1=m" "$CONFIG" > /dev/null
  34. }
  35. color() {
  36. local codes=()
  37. if [ "$1" = 'bold' ]; then
  38. codes=( "${codes[@]}" '1' )
  39. shift
  40. fi
  41. if [ "$#" -gt 0 ]; then
  42. local code=
  43. case "$1" in
  44. # see https://en.wikipedia.org/wiki/ANSI_escape_code#Colors
  45. black) code=30 ;;
  46. red) code=31 ;;
  47. green) code=32 ;;
  48. yellow) code=33 ;;
  49. blue) code=34 ;;
  50. magenta) code=35 ;;
  51. cyan) code=36 ;;
  52. white) code=37 ;;
  53. esac
  54. if [ "$code" ]; then
  55. codes=( "${codes[@]}" "$code" )
  56. fi
  57. fi
  58. local IFS=';'
  59. echo -en '\033['"${codes[*]}"'m'
  60. }
  61. wrap_color() {
  62. text="$1"
  63. shift
  64. color "$@"
  65. echo -n "$text"
  66. color reset
  67. echo
  68. }
  69. wrap_good() {
  70. echo "$(wrap_color "$1" white): $(wrap_color "$2" green)"
  71. }
  72. wrap_bad() {
  73. echo "$(wrap_color "$1" bold): $(wrap_color "$2" bold red)"
  74. }
  75. wrap_warning() {
  76. wrap_color >&2 "$*" red
  77. }
  78. check_flag() {
  79. if is_set_in_kernel "$1"; then
  80. wrap_good "CONFIG_$1" 'enabled'
  81. elif is_set_as_module "$1"; then
  82. wrap_good "CONFIG_$1" 'enabled (as module)'
  83. else
  84. wrap_bad "CONFIG_$1" 'missing'
  85. EXITCODE=1
  86. fi
  87. }
  88. check_flags() {
  89. for flag in "$@"; do
  90. echo -n "- "; check_flag "$flag"
  91. done
  92. }
  93. check_command() {
  94. if command -v "$1" >/dev/null 2>&1; then
  95. wrap_good "$1 command" 'available'
  96. else
  97. wrap_bad "$1 command" 'missing'
  98. EXITCODE=1
  99. fi
  100. }
  101. check_device() {
  102. if [ -c "$1" ]; then
  103. wrap_good "$1" 'present'
  104. else
  105. wrap_bad "$1" 'missing'
  106. EXITCODE=1
  107. fi
  108. }
  109. check_distro_userns() {
  110. source /etc/os-release 2>/dev/null || /bin/true
  111. if [[ "${ID}" =~ ^(centos|rhel)$ && "${VERSION_ID}" =~ ^7 ]]; then
  112. # this is a CentOS7 or RHEL7 system
  113. grep -q "user_namespace.enable=1" /proc/cmdline || {
  114. # no user namespace support enabled
  115. wrap_bad " (RHEL7/CentOS7" "User namespaces disabled; add 'user_namespace.enable=1' to boot command line)"
  116. EXITCODE=1
  117. }
  118. fi
  119. }
  120. if [ ! -e "$CONFIG" ]; then
  121. wrap_warning "warning: $CONFIG does not exist, searching other paths for kernel config ..."
  122. for tryConfig in "${possibleConfigs[@]}"; do
  123. if [ -e "$tryConfig" ]; then
  124. CONFIG="$tryConfig"
  125. break
  126. fi
  127. done
  128. if [ ! -e "$CONFIG" ]; then
  129. wrap_warning "error: cannot find kernel config"
  130. wrap_warning " try running this script again, specifying the kernel config:"
  131. wrap_warning " CONFIG=/path/to/kernel/.config $0 or $0 /path/to/kernel/.config"
  132. exit 1
  133. fi
  134. fi
  135. wrap_color "info: reading kernel config from $CONFIG ..." white
  136. echo
  137. echo 'Generally Necessary:'
  138. echo -n '- '
  139. cgroupSubsystemDir="$(awk '/[, ](cpu|cpuacct|cpuset|devices|freezer|memory)[, ]/ && $3 == "cgroup" { print $2 }' /proc/mounts | head -n1)"
  140. cgroupDir="$(dirname "$cgroupSubsystemDir")"
  141. if [ -d "$cgroupDir/cpu" -o -d "$cgroupDir/cpuacct" -o -d "$cgroupDir/cpuset" -o -d "$cgroupDir/devices" -o -d "$cgroupDir/freezer" -o -d "$cgroupDir/memory" ]; then
  142. echo "$(wrap_good 'cgroup hierarchy' 'properly mounted') [$cgroupDir]"
  143. else
  144. if [ "$cgroupSubsystemDir" ]; then
  145. echo "$(wrap_bad 'cgroup hierarchy' 'single mountpoint!') [$cgroupSubsystemDir]"
  146. else
  147. echo "$(wrap_bad 'cgroup hierarchy' 'nonexistent??')"
  148. fi
  149. EXITCODE=1
  150. echo " $(wrap_color '(see https://github.com/tianon/cgroupfs-mount)' yellow)"
  151. fi
  152. if [ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = 'Y' ]; then
  153. echo -n '- '
  154. if command -v apparmor_parser &> /dev/null; then
  155. echo "$(wrap_good 'apparmor' 'enabled and tools installed')"
  156. else
  157. echo "$(wrap_bad 'apparmor' 'enabled, but apparmor_parser missing')"
  158. echo -n ' '
  159. if command -v apt-get &> /dev/null; then
  160. echo "$(wrap_color '(use "apt-get install apparmor" to fix this)')"
  161. elif command -v yum &> /dev/null; then
  162. echo "$(wrap_color '(your best bet is "yum install apparmor-parser")')"
  163. else
  164. echo "$(wrap_color '(look for an "apparmor" package for your distribution)')"
  165. fi
  166. EXITCODE=1
  167. fi
  168. fi
  169. flags=(
  170. NAMESPACES {NET,PID,IPC,UTS}_NS
  171. CGROUPS CGROUP_CPUACCT CGROUP_DEVICE CGROUP_FREEZER CGROUP_SCHED CPUSETS MEMCG
  172. KEYS
  173. VETH BRIDGE BRIDGE_NETFILTER
  174. NF_NAT_IPV4 IP_NF_FILTER IP_NF_TARGET_MASQUERADE
  175. NETFILTER_XT_MATCH_{ADDRTYPE,CONNTRACK,IPVS}
  176. IP_NF_NAT NF_NAT NF_NAT_NEEDED
  177. # required for bind-mounting /dev/mqueue into containers
  178. POSIX_MQUEUE
  179. )
  180. check_flags "${flags[@]}"
  181. if [ "$kernelMajor" -lt 4 ] || [ "$kernelMajor" -eq 4 -a "$kernelMinor" -lt 8 ]; then
  182. check_flags DEVPTS_MULTIPLE_INSTANCES
  183. fi
  184. echo
  185. echo 'Optional Features:'
  186. {
  187. check_flags USER_NS
  188. check_distro_userns
  189. }
  190. {
  191. check_flags SECCOMP
  192. }
  193. {
  194. check_flags CGROUP_PIDS
  195. }
  196. {
  197. CODE=${EXITCODE}
  198. check_flags MEMCG_SWAP MEMCG_SWAP_ENABLED
  199. if [ -e /sys/fs/cgroup/memory/memory.memsw.limit_in_bytes ]; then
  200. echo " $(wrap_color '(cgroup swap accounting is currently enabled)' bold black)"
  201. EXITCODE=${CODE}
  202. elif is_set MEMCG_SWAP && ! is_set MEMCG_SWAP_ENABLED; then
  203. echo " $(wrap_color '(cgroup swap accounting is currently not enabled, you can enable it by setting boot option "swapaccount=1")' bold black)"
  204. fi
  205. }
  206. {
  207. if is_set LEGACY_VSYSCALL_NATIVE; then
  208. echo -n "- "; wrap_bad "CONFIG_LEGACY_VSYSCALL_NATIVE" 'enabled'
  209. echo " $(wrap_color '(dangerous, provides an ASLR-bypassing target with usable ROP gadgets.)' bold black)"
  210. elif is_set LEGACY_VSYSCALL_EMULATE; then
  211. echo -n "- "; wrap_good "CONFIG_LEGACY_VSYSCALL_EMULATE" 'enabled'
  212. elif is_set LEGACY_VSYSCALL_NONE; then
  213. echo -n "- "; wrap_bad "CONFIG_LEGACY_VSYSCALL_NONE" 'enabled'
  214. echo " $(wrap_color '(containers using eglibc <= 2.13 will not work. Switch to' bold black)"
  215. echo " $(wrap_color ' "CONFIG_VSYSCALL_[NATIVE|EMULATE]" or use "vsyscall=[native|emulate]"' bold black)"
  216. echo " $(wrap_color ' on kernel command line. Note that this will disable ASLR for the,' bold black)"
  217. echo " $(wrap_color ' VDSO which may assist in exploiting security vulnerabilities.)' bold black)"
  218. # else Older kernels (prior to 3dc33bd30f3e, released in v4.40-rc1) do
  219. # not have these LEGACY_VSYSCALL options and are effectively
  220. # LEGACY_VSYSCALL_EMULATE. Even older kernels are presumably
  221. # effectively LEGACY_VSYSCALL_NATIVE.
  222. fi
  223. }
  224. if [ "$kernelMajor" -lt 4 ] || [ "$kernelMajor" -eq 4 -a "$kernelMinor" -le 5 ]; then
  225. check_flags MEMCG_KMEM
  226. fi
  227. if [ "$kernelMajor" -lt 3 ] || [ "$kernelMajor" -eq 3 -a "$kernelMinor" -le 18 ]; then
  228. check_flags RESOURCE_COUNTERS
  229. fi
  230. if [ "$kernelMajor" -lt 3 ] || [ "$kernelMajor" -eq 3 -a "$kernelMinor" -le 13 ]; then
  231. netprio=NETPRIO_CGROUP
  232. else
  233. netprio=CGROUP_NET_PRIO
  234. fi
  235. flags=(
  236. BLK_CGROUP BLK_DEV_THROTTLING IOSCHED_CFQ CFQ_GROUP_IOSCHED
  237. CGROUP_PERF
  238. CGROUP_HUGETLB
  239. NET_CLS_CGROUP $netprio
  240. CFS_BANDWIDTH FAIR_GROUP_SCHED RT_GROUP_SCHED
  241. IP_VS
  242. IP_VS_NFCT
  243. IP_VS_RR
  244. )
  245. check_flags "${flags[@]}"
  246. if ! is_set EXT4_USE_FOR_EXT2; then
  247. check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
  248. if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
  249. echo " $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
  250. fi
  251. fi
  252. check_flags EXT4_FS EXT4_FS_POSIX_ACL EXT4_FS_SECURITY
  253. if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
  254. if is_set EXT4_USE_FOR_EXT2; then
  255. echo " $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
  256. else
  257. echo " $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
  258. fi
  259. fi
  260. echo '- Network Drivers:'
  261. echo ' - "'$(wrap_color 'overlay' blue)'":'
  262. check_flags VXLAN | sed 's/^/ /'
  263. echo ' Optional (for encrypted networks):'
  264. check_flags CRYPTO CRYPTO_AEAD CRYPTO_GCM CRYPTO_SEQIV CRYPTO_GHASH \
  265. XFRM XFRM_USER XFRM_ALGO INET_ESP INET_XFRM_MODE_TRANSPORT | sed 's/^/ /'
  266. echo ' - "'$(wrap_color 'ipvlan' blue)'":'
  267. check_flags IPVLAN | sed 's/^/ /'
  268. echo ' - "'$(wrap_color 'macvlan' blue)'":'
  269. check_flags MACVLAN DUMMY | sed 's/^/ /'
  270. echo ' - "'$(wrap_color 'ftp,tftp client in container' blue)'":'
  271. check_flags NF_NAT_FTP NF_CONNTRACK_FTP NF_NAT_TFTP NF_CONNTRACK_TFTP | sed 's/^/ /'
  272. # only fail if no storage drivers available
  273. CODE=${EXITCODE}
  274. EXITCODE=0
  275. STORAGE=1
  276. echo '- Storage Drivers:'
  277. echo ' - "'$(wrap_color 'aufs' blue)'":'
  278. check_flags AUFS_FS | sed 's/^/ /'
  279. if ! is_set AUFS_FS && grep -q aufs /proc/filesystems; then
  280. echo " $(wrap_color '(note that some kernels include AUFS patches but not the AUFS_FS flag)' bold black)"
  281. fi
  282. [ "$EXITCODE" = 0 ] && STORAGE=0
  283. EXITCODE=0
  284. echo ' - "'$(wrap_color 'btrfs' blue)'":'
  285. check_flags BTRFS_FS | sed 's/^/ /'
  286. check_flags BTRFS_FS_POSIX_ACL | sed 's/^/ /'
  287. [ "$EXITCODE" = 0 ] && STORAGE=0
  288. EXITCODE=0
  289. echo ' - "'$(wrap_color 'devicemapper' blue)'":'
  290. check_flags BLK_DEV_DM DM_THIN_PROVISIONING | sed 's/^/ /'
  291. [ "$EXITCODE" = 0 ] && STORAGE=0
  292. EXITCODE=0
  293. echo ' - "'$(wrap_color 'overlay' blue)'":'
  294. check_flags OVERLAY_FS | sed 's/^/ /'
  295. [ "$EXITCODE" = 0 ] && STORAGE=0
  296. EXITCODE=0
  297. echo ' - "'$(wrap_color 'zfs' blue)'":'
  298. echo -n " - "; check_device /dev/zfs
  299. echo -n " - "; check_command zfs
  300. echo -n " - "; check_command zpool
  301. [ "$EXITCODE" = 0 ] && STORAGE=0
  302. EXITCODE=0
  303. EXITCODE=$CODE
  304. [ "$STORAGE" = 1 ] && EXITCODE=1
  305. echo
  306. check_limit_over()
  307. {
  308. if [ $(cat "$1") -le "$2" ]; then
  309. wrap_bad "- $1" "$(cat $1)"
  310. wrap_color " This should be set to at least $2, for example set: sysctl -w kernel/keys/root_maxkeys=1000000" bold black
  311. EXITCODE=1
  312. else
  313. wrap_good "- $1" "$(cat $1)"
  314. fi
  315. }
  316. echo 'Limits:'
  317. check_limit_over /proc/sys/kernel/keys/root_maxkeys 10000
  318. echo
  319. exit $EXITCODE

若执行上述脚本的输出如下图所示,则表示宿主机不存在内核兼容性问题:

检查内核兼容性

2. 启动Docker服务

在Shell中运行以下命令,启动Docker服务:

  1. systemctl start docker.service

检查Docker服务的运行状态:

  1. systemctl status docker.service

若Docker服务的运行状态如下图所示,则表示启动成功:

docker服务状态

3. 运行hello-world镜像

运行hello-world镜像,验证Docker是否安装正确:

  1. docker run hello-world

若Shell输出如下图所示,则表示Docker安装正确:

运行hello-world镜像

4. 运行ubuntu镜像

运行ubuntu镜像,并且进入交互式操作的bash:

  1. docker run -i -t ubuntu /bin/bash

在容器的bash中运行以下命令,查看容器中运行的进程:

  1. ps aux

可以看出,容器中只运行了bash和ps的进程,如下图所示:

在容器中运行PS命令

在宿主机中启动一个新终端,查看正在运行的容器列表:

  1. docker ps

可以看出,宿主机中只运行了一个名为“ubuntu”的容器,如下图所示:

查看正在运行的容器列表