docker compose环境变量
为增加安全性，在前面的python例子中增加redis的密码校验，密码从环境变量中获取：
from flask import Flask
from redis import StrictRedis
import os
import socket
app = Flask(__name__)
redis = StrictRedis(host=os.environ.get('REDIS_HOST', '127.0.0.1'),
port=6379, password=os.environ.get('REDIS_PASS'))
@app.route('/')
def hello():
redis.incr('hits')
return f"Hello Container World! I have been seen {redis.get('hits').decode('utf-8')} times and my hostname is {socket.gethostname()}.\n"对前面的docker-compose.yml进行修改如下：
version: "3.3"
services:
flask-demo:
build:
context: .
dockerfile: Dockerfile
image: flask-demo:latest
environment:
- REDIS_HOST=redis-server
- REDIS_PASS=${REDIS_PASSWORD}
networks:
- demo-network
ports:
- 8080:5000
redis-server:
image: redis:latest
command: redis-server --requirepass ${REDIS_PASSWORD}
networks:
- demo-network
networks:
demo-network:在工程目录下新建.env文件，将环境变量配置好：
REDIS_PASS=abc启动服务：
$ docker-compose up -d
Creating network "app3_demo-network" with the default driver
Creating app3_redis-server_1 ... done
Creating app3_flask-demo_1 ... done参考文档：https://docs.docker.com/compose/environment-variables/
docker compose健康检查
Dockerfile healthcheck： https://docs.docker.com/engine/reference/builder/#healthcheck
docker compose：https://docs.docker.com/compose/compose-file/compose-file-v3/#healthcheck
健康检查是容器运行状态的高级检查，主要是检查容器所运行的进程是否能正常的对外提供“服务”，比如一个数据库容器，我们不光需要这个容器是up的状态，我们还要求这个容器的数据库进程能够正常对外提供服务，这就是所谓的健康检查。
容器的健康检查
容器本身有一个健康检查的功能，但是需要在Dockerfile里定义，或者在执行docker container run的时候，通过下面的一些参数指定：
--health-cmd string Command to run to check health
--health-interval duration Time between running the check
(ms|s|m|h) (default 0s)
--health-retries int Consecutive failures needed to
report unhealthy
--health-start-period duration Start period for the container to
initialize before starting
health-retries countdown
(ms|s|m|h) (default 0s)
--health-timeout duration Maximum time to allow one check to下面我们对前面的flask例子增加健康检查，主要是在Dockerfile中增加HEALTHCHECK指令：
FROM python:3.9.5-slim
RUN pip install flask redis && \
apt-get update && \
apt-get install -y curl && \
groupadd -r flask && useradd -r -g flask flask && \
mkdir /src && \
chown -R flask:flask /src
USER flask
COPY app.py /src/app.py
WORKDIR /src
ENV FLASK_APP=app.py REDIS_HOST=redis
EXPOSE 5000
HEALTHCHECK --interval=30s --timeout=3s \
CMD curl -f http://localhost:5000/ || exit 1
CMD ["flask", "run", "-h", "0.0.0.0"]上面Dockerfili里的HEALTHCHECK就是定义了一个健康检查。会每隔30秒检查一次，如果失败就会退出，退出代码是1。
构建flask-demo镜像，并启动容器：
$ docker build -t flask-demo .
$ docker network create mynetwork
b3958a0cb961ddcc856c7e0458bc10489c456727f6061d1f9dc23e7e264741ae
$ docker container run --rm -d --name flask-demo --network=mynetwork --env REDIS_PASS=abc --env REDIS_HOST=redis flask-demo
e761d19949b9e3284471864101ec196807fc6145431903f4041e04daf950fa86
$ docker container ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
e761d19949b9 flask-demo "flask run -h 0.0.0.0" 8 seconds ago Up 8 seconds (health: starting) 5000/tcp flask-demo启动容器后查看容器状态未health: starting。
因为此时没有启动redis服务，所以无法访问http://localhost:5000/，经过3次检查后发现一直是不通的，然后health的状态会从starting变为unhealthy：
$ docker container ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
e761d19949b9 flask-demo "flask run -h 0.0.0.0" 2 minutes ago Up 2 minutes (unhealthy) 5000/tcp flask-demo也可以通过docker container inspect查看其中有关health的详情：
"Health": {
"Status": "unhealthy",
"FailingStreak": 4,
"Log": [
{
"Start": "2023-10-09T14:17:51.7014803+08:00",
"End": "2023-10-09T14:17:54.7023591+08:00",
"ExitCode": -1,
"Output": "Health check exceeded timeout (3s)"
},
{
"Start": "2023-10-09T14:18:24.7095286+08:00",
"End": "2023-10-09T14:18:27.7099692+08:00",
"ExitCode": -1,
"Output": "Health check exceeded timeout (3s)"
},
{
"Start": "2023-10-09T14:18:57.7264309+08:00",
"End": "2023-10-09T14:19:00.7267289+08:00",
"ExitCode": -1,
"Output": "Health check exceeded timeout (3s)"
},
{
"Start": "2023-10-09T14:19:30.7443718+08:00",
"End": "2023-10-09T14:19:33.7444952+08:00",
"ExitCode": -1,
"Output": "Health check exceeded timeout (3s)"
}
]
}此时再启动redis服务，注意设置访问redis的密码：
$ docker container run --rm -d --network=mynetwork --name redis redis redis-server --requirepass abc
985cd32adbffd0d631a5a193c25903d704ddf08fb9a06f65a8e05af601a2ad77
$ docker container ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
985cd32adbff redis "docker-entrypoint.s…" About a minute ago Up About a minute 6379/tcp redis
e761d19949b9 flask-demo "flask run -h 0.0.0.0" 8 minutes ago Up 8 minutes (healthy) 5000/tcp flask-demo经过几秒钟，我们的flask-demo变成了healthy。
docker-compose健康检查
在上面的例子基础上删除Dockerfile中的心跳检测。
在docker-compose.yml中增加健康检查的配置：
version: "3.8"
services:
flask-demo:
build:
context: .
dockerfile: Dockerfile
image: flask-demo:latest
environment:
- REDIS_HOST=redis-server
- REDIS_PASS=${REDIS_PASS}
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:5000"]
interval: 30s
timeout: 3s
retries: 3
start_period: 40s
networks:
- demo-network
ports:
- 8080:5000
redis-server:
image: redis:latest
command: redis-server --requirepass ${REDIS_PASS}
networks:
- demo-network
networks:
demo-network:构建镜像并启动：
$ docker-compose up -d --build
$ docker-compose ps
Name Command State Ports
--------------------------------------------------------------------------------------------------------------
app5_flask-demo_1 flask run -h 0.0.0.0 Up (healthy) 0.0.0.0:8080->5000/tcp,:::8080->5000/tcp
app5_redis-server_1 docker-entrypoint.sh redis ... Up 6379/tcp可以通过修改docker-compose.yml文件中密码来测试容器状态为Up (unhealthy)的情况。
docker compose服务依赖
如果服务之间的启动有依赖顺序，可以使用depends_on来配置。
version: "3.8"
services:
flask-demo:
build:
context: .
dockerfile: Dockerfile
image: flask-demo:latest
environment:
- REDIS_HOST=redis-server
- REDIS_PASS=${REDIS_PASS}
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:5000"]
interval: 30s
timeout: 3s
retries: 3
start_period: 40s
depends_on:
- redis-server
networks:
- demo-network
ports:
- 8080:5000
redis-server:
image: redis:latest
command: redis-server --requirepass ${REDIS_PASS}
networks:
- demo-network
networks:
demo-network:上面的例子配置了flask-demo依赖redis-server，在启动的时候会先启动redis-server，然后在启动flask-demo：
$ docker-compose up -d
Creating network "app6_demo-network" with the default driver
Creating app6_redis-server_1 ... done
Creating app6_flask-demo_1 ... done服务依赖与健康检查的结合
这里再引入nginx来更好的演示服务依赖与健康检查的结合。
version: "3.8"
services:
flask-demo:
build:
context: .
dockerfile: Dockerfile
image: flask-demo:latest
environment:
- REDIS_HOST=redis-server
- REDIS_PASS=${REDIS_PASS}
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:5000"]
interval: 30s
timeout: 3s
retries: 3
start_period: 40s
depends_on:
- redis-server
networks:
- backend
- frontend
redis-server:
image: redis:latest
command: redis-server --requirepass ${REDIS_PASS}
networks:
- backend
nginx:
image: nginx:stable-alpine
ports:
- 8000:80
depends_on:
flask-demo:
condition: service_healthy
volumes:
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
- ./log/nginx:/var/log/nginx
networks:
- frontend
networks:
backend:
frontend:nginx.conf文件的内容如下：
server {
listen 80 default_server;
location / {
proxy_pass http://flask-demo:5000;
}
}启动服务，可以发现nginx在flask-demo启动后并健康检查通过后才启动。
$ docker-compose up -d
Creating network "app7_backend" with the default driver
Creating network "app7_frontend" with the default driver
Creating app7_redis-server_1 ... done
Creating app7_flask-demo_1 ... done
Creating app7_nginx_1 ... done
$ docker-compose ps
Name Command State Ports
----------------------------------------------------------------------------------------------------------
app7_flask-demo_1 flask run -h 0.0.0.0 Up (healthy) 5000/tcp
app7_nginx_1 /docker-entrypoint.sh ngin ... Up 0.0.0.0:8000->80/tcp,:::8000->80/tcp
app7_redis-server_1 docker-entrypoint.sh redis ... Up 6379/tcp