术语表

TermDefinition
Compose

Compose 是一个用于定义和运行复杂Docker应用程序的工具。使用Compose，您可以在一个文件中定义一个多容器应用程序，然后通过一个命令启动您的应用程序，该命令会完成所有需要完成的工作以使其运行。

也被称为 Docker Compose

Docker

术语 Docker 可以指

  • Docker项目作为一个整体，是一个供开发人员和系统管理员开发、交付和运行应用程序的平台
  • 在主机上运行的docker守护进程，用于管理镜像和容器（也称为Docker Engine）
Docker BusinessDocker Business is a Docker subscription. Docker Business offers centralized management and advanced security features for enterprises that use Docker at scale. It empowers leaders to manage their Docker development environments and accelerate their secure software supply chain initiatives.
Docker Desktop

Docker Desktop 是一个易于安装、轻量级的 Docker 开发环境。Docker Desktop 适用于 Mac、 Windows 和 Linux，为开发者提供跨平台的一致体验。Docker Desktop 包括 Docker Engine、Docker CLI 客户端、Docker Compose、Docker Content Trust、Kubernetes 和 Credential Helper。

Docker Desktop 可以与您选择的开发工具和语言配合使用，并让您访问 Docker Hub 中大量的认证镜像和模板库。这使得开发团队能够扩展他们的环境，以快速自动构建、持续集成，并使用安全的仓库进行协作。

Docker Desktop for LinuxDocker Desktop for Linux is an easy-to-install, lightweight Docker development environment designed specifically for Linux machines. It's the best solution if you want to build, debug, test, package, and ship Dockerized applications on a Linux machine.
Docker Desktop for MacDocker Desktop for Mac is an easy-to-install, lightweight Docker development environment designed specifically for the Mac. A native Mac application, Docker Desktop for Mac uses the macOS Hypervisor framework, networking, and filesystem. It's the best solution if you want to build, debug, test, package, and ship Dockerized applications on a Mac.
Docker Desktop for WindowsDocker Desktop for Windows is an easy-to-install, lightweight Docker development environment designed specifically for Windows systems that support WSL 2 and Microsoft Hyper-V. Docker Desktop for Windows uses WSL 2 or Hyper-V for virtualization. Docker Desktop for Windows is the best solution if you want to build, debug, test, package, and ship Dockerized applications from Windows machines.
Docker Hub

Docker Hub 是一个集中资源，用于处理 Docker 及其组件。它提供以下服务：

  • 一个用于托管Docker镜像的注册表
  • 用户认证
  • 自动化的镜像构建和工作流工具，如构建触发器和web钩子
  • 与GitHub和Bitbucket的集成
  • 安全漏洞扫描
Docker IDYour free Docker ID grants you access to Docker Hub repositories and some beta programs. All you need is an email address.
Docker Official ImagesThe Docker Official Images are a curated set of Docker repositories hosted on Docker Hub. Docker, Inc. sponsors a dedicated team that is responsible for reviewing and publishing all content in the Docker Official Images. This team works in collaboration with upstream software maintainers, security experts, and the broader Docker community.
Docker Open Source ImagesDocker Open Source Images are published and maintained by organizations that are a member of the Docker Open Source Program.
Docker PersonalDocker Personal is a Docker 订阅. With its focus on the open-source communities, individual developers, education, and small businesses, Docker Personal will continue to allow free use of Docker components - including the Docker CLI, Docker Compose, Docker Engine, Docker Desktop, Docker Hub, Kubernetes, Docker Build and Docker BuildKit, Docker Official Images, Docker Scan, and more.
Docker ProDocker Pro is a Docker 订阅. Docker Pro enables individual developers to get more control of their development environment and provides an integrated and reliable developer experience. It reduces the amount of time developers spend on mundane and repetitive tasks and empowers developers to spend more time creating value for their customers.
Docker TeamDocker Team is a Docker 订阅. Docker Team offers capabilities for collaboration, productivity, and security across organizations. It enables groups of developers to unlock the full power of collaboration and sharing combined with essential security features and team management capabilities.
Docker Trusted Content ProgramThe Docker Trusted Content Program verifies content through four programs, Docker 官方镜像, Docker 认证发布者镜像, Docker 开源镜像, and Custom Official Images.
Docker Verified Publisher ImagesDocker Verified Publisher Images are confirmed by Docker to be from a trusted software publishers that are partners in the Verified Publisher program. Docker Verified Publisher Images are identified by the Verified Publisher badge included on the Docker Hub repositories.
Docker subscriptionDocker subscription tiers, sometimes referred to as plans, include 个人, Pro, 团队, and 业务. For more details, see Docker 订阅概览.
DockerfileA Dockerfile is a text document that contains all the commands you would normally execute manually in order to build a Docker image. Docker can build images automatically by reading the instructions from a Dockerfile.
ENTRYPOINT

在Dockerfile中，ENTRYPOINT 是一个可选的定义，用于指定要运行的命令的第一部分。如果你希望你的Dockerfile在不指定额外参数给 docker run 命令的情况下可运行，你必须指定 ENTRYPOINT、CMD 或两者都指定。

  • 如果指定了ENTRYPOINT，它将被设置为单个命令。大多数官方的Docker镜像都有一个ENTRYPOINT为/bin/sh或/bin/bash。即使你没有指定ENTRYPOINT，你也可能从你在Dockerfile中使用FROM关键字指定的基础镜像中继承它。要在运行时覆盖ENTRYPOINT，你可以使用--entrypoint。以下示例将入口点覆盖为/bin/ls并将CMD设置为-l /tmp。

    $ docker run --entrypoint=/bin/ls ubuntu -l /tmp

  • CMD 被附加到 ENTRYPOINT 上。CMD 可以是任何在 ENTRYPOINT 方面有效的任意字符串，这允许您一次传递多个命令或标志。要在运行时覆盖 CMD，只需将其添加到容器名称或 ID 之后。在以下示例中，CMD 被覆盖为 /bin/ls -l /tmp。

    $ docker run ubuntu /bin/ls -l /tmp

在实践中，ENTRYPOINT 通常不会被覆盖。然而，指定 ENTRYPOINT 可以使您的镜像更加灵活且易于重用。

SSHSSH (secure shell) is a secure protocol for accessing remote machines and applications. It provides authentication and encrypts data communication over insecure networks such as the Internet. SSH uses public/private key pairs to authenticate logins.
Union file system

联合文件系统实现了一种 联合挂载 并通过创建层来操作。Docker 使用联合文件系统与 写时复制 技术相结合，为容器提供构建块，使其非常轻量且快速。

有关Docker和联合文件系统的更多信息，请参阅 Docker和OverlayFS的实际应用。

联合文件系统的示例实现是 UnionFS 和 OverlayFS。

amd64AMD64 is AMD's 64-bit extension of Intel's x86 architecture, and is also referred to as x86_64 (or x86-64).
arm64ARM64 is the 64-bit extension of the ARM CPU architecture. arm64 architecture is used in Apple silicon machines.
base imageA base image is an image you designate in a FROM directive in a Dockerfile. It defines the starting point for your build. Dockerfile instructions create additional layers on top of the base image. A Dockerfile with the FROM scratch directive uses an empty base image.
btrfsbtrfs (B-tree file system) is a Linux filesystem that Docker supports as a storage backend. It is a 写时复制 filesystem.
buildBuild is the process of building Docker images using a Dockerfile. The build uses a Dockerfile and a "context". The context is the set of files in the directory in which the image is built.
cgroups

cgroups 是 Linux 内核的一个功能，用于限制、统计和隔离一组进程的资源使用（CPU、内存、磁盘 I/O、网络等）。Docker 依赖 cgroups 来控制和隔离资源限制。

也被称为控制组

clusterA cluster is a group of machines that work together to run workloads and provide high availability.
container

容器是 docker image的运行时实例。

一个Docker容器包含

  • 一个Docker镜像
  • 一个执行环境
  • 一组标准的指令

这个概念借鉴了运输集装箱，它们定义了全球运输货物的标准。Docker 定义了一个运输软件的标准。

container imageDocker images are the basis of containers. An image is an ordered collection of root filesystem changes and the corresponding execution parameters for use within a container runtime. An image typically contains a union of layered filesystems stacked on top of each other.
copy-on-write

Docker 使用 写时复制 技术和 联合文件系统 来优化资源并加速性能，适用于镜像和容器。实体的多个副本共享同一个实例，每个副本仅在其独特的层上进行特定的更改。

多个容器可以共享对同一镜像的访问，并在可写层上进行容器特定的更改，这些更改在容器被删除时会被删除。这加快了容器的启动时间和性能。

镜像本质上是文件系统的层次结构，通常基于一个基础镜像，并在一个可写层上构建，通过从基础镜像的差异层来构建。这最小化了镜像的占用空间，并实现了共享开发。

有关Docker中写时复制的更多信息，请参阅 了解镜像、 容器和存储 驱动程序。

filesystem

文件系统是操作系统用于命名文件并为其分配位置以便高效存储和检索的方法。

示例：

  • Linux : overlay2, extfs, btrfs, zfs
  • Windows : NTFS
  • macOS : APFS
imageDocker images are the basis of containers. An Image is an ordered collection of root filesystem changes and the corresponding execution parameters for use within a container runtime. An image typically contains a union of layered filesystems stacked on top of each other. An image does not have state and it never changes.
inviteePeople who have been invited to join an organization, but have not yet accepted their invitation.
layerIn an image, a layer is modification to the image, represented by an instruction in the Dockerfile. Layers are applied in sequence to the base image to create the final image. When an image is updated or rebuilt, only layers that change need to be updated, and unchanged layers are cached locally. This is part of why Docker images are so fast and lightweight. The sizes of each layer add up to equal the size of the final image.
libcontainerlibcontainer provides a native Go implementation for creating containers with namespaces, cgroups, capabilities, and filesystem access controls. It allows you to manage the lifecycle of the container performing additional operations after the container is created.
libnetworklibnetwork provides a native Go implementation for creating and managing container network namespaces and other network resources. It manages the networking lifecycle of the container performing additional operations after the container is created.
memberThe people who have received and accepted invitations to join an organization. Member can also refer to members of a team within an organization.
namespaceA Linux 命名空间 is a Linux kernel feature that isolates and virtualizes system resources. Processes which are restricted to a namespace can only interact with resources or processes that are part of the same namespace. Namespaces are an important part of Docker's isolation model. Namespaces exist for each type of resource, including net (networking), mnt (storage), pid (processes), uts (hostname control), and user (UID mapping). For more information about namespaces, see Docker 运行参考 and 使用用户命名空间隔离容器.
node

一个 节点 是运行Docker Engine实例的物理或虚拟机 在 swarm模式中。

管理节点执行群集管理和编排职责。默认情况下，管理节点也是工作节点。

工作节点执行任务。

organizationAn organization is a collection of teams and repositories that can be managed together. Docker users become members of an organization when they are assigned to at least one team in the organization.
organization nameThe organization name, sometimes referred to as the organization namespace or the org ID, is the unique identifier of a Docker organization.
overlay network driverOverlay network driver provides out of the box multi-host network connectivity for Docker containers in a cluster.
overlay storage driverOverlayFS is a filesystem service for Linux which implements a 联合挂载 for other file systems. It is supported by the Docker daemon as a storage driver.
persistent storagePersistent storage or volume storage provides a way for a user to add a persistent layer to the running container's file system. This persistent layer could live on the container host or an external device. The lifecycle of this persistent layer is not connected to the lifecycle of the container, allowing a user to retain state.
registry

注册表是一个托管服务，包含 仓库的 镜像，这些镜像响应注册表API。

默认的注册表可以通过浏览器访问 Docker Hub 或者使用 docker search 命令。

repository

仓库是一组Docker镜像。可以通过将其推送到registry服务器来共享仓库。仓库中的不同镜像可以使用tags进行标记。

这里是一个共享的 nginx 仓库 及其 标签 的示例。

seatsThe number of seats refers to the number of planned members within an organization.
service

一个 服务 是定义如何在群集中运行应用程序容器的。在最基本的层面上，服务定义了在群集中运行哪个容器镜像以及在容器中运行哪些命令。为了编排目的，服务定义了“期望状态”，即作为任务运行多少个容器以及部署容器的约束条件。

通常，服务是在某些更大应用程序的上下文中的微服务。服务的示例可能包括HTTP服务器、数据库或您希望在分布式环境中运行的任何其他类型的可执行程序。

service accountA service account is a Docker ID used for automated management of container images or containerized applications. Service accounts are typically used in automated workflows, and do not share Docker IDs with the members in a Docker Team or Docker Business subscription plan.
service discovery

Swarm模式 container discovery 是Swarm内部的一个DNS组件，它自动为Swarm中的覆盖网络上的每个服务分配一个VIP和DNS条目。网络上的容器通过gossip共享服务的DNS映射，因此网络上的任何容器都可以通过其服务名称访问该服务。

您不需要暴露特定服务的端口来使服务在同一覆盖网络上的其他服务可用。Swarm的内部负载均衡器会自动将请求分配到活动任务的服务VIP中。

swarmA swarm is a cluster of one or more Docker Engines running in swarm mode.
swarm modeSwarm 模式 refers to cluster management and orchestration features embedded in Docker Engine. When you initialize a new swarm (cluster) or join nodes to a swarm, the Docker Engine runs in swarm mode.
tagA tag is a label applied to a Docker image in a repository. Tags are how various images in a repository are distinguished from each other.
taskA task is the atomic unit of scheduling within a swarm. A task carries a Docker container and the commands to run inside the container. Manager nodes assign tasks to worker nodes according to the number of replicas set in the service scale.
teamA team is a group of Docker users that belong to an organization. An organization can have multiple teams.
virtual machine

虚拟机是一种模拟完整计算机并模仿专用硬件的程序。 它与其他用户共享物理硬件资源，但隔离操作系统。最终用户在虚拟机上的体验与在专用硬件上的体验相同。

与容器相比，虚拟机运行起来更重，提供更多的隔离，拥有自己的一套资源，并且共享最少。

也被称为虚拟机

volume

卷是在一个或多个容器内特别指定的目录，它绕过了联合文件系统。卷旨在持久化数据，独立于容器的生命周期。因此，Docker 在删除容器时不会自动删除卷，也不会“垃圾回收”不再被容器引用的卷。 也称为：数据卷

有三种类型的卷：主机、匿名和命名：

  • 一个主机卷位于Docker主机的文件系统上，并且可以从容器内部访问。

  • 一个命名卷是Docker管理的一个卷，它在磁盘上创建，但被赋予了一个名称。

  • 一个匿名卷类似于一个命名卷，然而，当它是一个匿名卷时，随着时间的推移，可能很难引用同一个卷。Docker 处理文件的存储位置。

x86_64x86_64 (or x86-64) refers to a 64-bit instruction set invented by AMD as an extension of Intel's x86 architecture. AMD calls its x86_64 architecture, AMD64, and Intel calls its implementation, Intel 64.