用語集

Compose is a tool for defining and running complex applications with Docker. With Compose, you define a multi-container application in a single file, then spin your application up in a single command which does everything that needs to be done to get it running.

Also known as Docker Compose

The term Docker can refer to

• The Docker project as a whole, which is a platform for developers and sysadmins to develop, ship, and run applications
• The docker daemon process running on the host which manages images and containers (also called Docker Engine)

Docker Desktop is an easy-to-install, lightweight Docker development environment. Docker Desktop is available for Mac, Windows, and Linux, providing developers a consistent experience across platforms. Docker Desktop includes Docker Engine, Docker CLI client, Docker Compose, Docker Content Trust, Kubernetes, and Credential Helper.

Docker Desktop works with your choice of development tools and languages and gives you access to a vast library of certified images and templates in Docker Hub. This enables development teams to extend their environment to rapidly auto-build, continuously integrate, and collaborate using a secure repository.

Docker Hub is a centralized resource for working with Docker and its components. It provides the following services:

• A registry to host Docker images
• User authentication
• Automated image builds and workflow tools such as build triggers and web hooks
• Integration with GitHub and Bitbucket
• Security vulnerability scanning

In a Dockerfile, an ENTRYPOINT is an optional definition for the first part of the command to be run. If you want your Dockerfile to be runnable without specifying additional arguments to the docker run command, you must specify either ENTRYPOINT, CMD, or both.

• If ENTRYPOINT is specified, it is set to a single command. Most official Docker images have an ENTRYPOINT of /bin/sh or /bin/bash. Even if you do not specify ENTRYPOINT, you may inherit it from the base image that you specify using the FROM keyword in your Dockerfile. To override the ENTRYPOINT at runtime, you can use --entrypoint. The following example overrides the entrypoint to be /bin/ls and sets the CMD to -l /tmp.

  $ docker run --entrypoint=/bin/ls ubuntu -l /tmp

• CMD is appended to the ENTRYPOINT. The CMD can be any arbitrary string that is valid in terms of the ENTRYPOINT, which allows you to pass multiple commands or flags at once. To override the CMD at runtime, just add it after the container name or ID. In the following example, the CMD is overridden to be /bin/ls -l /tmp.

  $ docker run ubuntu /bin/ls -l /tmp

In practice, ENTRYPOINT is not often overridden. However, specifying the ENTRYPOINT can make your images more flexible and easier to reuse.

Union file systems implement a union mount and operate by creating layers. Docker uses union file systems in conjunction with copy-on-write techniques to provide the building blocks for containers, making them very lightweight and fast.

For more on Docker and union file systems, see Docker and OverlayFS in practice.

Example implementations of union file systems are UnionFS and OverlayFS.

cgroups is a Linux kernel feature that limits, accounts for, and isolates the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of processes. Docker relies on cgroups to control and isolate resource limits.

Also known as control groups

A container is a runtime instance of a docker image.

A Docker container consists of

• A Docker image
• An execution environment
• A standard set of instructions

The concept is borrowed from shipping containers, which define a standard to ship goods globally. Docker defines a standard to ship software.

Docker uses a copy-on-write technique and a union file system for both images and containers to optimize resources and speed performance. Multiple copies of an entity share the same instance and each one makes only specific changes to its unique layer.

Multiple containers can share access to the same image, and make container-specific changes on a writable layer which is deleted when the container is removed. This speeds up container start times and performance.

Images are essentially layers of filesystems typically predicated on a base image under a writable layer, and built up with layers of differences from the base image. This minimizes the footprint of the image and enables shared development.

For more about copy-on-write in the context of Docker, see Understand images, containers, and storage drivers.

A file system is the method an operating system uses to name files and assign them locations for efficient storage and retrieval.

Examples :

• Linux : overlay2, extfs, btrfs, zfs
• Windows : NTFS
• macOS : APFS

A node is a physical or virtual machine running an instance of the Docker Engine in swarm mode.

Manager nodes perform swarm management and orchestration duties. By default manager nodes are also worker nodes.

Worker nodes execute tasks.

A Registry is a hosted service containing repositories of images which responds to the Registry API.

The default registry can be accessed using a browser at Docker Hub or using the docker search command.

A repository is a set of Docker images. A repository can be shared by pushing it to a registry server. The different images in the repository can be labeled using tags.

Here is an example of the shared nginx repository and its tags.

A service is the definition of how you want to run your application containers in a swarm. At the most basic level, a service defines which container image to run in the swarm and which commands to run in the container. For orchestration purposes, the service defines the "desired state", meaning how many containers to run as tasks and constraints for deploying the containers.

Frequently a service is a microservice within the context of some larger application. Examples of services might include an HTTP server, a database, or any other type of executable program that you wish to run in a distributed environment.

Swarm mode container discovery is a DNS component internal to the swarm that automatically assigns each service on an overlay network in the swarm a VIP and DNS entry. Containers on the network share DNS mappings for the service through gossip so any container on the network can access the service through its service name.

You don’t need to expose service-specific ports to make the service available to other services on the same overlay network. The swarm’s internal load balancer automatically distributes requests to the service VIP among the active tasks.

A virtual machine is a program that emulates a complete computer and imitates dedicated hardware. It shares physical hardware resources with other users but isolates the operating system. The end user has the same experience on a Virtual Machine as they would have on dedicated hardware.

Compared to containers, a virtual machine is heavier to run, provides more isolation, gets its own set of resources and does minimal sharing.

Also known as VM

A volume is a specially-designated directory within one or more containers that bypasses the Union File System. Volumes are designed to persist data, independent of the container's life cycle. Docker therefore never automatically deletes volumes when you remove a container, nor will it "garbage collect" volumes that are no longer referenced by a container. Also known as: data volume

There are three types of volumes: host, anonymous, and named:

• A host volume lives on the Docker host's filesystem and can be accessed from within the container.

• A named volume is a volume which Docker manages where on disk the volume is created, but it is given a name.

• An anonymous volume is similar to a named volume, however, it can be difficult to refer to the same volume over time when it is an anonymous volume. Docker handles where the files are stored.