使用 Docker 在 Linux 上托管 ASP.NET Core 应用程序

说在前面

在阅读本文之前，您必须对 Docker 的中涉及的基本概念以及常见命令有一定了解，本文侧重实战，不会对相关概念详述。

同时请确保您本地开发机器已完成如下安装：

• Docker 18.06 或更高版本的 Docker 客户端
• .NET Core SDK 2.2 或更高版本
• Visual Studio Code 代码编辑器，以及 C# 语法插件 1.17.1 或更高版本

创建演示项目

开始之前要先准备一个需要 Docker 容器化的 ASP.NET Core 应用程序，用于下面的操作演示。这里我用 .NET Core CLI 快速搭建一个全新的 Web API 项目。

启动 VS Code，打开集成终端，输入如下命令：

dotnet new webapi -o TodoApi
code -r TodoApi

以上便创建了一个名为

TodoApi

打开集成终端，输入

dotnet run

http://localhost:5000/api/values

["value1","value2"]

现在让我们更进一步，在 Docker 中构建并运行该应用程序。

创建 Dockerfile 文件

Dockerfile 是一个文本文件，其用来定义单个容器的内容和启动行为，按顺序包含构建镜像所需的所有指令。Docker 会通过读取 Dockerfile 中的指令自动构建镜像。

在项目

TodoApi

Dockerfile

FROM microsoft/dotnet:2.2-sdk AS build-env
WORKDIR /app

# Copy csproj and restore as distinct layers
COPY *.csproj ./
RUN dotnet restore

# Copy everything else and build
COPY . ./
RUN dotnet publish -c Release -o out

# Build runtime image
FROM microsoft/dotnet:2.2-aspnetcore-runtime
WORKDIR /app
COPY --from=build-env /app/out .
ENTRYPOINT ["dotnet", "TodoApi.dll"]

• FROM

  指令必须放在第一位，用于初始化镜像，为后面的指令设置基础镜像。
  

• WORKDIR

  指令为其他指令设置工作目录，如果不存在，则会创建该目录。
  

• COPY

  指令会从源路径复制新文件或目录，并将它们添加到路径目标容器的文件系统中。
  

• RUN

  指令可以在当前镜像之上的新 层 中执行任何命令并提交结果，生成的已提交镜像将用于 Dockerfile 中的下一步。
  

• ENTRYPOINT

  指令支持以可执行文件的形式运行容器。

同时，为了避免构建项目中的一些调试生成文件，可以在项目文件夹中新增

.dockerignore

bin\
obj\

构建应用容器镜像

在项目

TodoApi

docker build -t todoapi .

-t

name:tag

name

todoapi

latest

如命令执行成功，终端会有类似如下输出：

$ docker build -t todoapi .
Sending build context to Docker daemon  1.137MB
Step 1/10 : FROM microsoft/dotnet:2.2-sdk AS build-env
2.2-sdk: Pulling from microsoft/dotnet
e79bb959ec00: Pull complete
d4b7902036fe: Pull complete
1b2a72d4e030: Pull complete
d54db43011fd: Pull complete
b3ae1535ac68: Pull complete
f04cf82b07ad: Pull complete
6f91a9d92092: Pull complete
Digest: sha256:c443ff79311dde76cb1acf625ae47581da45aad4fd66f84ab6ebf418016cc008
Status: Downloaded newer image for microsoft/dotnet:2.2-sdk
---> e268893be733
Step 2/10 : WORKDIR /app
---> Running in c7f62130f331
Removing intermediate container c7f62130f331
---> e8b6a73d3d84
Step 3/10 : COPY *.csproj ./
---> cfa03afa6003
Step 4/10 : RUN dotnet restore
---> Running in d96a9b89e4a9
Restore completed in 924.67 ms for /app/TodoApi.csproj.
Removing intermediate container d96a9b89e4a9
---> 14d5d32d40b6
Step 5/10 : COPY . ./
---> b1242ea0b0b8
Step 6/10 : RUN dotnet publish -c Release -o out
---> Running in 37c8eb07c86e
Microsoft (R) Build Engine version 16.0.450+ga8dc7f1d34 for .NET Core
Copyright (C) Microsoft Corporation. All rights reserved.

Restore completed in 663.74 ms for /app/TodoApi.csproj.
TodoApi -> /app/bin/Release/netcoreapp2.2/TodoApi.dll
TodoApi -> /app/out/
Removing intermediate container 37c8eb07c86e
---> 6238f4c1cf07
Step 7/10 : FROM microsoft/dotnet:2.2-aspnetcore-runtime
2.2-aspnetcore-runtime: Pulling from microsoft/dotnet
27833a3ba0a5: Pull complete
25dbf7dc93e5: Pull complete
0ed9cb15d3b8: Pull complete
874ea13b7488: Pull complete
Digest: sha256:ffd756d34bb0f976ba5586f6c88597765405af8014ae51b34811992b46ba40e8
Status: Downloaded newer image for microsoft/dotnet:2.2-aspnetcore-runtime
---> cb2dd04458bc
Step 8/10 : WORKDIR /app
---> Running in b0a3826d346b
Removing intermediate container b0a3826d346b
---> 4218db4cc2f5
Step 9/10 : COPY --from=build-env /app/out .
---> 765168aa2c7a
Step 10/10 : ENTRYPOINT ["dotnet", "TodoApi.dll"]
---> Running in f93bcaf5591f
Removing intermediate container f93bcaf5591f
---> 046226f5e9cb
Successfully built 046226f5e9cb
Successfully tagged todoapi:latest

dotnet-sdk

aspnetcore-runtime

构建完成后，我们可以通过

docker images

todoapi

REPOSITORY           TAG                      IMAGE ID            CREATED             SIZE
todoapi              latest                   c92a82f0efaa        19 hours ago        260MB
microsoft/dotnet     2.2-sdk                  5e09f77009fa        26 hours ago        1.74GB
microsoft/dotnet     2.2-aspnetcore-runtime   08ed21b5758c        26 hours ago        260MB
...

运行应用容器

容器镜像构建完成后，就可以使用

docker run

开发环境下，通常会通过

docker run --rm -it

docker run --rm -it -p 5000:80 todoapi

• -it

  参数表示以交互模式运行容器并为容器重新分配一个伪输入终端，方便查看输出调试程序。
  

• --rm

  参数表示将会在容器退出后自动删除当前容器，开发模式下常用参数。
  

• -p

  参数表示会将本地计算机上的

  5000

  端口映射到容器中的默认

  80

  端口，端口映射的关系为

  host：container

  。

• todoapi

  便是我们要启动的本地镜像名称。

如命令执行成功，终端会有类似如下输出：

$ docker run -it --rm -p 5000:80 todoapi
warn: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[35]
No XML encryptor configured. Key {1a78d899-738b-4aea-a7d6-777302933f38} may be persisted to storage in unencrypted form.
Hosting environment: Production
Content root path: /app
Now listening on: http://[::]:80
Application started. Press Ctrl+C to shut down.

生产环境下，通常会通过

docker run -d

docker run -d --restart=always --name myapp -p 5000:80 todoapi

• -d

  参数表示会将容器作为服务启动，不需要终端交互。

• --name

  参数用来指定容器名称，本例指定容器名称为

  myapp

  。

• --restart

  是一个面向生产环境的参数，用来指定容器非正常退出时的重启策略，本例

  always

  表示始终重新启动容器，其他可选策略请参考 Restart policies (--restart)。

如命令执行成功，终端会有类似如下输出：

$ docker run -d --restart=always --name myapp -p 5000:80 todoapi
e3d747d9d2b4cd14b2acb24f81bea9312f89c4eb689dba5f6559950c91db1600

容器启动后，在 Web 浏览器中再次访问

http://localhost:5000/api/values

["value1","value2"]

至此，我们的 ASP.NET Core 应用就成功运行在 Docker 容器中了。

多容器应用部署

目前我们创建的演示项目

TodoApi

还有就是，生产环境我们一般不会将 ASP.NET Core 应用程序的宿主服务器 Kestrel 直接暴露给用户，通常是在前面加一个反向代理服务 Nginx。

这些依赖服务还要像传统部署方式那样，一个一个单独配置部署吗？不用的，因为它们本身也是可以被容器化的，所以我们只要考虑如何把各个相互依赖的容器联系到一起，这就涉及到容器编排，而 Docker Compose 正是用来解决这一问题的，最终可以实现多容器应用的一键部署。

YAML

安装 Docker Compose

Linux 系统下的安装过程大致分为以下几步：

Step1：运行如下命令下载 Compose 最新稳定版本，截止发稿前最新版本为

1.24.0

sudo curl -L "https://github.com/docker/compose/releases/download/1.24.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

Step2：对下载完成的二进制程序添加可执行权限。

sudo chmod +x /usr/local/bin/docker-compose

Step3：测试安装是否成功。

$ docker-compose --version
docker-compose version 1.24.0, build 0aa59064

改造演示项目

现在来改造一下我们的演示项目

TodoApi

在

TodoApi

dotnet add package Microsoft.Extensions.Caching.StackExchangeRedis --version 2.2.0

修改应用启动配置文件

Startup.cs

ConfigureServices

// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
services.AddStackExchangeRedisCache(options =>
{
options.Configuration = Configuration.GetConnectionString("Redis");
});

services.AddHttpContextAccessor();

services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
}

在

TodoApi

Controllers

HelloController

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Caching.Distributed;

namespace TodoApi.Controllers
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Caching.Distributed;

namespace TodoApi.Controllers
{
[Route("api/[controller]")]
[ApiController]
public class HelloController : ControllerBase
{
private readonly IDistributedCache _distributedCache;
private readonly IHttpContextAccessor _httpContextAccessor;

public HelloController(
IDistributedCache distributedCache,
IHttpContextAccessor httpContextAccessor)
{
_distributedCache = distributedCache;
_httpContextAccessor = httpContextAccessor;
}

[HttpGet]
public ActionResult<string> Get()
{
var connection = _httpContextAccessor.HttpContext.Connection;
var ipv4 = connection.LocalIpAddress.MapToIPv4().ToString();
var message = $"Hello from Docker Container：{ipv4}";

return message;
}

[HttpGet("{name}")]
public ActionResult<string> Get(string name)
{
var defaultKey = $"hello:{name}";
_distributedCache.SetString(defaultKey, $"Hello {name} form Redis");
var message = _distributedCache.GetString(defaultKey);

return message;
}
}
}

以上控制器，提供了两个接口

/api/hello

/api/hello/{name}

创建 docker-compose.yml

准备工作就绪，下面我们就可以使用 Docker Compose 来编排容器。

同样是在

TodoApi

docker-compose.yml

version: "3.7"
services:
myproject-todoapi-1:
container_name: my-todoapi-1
build:
context: .
dockerfile: Dockerfile
restart: always
ports:
- "5001:80"
volumes:
- ./appsettings.json:/app/appsettings.json

myproject-todoapi-2:
container_name: my-todoapi-2
build:
context: .
dockerfile: Dockerfile
restart: always
ports:
- "5002:80"
volumes:
- ./appsettings.json:/app/appsettings.json

myproject-todoapi-3:
container_name: my-todoapi-3
build:
context: .
dockerfile: Dockerfile
restart: always
ports:
- "5003:80"
volumes:
- ./appsettings.json:/app/appsettings.json

myproject-nginx:
container_name: my-nginx
image: nginx
restart: always
ports:
- "80:80"
volumes:
- ./conf/nginx.conf:/etc/nginx/conf.d/default.conf

myproject-redis:
container_name: my-redis
image: redis
restart: always
ports:
- "6379:80"
volumes:
- ./conf/redis.conf:/etc/redis/redis.conf

其中

version

3.7

Compose 中强化了服务的概念，简单地理解就是， 服务是一种用于生产环境的容器。一个多容器 Docker 应用由若干个服务组成，如上文件即定义了 5 个服务：

• 3 个应用服务

  myproject-todoapi-1

  、

  myproject-todoapi-2

  和

  myproject-todoapi-3

• 1 个 Nginx 服务

  myproject-reverse-proxy

• 1 个 Redis 服务

  myproject-redis

以上 5 个服务的配置参数相差无几、也很简单，我就不展开叙述，不清楚的可以参阅 Compose file reference。

这里只讲一个配置参数

volumes

我们知道，容器中的文件在宿主机上存在形式复杂，修改文件需要先通过如下命令进入容器后操作。

docker exec -it <CONTAINER ID/NAMES> /bin/bash

容器一旦删除，其内部配置以及产生的数据也会丢失。

为了解决这些问题，Docker 引入了数据卷 volumes 机制。即 Compose 中 volumes 参数用来将宿主机的某个目录或文件映射挂载到 Docker 容器内部的对应的目录或文件，通常被用来灵活挂载配置文件或持久化容器产生的数据。

创建相关配置文件

接下来，需要根据如上

docker-compose.yml

volumes

首先，在

TodoApi

myproject-todoapi-*

appsettings.json

"ConnectionStrings": {
"Redis": "myproject-redis:6379,password=todoapi@2019"
},

以上配置，指定了 Redis 服务

myproject-redis

myproject-redis

password=todoapi@2019

然后，在

TodoApi

conf

mkdir conf && cd conf

先来创建 Redis 服务

myproject-redis

可以通过如下命令，下载一个 Redis 官方提供的标准配置文件

redis.conf

wget http://download.redis.io/redis-stable/redis.conf

然后打开下载后的

redis.conf

SECURITY

requirepass todoapi@2019

再来创建 Nginx 服务

myproject-nginx

在

conf

nginx.conf

upstream todoapi {
server myproject-todoapi-1:80;
server myproject-todoapi-2:80;
server myproject-todoapi-3:80;
}
server {
listen 80;
location / {
proxy_pass http://todoapi;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}

以上配置，是一个 Nginx 中具备负载均衡的代理配置，其默认采用轮循策略将请求转发给 Docker 服务

myproject-todoapi-1

myproject-todoapi-2

myproject-todoapi-3

运行并测试多容器应用

经过以上几个小节，容器编排的过程就完成了，接下来就可以直接定义并启动我们创建的多容器应用实例了。

切换到

docker-compose.yml

TodoApi

docker-compose up -d

如命令执行成功，终端最后会有类似如下输出：

......
Creating my-todoapi-1 ... done
Creating my-redis     ... done
Creating my-todoapi-3 ... done
Creating my-nginx     ... done
Creating my-todoapi-2 ... done

至此，我们的多容器应用就已经在运行了，可以通过

docker-compose ps

$ docker-compose ps
Name                  Command               State               Ports
--------------------------------------------------------------------------------------
my-nginx       nginx -g daemon off;             Up      0.0.0.0:80->80/tcp
my-redis       docker-entrypoint.sh redis ...   Up      6379/tcp, 0.0.0.0:6379->80/tcp
my-todoapi-1   dotnet TodoApi.dll               Up      0.0.0.0:5001->80/tcp
my-todoapi-2   dotnet TodoApi.dll               Up      0.0.0.0:5002->80/tcp
my-todoapi-3   dotnet TodoApi.dll               Up      0.0.0.0:5003->80/tcp

可以通过连续三次请求

/api/hello

curl http://localhost/api/hello
curl http://localhost/api/hello
curl http://localhost/api/hello

// Output:

Hello from Docker Container：172.30.0.2
Hello from Docker Container：172.30.0.4
Hello from Docker Container：172.30.0.5

三个应用服务分别部署在不同容器中，所以理论上来讲，他们的容器内部 IP 也是不同的，所以

/api/hello

请求

/api/hello/{name}

curl http://localhost/api/hello/esofar

// Output:

Hello esofar form Redis

小结

本文从零构建了一个 ASP.NET Core 应用，并通过 Docker 部署，然后由浅入深，引入 Docker Compose 演示了多容器应用的部署过程。通过本文的实战您可以更深入地了解 Docker。本文涉及的代码已托管到以下地址，您在实验过程中遇到问题可以参考。

https://github.com/esofar/dockerize-aspnetcore-samples

Docker 命令附录

$ docker --help

Usage:  docker [OPTIONS] COMMAND

A self-sufficient runtime for containers

Options:
--config string      Location of client config files (default "/root/.docker")
-D, --debug              Enable debug mode
-H, --host list          Daemon socket(s) to connect to
-l, --log-level string   Set the logging level ("debug"|"info"|"warn"|"error"|"fatal") (default "info")
--tls                Use TLS; implied by --tlsverify
--tlscacert string   Trust certs signed only by this CA (default "/root/.docker/ca.pem")
--tlscert string     Path to TLS certificate file (default "/root/.docker/cert.pem")
--tlskey string      Path to TLS key file (default "/root/.docker/key.pem")
--tlsverify          Use TLS and verify the remote
-v, --version            Print version information and quit

Management Commands:
builder     Manage builds
config      Manage Docker configs
container   Manage containers
engine      Manage the docker engine
image       Manage images
network     Manage networks
node        Manage Swarm nodes
plugin      Manage plugins
secret      Manage Docker secrets
service     Manage services
stack       Manage Docker stacks
swarm       Manage Swarm
system      Manage Docker
trust       Manage trust on Docker images
volume      Manage volumes

Commands:
attach      Attach local standard input, output, and error streams to a running container
build       Build an image from a Dockerfile
commit      Create a new image from a container's changes
cp          Copy files/folders between a container and the local filesystem
create      Create a new container
diff        Inspect changes to files or directories on a container's filesystem
events      Get real time events from the server
exec        Run a command in a running container
export      Export a container's filesystem as a tar archive
history     Show the history of an image
images      List images
import      Import the contents from a tarball to create a filesystem image
info        Display system-wide information
inspect     Return low-level information on Docker objects
kill        Kill one or more running containers
load        Load an image from a tar archive or STDIN
login       Log in to a Docker registry
logout      Log out from a Docker registry
logs        Fetch the logs of a container
pause       Pause all processes within one or more containers
port        List port mappings or a specific mapping for the container
ps          List containers
pull        Pull an image or a repository from a registry
push        Push an image or a repository to a registry
rename      Rename a container
restart     Restart one or more containers
rm          Remove one or more containers
rmi         Remove one or more images
run         Run a command in a new container
save        Save one or more images to a tar archive (streamed to STDOUT by default)
search      Search the Docker Hub for images
start       Start one or more stopped containers
stats       Display a live stream of container(s) resource usage statistics
stop        Stop one or more running containers
tag         Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE
top         Display the running processes of a container
unpause     Unpause all processes within one or more containers
update      Update configuration of one or more containers
version     Show the Docker version information
wait        Block until one or more containers stop, then print their exit codes

Docker Compose 命令附录

$ docker-compose --help
Define and run multi-container applications with Docker.

Usage:
docker-compose [-f <arg>...] [options] [COMMAND] [ARGS...]
docker-compose -h|--help

Options:
-f, --file FILE             Specify an alternate compose file
(default: docker-compose.yml)
-p, --project-name NAME     Specify an alternate project name
(default: directory name)
--verbose                   Show more output
--log-level LEVEL           Set log level (DEBUG, INFO, WARNING, ERROR, CRITICAL)
--no-ansi                   Do not print ANSI control characters
-v, --version               Print version and exit
-H, --host HOST             Daemon socket to connect to

--tls                       Use TLS; implied by --tlsverify
--tlscacert CA_PATH         Trust certs signed only by this CA
--tlscert CLIENT_CERT_PATH  Path to TLS certificate file
--tlskey TLS_KEY_PATH       Path to TLS key file
--tlsverify                 Use TLS and verify the remote
--skip-hostname-check       Don't check the daemon's hostname against the
name specified in the client certificate
--project-directory PATH    Specify an alternate working directory
(default: the path of the Compose file)
--compatibility             If set, Compose will attempt to convert keys
in v3 files to their non-Swarm equivalent

Commands:
build              Build or rebuild services
bundle             Generate a Docker bundle from the Compose file
config             Validate and view the Compose file
create             Create services
down               Stop and remove containers, networks, images, and volumes
events             Receive real time events from containers
exec               Execute a command in a running container
help               Get help on a command
images             List images
kill               Kill containers
logs               View output from containers
pause              Pause services
port               Print the public port for a port binding
ps                 List containers
pull               Pull service images
push               Push service images
restart            Restart services
rm                 Remove stopped containers
run                Run a one-off command
scale              Set number of containers for a service
start              Start services
stop               Stop services
top                Display the running processes
unpause            Unpause services
up                 Create and start containers
version            Show the Docker-Compose version information

相关阅读

• ASP.NET Core Docker Sample
• Dockerize a .NET Core application
• Best practices for writing Dockerfiles
• Fun With Docker-Compose Using .NET Core And NGINX
• ASP.NET Core 2.2: implementando Load Balancing com Nginx, Docker e Docker Compose