Docker从入门到动手实践

阅读原文时间：2023年07月11日阅读：3

一些理论知识，我这里就不累赘了

docker 入门资料，参考：https://yeasy.gitbooks.io/docker_practice/content/

Dockerfile常用命令，图片来源于网络

Dockerfile 打包控制台应用程序

新建一个控制台程序，控制台程序添加一个文本文件，去掉.txt 扩展名，改成Dockerfile 输入以下代码

FROM microsoft/dotnet:sdk AS build
WORKDIR /code
COPY *.csproj /code
RUN dotnet restore

COPY . /code
RUN dotnet publish -c Release -o out

FROM microsoft/dotnet:runtime
WORKDIR /app
COPY --from=build /code/out /app
ENTRYPOINT ["dotnet","console.dll"]

Program.cs 中编写测试代码

一切准备完成。就是build把项目打包成镜像了

切换到当前项目路径下。输入： docker build -t cn/console:v1 .

docker build -t ：是打包固有的命令

cn/console:v1 ：

cn：是组织名称或者说是用户名，如果你想把自己的镜像push到hub.docker 上，cn必须是你自己的用户名

console：是镜像名称

v1：是tag。一个标签，可以用来区分同一个镜像，不同用途。，如果不指定。默认是latest

. ：代表当前目录为上下文，dockerfile也必定是在当前目录下

回车后，会看到一系列的执行步骤，dockerfile中。一条命令就是一个步骤

通过 docker images 可以查看所有镜像

通过docker images cn/console 查看相关镜像

比如我本地有3个 cn/console镜像，但tag不同

既然镜像有了。那么就可以根据镜像生成容器了。容器是镜像的一个实例。镜像运行起来才会有容器，就跟类和对象一样，new一个类，是实例化的操作

输入命令：

docker run --name myfirst cn/console:v1

因为是占用前端线程运行容器，所有界面无法继续输入命令了。可以Ctrl+c 结束容器运行

从上面的dockerfile。你会发现，我们是把源码打包成镜像的。也就是执行了restore，到Release操作

其实如果你是已经Release后的文件了。dockerfile可以更简单

FROM microsoft/dotnet
WORKDIR /app
COPY . /app
CMD ["dotnet","run"]

以上就是一个基础的程序打包成镜像，我觉得这不是重点，常用的应该是应用程序，而不是控制台程序

后面打算把net core api打包成镜像。在讲这个之前，我们先来搭建好环境。

Docker mysql

因为我有个阿里云服务器（CentOS7），然后有2台笔记本，一个是Docker for Windows 环境，一个是CentOS7，所以经常会在这3个环境中来回折腾

两种系统还是有区别的，至少我弄的时候，遇到过不少问题

1：for Windows中默认拉起的镜像都在C盘。会导致C盘越来越大，建议迁移

如果迁移的盘。比如我这个E盘。路径中已经存在MobyLinuxVM.vhdx 。是迁移不过的。要删除，但之前的镜像都没有了

如果你想保存，先重命名MobyLinuxVM.vhdx，迁移后。删除之后的。之前的重命名回来即可

2：共享盘。为了数据卷挂载用

3：配置镜像加速（https://hlef8lmt.mirror.aliyuncs.com）

然后可以去hub.docker上寻找需要的镜像，官方的mysql有2个镜像

当然你通过命令也可以收索到： docker search mysql

首先来看docker mysql

准备需要挂载的目录和文件，上面我设置的共享盘是D盘，所以挂载的在D盘

my.cnf配置文件，主要是设置mysql的参数

[mysqld]
user=mysql
character-set-server=utf8
[client]
default-character-set=utf8
[mysql]
default-character-set=utf8

data是空的。当run的时候，mysql会写入文件

sql是需要在运行myslq后执行的初始化文件，比如我这里是给刚创建的用户名分配权限

这里为了说明sql是执行成功的。我在加条。创建数据库的sql，创建数据库 docker和user表，并插入一条数据

GRANT ALL PRIVILEGES ON *.* TO 'test'@'%' WITH GRANT OPTION;
Create DATABASE docker;
USE docker;
CREATE TABLE user (ID int auto_increment primary key,name nvarchar(20),address nvarchar(50));
insert into user(name,address)values('刘德华','香港');

初始化后就执行的好处是。不用在run后，去手动执行，关于run后手动执行，

可以查看我之前的docker安装mysql https://www.cnblogs.com/nsky/p/10413136.html

全部配置完成后，开始敲命令，以下命令需要去掉注释

docker run -d -p :
--restart always #总是自动重启。比如系统重启，该容器会自动启动
-e MYSQL_USER=test #创建用户名test
-e MYSQL_PASSWORD= #test密码
-e MYSQL_PASSWORD_HOST=% #test 开启外部登陆
-e MYSQL_ROOT_PASSWORD= #root密码
-e MYSQL_ROOT_HOST=% #root开启外部登陆
-v /d/docker/mysql/my.cnf:/etc/my.cnf #配置文件
-v /d/docker/mysql/sql:/docker-entrypoint-initdb.d #初始化的sql
-v /d/docker/mysql/data:/var/lib/mysql #data文件
--name mysql #镜像名称
mysql #基于那个镜像创建容器

执行成功没有异常后。通过 docker ps 可以查看运行的容器，如果没有，那就通过 docker ps -a 一定会有的

现在可以通过Navicat连接试试

创建了docker库。user表也有数据，能看到mysql库，说明test用户是有权限的

当我使用mysql-server 镜像时，创建容器会无法启动

可以看到。启动失败后。又继续重启，因为参数指定了restart always

输入命令 docker logs mysql 查看启动日志

最后在my.cnf中加这个，经测试，启动成功，就不一一放图了

数据库准备好了，那么就快速的构建一个net core api 接口

1：引入NugGet包，MySql.Data.EntityFrameworkCore

2：创建DbContext

using Docker.Api.Model;
using Microsoft.EntityFrameworkCore;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace Docker.Api.Data
{
public class DbUserInfoContext : DbContext
{
public DbUserInfoContext(DbContextOptions options) : base(options) { }

    public DbSet<UseInfo> userInfos { get; set; }

    /// <summary>  
    /// 模型创建时触发  
    /// </summary>  
    /// <param name="modelBuilder"></param>  
    protected override void OnModelCreating(ModelBuilder modelBuilder)  
    {  
        /\*  
         修改表名和主键，user对应数据库的表，mysql默认是区分大小写的  
         查看：show variables like '%lower%';  
        lower\_case\_table\_names 为 0 区分，1 不区分  
         \*/  
        modelBuilder.Entity<UseInfo>(b => b.ToTable("user").HasKey(u => u.id));

        //or  
        //modelBuilder.Entity<user>()  
        //    .ToTable("user")  
        //    .HasKey(u => u.id);

        base.OnModelCreating(modelBuilder);  
    }  
}

}

3：添加UserInfo控制器

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Docker.Api.Data;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;

namespace Docker.Api.Controllers
{
[Route("api/[controller]")]
[ApiController]
public class UserInfoController : ControllerBase
{
private DbUserInfoContext _DbUserInfoContext;
public UserInfoController(DbUserInfoContext context)
{
_DbUserInfoContext = context;
}
[HttpGet]
public async Task Get()
{
return new JsonResult(await _DbUserInfoContext.userInfos.FirstOrDefaultAsync());
}
}
}

4：配置sql连接字符串： server=localhost;port=;userid=test;password=;database=docker

run项目。访问能成功获取信息

容器互连，Docker Network

接下来我们把这个api也打包成镜像，然后基于该镜像创建容器，然后连接mysql镜像的容器。这称之为容器互连

容器互连有3种方式

1：Link方式。已经被docker淘汰，docker官方不推荐使用该方式

2：Bridger，桥接的方式，单台机器用

3：Overlay 适用于集群时候用

Overlay 就我目前环境不适合测试，集群也不懂。就不搞了

说说LInk和Bridger方式，具体理论知识请看docker官方文档。我这里只实践

现在一切来回忆下

刚上面打包控制台应用程序用的是：microsoft/dotnet 镜像

然后后面带上tag

比如：

Micirosoft/dotnet:sdk

包含了运行时和sdk命令，打包后会很大，因为包含sdk，一般用于测试环境

Microsoft/dotnet:-runtime

包含运行时，不包含sdk，打包后就很小了，一般用于正式环境

Microsoft/dotnet:-runtime-deps

打包的时候，会自包含runtime，也就是部署的机器有没有runtime是没有关系

上面2种，必须机器要包含core环境

修改程序port运行在80上

编写api的Dockerfile

我这里用的sdk，因为要用到sdk命令比如dotnet restore，dotnet publish

如果已经publish的文件，直接用runtime会方便很多。上面也有提及

#FROM mcr.microsoft.com/dotnet/core/sdk:2.2 AS build
FROM microsoft/dotnet:2.2-sdk AS build
WORKDIR /src
WORKDIR /source
#这里的后面的 . 就是/source 路径
#或者 COPY *.csproj /source
COPY *.csproj .
RUN dotnet restore
COPY . .
# 发布到 /source/out 下
RUN dotnet publish -c Release -o out

#FROM mcr.microsoft.com/dotnet/core/runtime:2.2
FROM microsoft/dotnet:2.2-aspnetcore-runtime
WORKDIR /app
COPY --from=build /source/out .
EXPOSE
ENTRYPOINT ["dotnet","Docker.Api.dll"]

开始build项目 docker build -t cn/myapi .

可以看到。这里没有指定tag。所以默认是latest，size也不大

成功后开始run一个容器，不过这之前要先：

准备挂载目录。因为配置文件 appsettings 会需要动态配置，所以挂载出来

还有，比如一个网站都有log日志，这些也需要挂载出来。便于管理。

我这里就只挂载appsettings.json

执行命令：

docker run -d -p : --restart always --link mysql:mysqldb -v /d/docker/myapi/appsettings.json:/app/appsettings.json --name api cn/myapi

分析：

--restart always :总是重启

-d：是在后台执行

-p 80:80 ：第一个80是暴露给外部的。第二个80是程序的。

--link mysql:mysqldb : mysql是容器名称，mysqldb是自定义名称，可以理解为服务器

-v /d/docker/myapi/appsettings.json:/app/appsettings.json：这里就是挂载外部的数据卷了

也许你会问。我怎么知道这个路径的：/app/appsettings.json。从编写的dockerfile能分析出来，待会也可以进入容器看看

最有的工作目录是根路径下： /app

然后通过页面访问试试

发现依然无法访问，因为修改appsettings.json的连接方式

记住这里是修改D:\docker\myapi\appsettings.json ,因为已经挂载出来

把server改成mysqldb，然后重启容器： docker restart api

再次刷新页面

我们进入容器看看： docker exec -it api bash 可以看到根目录下存在app目录

进入app目录

个人认为link方式是最简单的。在这3种中，接下来看看Bridge方式

1：首先创建一个网络 network，名称叫api2bridge

docker network create -d bridge api2bridge

通过： docker network ls 可以查看到已经创建成功

2：实例化容器

为了区别于上面的80端口，这里新增一个8081

docker run -d -p 8081:80 --restart always -v /d/docker/myapi/appsettings.json:/app/appsettings.json --net api2bridge --name api2 cn/myapi

创建容器的时候，自定network 这里的--net api2bridge 就是上面的bridge

3：连接2个容器，通过： docker network connect api2bridge mysql 把api2和mysql连接起来

4：修改appsettings.json server=mysql

5 : restart 容器，如果是在创建容器前修改的配置文件。是不需要重启的，测试通过

看看这两个容器是怎么连接的。通过命令： docker inspect api2bridge 可以查看对象的元数据（容器或者网络）

分别看看；

docker inspect api2

docker inspect mysql

你会发现mysql有个"IPAddress":地址，

上面我们在api2中的appsettings.json的server是直接些的容器名称：mysql。也可以直接些这个ip地址。比如： server=172.20.0.3 同样是可以的。

Overlay方式就不讲了。因为我也不知道。哈哈

docker-compose 容器编排

通过这几个例子你会发现。2个容器要部署2个，如果项目依赖mysql，redis，MQ等等。那得部署多次，如此重复性的工作会影响效率

所以有了docker-compose，compose

参考：https://yeasy.gitbooks.io/docker_practice/content/compose/install.html

安装：

sudo curl -L https://github.com/docker/compose/releases/download/1.17.1/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

安装完成后，可以通过： docker-compose --version 查看版本

通过： docker-compose --help 查看基本的命令

不过我英文不好，就通过百度翻译了，翻译得有点生硬。仅供参考

Commands:
build 建立或重建服务
bundle 从撰写文件生成Docker捆绑包
config 验证并查看撰写文件
create 创建服务
down 停止并删除容器、网络、图像和卷
events 从容器接收实时事件
exec 在正在运行的容器中执行命令
help 获取有关命令的帮助
images 列表图像
kill 杀死容器
logs 查看容器的输出
pause 暂停服务
port 打印端口绑定的公共端口
ps 列表容器
pull 拉取服务图像
push 推送服务图像
restart 重新启动服务
rm 移除停止的容器
run 运行一次性命令
scale 设置服务的容器数
start 启动服务
stop 停止服务
top 显示正在运行的进程
unpause 取消暂停服务
up 创建和启动容器
version 显示Docker撰写版本信息

目前为止已经有3个容器了，

为了区别于之前的mysql和api和api2，这里命名要修改，编写在程序根目录下添加docker-compose.yml文件

compose用的是yml语法。可以参考阮一峰些的文章

http://www.ruanyifeng.com/blog/2016/07/yaml.html

项目准备。依然在上面的api项目中添砖加瓦

还记得上面初始化的创建docker库，user表吗。这里我们通过在代码中来实现，

场景：创建myslq的时候，判断数据库是否有数据，否则新增一条数据

技术栈：项目依赖mysql，redis，其实我工作中用的都是mssql，所以待会也会介绍

1：init.sql 只保留一条sql语句

2：新增UserInit类。用于初始化数据

using Microsoft.AspNetCore.Builder;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace Docker.Api.Data
{
public class UserInit
{
private ILogger _logger;

    public UserInit(ILogger<UserInit> logger)  
    {  
        \_logger = logger;  
    }

    public static async Task InitData(IApplicationBuilder app, ILoggerFactory loggerFactory)  
    {

        using (var scope = app.ApplicationServices.CreateScope())  
        {  
            var context = scope.ServiceProvider.GetService<DbUserInfoContext>();  
            var logger = scope.ServiceProvider.GetService<ILogger<UserInit>>();  
            logger.LogDebug("begin mysql init");  
            context.Database.Migrate();  
            if (context.userInfos.Count() <= )  
            {  
                context.userInfos.Add(new Model.UseInfo  
                {  
                    name = "admin",  
                    address = "博客园"  
                });  
                context.SaveChanges();  
            }  
        }  
        await Task.CompletedTask;  
    }  
}

}

程序启动调用：

3：实体类

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace Docker.Api.Model
{
public class UseInfo
{
public int id { get; set; }
public string name { get; set; }
public string address { get; set; }
}
}

4：DbContext 上面也列出，这里就不展示了

5：RedisHelper网络有。这里也不提了

只准备2个接口。用于测试redis。一个读，一个写

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;

namespace Docker.Api.Controllers
{
[Route("api/[controller]")]
[ApiController]
public class RedisController : ControllerBase
{
[HttpPost]
public void Post()
{
RedisCommon.GetRedis().StringSet("docker", "hello", TimeSpan.FromMinutes());
}
[HttpGet]
public string Get()
{
var docker = RedisCommon.GetRedis().GetStringKey("docker");
if (docker.HasValue) return docker.ToString();
return "empty";
}
}
}

6：根据Model生成Migration，这里简单过一下，具体参考我之前的：https://www.cnblogs.com/nsky/p/10323415.html

调出程序包管理控制台

输入： Add-Migration init

如果成功了就会这样：

编写docker-compose.yml 文件，我这里的注释是便于理解。尽量不要写

注：我是直接在项目中创建的文本文件，然后修改后缀名

在网络上看到说。如果是在外部创建的记事本。要修改编码为：ASCII编码格式，我未测试

version: ''

services:
db:
image: mysql
container_name: 'mysql01'
command: --character-set-server=utf8 --collation-server=utf8_general_ci
restart: always
ports:
- '3307:3306'
environment:
MYSQL_USER: test
MYSQL_PASSWORD:
MYSQL_PASSWORD_HOST: '%'
MYSQL_ROOT_PASSWORD:
MYSQL_ROOT_HOST: '%'
volumes:
- /d/docker/mysql02/my.cnf:/etc/my.cnf
- /d/docker/mysql02/data:/var/lib/mysql
- /d/docker/mysql02/SqlInit:/docker-entrypoint-initdb.d
redis:
image: redis
container_name: 'redis'
command: redis-server /usr/local/etc/redis/redis.conf
restart: always
ports:
- '6379:6379'
environment:
requirepass: #redis密码
appendonly: 'yes' #redis是否持久化
volumes:
- /d/docker/redis/conf/redis.conf:/usr/local/etc/redis/redis.conf
- /d/docker/redis/data:/data #这里会保存持久化数据
web:
build: . #会执行当前目录下面的dockerfile文件
container_name: 'api3' #容器名称
restart: always # web依赖于db，如果web比db启动快。就连接不上db导致web异常，web容器启动失败，restart可以不断重试，直到连接为止
volumes:
- /d/docker/myapi/appsettings.json:/app/appsettings.json
ports:
- '8082:80'
depends_on: #依赖db容器，并不代表执行顺序
- db
- redis

如果想看编写的yml文件是否正确，可以去在线的网站，验证是否正确，比如：http://nodeca.github.io/js-yaml/

切换到当前目录输入： docker-compose build 会开始build项目成镜像

查看镜像：名字叫dockerapi_web

输入命令： docker-compose up 会开始创建容器并启动

输出的日志太多。这里只点几个有用的看

EFcore插入Migration历史记录

创建表:

直到最后，程序阻塞。显示成功，因为这里没用用 -d 会阻塞，调试的时候不建议 -d

然后新打开一个PowerShell，输入docker ps 查看运行的容器

分别测试是否成功

同样验证redis，用RedisDesktopManager连接

从容器可以看出api3端口是8082，尝试访问下

测试写redis，打开Postman写入Redis

写人成功

那么读取就不是什么大问题了

问题汇总：

如果你修改了代码，需要重新build。那么先删除容器： docker-compose down 会停止容器并删除

docker-compose ps 查看容器列表

docker-compose up -d 后端运行，不阻塞前端

docker-compose restart 重启所有容器。

自此所有容器成功运行，但我感觉还不够，因为一直都是在windos上玩。而没有上CentOS7,可我又不缺CentOS环境。所以要玩一把

net core Api 跨平台部署

技术栈：Jexus，mysql，mssql，redis

关于jexus部署net core 可以参考我前面写的文章：https://www.cnblogs.com/nsky/p/10386460.html

既然要加入新的成员。jexus 和 mssql，那么就得修改docker-compose文件

在通过docker-compose统一打包前，我们先来单独玩玩mssql

准备数据卷挂载目录

data：保存数据库文件

sql：执行的脚本。mssql没有mysql的docker-entrypoint-initdb.d 挂载，启动mysql就执行sql。这里sql文件夹

虽然保存的是.sql文件。但要手动执行，不知道是不是我没有找到具体的方案

sql里面放一个init.sql文件。编写sql脚本如下

这里要注意一点，一条语句完成必须要带一个Go语句

参考官方文档：

https://docs.microsoft.com/zh-cn/sql/linux/quickstart-install-connect-docker?view=sql-server-2017&pivots=cs1-bash

https://docs.microsoft.com/zh-cn/sql/linux/tutorial-restore-backup-in-sql-server-container?view=sql-server-2017

镜像文档：https://hub.docker.com/_/microsoft-mssql-server

//注释部分
docker run -d -p : \
-e ACCEPT_EULA=Y \ #确认您接受最终用户许可协议。
-e SA_PASSWORD=DockerPwd123 \ #强大的系统管理员（SA）密码：至少8个字符，包括大写，小写字母，基数为10的数字和/或非字母数字符号。
-e MSSQL_PID=Express \ #版本（Developer，Express，Enterprise，EnterpriseCore）默认值：Developer
-v /docker/mssql:/var/opt/mssql \ # 映射数据库
v /d/docker/mssql/sql:/script #把需要执行的脚本放这里，script路径随便改，不是初始化执行，是手到执行
--name mssql #容器名称
mcr.microsoft.com/mssql/server #镜像

执行成功后。数据卷挂载目录。生成了文件

此时data也有默认的数据库了

通过 MSSMS( Microsoft SQL Server Management Studio )连接试试

刚上面说了sql中文件是没有被执行的。必须手动执行。

手动执行前，先来看看其他一些相关命令

进入容器后： docker exec -it mssql bash

登陆数据库：localhost也可以用指定的ip代替，如果有端口。则带端口号即可

/opt/mssql-tools/bin/sqlcmd -S localhost -U SA -P DockerPwd123

-S 是服务器，不管端口是多少，都不用写
-U 是用户名
-P 是密码

如果出现 1> 说明的登陆成功了

可以输入语句：select getdate() 试试，回车后，需要加Go语句，不过日期怎么不对？好像是相差8个时区

修改时区，可以通过TZ变量

docker run -e TZ="Asia/Shanghai" -e 'ACCEPT_EULA=Y' -e 'MSSQL_SA_PASSWORD=DockerPwd123' -e MSSQL_PID=Express -p : --name mssql -d mcr.microsoft.com/mssql/server

官网文档：https://docs.microsoft.com/zh-cn/sql/linux/sql-server-linux-configure-docker?view=sql-server-2017#tz

执行sql中的文件

登陆容器后执行操作： /opt/mssql-tools/bin/sqlcmd -S localhost -U SA -P DockerPwd123 -i /script/init.sql

挂载目录也有，这样就算容器无法进入。数据库也存在

由于时间问题，docker-compose 就不加入mssql，只加jexus，修改docker-compose如下

直接上docker-compose文件

version: ''

services:
db:
image: mysql
container_name: 'mysql'
command: --character-set-server=utf8 --collation-server=utf8_general_ci
restart: always
ports:
- '3306:3306'
environment:
MYSQL_USER: test
MYSQL_PASSWORD:
MYSQL_PASSWORD_HOST: '%'
MYSQL_ROOT_PASSWORD:
MYSQL_ROOT_HOST: '%'
volumes:
- /docker/mysq/my.cnf:/etc/my.cnf
- /docker/mysql/data:/var/lib/mysql
- /docker/mysql/sql:/docker-entrypoint-initdb.d
redis:
image: redis
container_name: 'redis'
command: redis-server /usr/local/etc/redis/redis.conf
restart: always
ports:
- '6379:6379'
environment:
requirepass: #redis密码
appendonly: 'yes' #redis是否持久化
volumes:
- /docker/redis/conf/redis.conf:/usr/local/etc/redis/redis.conf
- /docker/redis/data:/data #这里会保存持久化数据
jexus:
image: byniqing/jexus
container_name: 'jexus'
ports:
- '80:8803'#前一个80是暴露外部的，后一个8803是jexus监听的的。也就是配置文件中port=，此端口必须要开通
restart: always
volumes:
- /docker/jexus/www:/var/www
- /docker/jexus/siteconf:/usr/jexus/siteconf
- /docker/jexus/log:/usr/jexus/log
#depends_on:
#- web
web:
build: . #会执行当前目录下面的dockerfile文件
container_name: 'api' #容器名称
restart: always # web依赖于db，如果web比db启动快。就连接不上db导致web异常，web容器启动失败，restart可以不断重试，直到连接为止
volumes:
- /docker/myapi/appsettings.json:/app/appsettings.json
ports:
- '8802:80'#8802端口必须开启，如果是阿里云。添加入栈规则，jexus配置。代理到8802即可，浏览器直接访问这个port也能访问
depends_on: #依赖db容器，并不代表执行顺序
- db
- redis

分析：

1：jexus我用了自己打包后的镜像。然后push到hub.docker上去了，大家也可以打包一个自己的。方便以后测试，升级，当然直接用给我这个也可以，dockerfile 如下：

FROM debian:latest
MAINTAINER xxx xxx@xxx.com

RUN apt-get update \
&& apt-get -y install wget \
&& cd /usr \
&& wget https://www.linuxdot.net/down/jexus-5.8.3-x64.tar.gz \
&& tar -zxvf jexus-5.8.-x64.tar.gz \
&& apt-get -y autoremove --purge wget \
&& rm -rf /var/lib/apt/lists/* jexus-5.8.3-x64.tar.gz

EXPOSE 80
WORKDIR /usr/jexus
CMD /usr/jexus/jwss

2：web中的ports暴露了8802端口，需要开通该端口

3：jexus文件配置：reproxy=/ ip:8802（绕过容器内部，直接访问容器，所以直接在浏览器也是直接可以访问的），或者reproxy=/ web:80 （容器互联）

然后你会发现通过ip:80和ip:8802都能访问，

一个是通过jexus访问。一个是绕过了jexus直接访问了api接口，那怎么行呢，那么jexus就没有存在的用意了

所以：我们应该不暴露web端口，即屏蔽掉ports

然后重新修改jexus，通过容器名称访问： reproxy=/ web:

因为compose打包后后是在同一个网络中：

比如： docker-compose ps 可以查看当前服务下的所有容器

那怎么判断当前容器使用的那些网络呢？

可以查看当前某个容器的元数据：比如我们来看mysql的： docker inspect mysql 也可以看出Networks节点信息

通过： docker network ls 查看当前网络，存在 dockerapi_default

那么就可以通过： docker inspect dockerapi_default 查看下dockerapi_default网络的元数据

可以看到Containers节点下。docker-compose中定义的4个容器，并且ip4都在192.168.48.x/20

不知道你跟是否有同一个疑问，虽然api没有暴露接口，但api和jexus。tcp都是80

那我直接访问ip地址怎么确定一定就是访问的jexus。而不是Api呢。那么我们来改造一下，jexus暴露8802，api内部依然是80

从新打包，查看容器：

然后浏览器输入：ip:8802/api/values 访问成功

输入：ip/aip/values 访问失败

那么这样就达到了只能通过jexus访问到我的aip了

修改挂载文件

使用数据卷，文件挂载到宿主机就是为了方便修改，这里拿redis为例

我们在创建redis的时候有个挂载目录为： /docker/redis/conf/redis.conf:/usr/local/etc/redis/redis.conf

redis.conf这个就是redis的配置文件。可以自行修改，

去网上下载一个对应版本的配置文件放进去即可：http://download.redis.io/releases/

比如上面的默认密码是：123456，我们来改成7890

1：注释掉，bind 127.0.0.1

2：修改，requirepass 值，是不是发现requirepass 跟docker-compose 中变量是同一个

3：重启redis

4：测试连接成功，

进入redis容器。查看 /usr/local/etc/redis/redis.conf

你会发现，redis.conf是同步更新的，这里就不截图了

放一个redis.confi文件

# Redis configuration file example

# Note on units: when memory size is needed, it is possible to specify
# it in the usual form of 1k 5GB 4M and so forth:
#
# 1k => bytes
# 1kb => bytes
# 1m => bytes
# 1mb => * bytes
# 1g => bytes
# 1gb => ** bytes
#
# units are case insensitive so 1GB 1Gb 1gB are all the same.

################################## INCLUDES ###################################

# Include one or more other config files here. This is useful if you
# have a standard template that goes to all Redis servers but also need
# to customize a few per-server settings. Include files can include
# other files, so use this wisely.
#
# Notice option "include" won't be rewritten by command "CONFIG REWRITE"
# from admin or Redis Sentinel. Since Redis always uses the last processed
# line as value of a configuration directive, you'd better put includes
# at the beginning of this file to avoid overwriting config change at runtime.
#
# If instead you are interested in using includes to override configuration
# options, it is better to use include as the last line.
#
# include .\path\to\local.conf
# include c:\path\to\other.conf

################################## NETWORK #####################################

# By default, if no "bind" configuration directive is specified, Redis listens
# for connections from all the network interfaces available on the server.
# It is possible to listen to just one or multiple selected interfaces using
# the "bind" configuration directive, followed by one or more IP addresses.
#
# Examples:
#
# bind 192.168.1.100 10.0.0.1
# bind 127.0.0.1 ::
#
# ~~~ WARNING~~ ~ If the computer running Redis is directly exposed to the
# internet, binding to all the interfaces is dangerous and will expose the
# instance to everybody on the internet. So by default we uncomment the
# following bind directive, that will force Redis to listen only into
# the IPv4 lookback interface address (this means Redis will be able to
# accept connections only from clients running into the same computer it
# is running).
#
# IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES
# JUST COMMENT THE FOLLOWING LINE.
# ~~~~~~~~~~~~~~~~
#bind 127.0.0.1

# Protected mode is a layer of security protection, in order to avoid that
# Redis instances left open on the internet are accessed and exploited.
#
# When protected mode is on and if:
#
# ) The server is not binding explicitly to a set of addresses using the
# "bind" directive.
# ) No password is configured.
#
# The server only accepts connections from clients connecting from the
# IPv4 and IPv6 loopback addresses 127.0.0.1 and ::, and from Unix domain
# sockets.
#
# By default protected mode is enabled. You should disable it only if
# you are sure you want clients from other hosts to connect to Redis
# even if no authentication is configured, nor a specific set of interfaces
# are explicitly listed using the "bind" directive.
protected-mode yes

# Accept connections on the specified port, default is (IANA #).
# If port is specified Redis will not listen on a TCP socket.
port

# TCP listen() backlog.
#
# In high requests-per-second environments you need an high backlog in order
# to avoid slow clients connections issues. Note that the Linux kernel
# will silently truncate it to the value of /proc/sys/net/core/somaxconn so
# make sure to raise both the value of somaxconn and tcp_max_syn_backlog
# in order to get the desired effect.
tcp-backlog

# Unix socket.
#
# Specify the path for the Unix socket that will be used to listen for
# incoming connections. There is no default, so Redis will not listen
# on a unix socket when not specified.
#
# unixsocket /tmp/redis.sock
# unixsocketperm

# Close the connection after a client is idle for N seconds ( to disable)
timeout

# TCP keepalive.
#
# If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence
# of communication. This is useful for two reasons:
#
# ) Detect dead peers.
# ) Take the connection alive from the point of view of network
# equipment in the middle.
#
# On Linux, the specified value (in seconds) is the period used to send ACKs.
# Note that to close the connection the double of the time is needed.
# On other kernels the period depends on the kernel configuration.
#
# A reasonable value for this option is seconds.
tcp-keepalive

################################# GENERAL #####################################

# By default Redis does not run as a daemon. Use 'yes' if you need it.
# Note that Redis will write a pid file in /var/run/redis.pid when daemonized.
# NOT SUPPORTED ON WINDOWS daemonize no

# If you run Redis from upstart or systemd, Redis can interact with your
# supervision tree. Options:
# supervised no - no supervision interaction
# supervised upstart - signal upstart by putting Redis into SIGSTOP mode
# supervised systemd - signal systemd by writing READY= to $NOTIFY_SOCKET
# supervised auto - detect upstart or systemd method based on
# UPSTART_JOB or NOTIFY_SOCKET environment variables
# Note: these supervision methods only signal "process is ready."
# They do not enable continuous liveness pings back to your supervisor.
# NOT SUPPORTED ON WINDOWS supervised no

# If a pid file is specified, Redis writes it where specified at startup
# and removes it at exit.
#
# When the server runs non daemonized, no pid file is created if none is
# specified in the configuration. When the server is daemonized, the pid file
# is used even if not specified, defaulting to "/var/run/redis.pid".
#
# Creating a pid file is best effort: if Redis is not able to create it
# nothing bad happens, the server will start and run normally.
# NOT SUPPORTED ON WINDOWS pidfile /var/run/redis.pid

# Specify the server verbosity level.
# This can be one of:
# debug (a lot of information, useful for development/testing)
# verbose (many rarely useful info, but not a mess like the debug level)
# notice (moderately verbose, what you want in production probably)
# warning (only very important / critical messages are logged)
loglevel notice

# Specify the log file name. Also 'stdout' can be used to force
# Redis to log on the standard output.
logfile ""

# To enable logging to the Windows EventLog, just set 'syslog-enabled' to
# yes, and optionally update the other syslog parameters to suit your needs.
# If Redis is installed and launched as a Windows Service, this will
# automatically be enabled.
# syslog-enabled no

# Specify the source name of the events in the Windows Application log.
# syslog-ident redis

# Set the number of databases. The default database is DB , you can select
# a different one on a per-connection basis using SELECT where
# dbid is a number between and 'databases'-
databases

################################ SNAPSHOTTING ################################
#
# Save the DB on disk:
#
# save
#
# Will save the DB if both the given number of seconds and the given
# number of write operations against the DB occurred.
#
# In the example below the behaviour will be to save:
# after sec ( min) if at least key changed
# after sec ( min) if at least keys changed
# after sec if at least keys changed
#
# Note: you can disable saving completely by commenting out all "save" lines.
#
# It is also possible to remove all the previously configured save
# points by adding a save directive with a single empty string argument
# like in the following example:
#
# save ""

save
save
save

# By default Redis will stop accepting writes if RDB snapshots are enabled
# (at least one save point) and the latest background save failed.
# This will make the user aware (in a hard way) that data is not persisting
# on disk properly, otherwise chances are that no one will notice and some
# disaster will happen.
#
# If the background saving process will start working again Redis will
# automatically allow writes again.
#
# However if you have setup your proper monitoring of the Redis server
# and persistence, you may want to disable this feature so that Redis will
# continue to work as usual even if there are problems with disk,
# permissions, and so forth.
stop-writes-on-bgsave-error yes

# Compress string objects using LZF when dump .rdb databases?
# For default that's set to 'yes' as it's almost always a win.
# If you want to save some CPU in the saving child set it to 'no' but
# the dataset will likely be bigger if you have compressible values or keys.
rdbcompression yes

# Since version of RDB a CRC64 checksum is placed at the end of the file.
# This makes the format more resistant to corruption but there is a performance
# hit to pay (around %) when saving and loading RDB files, so you can disable it
# for maximum performances.
#
# RDB files created with checksum disabled have a checksum of zero that will
# tell the loading code to skip the check.
rdbchecksum yes

# The filename where to dump the DB
dbfilename dump.rdb

# The working directory.
#
# The DB will be written inside this directory, with the filename specified
# above using the 'dbfilename' configuration directive.
#
# The Append Only File will also be created inside this directory.
#
# Note that you must specify a directory here, not a file name.
dir ./

################################# REPLICATION #################################

# Master-Slave replication. Use slaveof to make a Redis instance a copy of
# another Redis server. A few things to understand ASAP about Redis replication.
#
# ) Redis replication is asynchronous, but you can configure a master to
# stop accepting writes if it appears to be not connected with at least
# a given number of slaves.
# ) Redis slaves are able to perform a partial resynchronization with the
# master if the replication link is lost for a relatively small amount of
# time. You may want to configure the replication backlog size (see the next
# sections of this file) with a sensible value depending on your needs.
# ) Replication is automatic and does not need user intervention. After a
# network partition slaves automatically try to reconnect to masters
# and resynchronize with them.
#
# slaveof

# If the master is password protected (using the "requirepass" configuration
# directive below) it is possible to tell the slave to authenticate before
# starting the replication synchronization process, otherwise the master will
# refuse the slave request.
#
# masterauth

# When a slave loses its connection with the master, or when the replication
# is still in progress, the slave can act in two different ways:
#
# ) if slave-serve-stale-data is set to 'yes' (the default) the slave will
# still reply to client requests, possibly with out of date data, or the
# data set may just be empty if this is the first synchronization.
#
# ) if slave-serve-stale-data is set to 'no' the slave will reply with
# an error "SYNC with master in progress" to all the kind of commands
# but to INFO and SLAVEOF.
#
slave-serve-stale-data yes

# You can configure a slave instance to accept writes or not. Writing against
# a slave instance may be useful to store some ephemeral data (because data
# written on a slave will be easily deleted after resync with the master) but
# may also cause problems if clients are writing to it because of a
# misconfiguration.
#
# Since Redis 2.6 by default slaves are read-only.
#
# Note: read only slaves are not designed to be exposed to untrusted clients
# on the internet. It's just a protection layer against misuse of the instance.
# Still a read only slave exports by default all the administrative commands
# such as CONFIG, DEBUG, and so forth. To a limited extent you can improve
# security of read only slaves using 'rename-command' to shadow all the
# administrative / dangerous commands.
slave-read-only yes

# Replication SYNC strategy: disk or socket.
#
# -------------------------------------------------------
# WARNING: DISKLESS REPLICATION IS EXPERIMENTAL CURRENTLY
# -------------------------------------------------------
#
# New slaves and reconnecting slaves that are not able to continue the replication
# process just receiving differences, need to do what is called a "full
# synchronization". An RDB file is transmitted from the master to the slaves.
# The transmission can happen in two different ways:
#
# ) Disk-backed: The Redis master creates a new process that writes the RDB
# file on disk. Later the file is transferred by the parent
# process to the slaves incrementally.
# ) Diskless: The Redis master creates a new process that directly writes the
# RDB file to slave sockets, without touching the disk at all.
#
# With disk-backed replication, while the RDB file is generated, more slaves
# can be queued and served with the RDB file as soon as the current child producing
# the RDB file finishes its work. With diskless replication instead once
# the transfer starts, new slaves arriving will be queued and a new transfer
# will start when the current one terminates.
#
# When diskless replication is used, the master waits a configurable amount of
# time (in seconds) before starting the transfer in the hope that multiple slaves
# will arrive and the transfer can be parallelized.
#
# With slow disks and fast (large bandwidth) networks, diskless replication
# works better.
repl-diskless-sync no

# When diskless replication is enabled, it is possible to configure the delay
# the server waits in order to spawn the child that transfers the RDB via socket
# to the slaves.
#
# This is important since once the transfer starts, it is not possible to serve
# new slaves arriving, that will be queued for the next RDB transfer, so the server
# waits a delay in order to let more slaves arrive.
#
# The delay is specified in seconds, and by default is seconds. To disable
# it entirely just set it to seconds and the transfer will start ASAP.
repl-diskless-sync-delay

# Slaves send PINGs to server in a predefined interval. It's possible to change
# this interval with the repl_ping_slave_period option. The default value is
# seconds.
#
# repl-ping-slave-period

# The following option sets the replication timeout for:
#
# ) Bulk transfer I/O during SYNC, from the point of view of slave.
# ) Master timeout from the point of view of slaves (data, pings).
# ) Slave timeout from the point of view of masters (REPLCONF ACK pings).
#
# It is important to make sure that this value is greater than the value
# specified for repl-ping-slave-period otherwise a timeout will be detected
# every time there is low traffic between the master and the slave.
#
# repl-timeout

# Disable TCP_NODELAY on the slave socket after SYNC?
#
# If you select "yes" Redis will use a smaller number of TCP packets and
# less bandwidth to send data to slaves. But this can add a delay for
# the data to appear on the slave side, up to milliseconds with
# Linux kernels using a default configuration.
#
# If you select "no" the delay for data to appear on the slave side will
# be reduced but more bandwidth will be used for replication.
#
# By default we optimize for low latency, but in very high traffic conditions
# or when the master and slaves are many hops away, turning this to "yes" may
# be a good idea.
repl-disable-tcp-nodelay no

# Set the replication backlog size. The backlog is a buffer that accumulates
# slave data when slaves are disconnected for some time, so that when a slave
# wants to reconnect again, often a full resync is not needed, but a partial
# resync is enough, just passing the portion of data the slave missed while
# disconnected.
#
# The bigger the replication backlog, the longer the time the slave can be
# disconnected and later be able to perform a partial resynchronization.
#
# The backlog is only allocated once there is at least a slave connected.
#
# repl-backlog-size 1mb

# After a master has no longer connected slaves for some time, the backlog
# will be freed. The following option configures the amount of seconds that
# need to elapse, starting from the time the last slave disconnected, for
# the backlog buffer to be freed.
#
# A value of means to never release the backlog.
#
# repl-backlog-ttl

# The slave priority is an integer number published by Redis in the INFO output.
# It is used by Redis Sentinel in order to select a slave to promote into a
# master if the master is no longer working correctly.
#
# A slave with a low priority number is considered better for promotion, so
# for instance if there are three slaves with priority , , Sentinel will
# pick the one with priority , that is the lowest.
#
# However a special priority of marks the slave as not able to perform the
# role of master, so a slave with priority of will never be selected by
# Redis Sentinel for promotion.
#
# By default the priority is .
slave-priority

# It is possible for a master to stop accepting writes if there are less than
# N slaves connected, having a lag less or equal than M seconds.
#
# The N slaves need to be in "online" state.
#
# The lag in seconds, that must be <= the specified value, is calculated from
# the last ping received from the slave, that is usually sent every second.
#
# This option does not GUARANTEE that N replicas will accept the write, but
# will limit the window of exposure for lost writes in case not enough slaves
# are available, to the specified number of seconds.
#
# For example to require at least slaves with a lag <= seconds use:
#
# min-slaves-to-write
# min-slaves-max-lag
#
# Setting one or the other to disables the feature.
#
# By default min-slaves-to-write is set to (feature disabled) and
# min-slaves-max-lag is set to .

################################## SECURITY ###################################

# Require clients to issue AUTH before processing any other
# commands. This might be useful in environments in which you do not trust
# others with access to the host running redis-server.
#
# This should stay commented out for backward compatibility and because most
# people do not need auth (e.g. they run their own servers).
#
# Warning: since Redis is pretty fast an outside user can try up to
# 150k passwords per second against a good box. This means that you should
# use a very strong password otherwise it will be very easy to break.
#
# requirepass foobared
requirepass
# Command renaming.
#
# It is possible to change the name of dangerous commands in a shared
# environment. For instance the CONFIG command may be renamed into something
# hard to guess so that it will still be available for internal-use tools
# but not available for general clients.
#
# Example:
#
# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52
#
# It is also possible to completely kill a command by renaming it into
# an empty string:
#
# rename-command CONFIG ""
#
# Please note that changing the name of commands that are logged into the
# AOF file or transmitted to slaves may cause problems.

################################### LIMITS ####################################

# Set the max number of connected clients at the same time. By default
# this limit is set to clients, however if the Redis server is not
# able to configure the process file limit to allow for the specified limit
# the max number of allowed clients is set to the current file limit
# minus (as Redis reserves a few file descriptors for internal uses).
#
# Once the limit is reached Redis will close all the new connections sending
# an error 'max number of clients reached'.
#
# maxclients

# If Redis is to be used as an in-memory-only cache without any kind of
# persistence, then the fork() mechanism used by the background AOF/RDB
# persistence is unnecessary. As an optimization, all persistence can be
# turned off in the Windows version of Redis. This will redirect heap
# allocations to the system heap allocator, and disable commands that would
# otherwise cause fork() operations: BGSAVE and BGREWRITEAOF.
# This flag may not be combined with any of the other flags that configure
# AOF and RDB operations.
# persistence-available [(yes)|no]

# Don't use more memory than the specified amount of bytes.
# When the memory limit is reached Redis will try to remove keys
# according to the eviction policy selected (see maxmemory-policy).
#
# If Redis can't remove keys according to the policy, or if the policy is
# set to 'noeviction', Redis will start to reply with errors to commands
# that would use more memory, like SET, LPUSH, and so on, and will continue
# to reply to read-only commands like GET.
#
# This option is usually useful when using Redis as an LRU cache, or to set
# a hard memory limit for an instance (using the 'noeviction' policy).
#
# WARNING: If you have slaves attached to an instance with maxmemory on,
# the size of the output buffers needed to feed the slaves are subtracted
# from the used memory count, so that network problems / resyncs will
# not trigger a loop where keys are evicted, and in turn the output
# buffer of slaves is full with DELs of keys evicted triggering the deletion
# of more keys, and so forth until the database is completely emptied.
#
# In short… if you have slaves attached it is suggested that you set a lower
# limit for maxmemory so that there is some free RAM on the system for slave
# output buffers (but this is not needed if the policy is 'noeviction').
#
# WARNING: not setting maxmemory will cause Redis to terminate with an
# out-of-memory exception if the heap limit is reached.
#
# NOTE: since Redis uses the system paging file to allocate the heap memory,
# the Working Set memory usage showed by the Windows Task Manager or by other
# tools such as ProcessExplorer will not always be accurate. For example, right
# after a background save of the RDB or the AOF files, the working set value
# may drop significantly. In order to check the correct amount of memory used
# by the redis-server to store the data, use the INFO client command. The INFO
# command shows only the memory used to store the redis data, not the extra
# memory used by the Windows process for its own requirements. Th3 extra amount
# of memory not reported by the INFO command can be calculated subtracting the
# Peak Working Set reported by the Windows Task Manager and the used_memory_peak
# reported by the INFO command.
#
# maxmemory

# MAXMEMORY POLICY: how Redis will select what to remove when maxmemory
# is reached. You can select among five behaviors:
#
# volatile-lru -> remove the key with an expire set using an LRU algorithm
# allkeys-lru -> remove any key according to the LRU algorithm
# volatile-random -> remove a random key with an expire set
# allkeys-random -> remove a random key, any key
# volatile-ttl -> remove the key with the nearest expire time (minor TTL)
# noeviction -> don't expire at all, just return an error on write operations
#
# Note: with any of the above policies, Redis will return an error on write
# operations, when there are no suitable keys for eviction.
#
# At the date of writing these commands are: set setnx setex append
# incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd
# sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby
# zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby
# getset mset msetnx exec sort
#
# The default is:
#
# maxmemory-policy noeviction

# LRU and minimal TTL algorithms are not precise algorithms but approximated
# algorithms (in order to save memory), so you can tune it for speed or
# accuracy. For default Redis will check five keys and pick the one that was
# used less recently, you can change the sample size using the following
# configuration directive.
#
# The default of produces good enough results. Approximates very closely
# true LRU but costs a bit more CPU. is very fast but not very accurate.
#
# maxmemory-samples

############################## APPEND ONLY MODE ###############################

# By default Redis asynchronously dumps the dataset on disk. This mode is
# good enough in many applications, but an issue with the Redis process or
# a power outage may result into a few minutes of writes lost (depending on
# the configured save points).
#
# The Append Only File is an alternative persistence mode that provides
# much better durability. For instance using the default data fsync policy
# (see later in the config file) Redis can lose just one second of writes in a
# dramatic event like a server power outage, or a single write if something
# wrong with the Redis process itself happens, but the operating system is
# still running correctly.
#
# AOF and RDB persistence can be enabled at the same time without problems.
# If the AOF is enabled on startup Redis will load the AOF, that is the file
# with the better durability guarantees.
#
# Please check http://redis.io/topics/persistence for more information.

appendonly no

# The name of the append only file (default: "appendonly.aof")
appendfilename "appendonly.aof"

# The fsync() call tells the Operating System to actually write data on disk
# instead of waiting for more data in the output buffer. Some OS will really flush
# data on disk, some other OS will just try to do it ASAP.
#
# Redis supports three different modes:
#
# no: don't fsync, just let the OS flush the data when it wants. Faster.
# always: fsync after every write to the append only log. Slow, Safest.
# everysec: fsync only one time every second. Compromise.
#
# The default is "everysec", as that's usually the right compromise between
# speed and data safety. It's up to you to understand if you can relax this to
# "no" that will let the operating system flush the output buffer when
# it wants, for better performances (but if you can live with the idea of
# some data loss consider the default persistence mode that's snapshotting),
# or on the contrary, use "always" that's very slow but a bit safer than
# everysec.
#
# More details please check the following article:
# http://antirez.com/post/redis-persistence-demystified.html
#
# If unsure, use "everysec".

# appendfsync always
appendfsync everysec
# appendfsync no

# When the AOF fsync policy is set to always or everysec, and a background
# saving process (a background save or AOF log background rewriting) is
# performing a lot of I/O against the disk, in some Linux configurations
# Redis may block too long on the fsync() call. Note that there is no fix for
# this currently, as even performing fsync in a different thread will block
# our synchronous write() call.
#
# In order to mitigate this problem it's possible to use the following option
# that will prevent fsync() from being called in the main process while a
# BGSAVE or BGREWRITEAOF is in progress.
#
# This means that while another child is saving, the durability of Redis is
# the same as "appendfsync none". In practical terms, this means that it is
# possible to lose up to seconds of log in the worst scenario (with the
# default Linux settings).
#
# If you have latency problems turn this to "yes". Otherwise leave it as
# "no" that is the safest pick from the point of view of durability.
no-appendfsync-on-rewrite no

# Automatic rewrite of the append only file.
# Redis is able to automatically rewrite the log file implicitly calling
# BGREWRITEAOF when the AOF log size grows by the specified percentage.
#
# This is how it works: Redis remembers the size of the AOF file after the
# latest rewrite (if no rewrite has happened since the restart, the size of
# the AOF at startup is used).
#
# This base size is compared to the current size. If the current size is
# bigger than the specified percentage, the rewrite is triggered. Also
# you need to specify a minimal size for the AOF file to be rewritten, this
# is useful to avoid rewriting the AOF file even if the percentage increase
# is reached but it is still pretty small.
#
# Specify a percentage of zero in order to disable the automatic AOF
# rewrite feature.

auto-aof-rewrite-percentage
auto-aof-rewrite-min-size 64mb

# An AOF file may be found to be truncated at the end during the Redis
# startup process, when the AOF data gets loaded back into memory.
# This may happen when the system where Redis is running
# crashes, especially when an ext4 filesystem is mounted without the
# data=ordered option (however this can't happen when Redis itself
# crashes or aborts but the operating system still works correctly).
#
# Redis can either exit with an error when this happens, or load as much
# data as possible (the default now) and start if the AOF file is found
# to be truncated at the end. The following option controls this behavior.
#
# If aof-load-truncated is set to yes, a truncated AOF file is loaded and
# the Redis server starts emitting a log to inform the user of the event.
# Otherwise if the option is set to no, the server aborts with an error
# and refuses to start. When the option is set to no, the user requires
# to fix the AOF file using the "redis-check-aof" utility before to restart
# the server.
#
# Note that if the AOF file will be found to be corrupted in the middle
# the server will still exit with an error. This option only applies when
# Redis will try to read more data from the AOF file but not enough bytes
# will be found.
aof-load-truncated yes

################################ LUA SCRIPTING ###############################

# Max execution time of a Lua script in milliseconds.
#
# If the maximum execution time is reached Redis will log that a script is
# still in execution after the maximum allowed time and will start to
# reply to queries with an error.
#
# When a long running script exceeds the maximum execution time only the
# SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be
# used to stop a script that did not yet called write commands. The second
# is the only way to shut down the server in the case a write command was
# already issued by the script but the user doesn't want to wait for the natural
# termination of the script.
#
# Set it to or a negative value for unlimited execution without warnings.
lua-time-limit

################################ REDIS CLUSTER ###############################
#
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# WARNING EXPERIMENTAL: Redis Cluster is considered to be stable code, however
# in order to mark it as "mature" we need to wait for a non trivial percentage
# of users to deploy it in production.
# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#
# Normal Redis instances can't be part of a Redis Cluster; only nodes that are
# started as cluster nodes can. In order to start a Redis instance as a
# cluster node enable the cluster support uncommenting the following:
#
# cluster-enabled yes

# Every cluster node has a cluster configuration file. This file is not
# intended to be edited by hand. It is created and updated by Redis nodes.
# Every Redis Cluster node requires a different cluster configuration file.
# Make sure that instances running in the same system do not have
# overlapping cluster configuration file names.
#
# cluster-config-file nodes-.conf

# Cluster node timeout is the amount of milliseconds a node must be unreachable
# for it to be considered in failure state.
# Most other internal time limits are multiple of the node timeout.
#
# cluster-node-timeout

# A slave of a failing master will avoid to start a failover if its data
# looks too old.
#
# There is no simple way for a slave to actually have a exact measure of
# its "data age", so the following two checks are performed:
#
# ) If there are multiple slaves able to failover, they exchange messages
# in order to try to give an advantage to the slave with the best
# replication offset (more data from the master processed).
# Slaves will try to get their rank by offset, and apply to the start
# of the failover a delay proportional to their rank.
#
# ) Every single slave computes the time of the last interaction with
# its master. This can be the last ping or command received (if the master
# is still in the "connected" state), or the time that elapsed since the
# disconnection with the master (if the replication link is currently down).
# If the last interaction is too old, the slave will not try to failover
# at all.
#
# The point "" can be tuned by user. Specifically a slave will not perform
# the failover if, since the last interaction with the master, the time
# elapsed is greater than:
#
# (node-timeout * slave-validity-factor) + repl-ping-slave-period
#
# So for example if node-timeout is seconds, and the slave-validity-factor
# is , and assuming a default repl-ping-slave-period of seconds, the
# slave will not try to failover if it was not able to talk with the master
# for longer than seconds.
#
# A large slave-validity-factor may allow slaves with too old data to failover
# a master, while a too small value may prevent the cluster from being able to
# elect a slave at all.
#
# For maximum availability, it is possible to set the slave-validity-factor
# to a value of , which means, that slaves will always try to failover the
# master regardless of the last time they interacted with the master.
# (However they'll always try to apply a delay proportional to their
# offset rank).
#
# Zero is the only value able to guarantee that when all the partitions heal
# the cluster will always be able to continue.
#
# cluster-slave-validity-factor

# Cluster slaves are able to migrate to orphaned masters, that are masters
# that are left without working slaves. This improves the cluster ability
# to resist to failures as otherwise an orphaned master can't be failed over
# in case of failure if it has no working slaves.
#
# Slaves migrate to orphaned masters only if there are still at least a
# given number of other working slaves for their old master. This number
# is the "migration barrier". A migration barrier of means that a slave
# will migrate only if there is at least other working slave for its master
# and so forth. It usually reflects the number of slaves you want for every
# master in your cluster.
#
# Default is (slaves migrate only if their masters remain with at least
# one slave). To disable migration just set it to a very large value.
# A value of can be set but is useful only for debugging and dangerous
# in production.
#
# cluster-migration-barrier

# By default Redis Cluster nodes stop accepting queries if they detect there
# is at least an hash slot uncovered (no available node is serving it).
# This way if the cluster is partially down (for example a range of hash slots
# are no longer covered) all the cluster becomes, eventually, unavailable.
# It automatically returns available as soon as all the slots are covered again.
#
# However sometimes you want the subset of the cluster which is working,
# to continue to accept queries for the part of the key space that is still
# covered. In order to do so, just set the cluster-require-full-coverage
# option to no.
#
# cluster-require-full-coverage yes

# In order to setup your cluster make sure to read the documentation
# available at http://redis.io web site.

################################## SLOW LOG ###################################

# The Redis Slow Log is a system to log queries that exceeded a specified
# execution time. The execution time does not include the I/O operations
# like talking with the client, sending the reply and so forth,
# but just the time needed to actually execute the command (this is the only
# stage of command execution where the thread is blocked and can not serve
# other requests in the meantime).
#
# You can configure the slow log with two parameters: one tells Redis
# what is the execution time, in microseconds, to exceed in order for the
# command to get logged, and the other parameter is the length of the
# slow log. When a new command is logged the oldest one is removed from the
# queue of logged commands.

# The following time is expressed in microseconds, so is equivalent
# to one second. Note that a negative number disables the slow log, while
# a value of zero forces the logging of every command.
slowlog-log-slower-than

# There is no limit to this length. Just be aware that it will consume memory.
# You can reclaim memory used by the slow log with SLOWLOG RESET.
slowlog-max-len

################################ LATENCY MONITOR ##############################

# The Redis latency monitoring subsystem samples different operations
# at runtime in order to collect data related to possible sources of
# latency of a Redis instance.
#
# Via the LATENCY command this information is available to the user that can
# print graphs and obtain reports.
#
# The system only logs operations that were performed in a time equal or
# greater than the amount of milliseconds specified via the
# latency-monitor-threshold configuration directive. When its value is set
# to zero, the latency monitor is turned off.
#
# By default latency monitoring is disabled since it is mostly not needed
# if you don't have latency issues, and collecting data has a performance
# impact, that while very small, can be measured under big load. Latency
# monitoring can easily be enabled at runtime using the command
# "CONFIG SET latency-monitor-threshold " if needed.
latency-monitor-threshold

############################# EVENT NOTIFICATION ##############################

# Redis can notify Pub/Sub clients about events happening in the key space.
# This feature is documented at http://redis.io/topics/notifications
#
# For instance if keyspace events notification is enabled, and a client
# performs a DEL operation on key "foo" stored in the Database , two
# messages will be published via Pub/Sub:
#
# PUBLISH __keyspace@0__:foo del
# PUBLISH __keyevent@0__:del foo
#
# It is possible to select the events that Redis will notify among a set
# of classes. Every class is identified by a single character:
#
# K Keyspace events, published with __keyspace@__ prefix.
# E Keyevent events, published with __keyevent@__ prefix.
# g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, …
# $ String commands
# l List commands
# s Set commands
# h Hash commands
# z Sorted set commands
# x Expired events (events generated every time a key expires)
# e Evicted events (events generated when a key is evicted for maxmemory)
# A Alias for g$lshzxe, so that the "AKE" string means all the events.
#
# The "notify-keyspace-events" takes as argument a string that is composed
# of zero or multiple characters. The empty string means that notifications
# are disabled.
#
# Example: to enable list and generic events, from the point of view of the
# event name, use:
#
# notify-keyspace-events Elg
#
# Example : to get the stream of the expired keys subscribing to channel
# name __keyevent@0__:expired use:
#
# notify-keyspace-events Ex
#
# By default all notifications are disabled because most users don't need
# this feature and the feature has some overhead. Note that if you don't
# specify at least one of K or E, no events will be delivered.
notify-keyspace-events ""

############################### ADVANCED CONFIG ###############################

# Hashes are encoded using a memory efficient data structure when they have a
# small number of entries, and the biggest entry does not exceed a given
# threshold. These thresholds can be configured using the following directives.
hash-max-ziplist-entries
hash-max-ziplist-value

# Lists are also encoded in a special way to save a lot of space.
# The number of entries allowed per internal list node can be specified
# as a fixed maximum size or a maximum number of elements.
# For a fixed maximum size, use - through -, meaning:
# -: max size: Kb <-- not recommended for normal workloads
# -: max size: Kb <-- not recommended
# -: max size: Kb <-- probably not recommended
# -: max size: Kb <-- good
# -: max size: Kb <-- good
# Positive numbers mean store up to _exactly_ that number of elements
# per list node.
# The highest performing option is usually - ( Kb size) or - ( Kb size),
# but if your use case is unique, adjust the settings as necessary.
list-max-ziplist-size -

# Lists may also be compressed.
# Compress depth is the number of quicklist ziplist nodes from *each* side of
# the list to *exclude* from compression. The head and tail of the list
# are always uncompressed for fast push/pop operations. Settings are:
# : disable all list compression
# : depth means "don't start compressing until after 1 node into the list,
# going from either the head or tail"
# So: [head]->node->node->…->node->[tail]
# [head], [tail] will always be uncompressed; inner nodes will compress.
# : [head]->[next]->node->node->…->node->[prev]->[tail]
# here means: don't compress head or head->next or tail->prev or tail,
# but compress all nodes between them.
# : [head]->[next]->[next]->node->node->…->node->[prev]->[prev]->[tail]
# etc.
list-compress-depth

# Sets have a special encoding in just one case: when a set is composed
# of just strings that happen to be integers in radix in the range
# of bit signed integers.
# The following configuration setting sets the limit in the size of the
# set in order to use this special memory saving encoding.
set-max-intset-entries

# Similarly to hashes and lists, sorted sets are also specially encoded in
# order to save a lot of space. This encoding is only used when the length and
# elements of a sorted set are below the following limits:
zset-max-ziplist-entries
zset-max-ziplist-value

# HyperLogLog sparse representation bytes limit. The limit includes the
# bytes header. When an HyperLogLog using the sparse representation crosses
# this limit, it is converted into the dense representation.
#
# A value greater than is totally useless, since at that point the
# dense representation is more memory efficient.
#
# The suggested value is ~ in order to have the benefits of
# the space efficient encoding without slowing down too much PFADD,
# which is O(N) with the sparse encoding. The value can be raised to
# ~ when CPU is not a concern, but space is, and the data set is
# composed of many HyperLogLogs with cardinality in the - range.
hll-sparse-max-bytes

# Active rehashing uses millisecond every milliseconds of CPU time in
# order to help rehashing the main Redis hash table (the one mapping top-level
# keys to values). The hash table implementation Redis uses (see dict.c)
# performs a lazy rehashing: the more operation you run into a hash table
# that is rehashing, the more rehashing "steps" are performed, so if the
# server is idle the rehashing is never complete and some more memory is used
# by the hash table.
#
# The default is to use this millisecond times every second in order to
# actively rehash the main dictionaries, freeing memory when possible.
#
# If unsure:
# use "activerehashing no" if you have hard latency requirements and it is
# not a good thing in your environment that Redis can reply from time to time
# to queries with milliseconds delay.
#
# use "activerehashing yes" if you don't have such hard requirements but
# want to free memory asap when possible.
activerehashing yes

# The client output buffer limits can be used to force disconnection of clients
# that are not reading data from the server fast enough for some reason (a
# common reason is that a Pub/Sub client can't consume messages as fast as the
# publisher can produce them).
#
# The limit can be set differently for the three different classes of clients:
#
# normal -> normal clients including MONITOR clients
# slave -> slave clients
# pubsub -> clients subscribed to at least one pubsub channel or pattern
#
# The syntax of every client-output-buffer-limit directive is the following:
#
# client-output-buffer-limit
#
# A client is immediately disconnected once the hard limit is reached, or if
# the soft limit is reached and remains reached for the specified number of
# seconds (continuously).
# So for instance if the hard limit is megabytes and the soft limit is
# megabytes / seconds, the client will get disconnected immediately
# if the size of the output buffers reach megabytes, but will also get
# disconnected if the client reaches megabytes and continuously overcomes
# the limit for seconds.
#
# By default normal clients are not limited because they don't receive data
# without asking (in a push way), but just after a request, so only
# asynchronous clients may create a scenario where data is requested faster
# than it can read.
#
# Instead there is a default limit for pubsub and slave clients, since
# subscribers and slaves receive data in a push fashion.
#
# Both the hard or the soft limit can be disabled by setting them to zero.
client-output-buffer-limit normal
client-output-buffer-limit slave 256mb 64mb
client-output-buffer-limit pubsub 32mb 8mb

# Redis calls an internal function to perform many background tasks, like
# closing connections of clients in timeot, purging expired keys that are
# never requested, and so forth.
#
# Not all tasks are perforemd with the same frequency, but Redis checks for
# tasks to perform according to the specified "hz" value.
#
# By default "hz" is set to . Raising the value will use more CPU when
# Redis is idle, but at the same time will make Redis more responsive when
# there are many keys expiring at the same time, and timeouts may be
# handled with more precision.
#
# The range is between and , however a value over is usually not
# a good idea. Most users should use the default of and raise this up to
# only in environments where very low latency is required.
hz

# When a child rewrites the AOF file, if the following option is enabled
# the file will be fsync-ed every MB of data generated. This is useful
# in order to commit the file to the disk more incrementally and avoid
# big latency spikes.
aof-rewrite-incremental-fsync yes

################################## INCLUDES ###################################

# Include one or more other config files here. This is useful if you
# have a standard template that goes to all Redis server but also need
# to customize a few per-server settings. Include files can include
# other files, so use this wisely.
#
# include /path/to/local.conf
# include /path/to/other.conf

如果单独用：

docker run -d -p : --name redis --restart always -v /config/redis/conf/redis.conf:/usr/local/etc/redis/redis.conf -v /config/redis/data:/data redis --appendonly yes --requirepass