Docker Volume 与网络：数据持久化、容器通信与生产存储策略

# Volume（Docker 管理）
docker volume create my-data
docker run -v my-data:/app/data my-app

# Bind Mount（宿主机目录）
docker run -v /host/data:/app/data:ro my-app      # 只读
docker run -v /host/data:/app/data:Z my-app       # SELinux 私有标签
docker run -v /host/data:/app/data:z my-app       # SELinux 共享标签

# tmpfs（内存，限制 100MB，禁止执行）
docker run --tmpfs /app/cache:size=100m,noexec my-app

# 使用 NFS Volume Driver
docker volume create --driver local \
  --opt type=nfs \
  --opt o=addr=192.168.1.100,rw \
  --opt device=:/exports/data \
  nfs-data

# 使用 Ceph RBD Driver（通过 rexray/rbd 插件）
docker volume create --driver rexray/rbd \
  --opt size=20 ceph-volume

# 创建自定义 bridge 网络，指定子网和网关
docker network create \
  --driver bridge \
  --subnet=172.28.0.0/16 \
  --gateway=172.28.0.1 \
  --opt com.docker.network.bridge.name=br_custom \
  my-net

# 在网络中启动容器
docker run -d --name db --network my-net --ip 172.28.0.10 postgres:15
docker run -d --name api --network my-net my-api

# api 容器内可直接访问 db:5432，底层由 Docker DNS 解析

# 创建 macvlan 网络
docker network create -d macvlan \
  --subnet=192.168.1.0/24 \
  --gateway=192.168.1.1 \
  -o parent=eth0 \
  macvlan-net

# 启动容器获取独立 IP
docker run --net macvlan-net --ip 192.168.1.100 -d nginx

# sidecar 模式：日志采集容器共享应用容器网络
docker run -d --name app my-app
docker run -d --name log-collector --network container:app fluentd

# 查看网络详情及连接容器
docker network inspect my-net

# 进入容器抓包
docker run --net container:app nicolaka/netshoot tcpdump -i eth0 -w /tmp/capture.pcap

# 验证 DNS 解析
docker run --rm --network my-net nicolaka/netshoot dig db

# 查看容器 iptables 规则
docker run --rm --privileged nicolaka/netshoot iptables -t nat -L -n -v

version: "3.9"
services:
  frontend:
    image: nginx
    networks:
      - public-net
  api:
    image: my-api
    networks:
      - public-net
      - backend-net
  db:
    image: postgres:15
    networks:
      - backend-net
    volumes:
      - db-data:/var/lib/postgresql/data

networks:
  public-net:
    driver: bridge
  backend-net:
    driver: bridge
    internal: true  # 无外网访问，仅容器间通信

volumes:
  db-data:
    driver: local

volumes:
  shared-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /mnt/nas/shared

  cache:
    driver: local
    driver_opts:
      type: tmpfs
      device: tmpfs
      o: size=500m,uid=1000

docker network create \
  --driver overlay \
  --subnet 10.0.9.0/24 \
  --opt encrypted \
  --attachable \
  secure-overlay

# 部署三副本 Web 服务
docker service create \
  --name web \
  --network secure-overlay \
  --replicas 3 \
  --publish published=8080,target=80 \
  nginx

# 查看 VIP 和任务分布
docker service inspect web --format='{{json .Endpoint.VirtualIPs}}'

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: ebs.csi.aws.com  # CSI 驱动名称
parameters:
  type: gp3
  iops: "10000"
  throughput: "500"
  encrypted: "true"
  kmsKeyId: alias/aws/ebs
reclaimPolicy: Retain
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
mountOptions:
  - debug

apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfs-pv-01
spec:
  capacity:
    storage: 100Gi
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: ""
  nfs:
    server: 192.168.1.100
    path: /exports/data
    readOnly: false

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: app-data-pvc
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: fast-ssd
  resources:
    requests:
      storage: 50Gi

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: app
          image: my-app:latest
          volumeMounts:
            - name: data
              mountPath: /app/data
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: app-data-pvc

# 顺序写吞吐测试
docker run --rm -v test-vol:/data \n  williamyeh/fio --directory=/data \
  --name=seq-write --rw=write --bs=1M --size=1G --numjobs=4 --direct=1

# 随机读 IOPS 测试
docker run --rm -v test-vol:/data \n  williamyeh/fio --directory=/data \
  --name=rand-read --rw=randread --bs=4k --size=1G --numjobs=16 --direct=1 \
  --ioengine=libaio --iodepth=64 --runtime=60

# 查看 Docker 自动添加的 NAT 规则
sudo iptables -t nat -L DOCKER -n -v

# 典型输出包含：
# DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 to:172.17.0.2:80

# 查看容器网络命名空间中的接口
sudo nsenter -t $(docker inspect -f '{{.State.Pid}}' <container>) -n ip addr

# 查看宿主机侧的 veth 对端
ip link show | grep veth

# 查看容器的路由表
sudo nsenter -t $(docker inspect -f '{{.State.Pid}}' <container>) -n ip route

# 用户命名空间 remapping 配置（/etc/docker/daemon.json）
{
  "userns-remap": "default"
}