docker相关配置

一、概述：

　　1、centos7下，默认firewalld为防火墙， systemctl status firewalld.service

　　2、关闭firewalld， systemctl stop firewalld.service && setenforce 0

　　3、安装iptables， yum install iptables-services #安装

　　　　systemctl restart iptables.service #最后重启防火墙使配置生效

　　　　systemctl enable iptables.service #设置防火墙开机启动 

　Docker配置文件：/etc/sysconfig/docker

　主要参数解释：

1. -H 表示Docker Daemon绑定的地址， -H=unix:///var/run/docker.sock 或者-H=tcp://0.0.0.0:2375
2. --registry-mirror表示Docker Registry的镜像地址， --registry-mirror=http://xxxx
3. --insecure-registry表示（本地）私用Docker Registry的地址， --insecure-registry ${privateRegistryHost}:5000
4. --selinux-enabled是否开始SELinux，默认开启 --selinux-enabled=true; 开启SELinux
5. --bip表示网桥docker0使用指定的CIDR网络地址， --bip=172.17.42.1
6. -b 表示采用已经创建好的网桥， -b=xxx

      下面是代理的设置：

　　http_proxy=xxxx:8080

　　https_proxy=xxxx:8080

  Docker配置文件（Centos 7）

cat /usr/lib/systemd/system/docker.service

[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network.target

[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd
ExecReload=/bin/kill -s HUP $MAINPID
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
Environment="HTTP_PROXY=http://USRNAME:PASSWD@HOST:PORT/"
Environment="HTTPS_PROXY=http://USRENAME:PASSWD@HOST:PORT/"
# Uncomment TasksMax if your systemd version supports it.
# Only systemd 226 and above support this version.
#TasksMax=infinity
TimeoutStartSec=0
# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes
# kill only the docker process, not all processes in the cgroup
KillMode=process

[Install]
WantedBy=multi-user.target