flowchart TD
A[Dockerfile] --> B[docker build]
B --> C{指令解析}
C -->|FROM| D[拉取基础镜像]
C -->|COPY/ADD| E[复制文件]
C -->|RUN| F[执行命令]
C -->|ENV| G[设置环境变量]
C -->|EXPOSE| H[声明端口]
C -->|CMD/ENTRYPOINT| I[定义启动命令]
D --> J[创建镜像层]
E --> J
F --> J
G --> J
H --> J
I --> J
J --> K[生成新镜像]
K --> L[推送到仓库]
style A fill:#f9f,stroke:#333,stroke-width:2px
style K fill:#9f9,stroke:#333,stroke-width:2px
flowchart TD
subgraph 容器虚拟化技术
A[Linux Namespace] --> B[PID Namespace]
A --> C[NET Namespace]
A --> D[IPC Namespace]
A --> E[Mount Namespace]
A --> F[UTS Namespace]
A --> G[User Namespace]
H[Linux CGroup] --> I[CPU限制]
H --> J[内存限制]
H --> K[IO限制]
H --> L[PID限制]
M[UnionFS] --> N[AUFS]
M --> O[Overlay2]
M --> P[Btrfs]
end
subgraph Docker架构
Q[Docker Engine] --> R[Docker Daemon]
Q --> S[Docker CLI]
Q --> T[REST API]
U[容器运行时] --> V[containerd]
V --> W[runc]
V --> X[CRI接口]
Y[镜像管理] --> Z[镜像仓库]
Y --> AA[镜像缓存]
Y --> AB[镜像分层]
end
subgraph 容器网络
AC[网络模式] --> AD[bridge模式]
AC --> AE[host模式]
AC --> AF[none模式]
AC --> AG[container模式]
AH[网络插件] --> AI[CNI插件]
AI --> AJ[flannel]
AI --> AK[calico]
AI --> AL[weave]
AM[DNS解析] --> AN[内置DNS]
AN --> AO[容器名称解析]
end
subgraph 容器存储
AP[存储驱动] --> AQ[overlay2]
AP --> AR[aufs]
AP --> AS[btrfs]
AP --> AT[devicemapper]
AU[数据持久化] --> AV[Volume]
AU --> AW[Bind Mount]
AU --> AX[Tmpfs]
AY[存储插件] --> AZ[CSI插件]
end
subgraph 容器安全
BA[安全隔离] --> BB[AppArmor]
BA --> BC[SELinux]
BA --> BD[Capabilities]
BE[镜像安全] --> BF[镜像签名]
BE --> BG[镜像扫描]
BE --> BH[漏洞检测]
BI[运行时安全] --> BJ[容器逃逸防护]
BJ --> BK[恶意进程检测]
end
subgraph 容器编排集成
BL[Kubernetes] --> BM[CRI接口]
BM --> BN[Pod管理]
BN --> BO[容器调度]
BP[Docker Compose] --> BQ[多容器编排]
BQ --> BR[网络配置]
BQ --> BS[依赖管理]
end
A --> Q
H --> U
M --> Y
AC --> BL
AP --> AU
BA --> BI