ehlxr/docker_practice
1
0
Fork 0
mirror of https://github.com/yeasy/docker_practice.git synced 2026-08-10 16:37:34 +00:00
Code Issues Projects Releases Wiki Activity

fix(content): harden copy-paste safety examples

Browse Source
This commit is contained in:
yeasy
2026-05-27 18:17:24 -07:00
parent 3a9ee19d22
commit f09e800020
4 changed files with 30 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03_install/3.6_offline.md
+10 -6
View File
@@ -90,9 +90,11 @@ $ sudo dnf versionlock clear
##### 挂载 ISO 镜像搭建本地 File 源 ##### 挂载 ISO 镜像搭建本地 File 源
```bash ```bash
## 删除其他网络源 ## 备份其他网络源
$ sudo rm -f /etc/yum.repos.d/* $ repo_backup="/etc/yum.repos.d/backup-$(date +%Y%m%d%H%M%S)"
$ sudo mkdir -p "$repo_backup"
$ sudo find /etc/yum.repos.d -maxdepth 1 -type f -name '*.repo' -exec mv {} "$repo_backup"/ \;
## 挂载光盘或者iso镜像 ## 挂载光盘或者iso镜像
@@ -106,7 +108,7 @@ $ sudo tee /etc/yum.repos.d/local-base.repo <<EOF
name=local_base name=local_base
baseurl=file:///mnt baseurl=file:///mnt
enabled=1 enabled=1
gpgcheck=0 gpgcheck=1
EOF EOF
``` ```
```bash ```bash
@@ -156,7 +158,9 @@ $ sudo createrepo_c /var/www/html/docker-ce/
##### DNF 客户端设置 ##### DNF 客户端设置
```bash ```bash
$ sudo rm -f /etc/yum.repos.d/* $ repo_backup="/etc/yum.repos.d/backup-$(date +%Y%m%d%H%M%S)"
$ sudo mkdir -p "$repo_backup"
$ sudo find /etc/yum.repos.d -maxdepth 1 -type f -name '*.repo' -exec mv {} "$repo_backup"/ \;
$ sudo tee /etc/yum.repos.d/local-files.repo <<EOF $ sudo tee /etc/yum.repos.d/local-files.repo <<EOF
[local_base] [local_base]
name=local_base name=local_base
@@ -165,7 +169,7 @@ name=local_base
baseurl=http://x.x.x.x/base baseurl=http://x.x.x.x/base
enabled=1 enabled=1
gpgcheck=0 gpgcheck=1
proxy=_none_ proxy=_none_
[docker-ce-stable] [docker-ce-stable]
name=docker-ce-stable name=docker-ce-stable
@@ -174,7 +178,7 @@ name=docker-ce-stable
baseurl=http://x.x.x.x/docker-ce baseurl=http://x.x.x.x/docker-ce
enabled=1 enabled=1
gpgcheck=0 gpgcheck=1
proxy=_none_ proxy=_none_
EOF EOF
07_dockerfile/7.1_run.md
+3 -1
View File
@@ -158,9 +158,11 @@ RUN --mount=type=cache,target=/go/pkg/mod \
```docker ```docker
RUN --mount=type=secret,id=mysecret \ RUN --mount=type=secret,id=mysecret \
cat /run/secrets/mysecret my-private-tool --token-file /run/secrets/mysecret
``` ```
不要在构建命令中 `cat`、`echo` 或打印密钥内容；应把 `/run/secrets/<id>` 路径交给真正消费密钥的工具。
#### 3. Heredoc 语法 #### 3. Heredoc 语法
BuildKit 支持使用 heredoc 语法编写多行脚本，无需行末反斜杠 `\` 连接： BuildKit 支持使用 heredoc 语法编写多行脚本，无需行末反斜杠 `\` 连接：
14_kubernetes_setup/14.1_kubeadm.md
+9 -7
View File
@@ -186,8 +186,8 @@ $ sudo kubeadm init \
```bash ```bash
... ...
[addons] Applied essential addon: CoreDNS [addons] Applied essential addon: CoreDNS
I1116 12:35:13.270407 86677 request.go:538] Throttling request took 181.409184ms, request: POST:https://192.168.199.100:6443/api/v1/namespaces/kube-system/serviceaccounts I1116 12:35:13.270407 86677 request.go:538] Throttling request took 181.409184ms, request: POST:https://<CONTROL_PLANE_HOST>:6443/api/v1/namespaces/kube-system/serviceaccounts
I1116 12:35:13.470292 86677 request.go:538] Throttling request took 186.088112ms, request: POST:https://192.168.199.100:6443/api/v1/namespaces/kube-system/configmaps I1116 12:35:13.470292 86677 request.go:538] Throttling request took 186.088112ms, request: POST:https://<CONTROL_PLANE_HOST>:6443/api/v1/namespaces/kube-system/configmaps
[addons] Applied essential addon: kube-proxy [addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully! Your Kubernetes control-plane has initialized successfully!
@@ -204,8 +204,8 @@ Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
Then you can join any number of worker nodes by running the following on each as root: Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.199.100:6443 --token cz81zt.orsy9gm9v649e5lf \ kubeadm join <CONTROL_PLANE_HOST>:6443 --token <TOKEN> \
--discovery-token-ca-cert-hash sha256:5edb316fd0d8ea2792cba15cdf1c899a366f147aa03cba52d4e5c5884ad836fe --discovery-token-ca-cert-hash sha256:<DISCOVERY_TOKEN_CA_CERT_HASH>
``` ```
#### node 工作节点 #### node 工作节点
@@ -217,12 +217,14 @@ $ systemctl enable containerd
$ systemctl start containerd $ systemctl start containerd
$ kubeadm join 192.168.199.100:6443 \ $ kubeadm join <CONTROL_PLANE_HOST>:6443 \
--token cz81zt.orsy9gm9v649e5lf \ --token <TOKEN> \
--discovery-token-ca-cert-hash sha256:5edb316fd0d8ea2792cba15cdf1c899a366f147aa03cba52d4e5c5884ad836fe \ --discovery-token-ca-cert-hash sha256:<DISCOVERY_TOKEN_CA_CERT_HASH> \
--cri-socket unix:///run/containerd/containerd.sock --cri-socket unix:///run/containerd/containerd.sock
``` ```
其中 `<CONTROL_PLANE_HOST>`、`<TOKEN>` 和 `<DISCOVERY_TOKEN_CA_CERT_HASH>` 应使用你自己的 `kubeadm init` 输出，不要复用示例值。
### 14.1.7 查看服务 ### 14.1.7 查看服务
所有服务启动后，通过 `crictl` 查看本地实际运行的容器。这些服务大概分为三类：主节点服务、工作节点服务和其它服务。 所有服务启动后，通过 `crictl` 查看本地实际运行的容器。这些服务大概分为三类：主节点服务、工作节点服务和其它服务。
14_kubernetes_setup/14.2_kubeadm-docker.md
+8 -6
View File
@@ -213,8 +213,8 @@ $ sudo kubeadm init --image-repository registry.cn-hangzhou.aliyuncs.com/google_
```bash ```bash
... ...
[addons] Applied essential addon: CoreDNS [addons] Applied essential addon: CoreDNS
I1116 12:35:13.270407 86677 request.go:538] Throttling request took 181.409184ms, request: POST:https://192.168.199.100:6443/api/v1/namespaces/kube-system/serviceaccounts I1116 12:35:13.270407 86677 request.go:538] Throttling request took 181.409184ms, request: POST:https://<CONTROL_PLANE_HOST>:6443/api/v1/namespaces/kube-system/serviceaccounts
I1116 12:35:13.470292 86677 request.go:538] Throttling request took 186.088112ms, request: POST:https://192.168.199.100:6443/api/v1/namespaces/kube-system/configmaps I1116 12:35:13.470292 86677 request.go:538] Throttling request took 186.088112ms, request: POST:https://<CONTROL_PLANE_HOST>:6443/api/v1/namespaces/kube-system/configmaps
[addons] Applied essential addon: kube-proxy [addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully! Your Kubernetes control-plane has initialized successfully!
@@ -231,8 +231,8 @@ Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
Then you can join any number of worker nodes by running the following on each as root: Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.199.100:6443 --token cz81zt.orsy9gm9v649e5lf \ kubeadm join <CONTROL_PLANE_HOST>:6443 --token <TOKEN> \
--discovery-token-ca-cert-hash sha256:5edb316fd0d8ea2792cba15cdf1c899a366f147aa03cba52d4e5c5884ad836fe --discovery-token-ca-cert-hash sha256:<DISCOVERY_TOKEN_CA_CERT_HASH>
``` ```
#### node 工作节点 #### node 工作节点
@@ -240,11 +240,13 @@ kubeadm join 192.168.199.100:6443 --token cz81zt.orsy9gm9v649e5lf \
在 **另一主机** 重复 **部署** 小节以前的步骤，安装配置好 kubelet。根据提示，加入到集群。 在 **另一主机** 重复 **部署** 小节以前的步骤，安装配置好 kubelet。根据提示，加入到集群。
```bash ```bash
$ kubeadm join 192.168.199.100:6443 --token cz81zt.orsy9gm9v649e5lf \ $ kubeadm join <CONTROL_PLANE_HOST>:6443 --token <TOKEN> \
--discovery-token-ca-cert-hash sha256:5edb316fd0d8ea2792cba15cdf1c899a366f147aa03cba52d4e5c5884ad836fe \ --discovery-token-ca-cert-hash sha256:<DISCOVERY_TOKEN_CA_CERT_HASH> \
--cri-socket unix:///var/run/cri-dockerd.sock --cri-socket unix:///var/run/cri-dockerd.sock
``` ```
其中 `<CONTROL_PLANE_HOST>`、`<TOKEN>` 和 `<DISCOVERY_TOKEN_CA_CERT_HASH>` 应使用你自己的 `kubeadm init` 输出，不要复用示例值。
### 14.2.7 查看服务 ### 14.2.7 查看服务
所有服务启动后，查看本地实际运行的 Docker 容器。这些服务大概分为三类：主节点服务、工作节点服务和其它服务。 所有服务启动后，查看本地实际运行的 Docker 容器。这些服务大概分为三类：主节点服务、工作节点服务和其它服务。