Docker Production

Docker Production — 生产环境部署

Guidance for deploying and managing Docker in production.

When to Use

ALWAYS use this skill when the user mentions:

• "生产部署", "production Docker"
• "docker swarm", "docker stack", "swarm cluster"
• "Kubernetes migration", "kompose", "K8s"
• "零停机部署", "rolling update"
• "容器监控", "监控", "Prometheus"

Docker Swarm Quick Start

# Initialize cluster
docker swarm init --advertise-addr <MANAGER-IP>

# Join workers (run on worker nodes)
docker swarm join --token <TOKEN> <MANAGER-IP>:2377

# Deploy a stack
docker stack deploy -c docker-compose.yml myapp

# Manage services
docker service ls
docker service scale myapp_web=5
docker service update --image myapp:v2 myapp_web
docker service logs -f myapp_web

Swarm Compose Example

version: '3.8'
services:
  web:
    image: myapp:${TAG:-latest}
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      rollback_config:
        parallelism: 1
        delay: 10s
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    ports:
      - "80:8080"

Zero-Downtime Deployment

Rolling Update Flow:

┌──────┐  ┌──────┐  ┌──────┐     Old replicas (v1)
│ v1  │  │ v1  │  │ v1  │
└──────┘  └──────┘  └──────┘

docker service update --image myapp:v2 web

Step 1: Start v2
┌──────┐  ┌──────┐  ┌──────┐  ┌──────┐
│ v1  │  │ v1  │  │ v1  │  │ v2  │    ← 1 new
└──────┘  └──────┘  └──────┘  └──────┘

Step 2: Replace one v1 with v2
┌──────┐  ┌──────┐  ┌──────┐  ┌──────┐
│ v1  │  │ v1  │  │ v2  │  │ v2  │    ← 2 new
└──────┘  └──────┘  └──────┘  └──────┘

... until all v2

Kubernetes Migration

# Convert compose to K8s
kompose convert -f docker-compose.yml

# Output:
# web-deployment.yaml
# web-service.yaml
# ...

# Apply
kubectl apply -f .

Monitoring Stack

cAdvisor + Prometheus + Grafana

# docker-compose.monitoring.yml
services:
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    ports: ["8080:8080"]
    volumes:
      - /:/rootfs:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /sys:/sys:ro

  prometheus:
    image: prom/prometheus:latest
    ports: ["9090:9090"]
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml

  grafana:
    image: grafana/grafana:latest
    ports: ["3000:3000"]

Workflow — 推荐部署流程

Step 1: 单机部署: compose.yml + restart: unless-stopped + systemd 守护 Step 2: Swarm 集群: docker swarm init → docker stack deploy -c compose.yml myapp Step 3: 滚动更新: docker service update --image myapp:v2 + health check + rollback Step 4: 监控接入: Prometheus + cAdvisor + Grafana 绑定额仪表盘 Step 5: K8s 迁移: kompose convert → 手动添加资源限制+健康检查 → Helm Chart

Gotchas — Common Pitfalls

• Single Swarm manager: If the only manager goes down, the cluster is unresponsive. → Recovery: Use 3 or 5 managers; docker node promote <worker> to add manager; back up /var/lib/docker/swarm/ regularly.
• Rolling update health check: Without health checks, updates may deploy broken containers. → Recovery: Define HEALTHCHECK in Dockerfile + service health check; use --update-failure-action rollback.
• Data without volumes: Production databases MUST use volumes. Container restart = new filesystem without volumes. → Recovery: docker service create --mount type=volume,src=db_data,target=/var/lib/mysql.
• Direct K8s migration: kompose is a starting point, not production-ready K8s configs. → Recovery: After kompose convert, manually add resource limits, health checks, init containers, and ConfigMap/Secret references.

Boundary — 能力边界（适用与不适用场景）

When NOT to Use

Security & Stability

• Rotate Swarm join tokens regularly. Leaked worker tokens allow unauthorized node joining.
• Use Docker Secrets for all sensitive configuration in production stacks.
• Enable TLS for Docker daemon in production (tlsverify mode).
• Implement resource limits on all production services to prevent noisy-neighbor issues.
• Back up Swarm raft data regularly: /var/lib/docker/swarm/.
• Monitor node health and set up alerts for node failures.

📚 官方文档参考

🧭 Docker Skills Journey

📍 You are here: `docker-production` — 生产部署

← Previous: docker-cicd | → Next: docker-troubleshooting

FAQ

Q1: 如何快速上手此技能？ A: 参考上方的快速开始章节，按步骤操作即可。

Q2: 遇到版本不兼容问题怎么办？ A: 检查依赖版本，使用 lock 文件锁定，参考常见陷阱章节。

Q3: 如何在生产环境使用？ A: 参考最佳实践章节，确保配置正确，做好监控和日志。

Q4: 性能如何优化？ A: 参考性能优化相关文档，使用缓存、索引等手段。

Q5: 如何贡献或反馈问题？ A: 在 GitHub 仓库提交 Issue 或 Pull Request。

Q6: 是否支持中文？ A: 支持中文文档和中文注释，详见国内适配章节。

Swarm stack file for production

version: '3.8'
services:
  web:
    image: myapp:${TAG:-latest}
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
      rollback_config:
        parallelism: 1
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    ports:
      - "80:8080"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
      interval: 30s
      timeout: 3s
      retries: 3
    networks:
      - frontend

  redis:
    image: redis:7-alpine
    deploy:
      replicas: 1
    volumes:
      - redis-data:/data
    networks:
      - backend

networks:
  frontend:
  backend:
    internal: true

volumes:
  redis-data:

docker stack deploy -c docker-compose.yml myapp
docker stack services myapp
docker stack ps myapp

Docker Swarm 命令速查

集群管理

docker swarm init --advertise-addr eth0
docker swarm join --token SWMTKN-1-xxx 192.168.1.100:2377
docker swarm join-token manager      # 获取 manager token
docker swarm join-token worker       # 获取 worker token
docker swarm leave --force
docker node ls
docker node promote worker-1         # worker 升级为 manager
docker node update --availability drain node-1  # 排空节点

Service 管理

docker service create --name web --replicas 3 -p 8080:80 nginx:alpine
docker service ls
docker service ps web
docker service logs -f web
docker service scale web=5
docker service update --image nginx:alpine web
docker service update --force web    # 强制重新部署（不换镜像）
docker service rm web

Stack 部署

docker stack deploy -c compose.yml myapp
docker stack ls
docker stack ps myapp
docker stack services myapp
docker stack rm myapp

滚动更新

docker service create \
  --name api \
  --replicas 3 \
  --update-parallelism 1 \
  --update-delay 10s \
  --update-failure-action rollback \
  --update-monitor 30s \
  myapp:v1

docker service update --image myapp:v2 api

回滚

docker service rollback api
docker service update --rollback api

网络

docker network create --driver overlay mynet
docker service create --network mynet --name api myapp

Secrets & Configs

echo "secretpass" | docker secret create db_pass -
docker config create nginx_conf ./nginx.conf

docker service create \
  --secret db_pass \
  --config source=nginx_conf,target=/etc/nginx/nginx.conf \
  --name web nginx

Compose → Kubernetes 迁移指南

Kompose 一键转换

# 安装
brew install kompose

# 转换
kompose convert -f compose.yml -o k8s/

# 输出文件列表
ls k8s/
# api-deployment.yaml
# api-service.yaml
# db-deployment.yaml
# db-service.yaml
# db-persistentvolumeclaim.yaml
# frontend-networkpolicy.yaml
# backend-networkpolicy.yaml

转换差异处理

转换后手动调整

# 添加 init container 替代 depends_on
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  template:
    spec:
      initContainers:
        - name: wait-for-db
          image: busybox:1.36
          command: ['sh', '-c', 'until nc -z db 5432; do sleep 2; done']
      containers:
        - name: api
          image: myapp:latest

Helm Chart 包装

helm create myapp-chart
cp k8s/*.yaml myapp-chart/templates/
helm install myapp ./myapp-chart

常见陷阱

## 最终建议

小型项目用 Compose 足够；多节点/弹性扩容/服务网格用 K8s。过渡期可 Compose + K8s 并行运行。

Docker 监控栈搭建

组件

快速启动

# compose.yml
services:
  prometheus:
    image: prom/prometheus:v3.1.0
    ports: ["9090:9090"]
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus

  grafana:
    image: grafana/grafana:11.4.0
    ports: ["3000:3000"]
    volumes:
      - grafana_data:/var/lib/grafana
    environment:
      GF_SECURITY_ADMIN_PASSWORD: admin

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.50.0
    ports: ["8080:8080"]
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    privileged: true

  node-exporter:
    image: prom/node-exporter:v1.8.2
    ports: ["9100:9100"]
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro

  loki:
    image: grafana/loki:3.2.0
    ports: ["3100:3100"]

  promtail:
    image: grafana/promtail:3.2.0
    volumes:
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - ./promtail-config.yml:/etc/promtail/config.yml:ro
    command: -config.file=/etc/promtail/config.yml

volumes:
  prometheus_data:
  grafana_data:

prometheus.yml

global:
  scrape_interval: 15s

scrape_configs:
  - job_name: cadvisor
    static_configs:
      - targets: ['cadvisor:8080']

  - job_name: node-exporter
    static_configs:
      - targets: ['node-exporter:9100']

  - job_name: prometheus
    static_configs:
      - targets: ['localhost:9090']

Grafana 仪表盘 ID（导入）

常用 PromQL

# CPU 使用率
rate(container_cpu_usage_seconds_total{name="api"}[5m]) * 100

# 内存使用
container_memory_usage_bytes{name="api"} / 1024 / 1024

# 容器重启次数
changes(container_tasks_state{name="api"}[1h])

# 磁盘 IO
rate(container_fs_writes_bytes_total{name="api"}[5m])