chr*_*win 5 redis docker-compose docker-swarm
有没有办法使用 Docker 机密从 /run/secrets/redis-pass 读取并设置 redis --requirepass 标志？
例如：
在 swarm manager 上设置redis-pass，然后使用docker stack deploy -c docker-compose-prod.yml appname
这是我的 docker-compose.yml 文件中正在运行的 redis 服务。
redis:
build: ./redis
image: redis:3.2.9
volumes:
- ./redis/db/:/data/
# Without persistance
command: sh -c "redis-server --requirepass XXXXXXXXXX"
# With persistance (saves to /data), ref: https://redis.io/topics/persistence
# command: sh -c "redis-server --requirepass XXXXXXXXXX --appendonly yes"
expose:
- "6379"
以下是使用 Docker 群堆栈的建议 docker-compose.yml 片段。
version: '3.1'
secrets:
redis-pass:
external: true
redis:
build: ./redis
image: redis:3.2.9
networks:
- frontend
ports:
- "6379"
deploy:
replicas: 2
update_config:
parallelism: 2
delay: 10s
restart_policy:
condition: on-failure
secrets:
- redis-pass
environment:
REDIS_PASS_FILE: /run/secrets/redis-pass
你可以这样做
services: redis:
image: redis
secrets:
- redis_pass
environment:
REDIS_PASS_FILE: /run/secrets/redis_pass
command: [
"bash", "-c",
'
docker-entrypoint.sh
--requirepass "$$(cat $$REDIS_PASS_FILE)"
'
]
就像这里建议的那样：
通过遵循 Docker文档并使用入口点脚本解决了这个问题。
\n\n这是一种方法。
\n\n在您的本地开发机器上。
\n\n创建一个机密文件，确保添加 .gitignore 条目，以免将机密提交到您的存储库。
\n\n./secrets/redis-pass.txt
\n\ng7VacrULudmwcLnxy23JWyUNZRit7cazG2JekTCc6vccxX2LxLWoHFP8XYLbD4U9
在您的集群领导节点上。
\n\necho "g7VacrULudmwcLnxy23JWyUNZRit7cazG2JekTCc6vccxX2LxLWoHFP8XYLbD4U9" | docker secret create redis-pass -
./redis/redis.conf
\n\n定义 requirepass 属性。
\n\nrequirepass XXXXXXXXXX
在构建时将配置复制到容器中。
\n\n./redis/Dockerfile
\n\nFROM alpine:3.6\n\n# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added\nRUN addgroup -S redis && adduser -S -G redis redis\n\n# grab su-exec for easy step-down from root\nRUN apk add --no-cache \'su-exec>=0.2\'\n\nENV REDIS_VERSION 3.2.9\nENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-3.2.9.tar.gz\nENV REDIS_DOWNLOAD_SHA 6eaacfa983b287e440d0839ead20c2231749d5d6b78bbe0e0ffa3a890c59ff26\n\n# for redis-sentinel see: http://redis.io/topics/sentinel\nRUN set -ex; \\\n \\\n apk add --no-cache --virtual .build-deps \\\n coreutils \\\n gcc \\\n linux-headers \\\n make \\\n musl-dev \\\n ; \\\n \\\n wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \\\n echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \\\n mkdir -p /usr/src/redis; \\\n tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \\\n rm redis.tar.gz; \\\n \\\n# Disable Redis protected mode [1] as it is unnecessary in context\n# of Docker. Ports are not automatically exposed when running inside\n# Docker, but rather explicitely by specifying -p / -P.\n# [1] https://github.com/antirez/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da\n grep -q \'^#define CONFIG_DEFAULT_PROTECTED_MODE 1$\' /usr/src/redis/src/server.h; \\\n sed -ri \'s!^(#define CONFIG_DEFAULT_PROTECTED_MODE) 1$!\\1 0!\' /usr/src/redis/src/server.h; \\\n grep -q \'^#define CONFIG_DEFAULT_PROTECTED_MODE 0$\' /usr/src/redis/src/server.h; \\\n# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything"\n# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840\n# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default)\n \\\n make -C /usr/src/redis -j "$(nproc)"; \\\n make -C /usr/src/redis install; \\\n \\\n rm -r /usr/src/redis; \\\n \\\n apk del .build-deps\n\nRUN mkdir /data && chown redis:redis /data\nVOLUME /data\nWORKDIR /data\n\nCOPY redis.conf /home/redis/\nCOPY docker-entrypoint.sh /usr/local/bin/\nENTRYPOINT ["docker-entrypoint.sh"]\n\n# EXPOSE 6379\n# CMD ["redis-server"]\n./redis/docker-entrypoint.sh
\n\nsed 命令将使用 /run/secrets/redis-pass 中的 redis-pass 密钥中的密码替换 redis.conf 文件中的 requirepass 属性的值。
\n\n#!/bin/sh\nset -e\n\n# Updated password using sed\nsed -i "s/requirepass XXXXXXXXXX/requirepass `cat /run/secrets/redis_password`/" /home/redis/redis.conf\n\n# first arg is `-f` or `--some-option`\n# or first arg is `something.conf`\nif [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then\n set -- redis-server "$@"\nfi\n\n# allow the container to be started with `--user`\nif [ "$1" = \'redis-server\' -a "$(id -u)" = \'0\' ]; then\n chown -R redis .\n exec su-exec redis "$0" "$@"\nfi\n\nexec "$@"\n./docker-compose.yml
\n\n定义 3.1 的 compose 版本
\n\nversion: "3.1"\n定义秘密
\n\nsecrets:\n redis-pass:\n # local dev machine\n #file: ./secrets/redis-pass.txt\n # production environment\n external: true\n定义redis服务。
\n\n redis:\n build: ./redis\n image: redis:3.2.9\n command: sh -c \'redis-server /home/redis/redis.conf\'\n expose:\n - "6379"\n # networks:\n # - frontend\n deploy:\n replicas: 2\n update_config:\n parallelism: 2\n delay: 10s\n restart_policy:\n condition: on-failure\n secrets:\n - redis-pass\n tty: true \n\xe2\x9e\x9c blah git:(master) \xe2\x9c\x97 docker-compose exec redis sh\n/data # ps -ef\nPID USER TIME COMMAND\n 1 root 0:00 sh -c redis-server /home/redis/redis.conf\n 10 root 0:03 redis-server /home/redis/redis.conf\n 28 root 0:00 sh\n 34 root 0:00 ps -ef\n/data # cat /home/redis/redis.conf\nrequirepass g7VacrULudmwcLnxy23JWyUNZRit7cazG2JekTCc6vccxX2LxLWoHFP8XYLbD4U9\n/data #\n享受！
\n| 归档时间： |
|
| 查看次数： |
5676 次 |
| 最近记录： |