CHAPTER 8 为镜像添加SSH服务

8.1 基于commit命令创建

Docker提供了docker commit命令，支持用户提交自己对制定容器的修改，并生成新的镜像。命令格式为

docker commit CONTAINER [REPOSITORY [:TAG］

这里将介绍如何用docker commit命令为ubuntu:18.04镜像添加SSH服务。

8.1.1 准备工作

首先，获取ubuntu:18.04镜像，并创建一个容器

[root@dbc-server-554 ~]# docker run -it ubuntu:18.04 bash
root@7eacbb1d5d64:/#

8.1.2 配置软件源检

查软件源，并使用apt-get update命令来更新软件源信息：

root@7eacbb1d5d64:/# apt-get update
Get:1 http://archive.ubuntu.com/ubuntu bionic InRelease [242 kB]
...
Get:18 http://archive.ubuntu.com/ubuntu bionic-backports/main amd64 Packages [64.0 kB]
Fetched 26.9 MB in 1min 1s (440 kB/s)
Reading package lists... Done

如果默认的官方源速度慢的话，也可以替换为国内163、sohu等镜像的源。以163源为例，在容器内创建／etc/apνsources.list.d/163.list文件，添加如下内容到文件中：

root@7eacbb1d5d64:/# cat /etc/apt/sources.list.d/163.list
deb http://mirrors.163.com/ubuntu/ bionic main restricted universe multiverse
deb http://mirrors.163.com/ubuntu/ bionic-security main restricted universe multiverse
deb http://mirrors.163.com/ubuntu/ bionic-updates main restricted universe multiverse
deb http://mirrors.163.com/ubuntu/ bionic-proposed main restricted universe multiverse
deb http://mirrors.163.com/ubuntu/ bionic-backports main restricted universe multiverse
deb-src http://mirrors.163.com/ubuntu/ bionic main restricted universe multiverse
deb-src http://mirrors.163.com/ubuntu/ bionic-security main restricted universe multiverse
deb-src http://mirrors.163.com/ubuntu/ bionic-updates main restricted universe multiverse
deb-src http://mirrors.163.com/ubuntu/ bionic-proposed main restricted universe multiverse
deb-src http://mirrors.163.com/ubuntu/ bionic-backports main restricted universe multiverse

之后重新执行apt-get update命令即可。

8.1.3 安装和配置SSH服务

更新软件包缓存后可以安装SSH服务了，选择主流的openssh-server作为服务端。可以看到需要下载安装众多的依赖软件包：

root@7eacbb1d5d64:/# apt-get install openssh-server 

如果需要正常启动SSH服务，则目录/var/run/sshd必须存在。下面手动创建它，并启动SSH服务：

root@7eacbb1d5d64:/# mkdir /var/run/sshd
root@7eacbb1d5d64:/# /usr/sbin/sshd -D &
[1] 6802

此时查看容器的22端口（SSH服务默认监昕的端口），可见此端口已经处于监听状态：

root@7eacbb1d5d64:/# netstat -tulnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      6802/sshd
tcp6       0      0 :::22                   :::*                    LISTEN      6802/sshd

修改SSH服务的安全登录配置，取消pam登录限制：

root@7eacbb1d5d64:/# sed -ri 's/session    required     pam_loginuid.so/#session    required     pam_loginuid.so/g' /etc/pam.d/sshd

修改ssh配置文件/etc/ssh/sshd_config，如下，取消root登录限制

# Authentication:

LoginGraceTime 2m
PermitRootLogin yes
StrictModes yes

在root用户目录下创建.ssh目录，并复制需要登录的公钥信息（一般为本地主机用户目录下的.ssh/id_rsa.pub文件，可由ssh-keygen-t rsa命令生成）到authorized_keys文件中：

root@7eacbb1d5d64:/# mkdir /root/.ssh
root@7eacbb1d5d64:/# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
...
root@7eacbb1d5d64:/# cd /root/.ssh/
root@7eacbb1d5d64:~/.ssh# cp id_rsa.pub authorized_keys

创建自动启动SSH服务的可执行文件run.sh，并添加可执行权限：

root@7eacbb1d5d64:/# cat run.sh
#!/bin/bash
/usr/sbin/sshd -D
root@7eacbb1d5d64:/# chmod u+x run.sh

最后，退出容器

8.1.4 保存镜像

将所退出的容器用docker commit命令保存为一个新的sshd:ubuntu镜像。

[root@dbc-server-554 ~]# docker commit -m "myubuntu+sshd" -a "yurq" 7ea sshd:ubuntu
sha256:9c9ab1691e38b6dfec4a46dbcfd9f5d49bde1ccb1736727b354f385af3f52ad5
[root@dbc-server-554 ~]# docker images
REPOSITORY                                          TAG             IMAGE ID       CREATED          SIZE
sshd                                                ubuntu          9c9ab1691e38   43 seconds ago   327MB
[root@dbc-server-554 ~]# docker  inspect -f {{.Author}} 9c9
yurq

8.1.5 使用镜像

启动容器，并添加端口映射10022:22。其中10022是宿主主机的端口，22是容器的SSH服务监听端口：

[root@dbc-server-554 ~]# docker run -d -p 10022:22 9c9 /run.sh
126395f6400c020c51f34d4061614398ab9247c27215ec3ba20dcbf0f5691f46
[root@dbc-server-554 ~]# docker ps
CONTAINER ID   IMAGE               COMMAND                  CREATED          STATUS          PORTS                                         NAMES
126395f6400c   9c9                 "/run.sh"                12 seconds ago   Up 11 seconds   0.0.0.0:10022->22/tcp, :::10022->22/tcp       stupefied_brattain

在宿主主机（192.168.5.54）或其他主机上上，可以通过SSH访问10022端口来登录容器：

[root@dbc-server-554 ~]# ssh 192.168.5.54 -p 10022
Welcome to Ubuntu 18.04.6 LTS (GNU/Linux 3.10.0-1160.el7.x86_64 x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage
...

8.2 使用Dockerfile创建

使用Dockerfile来创建一个支持SSH服务的镜像

8.2.1 创建工作目录

首先，创建一个sshd_ubuntu工作目录，在其中，创建Dockerfile和run.sh文件

[root@dbc-server-554 docker]# mkdir sshd_ubuntu
[root@dbc-server-554 docker]# cd sshd_ubuntu
[root@dbc-server-554 sshd_ubuntu]# touch dockerfile run.sh

8.2.2 编写run.sh脚本和authorized_keys文件

脚本文件run.sh的内容与上一小节中一致：

[root@dbc-server-554 sshd_ubuntu]# cat run.sh
#!/bin/bash
/usr/sbin/sshd -D

在宿主主机上生成SSH密钥对，并创建authorized_keys文件：

$ ssh-keygen - t rsa 
...
$ cat ~/.ssh/id_rsa.pub >authorized_keys 

8.2.3 编写Dockerfile

下面是Dockerfile的内容及各部分的注释，可以对比上一节中利用docker commit命令创建镜像过程，所进行的操作基本一致：

[root@dbc-server-554 sshd_ubuntu]# cat dockerfile
#设置继承镜像
FROM ubuntu:18.04

#提供一些作者的信息
LABEL maintainer yurq

#下面开始运行命令，此处更改ubuntu的源为国内163的源
RUN echo "deb http://mirrors.163.com/ubuntu/ bionic main restricted universe multiverse" >/etc/apt/sources.list
RUN echo "deb http://mirrors.163.com/ubuntu/ bionic-security main restricted universe multiverse" >>/etc/apt/sources.list
RUN echo "deb http://mirrors.163.com/ubuntu/ bionic-updates main restricted universe multiverse" >>/etc/apt/sources.list
RUN echo "deb http://mirrors.163.com/ubuntu/ bionic-proposed main restricted universe multiverse" >>/etc/apt/sources.list
RUN echo "deb http://mirrors.163.com/ubuntu/ bionic-backports main restricted universe multiverse" >>/etc/apt/sources.list
RUN echo "deb-src http://mirrors.163.com/ubuntu/ bionic main restricted universe multiverse" >>/etc/apt/sources.list
RUN echo "deb-src http://mirrors.163.com/ubuntu/ bionic-security main restricted universe multiverse" >>/etc/apt/sources.list
RUN echo "deb-src http://mirrors.163.com/ubuntu/ bionic-updates main restricted universe multiverse" >>/etc/apt/sources.list
RUN echo "deb-src http://mirrors.163.com/ubuntu/ bionic-proposed main restricted universe multiverse" >>/etc/apt/sources.list
RUN echo "deb-src http://mirrors.163.com/ubuntu/ bionic-backports main restricted universe multiverse" >>/etc/apt/sources.list
RUN apt-get update

#安装ssh服务
RUN apt-get install -y openssh-server
RUN mkdir -p /var/run/sshd
RUN mkdir -p /root/.ssh

#取消pam限制
RUN sed -ri 's/session    required     pam_loginuid.so/#session    required     pam_loginuid.so/g' /etc/pam.d/sshd

#修改ssh设置
RUN sed -ri 's/#LoginGraceTime 2m/LoginGraceTime 2m/g' /etc/ssh/sshd_config
RUN sed -ri 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/g' /etc/ssh/sshd_config
RUN sed -ri 's/#StrictModes yes/StrictModes yes/g' /etc/ssh/sshd_config

#复制配置文件到相应位置，并赋予脚本可执行权限
ADD authorized_keys /root/.ssh/authorized_keys
ADD run. sh /run. sh
RUN chmod 755 /run.sh

#开放端口
EXPOSE 22

#设置自启动命令
CMD [”/run.sh"]

8.2.4 创建镜像

在sshd_ubuntu目录下，使用docker build命令来创建镜像。这里用户需要注意在最后还有一个“．”，表示使用当前目录中的Dockerfile:

[root@dbc-server-554 sshd_ubuntu]# docker build -t sshd:dockerfile .
Sending build context to Docker daemon  5.632kB
Step 1/22 : FROM ubuntu:18.04
 ---> e28a50f651f9
Step 2/22 : LABEL maintainer yurq
 ...
Step 22/22 : CMD [”/run.sh"]
 ---> Running in ba839c8ac002
Removing intermediate container ba839c8ac002
 ---> cae337d9b3f7
Successfully built cae337d9b3f7
Successfully tagged sshd:dockerfile
[root@dbc-server-554 sshd_ubuntu]# docker images
REPOSITORY                                          TAG             IMAGE ID       CREATED             SIZE
sshd                                                dockerfile      cae337d9b3f7   42 seconds ago      247MB
sshd                                                ubuntu          986f59c6a7b6   23 minutes ago      327MB

8.2.5 测试镜像

运行容器下面使用刚才创建的sshd:dockerfile镜像来运行一个容器。直接启动镜像，映射容器的22端口到本地的10122端口

[root@dbc-server-554 sshd_ubuntu]# docker run -d -p 10122:22 sshd:dockerfile_0.2
0ccc8640385e0fc22b339899d286ea82c7adbc05d8f71e74174c26cd549825a6
[root@dbc-server-554 sshd_ubuntu]# docker ps
CONTAINER ID   IMAGE                 COMMAND                  CREATED          STATUS          PORTS                                         NAMES
0ccc8640385e   sshd:dockerfile_0.2   "/run.sh"                3 seconds ago    Up 2 seconds    0.0.0.0:10122->22/tcp, :::10122->22/tcp       cool_borg