> For AI agents: the complete documentation index is available at https://www.tteam.icu/llms.txt, the full documentation bundle is available at https://www.tteam.icu/llms-full.txt.

# docker

## Docker 安装

### 自定义安装脚本

:::warning
Docker 29 之后为了规范镜像，使用 `containerd` 作为默认存储。

现在需要修改 `/etc/containerd/config.toml` 的 `root` 配置。

修改后执行: `systemctl daemon-reload && systemctl restart containerd`

按照原来的格式查看镜像`docker image ls --format "table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.CreatedSince}}\t{{.Size}}"`
:::


**debian**

```sh file="./docker/install/debian-install.sh"
apt-get update
apt-get install -y ca-certificates curl
install -m 0755 -d /etc/apt/keyrings

curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
tee /etc/apt/sources.list.d/docker.list > /dev/null
apt-get update
echo "开始安装 docker-ce"
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin 2>&1 > /dev/null
docker --version || ( echo "docker 安装失败" && exit )
# docker自动补全
source /usr/share/bash-completion/completions/docker
source /usr/share/bash-completion/bash_completion
mkdir -p /etc/docker/

cat << EOF > /etc/docker/daemon.json
{
  "data-root": "/data/docker/",
  "log-driver": "json-file",
  "iptables": false,
  "log-opts": {
    "max-size": "500m",
    "max-file": "10"
  }
}
EOF

sed -i '/^ExecStart=/cExecStart=/usr/bin/dockerd' /usr/lib/systemd/system/docker.service
systemctl daemon-reload
systemctl restart docker
systemctl enable docker
```


**centos7**

```sh file="./docker/install/centos7-install.sh"
yum -y install yum-utils device-mapper-persistent-data lvm2 bash-completion > /dev/null
# yum-config-manager --add-repo https://mirrors.ustc.edu.cn/docker-ce/linux/centos/docker-ce.repo
# yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum-config-manager --enable docker-ce-edge
echo "${CMSG}开始 yum 安装 docker-ce${CEND}"
yum -y install docker-ce 2>&1 > /dev/null
docker --version || ( echo "${CWARNING}docker 安装失败${CEND}" && exit )
# docker自动补全
source /usr/share/bash-completion/completions/docker
source /usr/share/bash-completion/bash_completion
mkdir -p /etc/docker/

    cat << EOF > /etc/docker/daemon.json
{
  "data-root": "/data/docker/",
  "log-driver": "json-file",
  "iptables": false,
  "log-opts": {
    "max-size": "500m",
    "max-file": "10"
  }
}
EOF

sed -i '/^ExecStart=/cExecStart=/usr/bin/dockerd' /usr/lib/systemd/system/docker.service
systemctl daemon-reload
systemctl start docker
systemctl enable docker
```


**oracle**

```sh file="./docker/install/oracle-install.sh"
dnf -y install dnf-utils device-mapper-persistent-data lvm2
dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
dnf install -y docker-ce docker-ce-cli containerd.io --nobest --allowerasing
source /usr/share/bash-completion/completions/docker
source /usr/share/bash-completion/bash_completion
mkdir -p /etc/docker/

cat << EOF > /etc/docker/daemon.json
{
  "data-root": "/data/docker/",
  "log-driver": "json-file",
  "iptables": false,
  "log-opts": {
    "max-size": "500m",
    "max-file": "10"
  }
}
EOF

sed -i '/^ExecStart=/cExecStart=/usr/bin/dockerd' /usr/lib/systemd/system/docker.service
systemctl daemon-reload
systemctl restart docker
systemctl enable docker
```


**arm-debian10**

```sh file="./docker/install/arm-debian10-install.sh"
apt update
apt-get install net-tools telnet wget curl zip unzip tar perl tree expect git vim sysstat -y
apt-get install chrony locales -y
systemctl restart chrony
systemctl enable chrony
timedatectl set-timezone Asia/Shanghai
timedatectl set-local-rtc 0

apt install apt-transport-https ca-certificates curl software-properties-common -y
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
echo "deb [arch=arm64] https://download.docker.com/linux/debian $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list
apt update
apt install docker-ce docker-ce-cli containerd.io -y

# 其他
cat << EOF > /etc/docker/daemon.json
{
  "data-root": "/data/docker/",
  "log-driver": "json-file",
  "iptables": false,
  "log-opts": {
    "max-size": "500m",
    "max-file": "10" 
  }
}
EOF

systemctl daemon-reload
systemctl restart docker
systemctl enable docker
```


**centos9**

```sh file="./docker/install/centos9-install.sh"
mkdir -p /etc/yum.repos.d/backup/
mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/backup/


cat << EOF > /etc/yum.repos.d/redhat.repo
[ali_baseos]
name=ali_baseos
baseurl=https://mirrors.aliyun.com/centos-stream/9-stream/BaseOS/x86_64/os/
gpgcheck=0

[ali_appstream]
name=ali_appstream
baseurl=https://mirrors.aliyun.com/centos-stream/9-stream/AppStream/x86_64/os/
gpgcheck=0
EOF

yum install -y yum-utils

rm -rf /etc/localtime
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
echo "Asia/Shanghai" > /etc/timezone
systemctl restart crond

yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

yum install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

source /usr/share/bash-completion/completions/docker
source /usr/share/bash-completion/bash_completion
mkdir -p /etc/docker/

cat << EOF > /etc/docker/daemon.json
{
  "data-root": "/data/docker/",
  "log-driver": "json-file",
  "iptables": false,
  "log-opts": {
    "max-size": "500m",
    "max-file": "10"
  }
}
EOF

sed -i '/^ExecStart=/cExecStart=/usr/bin/dockerd' /usr/lib/systemd/system/docker.service
systemctl daemon-reload
systemctl restart docker
systemctl enable docker
```


**arm-EulerOS2**

```sh file="./docker/install/arm-euler2-install.sh"
cat << EOF > /etc/yum.repos.d/docker-ce.repo
[docker-ce-stable]
name=Docker CE Stable - \$basearch
baseurl=https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/7/\$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg

[docker-ce-stable-source]
name=Docker CE Stable - Sources
baseurl=https://download.docker.com/linux/centos/7/source/stable
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg

[docker-ce-test]
name=Docker CE Test - \$basearch
baseurl=https://download.docker.com/linux/centos/7/\$basearch/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg

[docker-ce-test-source]
name=Docker CE Test - Sources
baseurl=https://download.docker.com/linux/centos/7/source/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
EOF

source /usr/share/bash-completion/completions/docker
source /usr/share/bash-completion/bash_completion
mkdir -p /etc/docker/

    cat << EOF > /etc/docker/daemon.json
{
  "data-root": "/data/docker/",
  "log-driver": "json-file",
  "iptables": false,
  "log-opts": {
    "max-size": "500m",
    "max-file": "10"
  }
}
EOF

systemctl daemon-reload
systemctl start docker
systemctl enable docker
```


### 在线官方一键安装

```bash
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
```

### 离线安装

:::tip 如果需要补全就执行

```shell
mkdir -p /etc/bash_completion.d/
curl -L https://raw.githubusercontent.com/docker/cli/v28.5.2/contrib/completion/bash/docker -o /etc/bash_completion.d/docker
source /etc/bash_completion.d/docker
```

:::


**x86**

```sh file="./docker/install/x86-offline-install.sh"
# 源站下载地址 https://download.docker.com/linux/static/stable/x86_64/docker-28.5.2.tgz
# 国内镜像下载地址 https://mirrors.nju.edu.cn/docker-ce/linux/static/stable/x86_64/docker-28.5.2.tgz

tar -zxvf docker-28.5.2.tgz
mv docker/* /usr/bin/ -f
groupadd docker

cat << EOF > /usr/lib/systemd/system/docker.service
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target nss-lookup.target docker.socket firewalld.service containerd.service time-set.target
Wants=network-online.target containerd.service
Requires=docker.socket

[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd
ExecReload=/bin/kill -s HUP \$MAINPID
TimeoutStartSec=0
RestartSec=2
Restart=always

# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
# Both the old, and new location are accepted by systemd 229 and up, so using the old location
# to make them work for either version of systemd.
StartLimitBurst=3

# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
# this option work for either version of systemd.
StartLimitInterval=60s

# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity

# Comment TasksMax if your systemd version does not support it.
# Only systemd 226 and above support this option.
TasksMax=infinity

# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes

# kill only the docker process, not all processes in the cgroup
KillMode=process
OOMScoreAdjust=-500

[Install]
WantedBy=multi-user.target
EOF

mkdir -p /etc/docker/
cat << EOF > /etc/docker/daemon.json
{
  "data-root": "/data/docker/",
  "log-driver": "json-file",
  "iptables": false,
  "log-opts": {
    "max-size": "500m",
    "max-file": "10"
  }
}
EOF

mkdir -p /usr/lib/systemd/system/
cat << EOF > /usr/lib/systemd/system/docker.socket
[Unit]
Description=Docker Socket for the API

[Socket]
# If /var/run is not implemented as a symlink to /run, you may need to
# specify ListenStream=/var/run/docker.sock instead.
ListenStream=/run/docker.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker

[Install]
WantedBy=sockets.target
EOF

systemctl daemon-reload
systemctl restart docker
systemctl enable docker
```


**arm**

```sh file="./docker/install/arm-offline-install.sh"
# 源站下载地址 https://download.docker.com/linux/static/stable/aarch64/docker-28.5.2.tgz
# 国内镜像下载地址 https://mirrors.nju.edu.cn/docker-ce/linux/static/stable/aarch64/docker-28.5.2.tgz

# 解压二进制
tar -zxvf docker-28.5.2.tgz
mv docker/* /usr/bin/ -f

# 添加 docker 用户组
groupadd docker

# systemd service
cat << 'EOF' > /etc/systemd/system/docker.service
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service
Wants=network-online.target

[Service]
Type=notify
ExecStart=/usr/bin/dockerd
ExecReload=/bin/kill -s HUP \$MAINPID
LimitNOFILE=65535
LimitNPROC=65535
LimitCORE=65535
TimeoutStartSec=0
Delegate=yes
KillMode=process
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s

[Install]
WantedBy=multi-user.target
EOF

# 配置 daemon.json
mkdir -p /etc/docker/
cat << EOF > /etc/docker/daemon.json
{
  "data-root": "/data/docker/",
  "log-driver": "json-file",
  "iptables": false,
  "log-opts": {
    "max-size": "500m",
    "max-file": "10"
  }
}
EOF

# docker.socket
cat << EOF > /etc/systemd/system/docker.socket
[Unit]
Description=Docker Socket for the API

[Socket]
ListenStream=/run/docker.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker

[Install]
WantedBy=sockets.target
EOF

# 重载 systemd
systemctl daemon-reload
systemctl enable docker
systemctl enable docker.socket
systemctl start docker

```


### openeuler

```bash
curl -fsSL https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
sed -i 's#$releasever#7#g' /etc/yum.repos.d/docker-ce.repo
yum install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
```

## Docker 技巧

### 镜像迁移技巧

当有多架构镜像需要迁移时，可以使用 `skopeo` 工具。

```sh file="./docker/transfer.sh" title="transfer.sh"
#!/bin/bash

SOURCE="old-repo/my-app"
TARGET="new-repo/my-app"
# 假设你要迁移的 tag 列表
TAGS=("v1.0" "v1.1" "latest")

for TAG in "${TAGS[@]}"
do
    echo "正在迁移多架构镜像: $TAG -> dev-$TAG"

    # --all 表示拷贝该 Tag 下的所有架构 (amd64, arm64 等)
    skopeo copy --all \
        docker://$SOURCE:$TAG \
        docker://$TARGET:dev-$TAG
done
```

### buildx

```bash
docker buildx create --name mybuilder
docker buildx use mybuilder
docker buildx inspect --bootstrap
docker buildx create --use --platform linux/amd64,linux/arm64
docker buildx build --builder mybuilder --platform linux/amd64,linux/arm64 -t test:v1 . --push

# 删除缓存
docker buildx prune --builder mybuilder --all -f
```

### 合并多架构镜像

```bash

docker push buyfakett/rsyslog:latest-amd64
docker push buyfakett/rsyslog:latest-arm64

docker manifest create buyfakett/rsyslog:latest \
    buyfakett/rsyslog:latest-amd64 \
    buyfakett/rsyslog:latest-arm64

docker manifest annotate buyfakett/rsyslog:latest buyfakett/rsyslog:latest-amd64 --os linux --arch amd64
docker manifest annotate buyfakett/rsyslog:latest buyfakett/rsyslog:latest-arm64 --os linux --arch arm64

docker manifest push buyfakett/rsyslog:latest
```