Docker 容器化部署实战：从镜像构建到Kubernetes集群的完整流程

引言

在当今快速发展的云计算时代，容器化技术已经成为企业实现云原生转型的核心技术之一。Docker作为最流行的容器化平台，为开发者和运维人员提供了高效、便捷的应用打包和部署解决方案。本文将深入探讨从Docker镜像构建到Kubernetes集群集成的完整容器化部署流程，帮助企业快速掌握现代云原生应用的开发和部署实践。

Docker基础概念与优势

什么是Docker

Docker是一种开源的容器化平台，它允许开发者将应用程序及其依赖项打包到一个轻量级、可移植的容器中。每个容器都包含了运行应用程序所需的所有内容：代码、运行时环境、系统工具、库和配置文件。

Docker的核心优势

环境一致性：确保开发、测试和生产环境中应用行为的一致性
资源效率：相比传统虚拟机，Docker容器共享宿主机操作系统内核，资源占用更少
快速部署：容器启动时间通常在秒级，大大提高了部署效率
可移植性：一次构建，到处运行，支持跨平台部署
版本控制：支持镜像版本管理，便于回滚和更新

Dockerfile编写最佳实践

基础Dockerfile结构

# 使用基础镜像
FROM node:16-alpine

# 设置工作目录
WORKDIR /app

# 复制依赖文件
COPY package*.json ./

# 安装依赖
RUN npm ci --only=production

# 复制应用代码
COPY . .

# 暴露端口
EXPOSE 3000

# 创建非root用户
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nextjs -u 1001

# 切换到非root用户
USER nextjs

# 健康检查
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

# 启动命令
CMD ["npm", "start"]

Dockerfile优化技巧

1. 多阶段构建

# 构建阶段
FROM node:16-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# 运行阶段
FROM node:16-alpine AS runtime
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY . .
EXPOSE 3000
USER nodejs
CMD ["npm", "start"]

2. 缓存优化

# 将依赖安装放在独立层，提高缓存效率
COPY package*.json ./
RUN npm ci --only=production && \
    npm cache clean --force

# 只在代码变更时重新构建应用
COPY . .

镜像构建与管理

构建镜像的基本命令

# 基本构建命令
docker build -t myapp:latest .

# 指定Dockerfile路径
docker build -f ./Dockerfile.prod -t myapp:prod .

# 设置构建参数
docker build --build-arg NODE_ENV=production -t myapp:prod .

镜像优化策略

1. 减少镜像层数

# 不好的做法：多个RUN命令
RUN apt-get update
RUN apt-get install -y python3
RUN pip install flask

# 好的做法：合并RUN命令
RUN apt-get update && \
    apt-get install -y python3 && \
    pip install flask

2. 使用多阶段构建减少最终镜像大小

# 构建阶段 - 完整环境
FROM node:16 AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# 运行阶段 - 最小化环境
FROM node:16-alpine AS runtime
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
EXPOSE 3000
CMD ["node", "dist/index.js"]

镜像安全扫描

# 使用Docker Scout进行安全扫描
docker scout quickview myapp:latest

# 使用Trivy扫描镜像
trivy image myapp:latest

# 推送镜像到私有仓库前进行扫描
docker push myregistry.com/myapp:latest
docker scan myregistry.com/myapp:latest

容器运行与管理

基本容器运行命令

# 运行容器
docker run -d \
  --name myapp-container \
  -p 3000:3000 \
  -e NODE_ENV=production \
  -v /host/data:/container/data \
  myapp:latest

# 查看运行中的容器
docker ps

# 查看所有容器（包括停止的）
docker ps -a

# 查看容器日志
docker logs -f myapp-container

网络配置管理

# 创建自定义网络
docker network create myapp-network

# 在指定网络中运行容器
docker run -d \
  --name app1 \
  --network myapp-network \
  myapp:latest

docker run -d \
  --name app2 \
  --network myapp-network \
  myapp:latest

数据持久化

# 使用命名卷
docker volume create myapp-data

docker run -d \
  --name myapp \
  -v myapp-data:/app/data \
  myapp:latest

# 使用绑定挂载
docker run -d \
  --name myapp \
  -v /host/path:/container/path \
  myapp:latest

Docker Compose多容器应用部署

docker-compose.yml示例

version: '3.8'

services:
  web:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://user:pass@db:5432/myapp
    depends_on:
      - db
    volumes:
      - ./logs:/app/logs
    restart: unless-stopped

  db:
    image: postgres:13-alpine
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped

  redis:
    image: redis:alpine
    ports:
      - "6379:6379"
    restart: unless-stopped

volumes:
  postgres_data:

Compose命令使用

# 启动所有服务
docker-compose up -d

# 停止所有服务
docker-compose down

# 查看服务状态
docker-compose ps

# 查看日志
docker-compose logs -f

# 重建镜像后重新启动
docker-compose up -d --build

Kubernetes集群基础概念

Kubernetes核心组件

Kubernetes由多个核心组件构成：

Control Plane（控制平面）：
- kube-apiserver：API服务器，提供REST接口
- etcd：分布式键值存储
- kube-scheduler：调度器
- kube-controller-manager：控制器管理器
Worker Nodes（工作节点）：
- kubelet：节点代理
- kube-proxy：网络代理
- Container Runtime：容器运行时

Kubernetes核心对象

# Deployment配置示例
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp-container
        image: myregistry.com/myapp:latest
        ports:
        - containerPort: 3000
        resources:
          requests:
            memory: "64Mi"
            cpu: "250m"
          limits:
            memory: "128Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10

Kubernetes部署流程

1. 集群环境准备

# 安装kubectl（Kubernetes命令行工具）
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/

# 验证集群连接
kubectl cluster-info

# 查看节点状态
kubectl get nodes

2. 创建命名空间

apiVersion: v1
kind: Namespace
metadata:
  name: production
---
apiVersion: v1
kind: Namespace
metadata:
  name: staging

kubectl apply -f namespaces.yaml

3. 部署应用

# Service配置
apiVersion: v1
kind: Service
metadata:
  name: myapp-service
  namespace: production
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 3000
  type: LoadBalancer

# Deployment配置
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp-container
        image: myregistry.com/myapp:latest
        ports:
        - containerPort: 3000
        envFrom:
        - secretRef:
            name: myapp-secret
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "200m"

4. 部署命令

# 应用配置文件
kubectl apply -f deployment.yaml
kubectl apply -f service.yaml

# 查看部署状态
kubectl get deployments -n production
kubectl get pods -n production
kubectl get services -n production

# 查看详细信息
kubectl describe deployment myapp-deployment -n production
kubectl describe pod <pod-name> -n production

高级Kubernetes配置

Ingress控制器配置

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp-service
            port:
              number: 80

ConfigMap和Secret管理

# ConfigMap配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: myapp-config
data:
  database.url: "postgresql://db:5432/myapp"
  log.level: "info"
---
# Secret配置
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secret
type: Opaque
data:
  database.password: <base64-encoded-password>

水平和垂直自动伸缩

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp-deployment
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

监控与日志管理

Prometheus监控配置

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: myapp-monitor
spec:
  selector:
    matchLabels:
      app: myapp
  endpoints:
  - port: http-metrics
    path: /metrics

日志收集配置

apiVersion: v1
kind: ConfigMap
metadata:
  name: fluentd-config
data:
  fluent.conf: |
    <source>
      @type tail
      path /var/log/containers/*.log
      pos_file /var/log/fluentd-containers.log.pos
      tag kubernetes.*
      read_from_head true
      <parse>
        @type json
      </parse>
    </source>
    
    <match kubernetes.**>
      @type stdout
    </match>

部署最佳实践

1. 环境分离策略

# 开发环境
kubectl apply -f environments/dev/deployment.yaml
kubectl apply -f environments/dev/service.yaml

# 生产环境
kubectl apply -f environments/prod/deployment.yaml
kubectl apply -f environments/prod/service.yaml

2. 滚动更新策略

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    spec:
      containers:
      - name: myapp-container
        image: myregistry.com/myapp:v2.0

3. 资源限制和请求

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: myapp-container
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "200m"

4. 健康检查配置

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: myapp-container
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /ready
            port: 3000
          initialDelaySeconds: 5
          periodSeconds: 5

故障排除与调试

常见问题排查

# 检查Pod状态
kubectl get pods -A

# 查看Pod详细信息
kubectl describe pod <pod-name> -n <namespace>

# 查看Pod日志
kubectl logs <pod-name> -n <namespace>

# 进入容器调试
kubectl exec -it <pod-name> -n <namespace> -- /bin/sh

# 检查服务端口映射
kubectl get svc -A

# 检查集群事件
kubectl get events --sort-by=.metadata.creationTimestamp

性能优化建议

资源配额管理：

apiVersion: v1
kind: ResourceQuota
metadata:
  name: myapp-quota
spec:
  hard:
    requests.cpu: "1"
    requests.memory: 1Gi
    limits.cpu: "2"
    limits.memory: 2Gi

镜像优化：

# 使用多阶段构建减少镜像大小
FROM node:16-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

FROM node:16-alpine AS runtime
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY . .
EXPOSE 3000
CMD ["npm", "start"]

CI/CD集成实践

GitLab CI配置示例

stages:
  - build
  - test
  - deploy

variables:
  DOCKER_REGISTRY: myregistry.com
  DOCKER_IMAGE: myapp

build:
  stage: build
  script:
    - docker build -t $DOCKER_REGISTRY/$DOCKER_IMAGE:$CI_COMMIT_SHA .
    - docker tag $DOCKER_REGISTRY/$DOCKER_IMAGE:$CI_COMMIT_SHA $DOCKER_REGISTRY/$DOCKER_IMAGE:latest
  only:
    - main

test:
  stage: test
  script:
    - docker run $DOCKER_REGISTRY/$DOCKER_IMAGE:$CI_COMMIT_SHA npm test
  only:
    - main

deploy:
  stage: deploy
  script:
    - kubectl set image deployment/myapp-deployment myapp-container=$DOCKER_REGISTRY/$DOCKER_IMAGE:$CI_COMMIT_SHA
  only:
    - main

安全最佳实践

镜像安全

# 使用最小基础镜像
FROM alpine:latest

# 禁用root用户运行
USER nobody

# 清理缓存
RUN rm -rf /var/cache/apk/*

Kubernetes安全配置

apiVersion: v1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535

总结

本文详细介绍了从Docker镜像构建到Kubernetes集群部署的完整容器化流程。通过实际代码示例和最佳实践，我们涵盖了：

Docker基础：包括Dockerfile编写、镜像构建和管理
容器运行：容器启动、网络配置、数据持久化等操作
Kubernetes部署：从基础概念到高级配置的完整流程
运维监控：监控、日志管理和故障排除
最佳实践：环境分离、自动伸缩、安全配置等

成功的容器化部署需要团队在技术、流程和文化上都做好准备。通过遵循本文介绍的最佳实践，企业可以快速实现云原生转型，提高应用的可移植性、可靠性和可扩展性。

记住，容器化是一个持续改进的过程。随着业务需求的变化和技术的发展，我们需要不断优化和调整我们的容器化策略，确保系统始终保持最佳状态。