• Docker制作镜像并部署bind9（yum安装bind）--use

    镜像制作

    1.1 下载镜像

    docker pull centos:centos7.9.2009

    1.2 运行容器

    1. [root@localhost ~]# docker run -d \
    2. --privileged \
    3. --name=bind9 \
    4. --restart=always \
    5. -p 53:53/udp \
    6. -p 53:53/tcp \
    7. -v /data/bind9:/etc/bind \
    8. -v /sys/fs/cgroup:/sys/fs/cgroup \
    9. centos:centos7.9.2009 /usr/sbin/init
    10.  
    11. # 查看容器日志
    12. [root@localhost ~]# docker logs bind9
    13.  
    14. # 进入容器查看
    15. [root@localhost ~]# docker exec -it bind9 bash
    16.  
    17. # 步骤七: 查看容器运行情况
    18. root@ubuntu-vm1:/data/bind9# docker ps
    19. CONTAINER ID   IMAGE                   COMMAND            CREATED          STATUS          PORTS                                                                  NAMES
    20. 3e12e7dd4439   centos:centos7.9.2009   "/usr/sbin/init"   42 seconds ago   Up 41 seconds   0.0.0.0:53->53/tcp, 0.0.0.0:53->53/udp, :::53->53/tcp, :::53->53/udp   bind9
    21.

    1.3 部署named服务

    1. # 1. 进入容器查看
    2. [root@localhost ~]# docker exec -it bind9 bash
    3.  
    4. # 2. 关闭SELinux与防火墙
    5. [root@localhost ~]# setenforce 0
    6. [root@localhost ~]# systemctl stop firewalld
    7.  
    8. # 永久关闭
    9. [root@localhost ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
    10. [root@localhost ~]# systemctl disable firewalld
    11.  
    12. # 3. yum 安装DNS服务
    13. [root@localhost ~]# yum install -y bind* vim*
    14.  
    15. # 查看bind是否完成
    16. [root@localhost yum.repos.d]# rpm -aq |grep bind
    17.  
    18. # 状态管理
    19. systemctl enable named --now
    20. systemctl status named
    21. systemctl stop named
    22. systemctl start named
    23. systemctl restart named

    1.4 配置文件

    1.4.1 named.conf

    1. # 在docker容器中执行
    2. $. cp /etc/named.conf /etc/named.conf-bak
    3. $. vi /etc/named.conf
    4. //
    5. // named.conf
    6. //
    7. // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
    8. // server as a caching only nameserver (as a localhost DNS resolver only).
    9. //
    10. // See /usr/share/doc/bind*/sample/ for example named configuration files.
    11. //
    12. // See the BIND Administrator's Reference Manual (ARM) for details about the
    13. // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
    14.  
    15. options {
    16.         // listen-on port 53 { 127.0.0.1; };
    17.         listen-on port 53 { any; };
    18.         listen-on-v6 port 53 { ::1; };
    19.         directory       "/var/named";
    20.         dump-file       "/var/named/data/cache_dump.db";
    21.         statistics-file "/var/named/data/named_stats.txt";
    22.         memstatistics-file "/var/named/data/named_mem_stats.txt";
    23.         recursing-file  "/var/named/data/named.recursing";
    24.         secroots-file   "/var/named/data/named.secroots";
    25.         //allow-query     { localhost; };
    26.         allow-query     { any; };
    27.  
    28.         /*
    29.          - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
    30.          - If you are building a RECURSIVE (caching) DNS server, you need to enable
    31.            recursion.
    32.          - If your recursive DNS server has a public IP address, you MUST enable access
    33.            control to limit queries to your legitimate users. Failing to do so will
    34.            cause your server to become part of large scale DNS amplification
    35.            attacks. Implementing BCP38 within your network would greatly
    36.            reduce such attack surface
    37.         */
    38.         recursion yes;
    39.  
    40.         forward first;
    41.         forwarders { 8.8.8.8; };
    42.  
    43.         dnssec-enable no;
    44.         dnssec-validation no;
    45.  
    46.         /* Path to ISC DLV key */
    47.         bindkeys-file "/etc/named.root.key";
    48.  
    49.         managed-keys-directory "/var/named/dynamic";
    50.  
    51.         pid-file "/run/named/named.pid";
    52.         session-keyfile "/run/named/session.key";
    53. };
    54.  
    55. logging {
    56.         channel default_debug {
    57.                 file "data/named.run";
    58.                 severity dynamic;
    59.         };
    60. };
    61.  
    62. zone "." IN {
    63.         type hint;
    64.         file "named.ca";
    65. };
    66.  
    67. include "/etc/named.rfc1912.zones";
    68. include "/etc/named.root.key";
    69.  
    70. // mine
    71. include "/etc/bind/named.zones";

    1.4.2 named.zones

    1. # 宿主机中
    2. [root@localhost ~]# cd /data/bind9
    3. [root@localhost ~]# vi named.zones
    4. // named.zones文件内容如下:
    5. zone "lpf-test.com" IN {
    6.     type master;
    7.     file "/etc/bind/lpf-test.com.hosts";
    8. };
    9.  
    10. zone "31.168.192.in-addr.arpa" IN {
    11.     type master;
    12.     file "/etc/bind/lpf-test.com.back";
    13. };

    1.4.3 lpf-test.com.hosts, lpf-test.com.back

    1. [root@localhost ~]# cd /data/bind9/zones
    2. [root@localhost ~]# vi lpf-test.com.hosts
    3. $TTL 1D
    4. @       IN SOA  @ root.lpf-test.com. (
    5.                                         0       ; serial
    6.                                         1D      ; refresh
    7.                                         1H      ; retry
    8.                                         1W      ; expire
    9.                                         3H )    ; minimum
    10.  
    11. @               NS      dns.lpf-test.com.
    12. @               IN A    192.168.31.85
    13. *               IN A    192.168.31.85
    14.  
    15. [root@localhost ~]# vi lpf-test.com.back
    16. $TTL 1D
    17. @       IN SOA  @ root.lpf-test.com. (
    18.                                         0       ; serial
    19.                                         1D      ; refresh
    20.                                         1H      ; retry
    21.                                         1W      ; expire
    22.                                         3H )    ; minimum
    23. @       IN      NS      dns.lpf-test.com.
    24. 100     IN      PTR     dns.lpf-test.com
    25. 101     IN      PTR     www.lpf-test.com
    26. 102     IN      PTR     smb.lpf-test.com
    27. 103     IN      PTR     ftp.lpf-test.com

    1.4.4 步骤四:检查

    1. root@my-ubuntu-vm1:~# docker exec -it bind9 bash
    2.  
    3. # 查看状态
    4. root@8d4b47ea885c:/# service named status
    5. root@8d4b47ea885c:/# service named restart
    6. root@8d4b47ea885c:/# service named status
    7.  
    8. $. named-checkconf -z "$NAMEDCONF"
    9. $. named-checkconf /etc/named.conf
    10.  
    11.  
    12. # 检查主配置文件： 
    13. [root@localhost ~]# named-checkconf
    14.  
    15. # named-checkzone yourDNS域名和路径
    16. # 检查正向解析文件
    17. [root@localhost ~]# named-checkzone lpf-test.com \
    18. /etc/bind/lpf-test.com.hosts
    19.  
    20. zone lpf-test.com/IN: loaded serial 0
    21.  
    22. OK
    23.  
    24. # 检查反向解析文件：
    25. [root@localhost ~]# named-checkzone \
    26. 31.168.192.in-addr.arpa \
    27. /etc/bind/lpf-test.com.back
    28.  
    29. zone 10.168.192.in-addr.arpa/IN: loaded serial 0
    30.  
    31. OK
    32.  
    33. # 问题排查
    34. journalctl -xefu named
    35. journalctl -xefu docker
    36. journalctl -u named

    1.4.5 开机启动执行

    1. # 容器中执行如下命令
    2. chmod +x /etc/rc.d/rc.local
    3. vi /etc/rc.d/rc.local
    4. # 添加如下内容  
    5. mkdir -p /etc/bind
    6. cp -p /opt/* /etc/bind

    1.5 打包镜像

    1. # 打包镜像
    2. docker commit -p \
    3. -a "langpf" \
    4. -m "centos7.9.2009, bind-9.11.4" \
    5. d46d528d2f97 centos/bind9:9.11.4-26 
    6.  
    7. # 推送到本地仓库
    8. 1) 
    9. docker tag centos/bind9:9.11.4-26 \
    10. k8s-harbor.com/my-project/centos-bind9:9.11.4-26
    11.  
    12. 2) 
    13. docker login \
    14. https://k8s-harbor.com/harbor/projects \
    15. -u admin -p Harbor12345
    16.  
    17. 3) 
    18. docker push k8s-harbor.com/my-project/centos-bind9:9.11.4-26

    问题处理

    1. 问题:
    2.     在docker中启动服务报错：
    3.         New main PID 547 does not belong to service, 
    4.         and PID file is not owned by root. Refusing.
    5.  
    6. 解决:
    7.     挂载宿主机 cgroup目录，启动时加上 -v /sys/fs/cgroup:/sys/fs/cgroup
    8.  
    9.     完整启动命令如下：
    10.     
    11.     docker run -itd --name=ldap --privileged=true \
    12.     -v /sys/fs/cgroup:/sys/fs/cgroup \ 
    13.     -p 80:80 -p 389:389 centos:7 /usr/sbin/init
  • 相关阅读:
    Python-Scrapy框架（框架学习）
    linux常见命令以及jdk，tomcat环境搭建
    PyTorch KernelAgent 源码解读 ---（1）--- 原理
    手把手建立Roofline模型（CPU）
    深入解析NPM：常用命令详解与实战示例
    三天吃透Redis面试八股文
    G1D4-软考中级《项目集成管理》-下午真题
    node版本切换（nvm）
    ⚡文件工具类⚡
    nvidia-smi常用选项汇总
  • 原文地址：https://blog.csdn.net/justlpf/article/details/133128108