Docker 与 Kubernetes 部署最佳实践 2027构建可靠的容器化应用1. 容器化技术的核心概念容器化技术已经成为现代应用部署的标准方式它提供了一种轻量级、可移植、一致的应用打包和运行环境。Docker 和 Kubernetes 是容器化生态系统中的核心技术它们共同构成了现代云原生应用的基础设施。1.1 容器化的优势环境一致性容器包含应用及其所有依赖确保在不同环境中运行一致快速部署容器启动速度快支持快速部署和扩展资源隔离容器之间相互隔离提高安全性和稳定性版本控制容器镜像可以版本化管理支持回滚和灰度发布跨平台容器可以在任何支持 Docker 的平台上运行2. Docker 最佳实践2.1 Dockerfile 优化# 使用官方基础镜像 FROM eclipse-temurin:21-jdk-alpine # 设置工作目录 WORKDIR /app # 复制构建文件 COPY pom.xml . COPY mvnw . COPY .mvn .mvn # 下载依赖 RUN ./mvnw dependency:go-offline # 复制源代码 COPY src src # 构建应用 RUN ./mvnw package -DskipTests # 暴露端口 EXPOSE 8080 # 运行应用 CMD [java, -jar, target/my-application.jar]2.2 镜像管理使用官方镜像优先使用官方认证的镜像最小化镜像大小使用 Alpine 等轻量级基础镜像分层构建合理利用 Docker 分层缓存定期更新定期更新基础镜像和依赖镜像标签使用语义化版本标签2.3 多阶段构建# 构建阶段 FROM eclipse-temurin:21-jdk-alpine as builder WORKDIR /app COPY . . RUN ./mvnw package -DskipTests # 运行阶段 FROM eclipse-temurin:21-jre-alpine WORKDIR /app COPY --frombuilder /app/target/my-application.jar . EXPOSE 8080 CMD [java, -jar, my-application.jar]3. Kubernetes 基础3.1 Kubernetes 核心概念Pod最小的部署单元包含一个或多个容器Deployment管理 Pod 的副本和更新Service提供服务发现和负载均衡Ingress管理外部访问ConfigMap存储配置信息Secret存储敏感信息PersistentVolume持久化存储Namespace资源隔离3.2 Kubernetes 部署配置apiVersion: apps/v1 kind: Deployment metadata: name: my-application namespace: default spec: replicas: 3 selector: matchLabels: app: my-application template: metadata: labels: app: my-application spec: containers: - name: my-application image: my-application:latest ports: - containerPort: 8080 env: - name: SPRING_PROFILES_ACTIVE value: prod - name: DATABASE_URL valueFrom: secretKeyRef: name: database-secret key: url resources: limits: cpu: 1 memory: 1Gi requests: cpu: 500m memory: 512Mi livenessProbe: httpGet: path: /actuator/health port: 8080 initialDelaySeconds: 30 periodSeconds: 10 readinessProbe: httpGet: path: /actuator/health port: 8080 initialDelaySeconds: 10 periodSeconds: 54. Kubernetes 高级特性4.1 水平自动伸缩apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: my-application-hpa spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: my-application minReplicas: 2 maxReplicas: 10 metrics: - type: Resource resource: name: cpu target: type: Utilization averageUtilization: 70 - type: Resource resource: name: memory target: type: Utilization averageUtilization: 804.2 滚动更新apiVersion: apps/v1 kind: Deployment metadata: name: my-application spec: replicas: 3 strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 selector: matchLabels: app: my-application template: metadata: labels: app: my-application spec: containers: - name: my-application image: my-application:v2 ports: - containerPort: 80804.3 网络策略apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: my-application-network-policy spec: podSelector: matchLabels: app: my-application policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: api-gateway ports: - protocol: TCP port: 8080 egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 54325. 配置管理5.1 ConfigMapapiVersion: v1 kind: ConfigMap metadata: name: my-application-config data: application.properties: | spring.application.namemy-application server.port8080 spring.datasource.urljdbc:postgresql://database:5432/mydb spring.datasource.usernameadmin spring.jpa.hibernate.ddl-autoupdate5.2 SecretapiVersion: v1 kind: Secret metadata: name: database-secret type: Opaque data: password: c2VjcmV0 url: amRiYzpwb3N0Z3Jlc3FsOi8vZGF0YWJhc2U6NTQzMi9teWRi5.3 使用配置apiVersion: apps/v1 kind: Deployment metadata: name: my-application spec: replicas: 3 selector: matchLabels: app: my-application template: metadata: labels: app: my-application spec: containers: - name: my-application image: my-application:latest ports: - containerPort: 8080 env: - name: SPRING_PROFILES_ACTIVE value: prod - name: DATABASE_PASSWORD valueFrom: secretKeyRef: name: database-secret key: password volumeMounts: - name: config-volume mountPath: /app/config volumes: - name: config-volume configMap: name: my-application-config6. 存储管理6.1 PersistentVolumeapiVersion: v1 kind: PersistentVolume metadata: name: my-pv spec: capacity: storage: 10Gi accessModes: - ReadWriteOnce hostPath: path: /data6.2 PersistentVolumeClaimapiVersion: v1 kind: PersistentVolumeClaim metadata: name: my-pvc spec: accessModes: - ReadWriteOnce resources: requests: storage: 5Gi6.3 使用存储apiVersion: apps/v1 kind: Deployment metadata: name: my-application spec: replicas: 1 selector: matchLabels: app: my-application template: metadata: labels: app: my-application spec: containers: - name: my-application image: my-application:latest ports: - containerPort: 8080 volumeMounts: - name:>apiVersion: v1 kind: Service metadata: name: my-application spec: type: ClusterIP selector: app: my-application ports: - port: 80 targetPort: 80807.2 IngressapiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: my-application-ingress annotations: nginx.ingress.kubernetes.io/rewrite-target: / spec: rules: - host: my-application.example.com http: paths: - path: / pathType: Prefix backend: service: name: my-application port: number: 807.3 负载均衡策略RoundRobin轮询LeastConnection最少连接IPHashIP 哈希Random随机8. 监控与日志8.1 监控Prometheus监控指标收集Grafana监控数据可视化AlertManager告警管理8.2 日志ELK StackElasticsearch、Logstash、KibanaLoki轻量级日志聚合8.3 配置示例apiVersion: apps/v1 kind: Deployment metadata: name: my-application spec: replicas: 3 selector: matchLabels: app: my-application template: metadata: labels: app: my-application annotations: prometheus.io/scrape: true prometheus.io/port: 8080 prometheus.io/path: /actuator/prometheus spec: containers: - name: my-application image: my-application:latest ports: - containerPort: 8080 env: - name: LOG_LEVEL value: info - name: LOG_FORMAT value: json9. CI/CD 集成9.1 GitHub Actionsname: CI/CD on: push: branches: [ main ] pull_request: branches: [ main ] jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkoutv3 - name: Set up JDK uses: actions/setup-javav3 with: java-version: 21 distribution: temurin - name: Build with Maven run: mvn clean package -DskipTests - name: Build Docker image run: docker build -t my-application:${{ github.sha }} . - name: Push to Docker Hub run: | echo ${{ secrets.DOCKER_PASSWORD }} | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin docker tag my-application:${{ github.sha }} my-application:latest docker push my-application:${{ github.sha }} docker push my-application:latest - name: Deploy to Kubernetes run: | kubectl config use-context my-cluster kubectl set image deployment/my-application my-applicationmy-application:${{ github.sha }}9.2 GitLab CIstages: - build - test - deploy build: stage: build script: - mvn clean package -DskipTests - docker build -t my-application:${CI_COMMIT_SHORT_SHA} . - docker tag my-application:${CI_COMMIT_SHORT_SHA} my-application:latest - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD - docker push my-application:${CI_COMMIT_SHORT_SHA} - docker push my-application:latest test: stage: test script: - mvn test deploy: stage: deploy script: - kubectl config use-context my-cluster - kubectl set image deployment/my-application my-applicationmy-application:${CI_COMMIT_SHORT_SHA} only: - main10. 实际应用案例10.1 微服务架构部署# API Gateway apiVersion: apps/v1 kind: Deployment metadata: name: api-gateway spec: replicas: 2 selector: matchLabels: app: api-gateway template: metadata: labels: app: api-gateway spec: containers: - name: api-gateway image: api-gateway:latest ports: - containerPort: 8080 --- # User Service apiVersion: apps/v1 kind: Deployment metadata: name: user-service spec: replicas: 3 selector: matchLabels: app: user-service template: metadata: labels: app: user-service spec: containers: - name: user-service image: user-service:latest ports: - containerPort: 8080 --- # Order Service apiVersion: apps/v1 kind: Deployment metadata: name: order-service spec: replicas: 3 selector: matchLabels: app: order-service template: metadata: labels: app: order-service spec: containers: - name: order-service image: order-service:latest ports: - containerPort: 8080 --- # Services apiVersion: v1 kind: Service metadata: name: api-gateway spec: type: LoadBalancer selector: app: api-gateway ports: - port: 80 targetPort: 8080 --- apiVersion: v1 kind: Service metadata: name: user-service spec: type: ClusterIP selector: app: user-service ports: - port: 80 targetPort: 8080 --- apiVersion: v1 kind: Service metadata: name: order-service spec: type: ClusterIP selector: app: order-service ports: - port: 80 targetPort: 808010.2 数据库部署# PostgreSQL apiVersion: apps/v1 kind: StatefulSet metadata: name: postgres spec: serviceName: postgres replicas: 1 selector: matchLabels: app: postgres template: metadata: labels: app: postgres spec: containers: - name: postgres image: postgres:15 ports: - containerPort: 5432 env: - name: POSTGRES_DB value: mydb - name: POSTGRES_USER value: admin - name: POSTGRES_PASSWORD valueFrom: secretKeyRef: name: postgres-secret key: password volumeMounts: - name: postgres-data mountPath: /var/lib/postgresql/data volumeClaimTemplates: - metadata: name: postgres-data spec: accessModes: [ReadWriteOnce] resources: requests: storage: 10Gi --- apiVersion: v1 kind: Service metadata: name: postgres spec: type: ClusterIP selector: app: postgres ports: - port: 5432 targetPort: 543211. 性能优化11.1 资源配置合理设置资源限制根据应用实际需求设置 CPU 和内存限制使用资源请求设置合理的资源请求帮助 Kubernetes 进行调度监控资源使用定期监控资源使用情况调整配置11.2 网络优化使用节点本地存储减少网络 IO优化网络策略减少不必要的网络流量使用 Service Mesh管理服务间通信11.3 存储优化使用合适的存储类型根据应用需求选择合适的存储类型优化存储访问模式根据应用访问模式选择合适的存储访问模式使用存储类使用 Kubernetes StorageClass 管理存储12. 安全最佳实践12.1 容器安全使用官方镜像使用官方认证的镜像定期更新定期更新基础镜像和依赖最小权限运行容器时使用最小权限扫描镜像使用镜像扫描工具检测安全漏洞12.2 Kubernetes 安全RBAC使用基于角色的访问控制网络策略使用网络策略限制容器通信Secret 管理安全管理敏感信息Pod 安全策略限制 Pod 的行为12.3 安全配置示例apiVersion: apps/v1 kind: Deployment metadata: name: my-application spec: replicas: 3 selector: matchLabels: app: my-application template: metadata: labels: app: my-application spec: securityContext: runAsNonRoot: true runAsUser: 1000 runAsGroup: 1000 containers: - name: my-application image: my-application:latest ports: - containerPort: 8080 securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: [ALL]13. 总结与最佳实践Docker 和 Kubernetes 已经成为现代应用部署的标准工具它们提供了强大的容器管理和编排能力。通过合理使用这些工具可以构建出更加可靠、可扩展、安全的应用系统。13.1 最佳实践优化 Dockerfile使用多阶段构建最小化镜像大小合理配置资源根据应用需求设置资源限制和请求使用健康检查配置存活和就绪探针实现自动伸缩根据负载自动调整副本数使用配置管理使用 ConfigMap 和 Secret 管理配置实现监控和日志使用 Prometheus、Grafana 和 ELK Stack集成 CI/CD实现自动化构建和部署安全配置使用最小权限原则定期更新镜像网络优化使用网络策略限制容器通信存储管理根据应用需求选择合适的存储方案13.2 注意事项资源管理避免资源过度分配合理设置资源限制网络配置注意网络策略的配置避免不必要的网络暴露安全问题定期扫描镜像更新依赖使用最小权限监控告警建立完善的监控和告警机制成本管理合理使用云资源控制成本团队协作建立跨职能团队促进 DevOps 文化持续学习关注 Docker 和 Kubernetes 的最新特性和最佳实践别叫我大神叫我 Alex 就好。这其实可以更优雅一点通过合理使用 Docker 和 Kubernetes 的最佳实践我们可以构建出更加可靠、可扩展、安全的容器化应用。