1
1)准备工作
2
[root@Docker ~]# rm -rf ./*
3
[root@Docker ~]# mkdir ./db-volume && cd ./db-volume
4

5
2)编写配置文件
6
[root@Docker db-volume]# vim docker-compose.yml
7
services:
8
  db_server:
9
    image: mysql:8.0.36
10
    container_name: db02
11
    ports:
12
      - "3306:3306"
13
    environment:
14
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
15
      MYSQL_DATABASE: "wordpress"
16
      MYSQL_USER: "jiuzhao"
17
      MYSQL_PASSWORD: "passwd"
18
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin", "--default-authentication-plugin=mysql_native_password"]
19
    volumes:
20
      # 存储卷名称(别名):容器挂载点:读写模式(rw,ro)
21
      - db:/var/lib/mysql:rw
22
      - web:/code:rw
23
# db和 web是内部引用名,方便在 compose 文件中使用
24
# 先引用,后声明
25

26
volumes:
27
  db:
28
    name: mysql-volume
29
    # 自定义 Docker 中实际的卷名称
30
  web:
31
    name: web-server
32
# mysql-volume和web-server是 Docker 实际创建的真实卷名
33
==================================================
34
# ⚠️如果不指定 name: web-server
35
# ⚠️Docker 会自动创建
36
    volumes: <-- "服务引用的数据卷"
37
      - db:/var/lib/mysql:rw
38
      - web:/code:rw
39

40
volumes:<-- "声明数据卷"
41
  db:
42
    name: mysql-volume
43
  web: "web没有指定name"
44
[root@Docker db-volume]# docker compose up -d
45
[+] up 4/4
46
 ✔ Network xxx        👇 项目名+别名
47
 ✔ Volume db-volume_web⚠️ <-- 自动创建的名称 📌
48
 ✔ Volume mysql-volume    <-- 手动指定的名称 ✅️
49
 ✔ Container xxx
50
'都写到这了,不手动指定一下name吗???'
51
==================================================
52
    volumes:
53
      - db:/var/lib/mysql:rw
54
      - web:/code:rw
55
'只有引用卷db和web ,没有声明'
56
[root@Docker db-volume]# docker compose up -d
57
❌️ undefined volume db: invalid compose project
58
==================================================
59
'最后一种匿名数据卷' 🤡 不推荐
60
    volumes:
61
    # 里面只有容器里面的路径
62
    # 不能指定模式(rw/ro)
63
      - /var/lib/mysql
64
      - /code
65
[root@Docker db-volume]# docker volume prune -f
66
[root@Docker db-volume]# docker compose up -d
67
[root@Docker db-volume]# docker volume ls
68
DRIVER    VOLUME NAME
69
local     192fdxxx...
70
local     5037bxxx...
71
'后面是一串神秘的字符'

1
3)启动服务
2
[root@Docker db-volume]# docker compose up -d
3
[+] up 4/4
4
 ✔ Network db-volume_default Created
5
 ✔ Volume web-server         Created
6
 ✔ Volume mysql-volume       Created
7
 ✔ Container db02            Started
8
"两个数据卷都创建成功了"
9
[root@Docker db-volume]# docker volume ls
10
local     mysql-volume
11
local     web-server
12
[root@Docker db-volume]# docker compose ps
13
db02      mysql:8.0.36   "docker-entrypoint.s…"   db_server   58 seconds ago   Up 57 seconds   0.0.0.0:3306->3306/tcp, [::]:3306->3306/tcp, 33060/tcp
14
[root@Docker db-volume]# docker compose ls
15
NAME       STATUS      CONFIG FILES
16
db-volume  running(1)  /root/db-volume/docker-compose.yml
17

18
4)停止容器&&移除网络
19
[root@Docker db-volume]# docker compose down
20
[+] down 2/2
21
 ✔ Container db02            Removed
22
 ✔ Network db-volume_default Removed
23
'创建的时候是4个,移除的时候只移除了两个'
24
✅️ 数据卷没有被移除!
25
[root@Docker db-volume]# docker volume ls
26
local     mysql-volume
27
local     web-server
28

29
5) -v
30
# 移除服务时,同时移除数据卷
31
[root@Docker db-volume]# docker compose down -v
32
[+] down 2/2
33
 ✔ Volume web-server   Removed
34
 ✔ Volume mysql-volume Removed
35
# 重新执行了一遍,把数据卷也移除了!
36

37
6)综合演示
38
[root@Docker db-volume]# docker compose up -d
39
[+] up 4/4
40
 ✔ Network db-volume_default Created
41
 ✔ Volume mysql-volume       Created
42
 ✔ Volume web-server         Created
43
 ✔ Container db02            Started
44
[root@Docker db-volume]# docker compose down -v -t 0
45
[+] down 4/4
46
 ✔ Container db02            Removed
47
 ✔ Volume mysql-volume       Removed
48
 ✔ Volume web-server         Removed
49
 ✔ Network db-volume_default Removed
50
"工作中,用的最多的就是 up down"

1
1)准备
2
[root@Docker ~]# rm -rf ./*
3
[root@Docker ~]# mkdir db-network && cd db-network
4
[root@Docker db-network]# docker network ls
5
NETWORK ID     NAME      DRIVER    SCOPE
6
66cc72cc26cd   bridge    bridge    local
7
bf4d048e4eed   host      host      local
8
5879c499792c   none      null      local
9
'现在只有3个默认的网络'
10

11
2)配置文件
12
[root@Docker db-network]# vim docker-compose.yml
13
services:
14
  db_server:
15
    image: mysql:8.0.36
16
    container_name: db02
17
    ports:
18
      - "3306:3306"
19
    environment:
20
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
21
      MYSQL_DATABASE: "wordpress"
22
      MYSQL_USER: "jiuzhao"
23
      MYSQL_PASSWORD: "passwd"
24
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin", "--default-authentication-plugin=mysql_native_password"]
25
    networks:
26
    # 只引用网络,没有声明(定义)网络
27
    # 下面的这些只是别名
28
      - db_net
29
      - web_net
30
[root@Docker db-network]# docker compose up -d
31
❌️ undefined network web_net: invalid compose project
32
# 在项目中并没有被定义(声明)
33
'自然是起不来的'
34
=================================
35
    networks:
36
      - db_net
37
      - web_net
38
# 先引用网络(别名),后声明
39

40
networks:
41
# 声明真实的网络
42
# name前面没有 -
43
  db_net:
44
    name: my_db
45
  web_net:
46
    name: my_web
47
  backup:
48
    name: my_backup
49
[root@Docker db-network]# docker compose up -d
50
'上面虽然声明了3个网络,但只创建了2个'
51
# 只有db_net和web_net被服务引用,所以才会被创建
52
[+] up 3/3
53
 ✔ Network my_web Created ✅️
54
 ✔ Network my_db  Created ✅️
55
 ✔ Container db02 Started
56
[root@Docker db-network]# docker network ls
57
NETWORK ID     NAME      DRIVER    SCOPE
58
dc02802cf1a2   my_db     bridge    local
59
88fee2060426   my_web    bridge    local
60
[root@Docker db-network]# docker network inspect my_db | grep -A 4 "Config\"""
61
            "Config": [
62
                {
63
                    "Subnet": "172.19.0.0/16",
64
                    "Gateway": "172.19.0.1"
65
                }
66
# 有这两个配置足以
67
✅️ '容器的网络从.2开始分配IP地址'
68
[root@Docker db-network]# docker network inspect my_web | grep -A 4 "Config\"""
69
            "Config": [
70
                {
71
                    "Subnet": "172.18.0.0/16",
72
                    "Gateway": "172.18.0.1"
73
                }
74
[root@Docker db-network]# docker inspect db02 | grep IPAddress
75
                    "IPAddress": "172.19.0.2",
76
                    "IPAddress": "172.18.0.2",
77
# 对于我们刚创建的容器db02来说
78
# 它是有两个网络的,都是从.2开始分配的IP地址
79

80
3)停止服务
81
[root@Docker db-network]# docker compose down -t 0
82
[+] down 3/3
83
 ✔ Container db02 Removed
84
 ✔ Network my_web Removed
85
 ✔ Network my_db  Removed
86
'在停止服务的同时把网络也移除了!'
87
✅️ 这里只有数据卷特殊,需要加-v才能移除 📌
88

89
4)声明网络的同时,指定驱动、子网、网关
90
'这种是最麻烦的,不推荐' 🤡
91
# 个人感觉,自定义网络名字就可以了
92
[root@Docker db-network]# vim docker-compose.yml
93
...xxxx # 省略
94
    networks:
95
      - db_net
96
      - web_net
97

98
networks:
99
  db_net:
100
    name: my_db
101
    driver: bridge
102
    # 网络驱动,网桥
103
    ipam:
104
      driver: default
105
      # 指定IPAM的驱动,一般使用默认值
106
      config:
107
      # 只有subnet前面有 -
108
        - subnet: 172.28.0.0/16
109
          gateway: 172.28.0.1
110
  web_net:
111
  # 它使用默认的
112
    name: my_web
113
    driver: bridge
114
--------------------------------
115
"IPAM": {
116
            "Driver": "default",
117
            "Options": null,
118
            "Config": [
119
                {
120
                    "Subnet": "172.28.0.0/16",
121
                    "Gateway": "172.28.0.1"
122
                }
123
[root@Docker db-network]# docker compose up -d
124
[+] up 3/3
125
 ✔ Network my_web Created
126
 ✔ Network my_db  Created
127
 ✔ Container db02 Started
128
'我们主要去看具体的网络配置'
129
[root@Docker db-network]# docker network inspect my_db | grep -A 4 "Config\"""
130
            "Config": [
131
                {
132
                    "Subnet": "172.28.0.0/16",
133
                    "Gateway": "172.28.0.1"
134
                }  ✅️ 这个就是我们手动指定的网络
135
[root@Docker db-network]# docker network inspect my_web | grep -A 4 "Config\"""
136
            "Config": [
137
                {
138
                    "Subnet": "172.18.0.0/16",
139
                    "Gateway": "172.18.0.1"
140
                }  📌 自动创建的子网配置
141
              # 它是接着docker 0 --> 172.17.0.1创建
142
[root@Docker db-network]# docker compose down -t 0

1
3)启动服务
2
[root@Docker mul-wordpress]# docker compose up -d
3
[+] up 5/5
4
 ✔ Network wordpress-net   Created
5
 ✔ Volume mysql-volume     Created
6
 ✔ Volume wordpress-volume Created
7
 ✔ Container db            Started
8
 ✔ Container wp            Started
9
"一个网络,两个数据卷"
10
[root@Docker mul-wordpress]# docker compose ls
11
NAME          STATUS      CONFIG FILES
12
mul-wordpress running(2)  ~/mul-wordpress/docker-compose.yml
13
[root@Docker mul-wordpress]# docker compose ps
14
db        mysql:8.0.36      "docker-entrypoint.s…"   db_server   About a minute ago   Up About a minute   0.0.0.0:3306->3306/tcp, [::]:3306->3306/tcp, 33060/tcp
15
-----------------------------------------------------
16
wp        wordpress:6.7.1   "docker-entrypoint.s…"   wordpress   About a minute ago   Up About a minute   0.0.0.0:81->80/tcp, [::]:81->80/tcp
17
[root@Docker mul-wordpress]# docker network ls
18
efece4192527   wordpress-net   bridge    local
19
[root@Docker mul-wordpress]# docker volume ls
20
DRIVER    VOLUME NAME
21
local     mysql-volume
22
local     wordpress-volume
23

24
4)访问测试
25
http://10.0.0.99:81/
26
"停止"
27
docker compose down -t 0 -v

1
'三节点ES集群 + Kibana'
2
1)确认镜像
3
[root@Docker ~]# docker images | grep -E "elasticsearch|kibana"
4
elasticsearch:9.4.4   5b4517639f5c
5
kibana:9.4.4          a52f906140d4
6
✅️ 9.4.4 已在本地
7

8
2)创建项目目录
9
[root@Docker ~]# mkdir /root/multiple-es-cluster && cd /root/multiple-es-cluster
10

11
3)编写 .env 环境变量文件
12
[root@Docker multiple-es-cluster]# vim .env
13
# Password for the 'elastic' user (at least 6 characters)
14
ELASTIC_PASSWORD=passwd
15
# Password for the 'kibana_system' user (at least 6 characters)
16
KIBANA_PASSWORD=passwd
17
# Version of Elastic products
18
STACK_VERSION=9.4.4
19
# Set the cluster name
20
CLUSTER_NAME=My-ES
21
# Set to 'basic' or 'trial' to automatically start the 30-day trial
22
LICENSE=basic
23
# Port to expose Elasticsearch HTTP API to the host
24
ES_PORT=127.0.0.1:19200
25
# Port to expose Kibana to the host
26
KIBANA_PORT=15601
27
# Increase or decrease based on the available host memory (in bytes)
28
MEM_LIMIT=1073741824
29
KIBANA_MEM_LIMIT=2147483648
30
# MEM_LIMIT 是 ES 三节点各 1G (1073741824),三节点集群内存压力大
31
# KIBANA_MEM_LIMIT 是 kibana 单独 2G (2147483648)
32
⭐ Kibana 9.x 内存吃紧  # 单独给 kibana 2G,堆升到 1.5G,稳定运行
33
✅️ 环境变量文件: 把密码、版本、端口全部抽到 .env 里
34
⭐ compose 里用 ${变量名} 引用,一处修改处处生效
35

36
4)编写 docker-compose.yml (官方模板)
37
# 镜像引用为本地短名 elasticsearch:${STACK_VERSION} 和 kibana:${STACK_VERSION}
38
# kibana 服务的 mem_limit 改为 ${KIBANA_MEM_LIMIT},ES 三节点保持 ${MEM_LIMIT}
39
[root@Docker multiple-es-cluster]# vim docker-compose.yml
40
version: "2.2"
41
services:
42
  setup:
43
    image: elasticsearch:${STACK_VERSION}
44
    volumes:
45
      - certs:/usr/share/elasticsearch/config/certs
46
    user: "0"
47
    command: >
48
      bash -c '
49
        if [ x${ELASTIC_PASSWORD} == x ]; then
50
          echo "Set the ELASTIC_PASSWORD environment variable in the .env file";
51
          exit 1;
52
        elif [ x${KIBANA_PASSWORD} == x ]; then
53
          echo "Set the KIBANA_PASSWORD environment variable in the .env file";
54
          exit 1;
55
        fi;
56
        if [ ! -f config/certs/ca.zip ]; then
57
          echo "Creating CA";
58
          bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
59
          unzip config/certs/ca.zip -d config/certs;
60
        fi;
61
        if [ ! -f config/certs/certs.zip ]; then
62
          echo "Creating certs";
63
          echo -ne \
64
          "instances:\n"\
65
          "  - name: es01\n"\
66
          "    dns:\n"\
67
          "      - es01\n"\
68
          "      - localhost\n"\
69
          "    ip:\n"\
70
          "      - 127.0.0.1\n"\
71
          "  - name: es02\n"\
72
          "    dns:\n"\
73
          "      - es02\n"\
74
          "      - localhost\n"\
75
          "    ip:\n"\
76
          "      - 127.0.0.1\n"\
77
          "  - name: es03\n"\
78
          "    dns:\n"\
79
          "      - es03\n"\
80
          "      - localhost\n"\
81
          "    ip:\n"\
82
          "      - 127.0.0.1\n"\
83
          > config/certs/instances.yml;
84
          bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
85
          unzip config/certs/certs.zip -d config/certs;
86
        fi;
87
        echo "Setting file permissions"
88
        chown -R root:root config/certs;
89
        find . -type d -exec chmod 750 \{\} \;;
90
        find . -type f -exec chmod 640 \{\} \;;
91
        echo "Waiting for Elasticsearch availability";
92
        until curl -s --cacert config/certs/ca/ca.crt https://es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
93
        echo "Setting kibana_system password";
94
        until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" https://es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 10; done;
95
        echo "All done!";
96
      '
97
    healthcheck:
98
      test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"]
99
      interval: 1s
100
      timeout: 5s
101
      retries: 120
102

103
  es01:
104
    depends_on:
105
      setup:
106
        condition: service_healthy
107
    image: elasticsearch:${STACK_VERSION}
108
    volumes:
109
      - certs:/usr/share/elasticsearch/config/certs
110
      - esdata01:/usr/share/elasticsearch/data
111
    ports:
112
      - ${ES_PORT}:9200
113
    environment:
114
      - node.name=es01
115
      - cluster.name=${CLUSTER_NAME}
116
      - cluster.initial_master_nodes=es01,es02,es03
117
      - discovery.seed_hosts=es02,es03
118
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
119
      - bootstrap.memory_lock=true
120
      - xpack.security.enabled=true
121
      - xpack.security.http.ssl.enabled=true
122
      - xpack.security.http.ssl.key=certs/es01/es01.key
123
      - xpack.security.http.ssl.certificate=certs/es01/es01.crt
124
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
125
      - xpack.security.transport.ssl.enabled=true
126
      - xpack.security.transport.ssl.key=certs/es01/es01.key
127
      - xpack.security.transport.ssl.certificate=certs/es01/es01.crt
128
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
129
      - xpack.security.transport.ssl.verification_mode=certificate
130
      - xpack.license.self_generated.type=${LICENSE}
131
      - xpack.ml.use_auto_machine_memory_percent=true
132
    mem_limit: ${MEM_LIMIT}
133
    ulimits:
134
      memlock:
135
        soft: -1
136
        hard: -1
137
    healthcheck:
138
      test: ["CMD-SHELL", "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'"]
139
      interval: 10s
140
      timeout: 10s
141
      retries: 120
142

143
  es02:
144
    depends_on:
145
      - es01
146
    image: elasticsearch:${STACK_VERSION}
147
    volumes:
148
      - certs:/usr/share/elasticsearch/config/certs
149
      - esdata02:/usr/share/elasticsearch/data
150
    environment:
151
      - node.name=es02
152
      - cluster.name=${CLUSTER_NAME}
153
      - cluster.initial_master_nodes=es01,es02,es03
154
      - discovery.seed_hosts=es01,es03
155
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
156
      - bootstrap.memory_lock=true
157
      - xpack.security.enabled=true
158
      - xpack.security.http.ssl.enabled=true
159
      - xpack.security.http.ssl.key=certs/es02/es02.key
160
      - xpack.security.http.ssl.certificate=certs/es02/es02.crt
161
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
162
      - xpack.security.transport.ssl.enabled=true
163
      - xpack.security.transport.ssl.key=certs/es02/es02.key
164
      - xpack.security.transport.ssl.certificate=certs/es02/es02.crt
165
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
166
      - xpack.security.transport.ssl.verification_mode=certificate
167
      - xpack.license.self_generated.type=${LICENSE}
168
      - xpack.ml.use_auto_machine_memory_percent=true
169
    mem_limit: ${MEM_LIMIT}
170
    ulimits:
171
      memlock:
172
        soft: -1
173
        hard: -1
174
    healthcheck:
175
      test: ["CMD-SHELL", "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'"]
176
      interval: 10s
177
      timeout: 10s
178
      retries: 120
179

180
  es03:
181
    depends_on:
182
      - es02
183
    image: elasticsearch:${STACK_VERSION}
184
    volumes:
185
      - certs:/usr/share/elasticsearch/config/certs
186
      - esdata03:/usr/share/elasticsearch/data
187
    environment:
188
      - node.name=es03
189
      - cluster.name=${CLUSTER_NAME}
190
      - cluster.initial_master_nodes=es01,es02,es03
191
      - discovery.seed_hosts=es01,es02
192
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
193
      - bootstrap.memory_lock=true
194
      - xpack.security.enabled=true
195
      - xpack.security.http.ssl.enabled=true
196
      - xpack.security.http.ssl.key=certs/es03/es03.key
197
      - xpack.security.http.ssl.certificate=certs/es03/es03.crt
198
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
199
      - xpack.security.transport.ssl.enabled=true
200
      - xpack.security.transport.ssl.key=certs/es03/es03.key
201
      - xpack.security.transport.ssl.certificate=certs/es03/es03.crt
202
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
203
      - xpack.security.transport.ssl.verification_mode=certificate
204
      - xpack.license.self_generated.type=${LICENSE}
205
      - xpack.ml.use_auto_machine_memory_percent=true
206
    mem_limit: ${MEM_LIMIT}
207
    ulimits:
208
      memlock:
209
        soft: -1
210
        hard: -1
211
    healthcheck:
212
      test: ["CMD-SHELL", "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'"]
213
      interval: 10s
214
      timeout: 10s
215
      retries: 120
216

217
  kibana:
218
    depends_on:
219
      es01:
220
        condition: service_healthy
221
      es02:
222
        condition: service_healthy
223
      es03:
224
        condition: service_healthy
225
    image: kibana:${STACK_VERSION}
226
    volumes:
227
      - certs:/usr/share/kibana/config/certs
228
      - kibanadata:/usr/share/kibana/data
229
    ports:
230
      - ${KIBANA_PORT}:5601
231
    environment:
232
      - SERVERNAME=kibana
233
      - ELASTICSEARCH_HOSTS=https://es01:9200
234
      - ELASTICSEARCH_USERNAME=kibana_system
235
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
236
      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
237
    mem_limit: ${KIBANA_MEM_LIMIT}
238
    healthcheck:
239
      test: ["CMD-SHELL", "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'"]
240
      interval: 10s
241
      timeout: 10s
242
      retries: 120
243

244
volumes:
245
  certs:
246
    driver: local
247
  esdata01:
248
    driver: local
249
  esdata02:
250
    driver: local
251
  esdata03:
252
    driver: local
253
  kibanadata:
254
    driver: local
255
========================================
256
cluster.initial_master_nodes: # 首次选举 master 的候选节点
257
discovery.seed_hosts:         # 各节点去发现彼此的种子地址
258
⭐ es01 只写 es02,es03;  es02 写 es01,es03;  es03 写 es01,es02
259
   # 相互发现,组成一个集群
260
xpack.security.http.ssl:      # 对应 9200 端口,对外走 HTTPS(客户端/kibana/curl连接)
261
xpack.security.transport.ssl: # 对应 9300 端口,对内走 TLS(节点间内部通信)
262
⭐ 所以只映射 19200:9200 而不映射 9300,9300 仅在集群内部使用
263
========================================
264
只映射一个 9200 端口（即 es01）的奥妙在于——集群对外是一个整体，入口只需要一个：
265
ES 集群对客户端是无状态的：任意节点都能接收请求并转发到正确位置
266
客户端 ──> 19200 (es01) ──> 集群内部 9300 互相转发
267
                          ├── es01
268
                          ├── es02
269
                          └── es03
270
`所以你写数据到 es01，如果数据本该在 es02，es01 会自动转发过去，客户端无感知`
271
# 安全、精简、便于运维

1
5)启动服务
2
[root@Docker multiple-es-cluster]# docker compose up -d
3
[+] Running 11/11
4
 ✔ Network multiple-es-cluster_default      Created           0.0s
5
 ✔ Volume "multiple-es-cluster_esdata02"    Created           0.0s
6
 ✔ Volume "multiple-es-cluster_certs"       Created           0.0s
7
 ✔ Volume "multiple-es-cluster_esdata03"    Created           0.0s
8
 ✔ Volume "multiple-es-cluster_kibanadata"  Created           0.0s
9
 ✔ Volume "multiple-es-cluster_esdata01"    Created           0.0s
10
 ✔ Container multiple-es-cluster-setup-1    Healthy           5.2s
11
 ✔ Container multiple-es-cluster-es01-1     Healthy          86.9s
12
 ✔ Container multiple-es-cluster-es02-1     Healthy          86.8s
13
 ✔ Container multiple-es-cluster-es03-1     Healthy          97.2s
14
 ✔ Container multiple-es-cluster-kibana-1   Started          97.3s
15
✅️ setup 容器只跑证书初始化,健康后 ES 节点才启动
16

17
6)查看容器状态
18
[root@Docker multiple-es-cluster]# docker compose ps
19
NAME                              IMAGE                 COMMAND      SERVICE   STATUS                            PORTS
20
multiple-es-cluster-es01-1     elasticsearch:9.4.4   "/bin/tini…" es01      Up About a minute (healthy)       9300/tcp, 127.0.0.1:19200->9200/tcp
21
multiple-es-cluster-es02-1     elasticsearch:9.4.4   "/bin/tini…" es02      Up About a minute (healthy)       9200/tcp, 9300/tcp
22
multiple-es-cluster-es03-1     elasticsearch:9.4.4   "/bin/tini…" es03      Up About a minute (healthy)       9200/tcp, 9300/tcp
23
multiple-es-cluster-kibana-1   kibana:9.4.4          "/bin/tini…" kibana    Up 2 seconds (health: starting)   0.0.0.0:15601->5601/tcp
24
# 只有 es01 映射了 19200:9200,其余节点仅在集群内部通信

1
7)验证ES集群
2
root@Docker multiple-es-cluster# curl https://127.0.0.1:19200 -k -u elastic:passwd
3
{
4
  "name" : "es01",
5
  "cluster_name" : "My-ES",
6
  "cluster_uuid" : "4hKfGKl3TcKEgA2a-w0ZXQ",
7
  "version" : {
8
    "number" : "9.4.4",
9
    "build_flavor" : "default",
10
    "build_type" : "docker",
11
  ...........
12
  },
13
  "tagline" : "You Know, for Search"
14
}
15
# 认证通过,ES 9.4.4
16
[root@Docker multiple-es-cluster]# curl -sk -u elastic:passwd https://127.0.0.1:19200/_cat/nodes
17
172.18.0.4 66 100 4 0.53 1.51 0.80 cdfhilmrstw * es02
18
172.18.0.3 66 100 4 0.53 1.51 0.80 cdfhilmrstw - es01
19
172.18.0.5 74  98 4 0.53 1.51 0.80 cdfhilmrstw - es03
20
✅️ 三个节点都在,星号*是当前 master(es02)

1
8)修改kibana语言为中文
2
[root@Docker multiple-es-cluster]# docker exec -it multiple-es-cluster-kibana-1 /bin/bash
3
kibana@4914a063e7e1:~$ echo '' >> config/kibana.yml
4
# 先去换行 ’空‘
5
kibana@4914a063e7e1:~$ echo i18n.locale: "zh-CN" >> config/kibana.yml
6
kibana@4914a063e7e1:~$ cat config/kibana.yml
7
server.host: "0.0.0.0"
8
elasticsearch.hosts: [ "http://elasticsearch:9200" ]
9
i18n.locale: zh-CN
10
kibana@4914a063e7e1:~$ exit
11
[root@Docker multiple-es-cluster]# docker compose restart kibana
12
 Container multiple-es-cluster-kibana-1  Restarting
13
 Container multiple-es-cluster-kibana-1  Started
14
✅️ 追加 i18n.locale: "zh-CN" 再重启,界面变中文
15

16
9)访问验证
17
[root@Docker multiple-es-cluster]# curl -s -o /dev/null -w "%{http_code}\n" http://10.0.0.9:15601/
18
200
19
✅️ Kibana 正常运行
20
访问: http://10.0.0.9:15601/
21
用户名: elastic  密码: passwd

1
3)编写 docker-compose.yaml
2
[root@Docker wordpress-secrets]# vim docker-compose.yaml
3
services:
4
  db_server:
5
    image: mysql:8.0.36
6
    container_name: db
7
    ports:
8
      - "3306:3306"
9
    environment:
10
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
11
      MYSQL_DATABASE: "wordpress"
12
      MYSQL_USER: "jiuzhao"
13
      MYSQL_PASSWORD_FILE: /run/secrets/db_password
14
    command: ["--character-set-server=utf8", "--collation-server=utf8_bin", "--default-authentication-plugin=mysql_native_password"]
15
    volumes:
16
      - db:/var/lib/mysql:rw
17
    networks:
18
      - wp-net
19
    restart: unless-stopped
20
    # 定义服务引用secrets资源,并将其挂载到"/run/secrets/"目录下
21
    secrets:
22
      - db_root_password
23
      - db_password
24

25
  wordpress:
26
    depends_on:
27
      - db_server
28
    image: wordpress:6.7.1
29
    container_name: wp
30
    restart: unless-stopped
31
    ports:
32
      - "81:80"
33
    environment:
34
      - WORDPRESS_DB_HOST=db_server:3306
35
      - WORDPRESS_DB_USER=jiuzhao
36
      - WORDPRESS_DB_PASSWORD_FILE=/run/secrets/db_password
37
      - WORDPRESS_DB_NAME=wordpress
38
    volumes:
39
      - wp:/var/www/html
40
    networks:
41
      - wp-net
42
    secrets:
43
      - db_password
44

45
networks:
46
  wp-net:
47
    name: wordpress-net
48
    driver: bridge
49
    ipam:
50
      driver: default
51
      config:
52
        - subnet: 172.19.0.0/16
53
          gateway: 172.19.0.1
54

55
# 定义secrets
56
secrets:
57
   # 定义secret的名称便于Service进行引用
58
   db_password:
59
     # 指定secret的文件名称
60
     file: db_password.txt
61
   db_root_password:
62
     file: db_root_password.txt
63

64
volumes:
65
  db:
66
    name: mysql-volume
67
  wp:
68
    name: wordpress-volume
69
========================================
70
MYSQL_ROOT_PASSWORD_FILE: # 告诉mysql镜像去这个文件里读密码
71
MYSQL_PASSWORD_FILE:      # 普通用户密码也从文件读
72
# ⭐ 这就是 secrets 的核心: 密码不写在 compose 里,而是挂载成文件
73
secrets:                  # 服务级引用,把对应的secret挂到 /run/secrets/ 下

1
4)启动服务
2
[root@Docker wordpress-secrets]# docker compose up -d
3
[+] Running 5/5
4
 ✔ Network wordpress-net      Crea...                         0.0s
5
 ✔ Volume "mysql-volume"      Crea...                         0.0s
6
 ✔ Volume "wordpress-volume"  Created                         0.0s
7
 ✔ Container db               Started                         0.4s
8
 ✔ Container wp               Started                         0.5s
9
root@Docker wordpress-secrets# docker compose ps
10
NAME      IMAGE             COMMAND                  SERVICE     CREATED          STATUS          PORTS
11
db        mysql:8.0.36      "docker-entrypoint.s…"   db_server   24 seconds ago   Up 24 seconds   0.0.0.0:3306->3306/tcp, 33060/tcp
12
wp        wordpress:6.7.1   "docker-entrypoint.s…"   wordpress   24 seconds ago   Up 24 seconds   0.0.0.0:81->80/tcp
13

14
5)测试验证
15
'用文件里的密码 redhat 登录mysql'
16
[root@Docker wordpress-secrets]# docker exec db mysql -predhat -e "SHOW DATABASES;"
17
Database
18
information_schema
19
mysql
20
performance_schema
21
sys
22
wordpress
23
✅️ 密码来自 /run/secrets/db_root_password 文件,root 登录成功