docker-production

Docker Production — 生产环境部署

Guidance for deploying and managing Docker in production.

When to Use

ALWAYS use this skill when the user mentions:

• "生产部署", "production Docker"
• "docker swarm", "docker stack", "swarm cluster"
• "Kubernetes migration", "kompose", "K8s"
• "零停机部署", "rolling update"
• "容器监控", "监控", "Prometheus"

Docker Swarm Quick Start

# Initialize cluster
docker swarm init --advertise-addr <MANAGER-IP>

# Join workers (run on worker nodes)
docker swarm join --token <TOKEN> <MANAGER-IP>:2377

# Deploy a stack
docker stack deploy -c docker-compose.yml myapp

# Manage services
docker service ls
docker service scale myapp_web=5
docker service update --image myapp:v2 myapp_web
docker service logs -f myapp_web

Swarm Compose Example

version: '3.8'
services:
  web:
    image: myapp:${TAG:-latest}
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
      rollback_config:
        parallelism: 1
        delay: 10s
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    ports:
      - "80:8080"

Zero-Downtime Deployment

Rolling Update Flow:

┌──────┐  ┌──────┐  ┌──────┐     Old replicas (v1)
│ v1  │  │ v1  │  │ v1  │
└──────┘  └──────┘  └──────┘

docker service update --image myapp:v2 web

Step 1: Start v2
┌──────┐  ┌──────┐  ┌──────┐  ┌──────┐
│ v1  │  │ v1  │  │ v1  │  │ v2  │    ← 1 new
└──────┘  └──────┘  └──────┘  └──────┘

Step 2: Replace one v1 with v2
┌──────┐  ┌──────┐  ┌──────┐  ┌──────┐
│ v1  │  │ v1  │  │ v2  │  │ v2  │    ← 2 new
└──────┘  └──────┘  └──────┘  └──────┘

... until all v2

Kubernetes Migration

# Convert compose to K8s
kompose convert -f docker-compose.yml

# Output:
# web-deployment.yaml
# web-service.yaml
# ...

# Apply
kubectl apply -f .

Compose	K8s
services	Deployments + Services
networks	Network Policies
volumes	PersistentVolumeClaims
deploy.replicas	Deployment.spec.replicas
secrets	Secrets

Monitoring Stack

cAdvisor + Prometheus + Grafana

# docker-compose.monitoring.yml
services:
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    ports: ["8080:8080"]
    volumes:
      - /:/rootfs:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /sys:/sys:ro

  prometheus:
    image: prom/prometheus:latest
    ports: ["9090:9090"]
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml

  grafana:
    image: grafana/grafana:latest
    ports: ["3000:3000"]

Workflow — 推荐部署流程

Step 1: 单机部署: compose.yml + restart: unless-stopped + systemd 守护 Step 2: Swarm 集群: docker swarm init → docker stack deploy -c compose.yml myapp Step 3: 滚动更新: docker service update --image myapp:v2 + health check + rollback Step 4: 监控接入: Prometheus + cAdvisor + Grafana 绑定额仪表盘 Step 5: K8s 迁移: kompose convert → 手动添加资源限制+健康检查 → Helm Chart

Gotchas — Common Pitfalls

• Single Swarm manager: If the only manager goes down, the cluster is unresponsive. → Recovery: Use 3 or 5 managers; docker node promote <worker> to add manager; back up /var/lib/docker/swarm/ regularly.
• Rolling update health check: Without health checks, updates may deploy broken containers. → Recovery: Define HEALTHCHECK in Dockerfile + service health check; use --update-failure-action rollback.
• Data without volumes: Production databases MUST use volumes. Container restart = new filesystem without volumes. → Recovery: docker service create --mount type=volume,src=db_data,target=/var/lib/mysql.
• Direct K8s migration: kompose is a starting point, not production-ready K8s configs. → Recovery: After kompose convert, manually add resource limits, health checks, init containers, and ConfigMap/Secret references.

Boundary — 能力边界（适用与不适用场景）

分类	场景	说明
✅ 能做	单机 Compose 生产部署	compose.yml + systemd 守护
✅ 能做	Swarm 集群管理	init/join/stack deploy/rolling update
✅ 能做	K8s 迁移方案	kompose + 手动调整 + Helm Chart
✅ 能做	生产监控搭建	Prometheus + cAdvisor + Grafana + Loki
⚠️ 需条件	多数据中心 Swarm	需 overlay 网络 + 低延迟连接
⚠️ 需条件	零停机迁移 K8s	需蓝绿/金丝雀发布策略
❌ 超范围	应用代码部署	各语言 CI/CD 管道
❌ 超范围	K8s 集群搭建	使用 K8s 官方文档
❌ 超范围	数据库高可用	DBA 专业领域 + 数据库原生方案

When NOT to Use

❌ Skip	✅ Use Instead
Development/debugging	docker-run
Single-container apps	docker-run + systemd
K8s-native from start	Skip Swarm, use K8s directly
Docker basics	docker-basics

Security & Stability

• Rotate Swarm join tokens regularly. Leaked worker tokens allow unauthorized node joining.
• Use Docker Secrets for all sensitive configuration in production stacks.
• Enable TLS for Docker daemon in production (tlsverify mode).
• Implement resource limits on all production services to prevent noisy-neighbor issues.
• Back up Swarm raft data regularly: /var/lib/docker/swarm/.
• Monitor node health and set up alerts for node failures.

📚 官方文档参考

文档	地址
Docker Swarm	https://docs.docker.com/engine/swarm/
Docker Stack	https://docs.docker.com/engine/swarm/stack-deploy/
管理指南	https://docs.docker.com/admin/
生产环境 Compose	https://docs.docker.com/compose/production/
安全部署	https://docs.docker.com/engine/security/
Docker 引擎	https://docs.docker.com/engine/

🧭 Docker Skills Journey

📍 You are here: docker-production — 生产部署

← Previous: docker-cicd | → Next: docker-troubleshooting

FAQ

Q1: 如何快速上手此技能？ A: 参考上方的快速开始章节，按步骤操作即可。

Q2: 遇到版本不兼容问题怎么办？ A: 检查依赖版本，使用 lock 文件锁定，参考常见陷阱章节。

Q3: 如何在生产环境使用？ A: 参考最佳实践章节，确保配置正确，做好监控和日志。

Q4: 性能如何优化？ A: 参考性能优化相关文档，使用缓存、索引等手段。

Q5: 如何贡献或反馈问题？ A: 在 GitHub 仓库提交 Issue 或 Pull Request。

Q6: 是否支持中文？ A: 支持中文文档和中文注释，详见国内适配章节。