容器化部署实战：从 Docker 到 Kubernetes

为什么容器化？#

在我电脑上能跑，为什么服务器上跑不了？

容器化解决了”环境一致性”问题：

开发环境：Node.js 16 + npm 8
测试环境：Node.js 14 + npm 6
生产环境：Node.js 18 + npm 9

结果：依赖冲突，无法运行。

容器化让应用”一次构建，到处运行”。

Docker 基础#

Dockerfile 最佳实践#

1
# 1. 使用官方镜像
2
FROM node:18-alpine
3

4
# 2. 设置工作目录
5
WORKDIR /app
6

7
# 3. 复制依赖文件（利用缓存）
8
COPY package*.json ./
9

10
# 4. 安装依赖
11
RUN npm ci --only=production
12

13
# 5. 复制源代码
14
COPY . .
15

16
# 6. 设置环境变量
17
ENV NODE_ENV=production
18

19
# 7. 暴露端口
20
EXPOSE 3000
21

22
# 8. 健康检查
23
HEALTHCHECK --interval=30s --timeout=3s \
24
  CMD curl -f http://localhost:3000/health || exit 1
25

26
# 9. 非root用户运行
27
RUN addgroup -g 1001 -S nodejs
28
RUN adduser -S nodejs -u 1001
29
USER nodejs
30

31
# 10. 启动命令
32
CMD ["node", "server.js"]

多阶段构建#

1
# 构建阶段
2
FROM node:18-alpine AS builder
3
WORKDIR /app
4
COPY package*.json ./
5
RUN npm ci
6
COPY . .
7
RUN npm run build
8

9
# 运行阶段
10
FROM node:18-alpine AS runner
11
WORKDIR /app
12
COPY --from=builder /app/dist ./dist
13
COPY package*.json ./
14
RUN npm ci --only=production
15
EXPOSE 3000
16
CMD ["node", "dist/server.js"]

好处：

减小镜像大小（不需要构建工具）
提高安全性（不暴露源代码）

Docker Compose#

1
version: '3.8'
2

3
services:
4
  app:
5
    build: .
6
    ports:
7
      - "3000:3000"
8
    environment:
9
      - NODE_ENV=production
10
      - DB_HOST=db
11
    depends_on:
12
      - db
13
      - redis
14
    restart: unless-stopped
15

16
  db:
17
    image: postgres:15-alpine
18
    environment:
19
      - POSTGRES_DB=myapp
20
      - POSTGRES_USER=user
21
      - POSTGRES_PASSWORD=pass
22
    volumes:
23
      - postgres-data:/var/lib/postgresql/data
24
    restart: unless-stopped
25

26
  redis:
27
    image: redis:7-alpine
28
    restart: unless-stopped
29

30
  nginx:
31
    image: nginx:alpine
32
    ports:
33
      - "80:80"
34
    volumes:
35
      - ./nginx.conf:/etc/nginx/nginx.conf
36
    depends_on:
37
      - app
38
    restart: unless-stopped
39

40
volumes:
41
  postgres-data:

Docker Registry#

私有 Registry#

1
# 启动私有 registry
2
docker run -d -p 5000:5000 --name registry registry:2
3

4
# 推送镜像
5
docker tag myapp:latest localhost:5000/myapp:latest
6
docker push localhost:5000/myapp:latest
7

8
# 拉取镜像
9
docker pull localhost:5000/myapp:latest

Harbor#

Harbor 是企业级 Docker Registry：

安全扫描
RBAC
镜像签名
高可用

1
# 安装 Harbor
2
wget https://github.com/goharbor/harbor/releases/download/v2.8.0/harbor-offline-installer-v2.8.0.tgz
3
tar xzvf harbor-offline-installer-v2.8.0.tgz
4
cd harbor
5
sudo ./install.sh

Kubernetes 基础#

核心概念#

Pod：最小部署单元

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: myapp-pod
5
spec:
6
  containers:
7
  - name: myapp
8
    image: myapp:latest
9
    ports:
10
    - containerPort: 3000
11
    resources:
12
      requests:
13
        memory: "256Mi"
14
        cpu: "250m"
15
      limits:
16
        memory: "512Mi"
17
        cpu: "500m"
18
    livenessProbe:
19
      httpGet:
20
        path: /health
21
        port: 3000
22
      initialDelaySeconds: 30
23
      periodSeconds: 10
24
    readinessProbe:
25
      httpGet:
26
        path: /ready
27
        port: 3000
28
      initialDelaySeconds: 5
29
      periodSeconds: 5

Deployment：管理 Pod 副本

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: myapp-deployment
5
spec:
6
  replicas: 3
7
  selector:
8
    matchLabels:
9
      app: myapp
10
  template:
11
    metadata:
12
      labels:
13
        app: myapp
14
    spec:
15
      containers:
16
      - name: myapp
17
        image: myapp:latest
18
        ports:
19
        - containerPort: 3000
20
        env:
21
        - name: NODE_ENV
22
          value: "production"
23
        - name: DB_HOST
24
          valueFrom:
25
            secretKeyRef:
26
              name: myapp-secret
27
              key: db-host

Service：暴露服务

1
apiVersion: v1
2
kind: Service
3
metadata:
4
  name: myapp-service
5
spec:
6
  selector:
7
    app: myapp
8
  ports:
9
  - protocol: TCP
10
    port: 80
11
    targetPort: 3000
12
  type: LoadBalancer

ConfigMap：配置管理

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: myapp-config
5
data:
6
  app.conf: |
7
    server.port=3000
8
    log.level=info

Secret：敏感信息

1
apiVersion: v1
2
kind: Secret
3
metadata:
4
  name: myapp-secret
5
type: Opaque
6
data:
7
  db-password: cGFzc3dvcmQ= # base64 encoded

Ingress#

1
apiVersion: networking.k8s.io/v1
2
kind: Ingress
3
metadata:
4
  name: myapp-ingress
5
  annotations:
6
    kubernetes.io/ingress.class: nginx
7
    cert-manager.io/cluster-issuer: letsencrypt-prod
8
spec:
9
  tls:
10
  - hosts:
11
    - myapp.example.com
12
    secretName: myapp-tls
13
  rules:
14
  - host: myapp.example.com
15
    http:
16
      paths:
17
      - path: /
18
        pathType: Prefix
19
        backend:
20
          service:
21
            name: myapp-service
22
            port:
23
              number: 80

高级特性#

Horizontal Pod Autoscaler (HPA)#

1
apiVersion: autoscaling/v2
2
kind: HorizontalPodAutoscaler
3
metadata:
4
  name: myapp-hpa
5
spec:
6
  scaleTargetRef:
7
    apiVersion: apps/v1
8
    kind: Deployment
9
    name: myapp-deployment
10
  minReplicas: 2
11
  maxReplicas: 10
12
  metrics:
13
  - type: Resource
14
    resource:
15
      name: cpu
16
      target:
17
        type: Utilization
18
        averageUtilization: 80
19
  - type: Resource
20
    resource:
21
      name: memory
22
      target:
23
        type: Utilization
24
        averageUtilization: 80

Persistent Volume (PV)#

1
apiVersion: v1
2
kind: PersistentVolume
3
metadata:
4
  name: myapp-pv
5
spec:
6
  capacity:
7
    storage: 10Gi
8
  accessModes:
9
    - ReadWriteOnce
10
  persistentVolumeReclaimPolicy: Retain
11
  storageClassName: local-storage
12
  local:
13
    path: /mnt/data
14
  nodeAffinity:
15
    required:
16
      nodeSelectorTerms:
17
      - matchExpressions:
18
        - key: kubernetes.io/hostname
19
          operator: In
20
          values:
21
          - node1

StatefulSet#

1
apiVersion: apps/v1
2
kind: StatefulSet
3
metadata:
4
  name: myapp-statefulset
5
spec:
6
  serviceName: myapp
7
  replicas: 3
8
  selector:
9
    matchLabels:
10
      app: myapp
11
  template:
12
    metadata:
13
      labels:
14
        app: myapp
15
    spec:
16
      containers:
17
      - name: myapp
18
        image: myapp:latest
19
        ports:
20
        - containerPort: 3000
21
        volumeMounts:
22
        - name: data
23
          mountPath: /data
24
  volumeClaimTemplates:
25
  - metadata:
26
      name: data
27
    spec:
28
      accessModes:
29
      - ReadWriteOnce
30
      resources:
31
        requests:
32
          storage: 10Gi

部署流程#

1. CI/CD Pipeline#

1
name: Deploy to Kubernetes
2

3
on:
4
  push:
5
    branches: [ main ]
6

7
jobs:
8
  build-and-deploy:
9
    runs-on: ubuntu-latest
10
    steps:
11
    - uses: actions/checkout@v3
12

13
    - name: Build Docker image
14
      run: docker build -t myapp:${{ github.sha }} .
15

16
    - name: Push to Registry
17
      run: |
18
        echo ${{ secrets.REGISTRY_PASSWORD }} | docker login -u ${{ secrets.REGISTRY_USER }} --password-stdin registry.example.com
19
        docker tag myapp:${{ github.sha }} registry.example.com/myapp:${{ github.sha }}
20
        docker push registry.example.com/myapp:${{ github.sha }}
21

22
    - name: Deploy to Kubernetes
23
      run: |
24
        kubectl set image deployment/myapp-deployment myapp=registry.example.com/myapp:${{ github.sha }}
25
        kubectl rollout status deployment/myapp-deployment

2. 蓝绿部署#

1
# 部署新版本到 green
2
kubectl apply -f deployment-green.yaml
3

4
# 验证 green 版本
5
kubectl rollout status deployment/myapp-green
6

7
# 切换流量
8
kubectl patch service myapp-service -p '{"spec":{"selector":{"version":"green"}}}'

3. 金丝雀发布#

1
apiVersion: flagger.app/v1beta1
2
kind: Canary
3
metadata:
4
  name: myapp-canary
5
spec:
6
  targetRef:
7
    apiVersion: apps/v1
8
    kind: Deployment
9
    name: myapp
10
  service:
11
    port: 80
12
    targetPort: 3000
13
  analysis:
14
    interval: 1m
15
    threshold: 5
16
    maxWeight: 50
17
    stepWeight: 10
18
    metrics:
19
    - name: request-success-rate
20
      thresholdRange:
21
        min: 99
22
      interval: 1m

监控与日志#

Prometheus + Grafana#

1
# Prometheus 配置
2
apiVersion: v1
3
kind: ConfigMap
4
metadata:
5
  name: prometheus-config
6
data:
7
  prometheus.yml: |
8
    global:
9
      scrape_interval: 15s
10
    scrape_configs:
11
    - job_name: 'kubernetes-pods'
12
      kubernetes_sd_configs:
13
      - role: pod
14
      relabel_configs:
15
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
16
        action: keep
17
        regex: true

ELK Stack#

1
# Elasticsearch
2
apiVersion: apps/v1
3
kind: Deployment
4
metadata:
5
  name: elasticsearch
6
spec:
7
  replicas: 1
8
  selector:
9
    matchLabels:
10
      app: elasticsearch
11
  template:
12
    metadata:
13
      labels:
14
        app: elasticsearch
15
    spec:
16
      containers:
17
      - name: elasticsearch
18
        image: elasticsearch:8.0.0
19
        ports:
20
        - containerPort: 9200
21
        env:
22
        - name: discovery.type
23
          value: single-node
24
        volumeMounts:
25
        - name: data
26
          mountPath: /usr/share/elasticsearch/data
27
      volumes:
28
      - name: data
29
        emptyDir: {}

安全最佳实践#

1. 使用非 root 用户#

1
RUN addgroup -g 1001 -S appuser
2
RUN adduser -S appuser -u 1001
3
USER appuser

2. 扫描镜像漏洞#

1
# 使用 Trivy
2
trivy image myapp:latest
3

4
# 使用 Clair
5
clairctl scan myapp:latest

3. Network Policies#

1
apiVersion: networking.k8s.io/v1
2
kind: NetworkPolicy
3
metadata:
4
  name: myapp-network-policy
5
spec:
6
  podSelector:
7
    matchLabels:
8
      app: myapp
9
  policyTypes:
10
  - Ingress
11
  - Egress
12
  ingress:
13
  - from:
14
    - podSelector:
15
        matchLabels:
16
          app: frontend
17
    ports:
18
    - protocol: TCP
19
      port: 3000
20
  egress:
21
  - to:
22
    - podSelector:
23
        matchLabels:
24
          app: database
25
    ports:
26
    - protocol: TCP
27
      port: 5432

4. RBAC#

1
apiVersion: v1
2
kind: ServiceAccount
3
metadata:
4
  name: myapp-sa
5
---
6
apiVersion: rbac.authorization.k8s.io/v1
7
kind: Role
8
metadata:
9
  name: myapp-role
10
rules:
11
- apiGroups: [""]
12
  resources: ["pods"]
13
  verbs: ["get", "list"]
14
---
15
apiVersion: rbac.authorization.k8s.io/v1
16
kind: RoleBinding
17
metadata:
18
  name: myapp-rolebinding
19
subjects:
20
- kind: ServiceAccount
21
  name: myapp-sa
22
roleRef:
23
  kind: Role
24
  name: myapp-role
25
  apiGroup: rbac.authorization.k8s.io

故障排查#

1. 查看 Pod 状态#

1
kubectl get pods
2
kubectl describe pod <pod-name>
3
kubectl logs <pod-name>

2. 查看事件#

1
kubectl get events --sort-by=.metadata.creationTimestamp

3. 进入容器调试#

1
kubectl exec -it <pod-name> -- /bin/sh

4. 端口转发#

1
kubectl port-forward <pod-name> 8080:3000

成本优化#

1. 资源限制#

1
resources:
2
  requests:
3
    memory: "128Mi"
4
    cpu: "100m"
5
  limits:
6
    memory: "256Mi"
7
    cpu: "200m"

2. 自动伸缩#

1
apiVersion: autoscaling/v2
2
kind: VerticalPodAutoscaler
3
metadata:
4
  name: myapp-vpa
5
spec:
6
  targetRef:
7
    apiVersion: apps/v1
8
    kind: Deployment
9
    name: myapp
10
  updatePolicy:
11
    updateMode: Auto

3. Spot Instances#

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: myapp-spot
5
spec:
6
  replicas: 3
7
  template:
8
    spec:
9
      affinity:
10
        nodeAffinity:
11
          preferredDuringSchedulingIgnoredDuringExecution:
12
          - weight: 100
13
            preference:
14
              matchExpressions:
15
              - key: cloud.google.com/gke-spot
16
                operator: Exists

总结#

容器化部署是现代化的应用交付方式：

Docker 层面：

编写高效的 Dockerfile
使用多阶段构建
Docker Compose 本地开发

Kubernetes 层面：

理解核心概念
使用高级特性（HPA, PV, StatefulSet）
实现自动化部署

最佳实践：

安全扫描
监控日志
成本优化

记住：容器化不是目的，是手段。目标是提高开发效率、降低运维成本、提升系统可靠性。

相关文章：