服务器容器化改造指南

# 改造前先摸清现状：进程、监听端口、写文件的目录、定时任务
ss -lntp
ps aux --sort=-%mem | head -20
lsof -p  | grep -E '/data|/var/www|/tmp'   # 找出所有写本地磁盘的路径
crontab -l -u www
systemctl list-units --type=service --state=running

# syntax=docker/dockerfile:1
# ---- 构建阶段 ----
FROM golang:1.23-alpine AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/app ./cmd/api

# ---- 运行阶段 ----
FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /app
COPY --from=builder /out/app /app/app
COPY --from=builder /src/configs/config.yaml /app/configs/config.yaml
USER 65532:65532
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD ["/app/app", "-healthcheck"]
ENTRYPOINT ["/app/app"]

cat > .dockerignore <<'EOF'
.git
.gitignore
node_modules
*.log
logs/
Dockerfile
.dockerignore
.env
EOF

# 构建并打标签，tag 用 git commit，保证可追溯
IMAGE=registry.example.com/team/api
docker build -t $IMAGE:$(git rev-parse --short HEAD) -t $IMAGE:latest .
docker images $IMAGE
# 安全扫描（trivy，2026 年主流开源扫描器）
trivy image --severity HIGH,CRITICAL $IMAGE:latest

# docker-compose.yml
services:
  api:
    image: registry.example.com/team/api:1.4.2
    restart: unless-stopped
    env_file: .env
    environment:
      - TZ=Asia/Shanghai
      - DB_HOST=mysql
    expose:
      - "8080"
    depends_on:
      mysql:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/healthz"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 20s
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 2G

  nginx:
    image: nginx:1.27-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./certs:/etc/nginx/certs:ro
      - static:/var/www/static:ro
    depends_on:
      - api

volumes:
  static:

# 1) 日志不限制会撑爆磁盘，务必配 max-size/max-file（见上）
# 2) 开机自启：不要只靠 restart 策略，加一个 systemd 单元
sudo tee /etc/systemd/system/app-compose.service >/dev/null <<'EOF'
[Unit]
Description=Docker Compose Application
Requires=docker.service
After=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
WorkingDirectory=/opt/app
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down
TimeoutStartSec=0

[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload && sudo systemctl enable app-compose

# Kubernetes 有状态服务最小可用示例（MySQL）
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  serviceName: mysql
  replicas: 1
  selector:
    matchLabels: { app: mysql }
  template:
    metadata:
      labels: { app: mysql }
    spec:
      containers:
        - name: mysql
          image: mysql:8.4
          ports: [{ containerPort: 3306 }]
          env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef: { name: mysql-secret, key: password }
          resources:
            requests: { cpu: "1", memory: 2Gi }
            limits:   { cpu: "2", memory: 4Gi }
          volumeMounts:
            - { name: data, mountPath: /var/lib/mysql }
          livenessProbe:
            exec:
              command: ["mysqladmin", "ping", "-h", "127.0.0.1"]
            initialDelaySeconds: 30
            periodSeconds: 10
  volumeClaimTemplates:
    - metadata: { name: data }
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: "ssd"
        resources:
          requests: { storage: 100Gi }
---
apiVersion: v1
kind: Service
metadata:
  name: mysql
spec:
  clusterIP: None          # Headless Service，StatefulSet 固定 DNS 必需
  selector: { app: mysql }
  ports: [{ port: 3306 }]

# 容器日志标准排查命令
docker logs --tail 200 -f --timestamps api
docker inspect api --format '{{.State.Health.Status}} {{.RestartCount}}'
docker stats --no-stream

# 宿主机磁盘被容器日志吃满时的应急清理
docker system df
find /var/lib/docker/containers -name '*-json.log' -size +1G -print
truncate -s 0 /var/lib/docker/containers//-json.log

# 回滚标准动作（Compose 场景）
cd /opt/app
docker compose down
sed -i 's|api:1.4.2|api:1.4.1|' docker-compose.yml     # 回退到上一个版本
docker compose up -d
docker compose ps
curl -sS -o /dev/null -w '%{http_code}\n' https://www.example.com/healthz