CentOS7下Docker与数据库服务部署优化指南

1. CentOS7环境下的Docker与数据库服务部署全景指南在Linux服务器环境部署中CentOS 7依然是当前企业级应用的主流选择。最近在为客户部署一套新的微服务架构时我再次验证了DockerRedisPostgreSQL这个黄金组合的可靠性。不同于简单的安装教程本文将分享我在生产环境中反复验证过的完整方案包括性能调优参数和安全加固措施。2. 基础环境准备与调优2.1 系统初始化配置在全新安装的CentOS 7.9最小化系统上首先执行以下基础优化# 关闭SELinux生产环境需根据安全要求调整 sed -i s/SELINUXenforcing/SELINUXdisabled/g /etc/selinux/config setenforce 0 # 配置阿里云yum源解决官方源速度慢的问题 mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo yum clean all yum makecache # 安装基础工具集 yum install -y vim wget net-tools lsof telnet tree htop nc关键提示对于生产环境建议保留SELinux但配置适当策略可使用semanage命令为Docker容器添加自定义策略。2.2 内核参数调优针对数据库应用场景需要调整以下内核参数cat /etc/sysctl.d/99-sysctl.conf EOF # 提升TCP连接性能 net.ipv4.tcp_max_syn_backlog 8192 net.core.somaxconn 8192 # 内存与swap优化 vm.swappiness 10 vm.overcommit_memory 1 # 文件系统优化 fs.file-max 65535 fs.inotify.max_user_watches 524288 # 容器专用参数 user.max_user_namespaces 28633 EOF sysctl -p /etc/sysctl.d/99-sysctl.conf3. Docker引擎部署与优化3.1 最新版Docker-CE安装官方推荐的方式是通过仓库安装# 安装依赖 yum install -y yum-utils device-mapper-persistent-data lvm2 # 添加Docker官方仓库国内可使用阿里云镜像 yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo # 查看可用版本 yum list docker-ce --showduplicates | sort -r # 安装指定版本推荐19.03.15 yum install -y docker-ce-19.03.15 docker-ce-cli-19.03.15 containerd.io3.2 生产环境配置模板修改/etc/docker/daemon.json配置文件{ exec-opts: [native.cgroupdriversystemd], log-driver: json-file, log-opts: { max-size: 100m, max-file: 3 }, storage-driver: overlay2, storage-opts: [ overlay2.override_kernel_checktrue ], registry-mirrors: [ https://registry.docker-cn.com, https://docker.mirrors.ustc.edu.cn ], live-restore: true, oom-score-adjust: -500, max-concurrent-downloads: 10, max-concurrent-uploads: 5, bip: 172.17.0.1/16, data-root: /data/docker }启动并验证systemctl enable docker --now docker info | grep -E Storage Driver|Cgroup Driver|Registry Mirrors避坑指南如果遇到overlay2存储驱动问题可添加storage-opts: [overlay2.override_kernel_checktrue]参数。对于磁盘I/O敏感型应用建议单独挂载SSD作为># 创建数据目录和配置文件 mkdir -p /data/redis/{data,conf} cat /data/redis/conf/redis.conf EOF bind 0.0.0.0 port 6379 daemonize no pidfile /var/run/redis.pid logfile databases 16 save 900 1 save 300 10 save 60 10000 maxmemory 2gb maxmemory-policy allkeys-lru appendonly yes appendfilename appendonly.aof appendfsync everysec no-appendfsync-on-rewrite no auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb slowlog-log-slower-than 10000 slowlog-max-len 128 EOF # 启动容器带资源限制 docker run -d --name redis-server \ --restart always \ --memory 4g --memory-swap 4g \ --cpus 2 \ --ulimit nofile65535:65535 \ -p 6379:6379 \ -v /data/redis/data:/data \ -v /data/redis/conf/redis.conf:/usr/local/etc/redis/redis.conf \ redis:6.2.7-alpine \ redis-server /usr/local/etc/redis/redis.conf4.2 性能测试与调优使用redis-benchmark进行压力测试docker exec -it redis-server redis-benchmark \ -h 127.0.0.1 \ -p 6379 \ -c 50 \ -n 100000 \ -q \ -t set,get根据测试结果调整以下参数tcp-backlog网络连接队列长度repl-backlog-size复制积压缓冲区大小client-output-buffer-limit客户端输出缓冲区限制5. PostgreSQL容器化部署方案5.1 生产级配置模板# 准备目录结构 mkdir -p /data/pgsql/{data,conf,backup} chown -R 70:70 /data/pgsql # 自定义配置文件 cat /data/pgsql/conf/postgresql.conf EOF listen_addresses * max_connections 200 shared_buffers 1GB effective_cache_size 3GB work_mem 16MB maintenance_work_mem 256MB wal_level replica synchronous_commit off wal_buffers 16MB checkpoint_timeout 15min checkpoint_completion_target 0.9 random_page_cost 1.1 effective_io_concurrency 200 log_statement none log_duration off log_lock_waits on log_min_duration_statement 1000 EOF # 启动容器 docker run -d --name postgres-server \ --restart always \ --memory 8g --memory-swap 8g \ --cpus 4 \ --shm-size 1g \ -e POSTGRES_PASSWORDComplexPssw0rd \ -e PGDATA/var/lib/postgresql/data/pgdata \ -p 5432:5432 \ -v /data/pgsql/data:/var/lib/postgresql/data \ -v /data/pgsql/conf:/etc/postgresql \ -v /data/pgsql/backup:/backup \ postgres:13.4-alpine \ -c config_file/etc/postgresql/postgresql.conf5.2 关键维护操作数据库备份策略# 每日全量备份 docker exec postgres-server pg_dumpall -U postgres | gzip /data/pgsql/backup/full_$(date %Y%m%d).sql.gz # 保留最近7天备份 find /data/pgsql/backup -name *.sql.gz -mtime 7 -exec rm -f {} \;性能监控命令# 查看活跃连接 docker exec postgres-server psql -U postgres -c SELECT datname,usename,client_addr,state FROM pg_stat_activity; # 查看锁等待 docker exec postgres-server psql -U postgres -c SELECT blocked_locks.pid AS blocked_pid, blocking_locks.pid AS blocking_pid FROM pg_catalog.pg_locks blocked_locks JOIN pg_catalog.pg_locks blocking_locks ON blocking_locks.locktype blocked_locks.locktype AND blocking_locks.DATABASE IS NOT DISTINCT FROM blocked_locks.DATABASE AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid AND blocking_locks.pid ! blocked_locks.pid JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid blocking_locks.pid WHERE NOT blocked_locks.GRANTED;6. 服务集成与安全加固6.1 容器网络隔离方案创建自定义网络实现服务隔离docker network create --driver bridge --subnet 172.28.0.0/16 --gateway 172.28.0.1 backend-net # 重新启动服务时加入网络 docker run ... --network backend-net ...6.2 防火墙规则配置# 仅开放必要端口 firewall-cmd --permanent --new-zonedocker-services firewall-cmd --permanent --zonedocker-services --add-source172.17.0.0/16 firewall-cmd --permanent --zonedocker-services --add-port5432/tcp firewall-cmd --permanent --zonedocker-services --add-port6379/tcp firewall-cmd --permanent --zonepublic --add-port80/tcp firewall-cmd --permanent --zonepublic --add-port443/tcp firewall-cmd --reload6.3 日志收集方案配置统一的日志收集策略# 修改daemon.json添加日志配置 { log-driver: syslog, log-opts: { syslog-address: udp://192.168.1.100:514, tag: {{.Name}} } }7. 运维监控体系搭建7.1 容器资源监控安装cAdvisorPrometheusGrafana组合# 启动cAdvisor docker run \ --volume/:/rootfs:ro \ --volume/var/run:/var/run:ro \ --volume/sys:/sys:ro \ --volume/var/lib/docker/:/var/lib/docker:ro \ --volume/dev/disk/:/dev/disk:ro \ --publish8080:8080 \ --detachtrue \ --namecadvisor \ --privileged \ --device/dev/kmsg \ gcr.io/cadvisor/cadvisor:v0.47.07.2 数据库监控方案对于PostgreSQL推荐使用pgMonitor套件docker run -d --name pgmonitor \ -e DATA_SOURCE_NAMEpostgresql://postgres:ComplexPssw0rdpostgres-server:5432/postgres?sslmodedisable \ -p 9187:9187 \ prometheuscommunity/postgres-exporterRedis监控则可以使用redis_exporterdocker run -d --name redis-exporter \ -e REDIS_ADDRredis://redis-server:6379 \ -p 9121:9121 \ oliver006/redis_exporter8. 故障排查手册8.1 Docker常见问题问题1容器启动失败提示端口冲突解决方案# 查看端口占用 ss -tulnp | grep 5432 # 解决方案1停止占用进程 systemctl stop [service] # 解决方案2修改容器映射端口 docker run -p 5433:5432 ...问题2存储驱动导致的性能问题诊断命令docker info | grep -i storage dmesg | grep -i overlay8.2 Redis性能问题问题响应延迟高排查步骤检查慢查询日志docker exec redis-server redis-cli slowlog get 10检查内存使用docker exec redis-server redis-cli info memory检查持久化阻塞docker exec redis-server redis-cli info persistence8.3 PostgreSQL连接问题问题连接数耗尽紧急处理# 释放空闲连接 docker exec postgres-server psql -U postgres -c SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE state idle; # 修改最大连接数 docker exec postgres-server sed -i s/max_connections 100/max_connections 200/ /etc/postgresql/postgresql.conf docker restart postgres-server长期解决方案配置连接池如PgBouncer优化应用连接管理9. 版本升级策略9.1 Docker版本升级# 查看当前版本 docker version # 升级步骤 yum remove docker-ce docker-ce-cli containerd.io yum install docker-ce-20.10.12 docker-ce-cli-20.10.12 containerd.io # 验证升级 docker run hello-world9.2 数据库升级方案PostgreSQL大版本升级步骤# 创建备份 docker exec postgres-server pg_dumpall -U postgres /backup/full_backup.sql # 启动新版本容器 docker run --name postgres13 \ -e POSTGRES_PASSWORDComplexPssw0rd \ -v /data/pgsql13/data:/var/lib/postgresql/data \ -p 5433:5432 \ postgres:13.4-alpine # 导入数据 cat /backup/full_backup.sql | docker exec -i postgres13 psql -U postgresRedis升级相对简单只需更新镜像版本并重启容器即可但要注意确保AOF/RDB文件兼容性在低峰期执行先在新环境测试10. 生产环境检查清单在交付生产环境前请逐一验证以下项目[ ] 所有容器配置了资源限制CPU/内存[ ] 数据卷已正确挂载且权限合适[ ] 防火墙规则已按最小权限配置[ ] 备份策略已实施并测试恢复流程[ ] 监控系统已对接并产生有效指标[ ] 日志收集系统正常工作[ ] 所有服务配置了适当的重启策略[ ] 敏感信息如密码已从配置文件中移除[ ] 进行了压力测试并记录基准性能指标[ ] 制定了回滚方案和应急预案这套方案已经在多个生产环境稳定运行超过两年期间经历了多次流量高峰的考验。特别是在配置PostgreSQL的WAL日志和Redis的AOF持久化时需要特别注意IO性能的影响。建议在正式上线前使用类似sysbench的工具进行充分的基准测试记录不同配置参数下的性能表现最终选择最适合你硬件配置的方案。