本篇为大家介绍Docker的容器命令，也顺带着让大家明白Docker和vmware都属于虚拟化技术下的软件，但是他们的不同之处不止在于运行的系统不同，他们的运行逻辑也不同，VMware是虚拟化完整的系统，而docker是隔离一个进程，这个进程拥有着能够使目标服务运行起来的最小资源量，所有本篇容器命令，我们使用Docker直接在CentOS宿主机上虚拟化一个CentOS来整体讲解容器命令。
1、下载CentOS镜像
[root@hdp3 ~] docker pull centos
Using default tag: latest
latest: Pulling from library/centos
a1d0c7532777: Pull complete
Digest: sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f432b177
Status: Downloaded newer image for centos:latest
docker.io/library/centos:latest
[root@hdp3 ~] docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
centos latest 5d0da3dc9764 14 months ago 231MB
通过结果就会发现，docker的镜像如容器比VMware的虚拟机实例小多了。
2、新建容器并启动运行，run命令有很多参数，具体打大家自己–help去看，不过，常用的就那么几个
此时我们启动一个CentOS的交互式docker容器，说白了就是你可以从外部连接到这个容器
[root@hdp3 ~] docker run -it --name mycentos centos
[root@64fb7232d515 /]
[root@64fb7232d515 /] ls
bin etc lib lost+found mnt proc run srv tmp var
dev home lib64 media opt root sbin sys usr
大家注意看输出，我运行doc命令的时候是在宿主机上，但是当运行docker虚拟化centos之后，默认会自动进入虚拟化出的centos的伪终端，此时你可以正常使用这个虚拟的centos，但是我前面说了，由于它只持有最小资源量所有某些系统内容是没有的。
这里说明一下，本篇博文我们不讲 -P 和 -p 怎么用，后面需要映射端口的时候再说，只讲前四个，同时不要觉得名字鸡肋，虽然我下面的操作都会用容器的ID操作，但是如果你有一个可以很好区分容器的别名，你下面的很多操作其实都可以用别名的
3、查询正在运行的容器列表，我们需要再开启一个宿主机的终端，运行如下命令
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
64fb7232d515 centos "/bin/bash" 6 minutes ago Up 6 minutes mycentos
注意IMAGE的值由跟着你实例化容器时指定的镜像参数不同而不同，比如我指定的是centos这个镜像名字，如果我指定的是镜像的IMAGE ID那该值就等于IMAGE ID
如果你想查看上一个操作的容器可以使用-l
[root@hdp3 ~] docker ps -l
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
64fb7232d515 centos "/bin/bash" 15 minutes ago Exited (0) 2 minutes ago mycentos
如果你想查看上n个操作的容器可以使用-n num
[root@hdp3 ~] docker ps -n 2
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
64fb7232d515 centos "/bin/bash" 17 minutes ago Exited (0) 4 minutes ago mycentos
8854df79ef4b feb5d9fea6a5 "/hello" 3 hours ago Exited (0) 3 hours ago confident_allen
如果你想查看操作过的所有容器可以使用-a
[root@hdp3 ~] docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
64fb7232d515 centos "/bin/bash" 16 minutes ago Exited (0) 2 minutes ago mycentos
8854df79ef4b feb5d9fea6a5 "/hello" 3 hours ago Exited (0) 3 hours ago confident_allen
4f16af718bfd feb5d9fea6a5 "/hello" 3 hours ago Exited (0) 3 hours ago angry_cohen
在查看容器的基础上，你可以只看容器编号-q
[root@hdp3 ~] docker ps -q
64fb7232d515
你也可以查看容器的所有信息
[root@hdp3 ~] docker ps --no-trunc
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6fd2eec282e4f4b03b3fbafade62304b45803455ac837695857de centos "/bin/bash" About a minute ago Up About a minute mycentos01
4、退出当前所在的容器，有两种方式
方式一：容器停止并退出
[root@64fb7232d515 /] exit
exit
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
方式二：容器不停止，只退出，在容器的会话界面使用快捷键Ctrl+P+Q
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6 centos "/bin/bash" 5 minutes ago Up 5 minutes mycentos01
5、启动一个以关闭的容器
[root@hdp3 ~] docker ps -n 2
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6 centos "/bin/bash" 8 minutes ago Up 8 minutes mycentos01
64fb7232d515 centos "/bin/bash" 30 minutes ago Exited (0) 16 minutes ago mycentos
[root@hdp3 ~] docker start 64fb7232d515
64fb7232d515
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6 centos "/bin/bash" 8 minutes ago Up 8 minutes mycentos01
64fb7232d515 centos "/bin/bash" 30 minutes ago Up 5 seconds mycentos
6、重启一个容器
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6 centos "/bin/bash" 8 minutes ago Up 8 minutes mycentos01
64fb7232d515 centos "/bin/bash" 30 minutes ago Up 5 seconds mycentos
[root@hdp3 ~] docker restart 709a23ef0ee6
709a23ef0ee6
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6 centos "/bin/bash" 12 minutes ago Up 7 seconds mycentos01
64fb7232d515 centos "/bin/bash" 34 minutes ago Up 3 minutes mycentos
7、停止容器，有两种方式。
方式一：正常停止
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6 centos "/bin/bash" 12 minutes ago Up 7 seconds mycentos01
64fb7232d515 centos "/bin/bash" 34 minutes ago Up 3 minutes mycentos
[root@hdp3 ~] docker stop 709a23ef0ee6
709a23ef0ee6
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
64fb7232d515 centos "/bin/bash" 36 minutes ago Up 5 minutes mycentos
[root@hdp3 ~] docker ps -n 2
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6 centos "/bin/bash" 14 minutes ago Exited (0) 13 seconds ago mycentos01
64fb7232d515 centos "/bin/bash" 36 minutes ago Up 6 minutes mycentos
方式二：强制停止
[root@hdp3 ~] docker kill 64fb7232d515
64fb7232d515
[root@hdp3 ~] docker ps -n 2
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6 centos "/bin/bash" 16 minutes ago Exited (0) 2 minutes ago mycentos01
64fb7232d515 centos "/bin/bash" 38 minutes ago Exited (137) 3 seconds ago mycentos
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
8、删除一个已停止的容器
[root@hdp3 ~] docker ps -n 2
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
709a23ef0ee6 centos "/bin/bash" 19 minutes ago Exited (0) 5 minutes ago mycentos01
64fb7232d515 centos "/bin/bash" 41 minutes ago Exited (137) 2 minutes ago mycentos
[root@hdp3 ~] docker rm 709a23ef0ee6
709a23ef0ee6
[root@hdp3 ~] docker ps -n 2
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
64fb7232d515 centos "/bin/bash" 41 minutes ago Exited (137) 2 minutes ago mycentos
8854df79ef4b feb5d9fea6a5 "/hello" 3 hours ago Exited (0) 3 hours ago confident_allen
从输出可以看出，容器以及被删除了，注意只能删除已经停止的容器，除非必要不要用-f强制删，而且要分清楚rm是删除容器，rmi删除镜像
当然和删除镜像一样，如果你要删除多个就用空格分隔，如果你要删除所有就使用如两个命令中的任意一个
docker rm -f $(docker ps -a -q)
或者
docker ps -a -q | xargs docker rm
9、我们上面用了一个交互式，效果就是创建并启动容器后自动打开伪终端。但是我们总不能每次用快捷键退出吧，而且前面没有说怎么进入一个启动的容器。所以现在我们介绍另一种以守护进程的方式创建一个容器。注意守护进程创建的容器默认创建后自动关闭并退出
[root@hdp3 ~] docker run -d centos
7cabf0e3224fe643c1cf7a5c37be51f1d38af5d6b9f443aa92541f463ff7a89f
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
[root@hdp3 ~] docker ps -n 1
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
7cabf0e3224f centos "/bin/bash" 2 minutes ago Exited (0) 2 minutes ago agitated_galileo
10、查看一个容器的日志
[root@hdp3 ~] docker logs -f -t -n 10 7cabf0e3224f
[root@hdp3 ~]
可以看到在查询守护进程所创建的容器日志时，他没有任何输出，这是因为我前面也说了，守护士进程创建的容器，在创建好之后会立马退出并关闭，没有做任何的动作，所以他没有产生任何日志，如果你想让他保持启动，那你就需要通过linux的命令给他传递一个前台挂起的任务，比如我让他创建后循环输出
[root@hdp3 ~] docker run -d centos /bin/sh -c "while true;do echo 作者真帅;sleep 2;done"
dfaf90c30410b4e93a4f8ebf5fa6c89024f8d9f493e32451981aa6fcac938423
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
dfaf90c30410 centos "/bin/sh -c 'while t…" 7 seconds ago Up 6 seconds silly_albattani
[root@hdp3 ~] docker logs -f -t -n 10 dfaf90c30410
2022-12-05T10:00:12.404963412Z 作者真帅
2022-12-05T10:00:14.406957687Z 作者真帅
2022-12-05T10:00:16.409965178Z 作者真帅
2022-12-05T10:00:18.412695716Z 作者真帅
2022-12-05T10:00:20.414700829Z 作者真帅
2022-12-05T10:00:22.416993692Z 作者真帅
2022-12-05T10:00:24.419391620Z 作者真帅
2022-12-05T10:00:26.422298319Z 作者真帅
2022-12-05T10:00:28.423760321Z 作者真帅
2022-12-05T10:00:30.426126663Z 作者真帅
2022-12-05T10:00:32.429163038Z 作者真帅
2022-12-05T10:00:34.431533516Z 作者真帅
这里说一点run命令后面跟着/bin/sh意思是登录点，通俗点就是你用那个shell编译器和容器交互，默认是bash
11、查看一个容器内部运行的进程
[root@hdp3 ~] docker top dfaf90c30410
UID PID PPID C STIME TTY TIME CMD
root 19485 19464 0 18:08 ? 00:00:00 /bin/sh -c while true;do echo 作者真帅;sleep 2;done
root 19521 19485 0 18:09 ? 00:00:00 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 2
12、查看一个容器的结构细节
[root@hdp3 ~]# docker inspect dfaf90c30410
[
{
"Id": "dfaf90c30410b4e93a4f8ebf5fa6c89024f8d9f493e32451981aa6fcac938423",
"Created": "2022-12-05T10:00:04.201303703Z",
"Path": "/bin/sh",
"Args": [
"-c",
"while true;do echo 作者真帅;sleep 2;done"
],
"State": {
"Status": "exited",
"Running": false,
"Paused": false,
"Restarting": false,
"OOMKilled": false,
"Dead": false,
"Pid": 0,
"ExitCode": 137,
"Error": "",
"StartedAt": "2022-12-05T10:00:04.39646781Z",
"FinishedAt": "2022-12-05T10:01:36.409467857Z"
},
"Image": "sha256:5d0da3dc976460b72c77d94c8a1ad043720b0416bfc16c52c45d4847e53fadb6",
"ResolvConfPath": "/opt/docker/containers/dfaf90c30410b4e93a4f8ebf5fa6c89024f8d9f493e32451981aa6fcac938423/resolv.conf",
"HostnamePath": "/opt/docker/containers/dfaf90c30410b4e93a4f8ebf5fa6c89024f8d9f493e32451981aa6fcac938423/hostname",
"HostsPath": "/opt/docker/containers/dfaf90c30410b4e93a4f8ebf5fa6c89024f8d9f493e32451981aa6fcac938423/hosts",
"LogPath": "/opt/docker/containers/dfaf90c30410b4e93a4f8ebf5fa6c89024f8d9f493e32451981aa6fcac938423/dfaf90c30410b4e93a4f8ebf5fa6c89024f8d9f493e32451981aa6fcac938423-json.log",
"Name": "/silly_albattani",
"RestartCount": 0,
"Driver": "overlay2",
"Platform": "linux",
"MountLabel": "",
"ProcessLabel": "",
"AppArmorProfile": "",
"ExecIDs": null,
"HostConfig": {
"Binds": null,
"ContainerIDFile": "",
"LogConfig": {
"Type": "json-file",
"Config": {}
},
"NetworkMode": "default",
"PortBindings": {},
"RestartPolicy": {
"Name": "no",
"MaximumRetryCount": 0
},
"AutoRemove": false,
"VolumeDriver": "",
"VolumesFrom": null,
"CapAdd": null,
"CapDrop": null,
"CgroupnsMode": "host",
"Dns": [],
"DnsOptions": [],
"DnsSearch": [],
"ExtraHosts": null,
"GroupAdd": null,
"IpcMode": "private",
"Cgroup": "",
"Links": null,
"OomScoreAdj": 0,
"PidMode": "",
"Privileged": false,
"PublishAllPorts": false,
"ReadonlyRootfs": false,
"SecurityOpt": null,
"UTSMode": "",
"UsernsMode": "",
"ShmSize": 67108864,
"Runtime": "runc",
"ConsoleSize": [
0,
0
],
"Isolation": "",
"CpuShares": 0,
"Memory": 0,
"NanoCpus": 0,
"CgroupParent": "",
"BlkioWeight": 0,
"BlkioWeightDevice": [],
"BlkioDeviceReadBps": null,
"BlkioDeviceWriteBps": null,
"BlkioDeviceReadIOps": null,
"BlkioDeviceWriteIOps": null,
"CpuPeriod": 0,
"CpuQuota": 0,
"CpuRealtimePeriod": 0,
"CpuRealtimeRuntime": 0,
"CpusetCpus": "",
"CpusetMems": "",
"Devices": [],
"DeviceCgroupRules": null,
"DeviceRequests": null,
"KernelMemory": 0,
"KernelMemoryTCP": 0,
"MemoryReservation": 0,
"MemorySwap": 0,
"MemorySwappiness": null,
"OomKillDisable": false,
"PidsLimit": null,
"Ulimits": null,
"CpuCount": 0,
"CpuPercent": 0,
"IOMaximumIOps": 0,
"IOMaximumBandwidth": 0,
"MaskedPaths": [
"/proc/asound",
"/proc/acpi",
"/proc/kcore",
"/proc/keys",
"/proc/latency_stats",
"/proc/timer_list",
"/proc/timer_stats",
"/proc/sched_debug",
"/proc/scsi",
"/sys/firmware"
],
"ReadonlyPaths": [
"/proc/bus",
"/proc/fs",
"/proc/irq",
"/proc/sys",
"/proc/sysrq-trigger"
]
},
"GraphDriver": {
"Data": {
"LowerDir": "/opt/docker/overlay2/0828a0392e6c69c6bf2a66865c0fc7369bcdcb43de22511a2aa67d5492aa4813-init/diff:/opt/docker/overlay2/3a95ae1d07564705753844180cffb19a23e1f0519b4bd76fcda276a480d99be1/diff",
"MergedDir": "/opt/docker/overlay2/0828a0392e6c69c6bf2a66865c0fc7369bcdcb43de22511a2aa67d5492aa4813/merged",
"UpperDir": "/opt/docker/overlay2/0828a0392e6c69c6bf2a66865c0fc7369bcdcb43de22511a2aa67d5492aa4813/diff",
"WorkDir": "/opt/docker/overlay2/0828a0392e6c69c6bf2a66865c0fc7369bcdcb43de22511a2aa67d5492aa4813/work"
},
"Name": "overlay2"
},
"Mounts": [],
"Config": {
"Hostname": "dfaf90c30410",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"/bin/sh",
"-c",
"while true;do echo 作者真帅;sleep 2;done"
],
"Image": "centos",
"Volumes": null,
"WorkingDir": "",
"Entrypoint": null,
"OnBuild": null,
"Labels": {
"org.label-schema.build-date": "20210915",
"org.label-schema.license": "GPLv2",
"org.label-schema.name": "CentOS Base Image",
"org.label-schema.schema-version": "1.0",
"org.label-schema.vendor": "CentOS"
}
},
"NetworkSettings": {
"Bridge": "",
"SandboxID": "53b915430bb84fa3aa0d8e4466b800d78fe58f2c679de0dc1dc7939aa21eaa08",
"HairpinMode": false,
"LinkLocalIPv6Address": "",
"LinkLocalIPv6PrefixLen": 0,
"Ports": {},
"SandboxKey": "/var/run/docker/netns/53b915430bb8",
"SecondaryIPAddresses": null,
"SecondaryIPv6Addresses": null,
"EndpointID": "",
"Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "",
"IPPrefixLen": 0,
"IPv6Gateway": "",
"MacAddress": "",
"Networks": {
"bridge": {
"IPAMConfig": null,
"Links": null,
"Aliases": null,
"NetworkID": "18ca23716e982ea105fdae027b63d8e3770ea0281d948496370b38ea28422c8b",
"EndpointID": "",
"Gateway": "",
"IPAddress": "",
"IPPrefixLen": 0,
"IPv6Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "",
"DriverOpts": null
}
}
}
}
]
13、操作一个启动的容器，有两种方式
方式一：attach，这种方式会再次进入这个容器
[root@hdp3 ~] docker run -it centos
[root@b76a1b5188ce /] pwd
/
[root@hdp3 ~]
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b76a1b5188ce centos "/bin/bash" 2 minutes ago Up 2 minutes vigilant_bouman
[root@hdp3 ~] docker attach b76a1b5188ce
[root@b76a1b5188ce /]
方式二：exec，这种方式并不会直接进入容器，而是用来，把命令直接交给容器，并拿到结果
[root@hdp3 ~] docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b76a1b5188ce centos "/bin/bash" 7 minutes ago Up 7 minutes vigilant_bouman
[root@hdp3 ~] docker exec -it b76a1b5188ce ls -l /tmp
total 12
-rwx------ 1 root root 701 Sep 15 2021 ks-script-4luisyla
-rwx------ 1 root root 671 Sep 15 2021 ks-script-o23i7rc2
-rwx------ 1 root root 291 Sep 15 2021 ks-script-x6ei4wuu
当然方法二也可以进入容器
[root@hdp3 ~] docker exec -t b76a1b5188ce /bin/bash
[root@b76a1b5188ce /]
14、如何从容器中拿出某个文件，你可以运行cp命令
[root@hdp3 ~] docker attach b76a1b5188ce
[root@b76a1b5188ce /] ls
bin etc lib lost+found mnt proc run srv tmp var
dev home lib64 media opt root sbin sys usr
[root@b76a1b5188ce /] vi myfile
[root@b76a1b5188ce /] cat myfile
容器内部数据
[root@hdp3 ~] docker cp b76a1b5188ce:/myfile /opt
[root@hdp3 ~] cd /opt/
[root@hdp3 opt] ll |grep myfile
-rw-r--r-- 1 root root 19 12月 5 19:02 myfile
[root@hdp3 opt] cat myfile
容器内部数据
说明一下，Doctor虚拟化的本质虽然是一个隔离进程，但是它的生成容器是持久化的，只是运行的模式不同而已，从容器里往出拷贝数据，大多是用在当你某个容器不再使用，但是里面有重要数据，比如说数据库的文件相关的东西要考出来之后，容器才能正常删除的情况
![[ 红队知识库 ] 常见防火墙(WAF)拦截页面](https://img-blog.csdnimg.cn/9a895acff51c4beaa1d36d414afe7470.png)
