docker-swarm

Docker Swarm 技能

掌握 Docker Swarm，进行容器编排、集群管理和生产部署。

用途

设置和管理 Docker Swarm 集群，以实现高可用性、服务扩缩容和生产环境编排。

参数

参数	类型	必填	默认值	描述
managers	number	否	3	管理器节点数量
workers	number	否	-	工作节点数量
encrypted	boolean	否	true	加密覆盖网络

集群设置

初始化 Swarm

# Initialize on first manager
docker swarm init --advertise-addr <MANAGER_IP>

# Get join tokens
docker swarm join-token worker
docker swarm join-token manager

# Join as worker
docker swarm join --token <WORKER_TOKEN> <MANAGER_IP>:2377

# Join as manager
docker swarm join --token <MANAGER_TOKEN> <MANAGER_IP>:2377

高可用性（3 或 5 个管理器）

# Manager quorum: N/2 + 1
# 3 managers = tolerates 1 failure
# 5 managers = tolerates 2 failures

服务部署

基本服务

# Create service
docker service create \
  --name webapp \
  --replicas 3 \
  --publish 80:80 \
  nginx:alpine

# Scale
docker service scale webapp=5

# Update image
docker service update --image nginx:1.25-alpine webapp

# Rollback
docker service rollback webapp

完整服务配置

docker service create \
  --name api \
  --replicas 3 \
  --network backend \
  --publish 8080:3000 \
  --mount type=volume,source=data,target=/data \
  --secret db_password \
  --env NODE_ENV=production \
  --limit-cpu 0.5 \
  --limit-memory 512M \
  --update-delay 10s \
  --update-parallelism 1 \
  --update-failure-action rollback \
  --health-cmd "curl -f http://localhost:3000/health" \
  --health-interval 30s \
  myapp:latest

堆栈部署

生产环境堆栈

# stack.yaml
services:
  frontend:
    image: frontend:${VERSION:-latest}
    deploy:
      replicas: 3
      placement:
        constraints:
          - node.role == worker
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
    ports:
      - "80:80"
    networks:
      - frontend
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 30s

  backend:
    image: backend:${VERSION:-latest}
    deploy:
      replicas: 3
    secrets:
      - db_password
    networks:
      - frontend
      - backend

networks:
  frontend:
    driver: overlay
  backend:
    driver: overlay
    internal: true

secrets:
  db_password:
    external: true

# Deploy stack
docker stack deploy -c stack.yaml myapp

# List services
docker stack services myapp

# Remove stack
docker stack rm myapp

密钥和配置

密钥

# Create secret
echo "password" | docker secret create db_password -

# Use in service
docker service update --secret-add db_password myservice

# Rotate secret
echo "newpassword" | docker secret create db_password_v2 -
docker service update \
  --secret-rm db_password \
  --secret-add source=db_password_v2,target=db_password \
  myservice

配置

# Create config
docker config create nginx_config ./nginx.conf

# Use in service
docker service create \
  --config source=nginx_config,target=/etc/nginx/nginx.conf \
  nginx

节点管理

# List nodes
docker node ls

# Drain node (maintenance)
docker node update --availability drain <node>

# Activate node
docker node update --availability active <node>

# Add label
docker node update --label-add role=database <node>

# Promote to manager
docker node promote <node>

# Demote from manager
docker node demote <node>

错误处理

常见错误

错误	原因	解决方案
no suitable node	不满足约束条件	放宽条件或添加节点
not converging	健康检查失败	检查服务日志
Raft: no leader	仲裁丢失	恢复管理器

管理器恢复

# If quorum lost, force new cluster
docker swarm init --force-new-cluster --advertise-addr <IP>

故障排除

调试清单

• Swarm 是否处于活动状态？docker info | grep Swarm
• 节点是否健康？docker node ls
• 服务是否正在运行？docker service ls
• 是否已放置任务？docker service ps <svc>

诊断

# Service status
docker service ls

# Task status
docker service ps <service> --no-trunc

# Service logs
docker service logs -f <service>

# Node issues
docker node inspect <node> --pretty

用法

Skill("docker-swarm")

资源

• assets/swarm-stack.yaml - 堆栈模板
• scripts/swarm-init.sh - 初始化脚本

相关技能

• docker-networking
• docker-security
• docker-production