【Docker系列】通过Dockerfile创建支持SSH服务的CentOS 7镜像学习心得分享

Docker系列文章

之前的文章中介绍了如何在 CentOS 7安装docker 18.09 ，下面介绍一下如何通过Dockerfile创建一个支持SSH服务的CentOS 7镜像，这样我们在宿主机上直接就可通过ssh去连接到docker容器中；

一步一步的新建一个支持SSH服务的Centos镜像，也是没有任何的问题大，但是无法满足生产环境流程化，标准化，快速生成的需要的。

因此就需要使用Dockerfile来生成所需镜像，这样，无论在什么环境下，都可以使用docker build快速，标准，无差错的批量生成一模一样的镜像，方便管理员快速布署。

1、在/root目录下新建docker_ssh_centos7目录用于存放Dockerfile和其他相关文件。

[root@VM_54_118_centos ~]# mkdir docker_ssh_centos7

2、新建在容器中启动sshd服务的脚本

[root@VM_54_118_centos ~]# cd docker_ssh_centos7/
[root@VM_54_118_centos docker_ssh_centos7]# vim run_sshd.sh
#!/bin/bash
/usr/sbin/sshd -D

3、在宿主机上生成RSA密钥

（注意：如果宿主机之前就已经生成过了，就不需要在重新生成了）

[root@VM_54_118_centos docker_ssh_centos7]# ssh-keygen -t rsa -b 2048 -f /etc/ssh/ssh_host_rsa_key

4、然后将生成的密钥复制到docker_ssh_centos7目录中

[root@VM_54_118_centos docker_ssh_centos7]# cp /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key.pub .

[root@VM_54_118_centos docker_ssh_centos7]# ll
total 12
-rw-r--r-- 1 root root   30 Apr  6 11:22 run_sshd.sh
-rw------- 1 root root 1675 Apr  6 11:31 ssh_host_rsa_key
-rw-r--r-- 1 root root  403 Apr  6 11:31 ssh_host_rsa_key.pub

[root@VM_54_118_centos docker_ssh_centos7]# cat ssh_host_rsa_key.pub > authorized_keys

5、在/root/docker_ssh_centos7目录下新建Dockerfile文件

[root@VM_54_118_centos docker_ssh_centos7]# vim <a href="http://www.seiang.com/?tag=docker" title="查看更多关于Docker的文章" target="_blank">Docker</a>file    
#生成的新镜像以centos镜像为基础
FROM centos
MAINTAINER by seiang (1193914535@qq.com)

#设置时区
RUN /bin/cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && echo 'Asia/Shanghai' >/etc/timezone

#升级系统
RUN yum -y update

#安装openssh-server
RUN yum -y install openssh-server

#修改/etc/ssh/sshd_config
RUN sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config

#将密钥文件复制到/etc/ssh/目录中
ADD ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key
ADD ssh_host_rsa_key.pub /etc/ssh/ssh_host_rsa_key.pub
RUN mkdir -p /root/.ssh
ADD authorized_keys /root/.ssh/authorized_keys

#将ssh服务启动脚本复制到/usr/local/sbin目录中，并改变权限为755
ADD run_sshd.sh /usr/local/sbin/run_sshd.sh
RUN chmod 755 /usr/local/sbin/run_sshd.sh

#变更root密码为XXXXX
RUN echo "root:XXXXX"|chpasswd

#开放窗口的22端口
EXPOSE 22

#运行脚本，启动sshd服务
CMD ["/usr/local/sbin/run_sshd.sh"]

其实可以把Dockerfile想像成shell脚本，里面执大部分内容都是shell命令。

此时/root/docker_ssh_centos7目录下应该存在如下文件：

[root@VM_54_118_centos docker_ssh_centos7]# ll
total 20
-rw-r--r-- 1 root root  403 Apr  6 11:49 authorized_keys
-rw-r--r-- 1 root root  839 Apr  6 11:36 Dockerfile
-rw-r--r-- 1 root root   30 Apr  6 11:22 run_sshd.sh
-rw------- 1 root root 1675 Apr  6 11:31 ssh_host_rsa_key
-rw-r--r-- 1 root root  403 Apr  6 11:31 ssh_host_rsa_key.pub

6、使用docker build生成镜像文件

（注意：命令最后面是一个”.”，这说明Dockerfile是在当前目录下）

[root@VM_54_118_centos docker_ssh_centos7]# docker build -t centos_sshd:dockerfile .        
Sending build context to Docker daemon  7.168kB
Step 1/14 : FROM centos
latest: Pulling from library/centos
Digest: sha256:8d487d68857f5bc9595793279b33d082b03713341ddec91054382641d14db861
Status: Downloaded newer image for centos:latest
 ---> 9f38484d220f
Step 2/14 : MAINTAINER by seiang (1193914535@qq.com)
 ---> Running in db9167150f9e
Removing intermediate container db9167150f9e
 ---> 930706cb8922
Step 3/14 : RUN yum -y update
 ---> Running in 49937ceac79f
Loaded plugins: fastestmirror, ovl
Determining fastest mirrors
 * base: mirrors.aliyun.com
 * extras: mirrors.shu.edu.cn
 * updates: mirrors.aliyun.com
Resolving Dependencies
--> Running transaction check
---> Package dbus.x86_64 1:1.10.24-12.el7 will be updated
---> Package dbus.x86_64 1:1.10.24-13.el7_6 will be an update
......
......
Removing intermediate container eb0515c7f73d
 ---> 82626ae6dbc9
Step 13/14 : EXPOSE 22
 ---> Running in 79e5417f364a
Removing intermediate container 79e5417f364a
 ---> 05b0cb4e8f63
Step 14/14 : CMD ["/usr/local/sbin/run_sshd.sh"]
 ---> Running in 5f2c766fd67a
Removing intermediate container 5f2c766fd67a
 ---> ebab8ae21382
Successfully built ebab8ae21382

执行完成后，会在最后显示

Successfully built ebab8ae21382
Successfully tagged centos_sshd:dockerfile

然后查看生成的镜像

[root@VM_54_118_centos ~]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
centos_sshd         dockerfile          ebab8ae21382        7 minutes ago       384MB
centos              7                   9f38484d220f        3 weeks ago         202MB
centos              latest              9f38484d220f        3 weeks ago         202MB

7、用新创建的镜像新建容器

[root@VM_54_118_centos ~]# docker run -d -p 10022:22 centos_sshd:dockerfile /usr/local/sbin/run_sshd.sh
8edca634ca63f96dea7868b7bf035d04bc4bef32b20e8fd8172d377e61c2e5f3

将宿主机的10022端口映射到容器的22端口，并启动sshd服务。

[root@VM_54_118_centos ~]# docker ps -a
CONTAINER ID        IMAGE                    COMMAND                  CREATED              STATUS                          PORTS                   NAMES
8edca634ca63        centos_sshd:dockerfile   "/usr/local/sbin/run…"   About a minute ago   Up About a minute               0.0.0.0:10022->22/tcp   trusting_montalcini

现在就可以使用ssh工具远程通过宿主机的10022端口访问容器了。

[root@VM_54_118_centos ~]# ssh root@10.105.54.118 -p 10022
The authenticity of host '[10.105.54.118]:10022 ([10.105.54.118]:10022)' can't be established.
RSA key fingerprint is SHA256:spNhHGgbDn5OJuYztesJ0D0w181625feAvjY7XgOtNo.
RSA key fingerprint is MD5:16:74:73:01:5a:40:4a:d5:04:6a:be:75:3e:d1:b3:e2.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[10.105.54.118]:10022' (RSA) to the list of known hosts.
root@10.105.54.118's password: 
[root@8edca634ca63 ~]# 

[root@8edca634ca63 ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.3  netmask 255.255.0.0  broadcast 172.17.255.255
        ether 02:42:ac:11:00:03  txqueuelen 0  (Ethernet)
        RX packets 317  bytes 341322 (333.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 198  bytes 28277 (27.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

遇到的问题：

从报错信息看，是由于找不到authorized_keys文件导致的，在宿主机上核实该文件是否存在

[root@VM_54_118_centos docker_ssh_centos7]# ll
total 20
-rw-r--r-- 1 root root  403 Apr  6 11:49 authorized_keys
-rw-r--r-- 1 root root  839 Apr  6 11:36 Dockerfile
-rw-r--r-- 1 root root   30 Apr  6 11:22 run_sshd.sh
-rw------- 1 root root 1675 Apr  6 11:31 ssh_host_rsa_key
-rw-r--r-- 1 root root  403 Apr  6 11:31 ssh_host_rsa_key.pub