1. 项目概述最近在帮朋友部署一个Python开发的Web应用时我重新梳理了一遍从代码到生产环境的完整部署流程。这个过程中涉及到Docker容器化、Nginx反向代理等多个技术环节每个环节都有不少值得注意的细节。今天就把这套经过实战检验的部署方案完整分享出来特别适合中小型Python Web项目的生产环境部署。这个方案的核心优势在于使用Docker实现环境隔离和快速部署通过Nginx提供高性能的静态文件服务和反向代理配置简单但完整覆盖生产环境需求易于扩展和后续维护无论你是部署Django、Flask还是其他Python Web框架这套方案都能提供稳定可靠的生产环境支持。下面我就从环境准备开始一步步带你完成整个部署过程。2. 环境准备与基础配置2.1 服务器基础环境首先需要准备一台Linux服务器推荐Ubuntu 20.04/22.04 LTS确保满足以下基本要求系统更新sudo apt update sudo apt upgrade -y安装必要工具sudo apt install -y curl git vim net-tools配置SSH安全访问修改默认端口、禁用root登录等提示生产环境务必配置防火墙规则只开放必要的端口如80、443、SSH端口2.2 Docker安装与配置Docker是我们部署方案的核心组件安装步骤如下安装Docker官方GPG密钥curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg添加Docker仓库echo deb [arch$(dpkg --print-architecture) signed-by/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable | sudo tee /etc/apt/sources.list.d/docker.list /dev/null安装Docker引擎sudo apt update sudo apt install -y docker-ce docker-ce-cli containerd.io验证安装sudo docker run hello-world配置非root用户使用Dockersudo usermod -aG docker $USER newgrp docker2.3 Docker Compose安装虽然我们可以直接使用docker命令但使用Docker Compose能更好地管理多容器应用sudo curl -L https://github.com/docker/compose/releases/download/v2.20.3/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose sudo chmod x /usr/local/bin/docker-compose验证安装docker-compose --version3. Python Web应用容器化3.1 项目结构准备典型的Python Web项目在容器化前应有清晰的文件结构mywebapp/ ├── app/ # 应用代码 │ ├── __init__.py │ ├── views.py │ └── ... ├── requirements.txt # 依赖文件 ├── Dockerfile # 容器构建文件 ├── docker-compose.yml # 编排文件 └── nginx/ └── nginx.conf # Nginx配置3.2 编写Dockerfile这是一个针对Python Web应用的通用Dockerfile模板# 使用官方Python镜像作为基础 FROM python:3.9-slim # 设置工作目录 WORKDIR /app # 先复制依赖文件利用Docker缓存层 COPY requirements.txt . # 安装依赖 RUN pip install --no-cache-dir -r requirements.txt # 复制应用代码 COPY . . # 暴露应用端口 EXPOSE 8000 # 定义启动命令 CMD [gunicorn, --bind, 0.0.0.0:8000, app.wsgi:application]关键点说明使用slim镜像减小体积先复制requirements.txt以利用缓存使用--no-cache-dir避免缓存占用空间使用Gunicorn作为WSGI服务器3.3 构建和测试容器构建镜像docker build -t mywebapp .运行测试docker run -d -p 8000:8000 --name webapp mywebapp验证应用是否正常运行curl http://localhost:80004. Nginx配置与优化4.1 安装Nginx容器我们不直接在主机安装Nginx而是使用官方Nginx镜像docker pull nginx:latest4.2 Nginx基础配置创建nginx/nginx.conf配置文件worker_processes auto; events { worker_connections 1024; } http { server_tokens off; include /etc/nginx/mime.types; default_type application/octet-stream; # 日志格式 log_format main $remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for; access_log /var/log/nginx/access.log main; error_log /var/log/nginx/error.log warn; # 启用gzip压缩 gzip on; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xmlrss text/javascript; # 静态文件缓存 proxy_cache_path /var/cache/nginx levels1:2 keys_zoneSTATIC:10m inactive7d use_temp_pathoff; # 反向代理配置 server { listen 80; server_name yourdomain.com; location / { proxy_pass http://webapp:8000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /static/ { alias /app/static/; expires 30d; access_log off; add_header Cache-Control public; } location /media/ { alias /app/media/; expires 30d; access_log off; add_header Cache-Control public; } } }4.3 安全加固配置在server块中添加以下安全相关配置# 禁用iframe嵌入 add_header X-Frame-Options SAMEORIGIN; # 启用XSS保护 add_header X-XSS-Protection 1; modeblock; # 防止MIME类型混淆攻击 add_header X-Content-Type-Options nosniff; # CSP策略根据实际需求调整 add_header Content-Security-Policy default-src self; script-src self unsafe-inline cdn.example.com; style-src self unsafe-inline; img-src self data:; font-src self; connect-src self; frame-src none; object-src none; # 限制HTTP方法 if ($request_method !~ ^(GET|HEAD|POST)$ ) { return 405; }5. 使用Docker Compose编排服务5.1 编写docker-compose.yml完整的编排文件示例version: 3.8 services: webapp: build: . container_name: webapp restart: unless-stopped environment: - PYTHONUNBUFFERED1 - DJANGO_SETTINGS_MODULEapp.settings.production volumes: - ./app:/app - static_volume:/app/static - media_volume:/app/media networks: - web_network depends_on: - redis healthcheck: test: [CMD, curl, -f, http://localhost:8000/health] interval: 30s timeout: 10s retries: 3 nginx: image: nginx:latest container_name: nginx restart: unless-stopped ports: - 80:80 - 443:443 volumes: - ./nginx/nginx.conf:/etc/nginx/nginx.conf - ./nginx/conf.d:/etc/nginx/conf.d - static_volume:/app/static:ro - media_volume:/app/media:ro - ./certbot/conf:/etc/letsencrypt - ./certbot/www:/var/www/certbot networks: - web_network depends_on: - webapp redis: image: redis:alpine container_name: redis restart: unless-stopped volumes: - redis_data:/data networks: - web_network volumes: static_volume: media_volume: redis_data: networks: web_network: driver: bridge5.2 关键配置说明网络配置创建专用网络web_network实现容器间通信容器间使用服务名互访如webapp:8000数据持久化使用命名卷保存静态文件、媒体文件和Redis数据确保容器重启后数据不丢失健康检查配置webapp容器的健康检查端点便于监控和自动恢复环境变量通过环境变量区分开发和生产配置敏感信息应使用Docker secrets或环境文件6. HTTPS配置与证书管理6.1 使用Certbot获取SSL证书在docker-compose.yml中添加certbot服务certbot: image: certbot/certbot container_name: certbot volumes: - ./certbot/conf:/etc/letsencrypt - ./certbot/www:/var/www/certbot command: certonly --webroot -w /var/www/certbot --email youremail.com -d yourdomain.com --agree-tos --non-interactive --keep-until-expiring depends_on: - nginx6.2 更新Nginx配置支持HTTPS创建nginx/conf.d/ssl.confserver { listen 443 ssl http2; server_name yourdomain.com; ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem; ssl_certificate_key /etc/lets/encrypt/live/yourdomain.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256...; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; # 其他配置同HTTP版本 ... } # HTTP重定向到HTTPS server { listen 80; server_name yourdomain.com; return 301 https://$host$request_uri; }6.3 证书自动续期创建续期脚本renew_cert.sh#!/bin/bash docker-compose stop nginx docker run --rm --name certbot \ -v /path/to/certbot/conf:/etc/letsencrypt \ -v /path/to/certbot/www:/var/www/certbot \ certbot/certbot renew --quiet docker-compose start nginx添加到crontab每月执行0 0 1 * * /path/to/renew_cert.sh /var/log/certbot-renew.log 217. 部署与维护实践7.1 完整部署流程上传代码到服务器构建Docker镜像docker-compose build启动所有服务docker-compose up -d初始化数据库如需要docker-compose exec webapp python manage.py migrate收集静态文件docker-compose exec webapp python manage.py collectstatic --noinput7.2 日常维护操作查看服务状态docker-compose ps查看日志docker-compose logs -f webapp进入容器docker-compose exec webapp bash更新代码后重新部署docker-compose down git pull origin main docker-compose build docker-compose up -d7.3 性能监控与优化容器资源监控docker statsNginx状态监控server { location /nginx_status { stub_status on; access_log off; allow 127.0.0.1; deny all; } }Gunicorn优化参数# gunicorn_config.py workers (2 * cpu_count()) 1 worker_class gevent worker_connections 1000 timeout 30 keepalive 28. 常见问题与解决方案8.1 容器启动失败排查查看容器日志docker logs container_id检查端口冲突netstat -tuln | grep port检查Docker网络docker network inspect web_network8.2 Nginx 502 Bad Gateway可能原因及解决方案后端服务未启动docker-compose ps网络配置错误docker-compose exec webapp curl http://localhost:8000权限问题docker-compose exec nginx nginx -t8.3 静态文件404错误检查步骤确认静态文件路径docker-compose exec webapp ls -l /app/static检查Nginx配置docker-compose exec nginx cat /etc/nginx/nginx.conf重新收集静态文件docker-compose exec webapp python manage.py collectstatic --noinput8.4 数据库连接问题常见排查方法检查数据库服务状态docker-compose exec redis redis-cli ping检查连接字符串docker-compose exec webapp env | grep DB测试直接连接docker-compose exec webapp python -c import redis; rredis.Redis(hostredis); print(r.ping())9. 高级配置与优化9.1 多阶段构建优化改进后的Dockerfile# 构建阶段 FROM python:3.9 as builder WORKDIR /app COPY requirements.txt . RUN pip install --user -r requirements.txt # 运行时阶段 FROM python:3.9-slim WORKDIR /app COPY --frombuilder /root/.local /root/.local COPY . . ENV PATH/root/.local/bin:$PATH EXPOSE 8000 CMD [gunicorn, --bind, 0.0.0.0:8000, app.wsgi:application]9.2 负载均衡配置扩展docker-compose.yml支持多实例services: webapp: # ...原有配置 deploy: replicas: 3 resources: limits: cpus: 0.5 memory: 512M restart_policy: condition: on-failure delay: 5s max_attempts: 3 window: 120s nginx: # ...更新配置 environment: - UPSTREAM_SERVERSwebapp:8000 configs: - source: nginx_load_balancer.conf target: /etc/nginx/nginx.conf对应的nginx_load_balancer.confupstream webapp { server webapp:8000; # 更多服务器可以添加在这里 } server { location / { proxy_pass http://webapp; # ...其他代理配置 } }9.3 日志收集与分析配置ELK栈收集日志services: # ...原有服务 filebeat: image: docker.elastic.co/beats/filebeat:8.7.0 container_name: filebeat volumes: - ./filebeat.yml:/usr/share/filebeat/filebeat.yml - /var/lib/docker/containers:/var/lib/docker/containers:ro - /var/run/docker.sock:/var/run/docker.sock:ro depends_on: - elasticsearch - kibana elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:8.7.0 environment: - discovery.typesingle-node - xpack.security.enabledfalse volumes: - es_data:/usr/share/elasticsearch/data ports: - 9200:9200 kibana: image: docker.elastic.co/kibana/kibana:8.7.0 ports: - 5601:5601 depends_on: - elasticsearch volumes: es_data:对应的filebeat.yml配置filebeat.inputs: - type: container paths: - /var/lib/docker/containers/*/*.log processors: - add_docker_metadata: ~ output.elasticsearch: hosts: [elasticsearch:9200]10. 安全最佳实践10.1 容器安全加固使用非root用户运行容器FROM python:3.9-slim RUN groupadd -r appuser useradd -r -g appuser appuser USER appuser # ...其余配置限制容器能力services: webapp: # ...其他配置 security_opt: - no-new-privileges:true cap_drop: - ALL read_only: true tmpfs: - /tmp:rw,size64M10.2 敏感信息管理使用Docker secretsecho mysecretpassword | docker secret create db_password -然后在docker-compose.yml中引用services: webapp: # ...其他配置 secrets: - db_password environment: - DB_PASSWORD_FILE/run/secrets/db_password secrets: db_password: external: true10.3 网络安全配置限制网络访问networks: web_network: driver: bridge internal: true # 限制外部访问 public_network: driver: bridge服务间通信加密services: webapp: # ...其他配置 environment: - REDIS_URLrediss://redis:637911. 备份与恢复策略11.1 数据备份方案数据库备份脚本#!/bin/bash BACKUP_DIR/backups DATE$(date %Y%m%d_%H%M%S) docker-compose exec -T redis redis-cli save docker cp redis:/data/dump.rdp $BACKUP_DIR/redis_$DATE.rdp媒体文件备份docker run --rm -v media_volume:/data -v $BACKUP_DIR:/backup alpine \ tar czf /backup/media_$DATE.tar.gz -C /data .11.2 自动化备份配置添加到crontab0 2 * * * /path/to/backup_script.sh /var/log/backup.log 2111.3 灾难恢复流程恢复Redis数据docker-compose stop redis docker cp backup.rdp redis:/data/dump.rdp docker-compose start redis恢复媒体文件docker run --rm -v media_volume:/data -v $BACKUP_DIR:/backup alpine \ tar xzf /backup/latest_media.tar.gz -C /data12. 监控与告警配置12.1 Prometheus监控docker-compose.yml添加services: prometheus: image: prom/prometheus ports: - 9090:9090 volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml command: - --config.file/etc/prometheus/prometheus.yml networks: - web_network grafana: image: grafana/grafana ports: - 3000:3000 volumes: - grafana_data:/var/lib/grafana networks: - web_network depends_on: - prometheus对应的prometheus.yml配置global: scrape_interval: 15s scrape_configs: - job_name: webapp static_configs: - targets: [webapp:8000] - job_name: nginx static_configs: - targets: [nginx:80]12.2 告警规则配置在prometheus.yml中添加rule_files: - alerts.ymlalerts.yml示例groups: - name: webapp rules: - alert: HighErrorRate expr: rate(http_requests_total{status~5..}[5m]) / rate(http_requests_total[5m]) 0.1 for: 10m labels: severity: critical annotations: summary: High error rate on {{ $labels.instance }} description: Error rate is {{ $value }}12.3 告警通知集成配置Alertmanagerservices: alertmanager: image: prom/alertmanager ports: - 9093:9093 volumes: - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml networks: - web_networkalertmanager.yml示例route: receiver: slack-notifications receivers: - name: slack-notifications slack_configs: - api_url: https://hooks.slack.com/services/... channel: #alerts send_resolved: true13. 持续集成与部署13.1 GitHub Actions配置创建.github/workflows/deploy.ymlname: Deploy to Production on: push: branches: [ main ] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkoutv3 - name: Install SSH key uses: shimataro/ssh-key-actionv2 with: key: ${{ secrets.SSH_PRIVATE_KEY }} known_hosts: ${{ secrets.KNOWN_HOSTS }} - name: Deploy to server run: | ssh -o StrictHostKeyCheckingno userserver cd /path/to/project git pull origin main docker-compose build docker-compose up -d docker-compose exec webapp python manage.py migrate docker-compose exec webapp python manage.py collectstatic --noinput 13.2 镜像构建与推送扩展GitHub Actions配置- name: Login to Docker Hub uses: docker/login-actionv2 with: username: ${{ secrets.DOCKER_HUB_USERNAME }} password: ${{ secrets.DOCKER_HUB_TOKEN }} - name: Build and push uses: docker/build-push-actionv3 with: context: . push: true tags: user/repo:latest13.3 滚动更新策略更新docker-compose.ymlservices: webapp: # ...其他配置 deploy: update_config: parallelism: 2 delay: 10s order: start-first对应的更新命令docker-compose pull webapp docker-compose up -d --no-deps webapp14. 性能调优实战14.1 Nginx调优参数worker_processes auto; worker_rlimit_nofile 100000; events { worker_connections 4000; multi_accept on; use epoll; } http { # 其他配置... client_max_body_size 100M; client_body_buffer_size 1M; client_header_buffer_size 1k; large_client_header_buffers 4 8k; # TCP优化 sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 30; keepalive_requests 1000; reset_timedout_connection on; # 静态文件优化 open_file_cache max200000 inactive20s; open_file_cache_valid 30s; open_file_cache_min_uses 2; open_file_cache_errors on; }14.2 Gunicorn调优配置创建gunicorn_config.pyimport multiprocessing bind 0.0.0.0:8000 workers multiprocessing.cpu_count() * 2 1 worker_class gthread threads 4 max_requests 1000 max_requests_jitter 50 timeout 30 keepalive 2 accesslog - errorlog -14.3 数据库连接池配置对于Django项目在settings.py中添加DATABASES { default: { ENGINE: django.db.backends.postgresql, NAME: mydb, USER: user, PASSWORD: password, HOST: db, PORT: 5432, OPTIONS: { connect_timeout: 5, options: -c statement_timeout5000, }, CONN_MAX_AGE: 300, } }15. 成本优化策略15.1 资源限制与分配在docker-compose.yml中合理设置资源限制services: webapp: # ...其他配置 deploy: resources: limits: cpus: 1 memory: 1G reservations: cpus: 0.5 memory: 512M15.2 镜像大小优化多阶段构建Dockerfile优化# 构建阶段 FROM python:3.9 as builder WORKDIR /app COPY requirements.txt . RUN pip install --user --no-cache-dir -r requirements.txt # 清理阶段 FROM builder as cleaner RUN find /usr/local/lib/python3.9 -type d -name __pycache__ -exec rm -rf {} RUN find /usr/local/lib/python3.9 -type d -name tests -exec rm -rf {} RUN find /root/.local/lib/python3.9 -type d -name __pycache__ -exec rm -rf {} # 运行时阶段 FROM python:3.9-slim WORKDIR /app COPY --fromcleaner /root/.local /root/.local COPY --fromcleaner /usr/local/lib/python3.9 /usr/local/lib/python3.9 COPY . . ENV PATH/root/.local/bin:$PATH EXPOSE 8000 CMD [gunicorn, --bind, 0.0.0.0:8000, app.wsgi:application]15.3 自动缩放策略使用Docker Swarm或Kubernetes实现自动缩放services: webapp: # ...其他配置 deploy: mode: replicated replicas: 2 resources: limits: cpus: 0.5 memory: 512M update_config: parallelism: 1 delay: 10s restart_policy: condition: on-failure placement: constraints: - node.role worker16. 本地开发与生产一致性16.1 开发环境配置创建docker-compose.override.ymlversion: 3.8 services: webapp: volumes: - .:/app environment: - DJANGO_SETTINGS_MODULEapp.settings.development - DEBUG1 ports: - 8000:8000 command: python manage.py runserver 0.0.0.0:800016.2 热重载配置配置开发环境支持代码热更新services: webapp: # ...其他配置 volumes: - .:/app environment: - PYTHONUNBUFFERED1 - FLASK_ENVdevelopment command: watchmedo auto-restart --directory/app --pattern*.py --recursive -- python app.py16.3 开发工具集成配置VS Code开发容器{ name: Python Web App, dockerComposeFile: docker-compose.yml, service: webapp, workspaceFolder: /app, settings: { python.pythonPath: /usr/local/bin/python, python.linting.enabled: true, python.linting.pylintEnabled: true, python.formatting.provider: black }, extensions: [ ms-python.python, ms-python.vscode-pylance ] }17. 多环境管理策略17.1 环境变量管理创建.env文件# 公共配置 APP_ENVproduction SECRET_KEYyour-secret-key DEBUG0 # 数据库配置 DB_HOSTdb DB_PORT5432 DB_NAMEmydb DB_USERuser DB_PASSWORDpassword在docker-compose.yml中引用services: webapp: # ...其他配置 env_file: - .env17.2 多环境Compose文件创建docker-compose.prod.ymlversion: 3.8 services: webapp: environment: - DJANGO_SETTINGS_MODULEapp.settings.production deploy: replicas: 3 resources: limits: cpus: 1 memory: 1G使用不同环境docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d17.3 配置管理工具使用confd动态管理配置services: confd: image: kelseyhightower/confd volumes: - ./confd:/etc/confd - ./nginx/nginx.conf:/etc/nginx/nginx.conf.tmpl command: -watch -backend env -onetime environment: - NGINX_WORKER_PROCESSESauto - NGINX_WORKER_CONNECTIONS4096对应的模板文件nginx.conf.tmplworker_processes {{getenv NGINX_WORKER_PROCESSES}}; events { worker_connections {{getenv NGINX_WORKER_CONNECTIONS}}; }18. 扩展与高可用架构18.1 数据库集群配置使用PostgreSQL主从复制services: db: image: postgres:13 environment: - POSTGRES_USERuser - POSTGRES_PASSWORDpassword - POSTGRES_DBmydb volumes: - pg_data:/var/lib/postgresql/data networks: - db_network deploy: placement: constraints: - node.role manager db_replica: image: postgres:13 environment: - POSTGRES_USERuser - POSTGRES_PASSWORDpassword - POSTGRES_DBmydb - POSTGRES_HOST_AUTH_METHODtrust volumes: - pg_replica_data:/var/lib/postgresql/data command: bash -c echo \host replication replicator 0.0.0.0/0 md5\ /var/lib/postgresql/data/pg_hba.conf docker-entrypoint.sh postgres networks: - db_network depends_on: - db18.2 应用水平扩展使用Docker Swarm模式docker swarm init docker stack deploy -c docker-compose.yml myapp扩展服务实例docker service scale myapp_webapp518.3 全局服务发现使用Consul进行服务发现services: consul: image: consul ports: - 8500:8500 volumes: - consul_data:/consul/data command: agent -server -bootstrap-expect1 -client0.0.0.0 -ui registrator: image: gliderlabs/registrator volumes: - /var/run/docker.sock:/tmp/docker.sock command: -internal consul://consul:8500 depends_on: - consul19. 迁移与升级策略19.1 版本升级流程创建备份docker-compose exec db pg_dump -U user mydb backup.sql停止服务docker-compose down更新镜像版本services: webapp: image: myapp:v2.0逐步升级docker-compose up -d db docker-compose up -d webapp19.2 数据迁移方案使用Flyway进行数据库迁移services: flyway: image: flyway/flyway volumes: - ./db/migrations:/flyway/sql command: Python Web应用Docker+Nginx生产环境部署指南
1. 项目概述最近在帮朋友部署一个Python开发的Web应用时我重新梳理了一遍从代码到生产环境的完整部署流程。这个过程中涉及到Docker容器化、Nginx反向代理等多个技术环节每个环节都有不少值得注意的细节。今天就把这套经过实战检验的部署方案完整分享出来特别适合中小型Python Web项目的生产环境部署。这个方案的核心优势在于使用Docker实现环境隔离和快速部署通过Nginx提供高性能的静态文件服务和反向代理配置简单但完整覆盖生产环境需求易于扩展和后续维护无论你是部署Django、Flask还是其他Python Web框架这套方案都能提供稳定可靠的生产环境支持。下面我就从环境准备开始一步步带你完成整个部署过程。2. 环境准备与基础配置2.1 服务器基础环境首先需要准备一台Linux服务器推荐Ubuntu 20.04/22.04 LTS确保满足以下基本要求系统更新sudo apt update sudo apt upgrade -y安装必要工具sudo apt install -y curl git vim net-tools配置SSH安全访问修改默认端口、禁用root登录等提示生产环境务必配置防火墙规则只开放必要的端口如80、443、SSH端口2.2 Docker安装与配置Docker是我们部署方案的核心组件安装步骤如下安装Docker官方GPG密钥curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg添加Docker仓库echo deb [arch$(dpkg --print-architecture) signed-by/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable | sudo tee /etc/apt/sources.list.d/docker.list /dev/null安装Docker引擎sudo apt update sudo apt install -y docker-ce docker-ce-cli containerd.io验证安装sudo docker run hello-world配置非root用户使用Dockersudo usermod -aG docker $USER newgrp docker2.3 Docker Compose安装虽然我们可以直接使用docker命令但使用Docker Compose能更好地管理多容器应用sudo curl -L https://github.com/docker/compose/releases/download/v2.20.3/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose sudo chmod x /usr/local/bin/docker-compose验证安装docker-compose --version3. Python Web应用容器化3.1 项目结构准备典型的Python Web项目在容器化前应有清晰的文件结构mywebapp/ ├── app/ # 应用代码 │ ├── __init__.py │ ├── views.py │ └── ... ├── requirements.txt # 依赖文件 ├── Dockerfile # 容器构建文件 ├── docker-compose.yml # 编排文件 └── nginx/ └── nginx.conf # Nginx配置3.2 编写Dockerfile这是一个针对Python Web应用的通用Dockerfile模板# 使用官方Python镜像作为基础 FROM python:3.9-slim # 设置工作目录 WORKDIR /app # 先复制依赖文件利用Docker缓存层 COPY requirements.txt . # 安装依赖 RUN pip install --no-cache-dir -r requirements.txt # 复制应用代码 COPY . . # 暴露应用端口 EXPOSE 8000 # 定义启动命令 CMD [gunicorn, --bind, 0.0.0.0:8000, app.wsgi:application]关键点说明使用slim镜像减小体积先复制requirements.txt以利用缓存使用--no-cache-dir避免缓存占用空间使用Gunicorn作为WSGI服务器3.3 构建和测试容器构建镜像docker build -t mywebapp .运行测试docker run -d -p 8000:8000 --name webapp mywebapp验证应用是否正常运行curl http://localhost:80004. Nginx配置与优化4.1 安装Nginx容器我们不直接在主机安装Nginx而是使用官方Nginx镜像docker pull nginx:latest4.2 Nginx基础配置创建nginx/nginx.conf配置文件worker_processes auto; events { worker_connections 1024; } http { server_tokens off; include /etc/nginx/mime.types; default_type application/octet-stream; # 日志格式 log_format main $remote_addr - $remote_user [$time_local] $request $status $body_bytes_sent $http_referer $http_user_agent $http_x_forwarded_for; access_log /var/log/nginx/access.log main; error_log /var/log/nginx/error.log warn; # 启用gzip压缩 gzip on; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xmlrss text/javascript; # 静态文件缓存 proxy_cache_path /var/cache/nginx levels1:2 keys_zoneSTATIC:10m inactive7d use_temp_pathoff; # 反向代理配置 server { listen 80; server_name yourdomain.com; location / { proxy_pass http://webapp:8000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /static/ { alias /app/static/; expires 30d; access_log off; add_header Cache-Control public; } location /media/ { alias /app/media/; expires 30d; access_log off; add_header Cache-Control public; } } }4.3 安全加固配置在server块中添加以下安全相关配置# 禁用iframe嵌入 add_header X-Frame-Options SAMEORIGIN; # 启用XSS保护 add_header X-XSS-Protection 1; modeblock; # 防止MIME类型混淆攻击 add_header X-Content-Type-Options nosniff; # CSP策略根据实际需求调整 add_header Content-Security-Policy default-src self; script-src self unsafe-inline cdn.example.com; style-src self unsafe-inline; img-src self data:; font-src self; connect-src self; frame-src none; object-src none; # 限制HTTP方法 if ($request_method !~ ^(GET|HEAD|POST)$ ) { return 405; }5. 使用Docker Compose编排服务5.1 编写docker-compose.yml完整的编排文件示例version: 3.8 services: webapp: build: . container_name: webapp restart: unless-stopped environment: - PYTHONUNBUFFERED1 - DJANGO_SETTINGS_MODULEapp.settings.production volumes: - ./app:/app - static_volume:/app/static - media_volume:/app/media networks: - web_network depends_on: - redis healthcheck: test: [CMD, curl, -f, http://localhost:8000/health] interval: 30s timeout: 10s retries: 3 nginx: image: nginx:latest container_name: nginx restart: unless-stopped ports: - 80:80 - 443:443 volumes: - ./nginx/nginx.conf:/etc/nginx/nginx.conf - ./nginx/conf.d:/etc/nginx/conf.d - static_volume:/app/static:ro - media_volume:/app/media:ro - ./certbot/conf:/etc/letsencrypt - ./certbot/www:/var/www/certbot networks: - web_network depends_on: - webapp redis: image: redis:alpine container_name: redis restart: unless-stopped volumes: - redis_data:/data networks: - web_network volumes: static_volume: media_volume: redis_data: networks: web_network: driver: bridge5.2 关键配置说明网络配置创建专用网络web_network实现容器间通信容器间使用服务名互访如webapp:8000数据持久化使用命名卷保存静态文件、媒体文件和Redis数据确保容器重启后数据不丢失健康检查配置webapp容器的健康检查端点便于监控和自动恢复环境变量通过环境变量区分开发和生产配置敏感信息应使用Docker secrets或环境文件6. HTTPS配置与证书管理6.1 使用Certbot获取SSL证书在docker-compose.yml中添加certbot服务certbot: image: certbot/certbot container_name: certbot volumes: - ./certbot/conf:/etc/letsencrypt - ./certbot/www:/var/www/certbot command: certonly --webroot -w /var/www/certbot --email youremail.com -d yourdomain.com --agree-tos --non-interactive --keep-until-expiring depends_on: - nginx6.2 更新Nginx配置支持HTTPS创建nginx/conf.d/ssl.confserver { listen 443 ssl http2; server_name yourdomain.com; ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem; ssl_certificate_key /etc/lets/encrypt/live/yourdomain.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256...; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; # 其他配置同HTTP版本 ... } # HTTP重定向到HTTPS server { listen 80; server_name yourdomain.com; return 301 https://$host$request_uri; }6.3 证书自动续期创建续期脚本renew_cert.sh#!/bin/bash docker-compose stop nginx docker run --rm --name certbot \ -v /path/to/certbot/conf:/etc/letsencrypt \ -v /path/to/certbot/www:/var/www/certbot \ certbot/certbot renew --quiet docker-compose start nginx添加到crontab每月执行0 0 1 * * /path/to/renew_cert.sh /var/log/certbot-renew.log 217. 部署与维护实践7.1 完整部署流程上传代码到服务器构建Docker镜像docker-compose build启动所有服务docker-compose up -d初始化数据库如需要docker-compose exec webapp python manage.py migrate收集静态文件docker-compose exec webapp python manage.py collectstatic --noinput7.2 日常维护操作查看服务状态docker-compose ps查看日志docker-compose logs -f webapp进入容器docker-compose exec webapp bash更新代码后重新部署docker-compose down git pull origin main docker-compose build docker-compose up -d7.3 性能监控与优化容器资源监控docker statsNginx状态监控server { location /nginx_status { stub_status on; access_log off; allow 127.0.0.1; deny all; } }Gunicorn优化参数# gunicorn_config.py workers (2 * cpu_count()) 1 worker_class gevent worker_connections 1000 timeout 30 keepalive 28. 常见问题与解决方案8.1 容器启动失败排查查看容器日志docker logs container_id检查端口冲突netstat -tuln | grep port检查Docker网络docker network inspect web_network8.2 Nginx 502 Bad Gateway可能原因及解决方案后端服务未启动docker-compose ps网络配置错误docker-compose exec webapp curl http://localhost:8000权限问题docker-compose exec nginx nginx -t8.3 静态文件404错误检查步骤确认静态文件路径docker-compose exec webapp ls -l /app/static检查Nginx配置docker-compose exec nginx cat /etc/nginx/nginx.conf重新收集静态文件docker-compose exec webapp python manage.py collectstatic --noinput8.4 数据库连接问题常见排查方法检查数据库服务状态docker-compose exec redis redis-cli ping检查连接字符串docker-compose exec webapp env | grep DB测试直接连接docker-compose exec webapp python -c import redis; rredis.Redis(hostredis); print(r.ping())9. 高级配置与优化9.1 多阶段构建优化改进后的Dockerfile# 构建阶段 FROM python:3.9 as builder WORKDIR /app COPY requirements.txt . RUN pip install --user -r requirements.txt # 运行时阶段 FROM python:3.9-slim WORKDIR /app COPY --frombuilder /root/.local /root/.local COPY . . ENV PATH/root/.local/bin:$PATH EXPOSE 8000 CMD [gunicorn, --bind, 0.0.0.0:8000, app.wsgi:application]9.2 负载均衡配置扩展docker-compose.yml支持多实例services: webapp: # ...原有配置 deploy: replicas: 3 resources: limits: cpus: 0.5 memory: 512M restart_policy: condition: on-failure delay: 5s max_attempts: 3 window: 120s nginx: # ...更新配置 environment: - UPSTREAM_SERVERSwebapp:8000 configs: - source: nginx_load_balancer.conf target: /etc/nginx/nginx.conf对应的nginx_load_balancer.confupstream webapp { server webapp:8000; # 更多服务器可以添加在这里 } server { location / { proxy_pass http://webapp; # ...其他代理配置 } }9.3 日志收集与分析配置ELK栈收集日志services: # ...原有服务 filebeat: image: docker.elastic.co/beats/filebeat:8.7.0 container_name: filebeat volumes: - ./filebeat.yml:/usr/share/filebeat/filebeat.yml - /var/lib/docker/containers:/var/lib/docker/containers:ro - /var/run/docker.sock:/var/run/docker.sock:ro depends_on: - elasticsearch - kibana elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:8.7.0 environment: - discovery.typesingle-node - xpack.security.enabledfalse volumes: - es_data:/usr/share/elasticsearch/data ports: - 9200:9200 kibana: image: docker.elastic.co/kibana/kibana:8.7.0 ports: - 5601:5601 depends_on: - elasticsearch volumes: es_data:对应的filebeat.yml配置filebeat.inputs: - type: container paths: - /var/lib/docker/containers/*/*.log processors: - add_docker_metadata: ~ output.elasticsearch: hosts: [elasticsearch:9200]10. 安全最佳实践10.1 容器安全加固使用非root用户运行容器FROM python:3.9-slim RUN groupadd -r appuser useradd -r -g appuser appuser USER appuser # ...其余配置限制容器能力services: webapp: # ...其他配置 security_opt: - no-new-privileges:true cap_drop: - ALL read_only: true tmpfs: - /tmp:rw,size64M10.2 敏感信息管理使用Docker secretsecho mysecretpassword | docker secret create db_password -然后在docker-compose.yml中引用services: webapp: # ...其他配置 secrets: - db_password environment: - DB_PASSWORD_FILE/run/secrets/db_password secrets: db_password: external: true10.3 网络安全配置限制网络访问networks: web_network: driver: bridge internal: true # 限制外部访问 public_network: driver: bridge服务间通信加密services: webapp: # ...其他配置 environment: - REDIS_URLrediss://redis:637911. 备份与恢复策略11.1 数据备份方案数据库备份脚本#!/bin/bash BACKUP_DIR/backups DATE$(date %Y%m%d_%H%M%S) docker-compose exec -T redis redis-cli save docker cp redis:/data/dump.rdp $BACKUP_DIR/redis_$DATE.rdp媒体文件备份docker run --rm -v media_volume:/data -v $BACKUP_DIR:/backup alpine \ tar czf /backup/media_$DATE.tar.gz -C /data .11.2 自动化备份配置添加到crontab0 2 * * * /path/to/backup_script.sh /var/log/backup.log 2111.3 灾难恢复流程恢复Redis数据docker-compose stop redis docker cp backup.rdp redis:/data/dump.rdp docker-compose start redis恢复媒体文件docker run --rm -v media_volume:/data -v $BACKUP_DIR:/backup alpine \ tar xzf /backup/latest_media.tar.gz -C /data12. 监控与告警配置12.1 Prometheus监控docker-compose.yml添加services: prometheus: image: prom/prometheus ports: - 9090:9090 volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml command: - --config.file/etc/prometheus/prometheus.yml networks: - web_network grafana: image: grafana/grafana ports: - 3000:3000 volumes: - grafana_data:/var/lib/grafana networks: - web_network depends_on: - prometheus对应的prometheus.yml配置global: scrape_interval: 15s scrape_configs: - job_name: webapp static_configs: - targets: [webapp:8000] - job_name: nginx static_configs: - targets: [nginx:80]12.2 告警规则配置在prometheus.yml中添加rule_files: - alerts.ymlalerts.yml示例groups: - name: webapp rules: - alert: HighErrorRate expr: rate(http_requests_total{status~5..}[5m]) / rate(http_requests_total[5m]) 0.1 for: 10m labels: severity: critical annotations: summary: High error rate on {{ $labels.instance }} description: Error rate is {{ $value }}12.3 告警通知集成配置Alertmanagerservices: alertmanager: image: prom/alertmanager ports: - 9093:9093 volumes: - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml networks: - web_networkalertmanager.yml示例route: receiver: slack-notifications receivers: - name: slack-notifications slack_configs: - api_url: https://hooks.slack.com/services/... channel: #alerts send_resolved: true13. 持续集成与部署13.1 GitHub Actions配置创建.github/workflows/deploy.ymlname: Deploy to Production on: push: branches: [ main ] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkoutv3 - name: Install SSH key uses: shimataro/ssh-key-actionv2 with: key: ${{ secrets.SSH_PRIVATE_KEY }} known_hosts: ${{ secrets.KNOWN_HOSTS }} - name: Deploy to server run: | ssh -o StrictHostKeyCheckingno userserver cd /path/to/project git pull origin main docker-compose build docker-compose up -d docker-compose exec webapp python manage.py migrate docker-compose exec webapp python manage.py collectstatic --noinput 13.2 镜像构建与推送扩展GitHub Actions配置- name: Login to Docker Hub uses: docker/login-actionv2 with: username: ${{ secrets.DOCKER_HUB_USERNAME }} password: ${{ secrets.DOCKER_HUB_TOKEN }} - name: Build and push uses: docker/build-push-actionv3 with: context: . push: true tags: user/repo:latest13.3 滚动更新策略更新docker-compose.ymlservices: webapp: # ...其他配置 deploy: update_config: parallelism: 2 delay: 10s order: start-first对应的更新命令docker-compose pull webapp docker-compose up -d --no-deps webapp14. 性能调优实战14.1 Nginx调优参数worker_processes auto; worker_rlimit_nofile 100000; events { worker_connections 4000; multi_accept on; use epoll; } http { # 其他配置... client_max_body_size 100M; client_body_buffer_size 1M; client_header_buffer_size 1k; large_client_header_buffers 4 8k; # TCP优化 sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 30; keepalive_requests 1000; reset_timedout_connection on; # 静态文件优化 open_file_cache max200000 inactive20s; open_file_cache_valid 30s; open_file_cache_min_uses 2; open_file_cache_errors on; }14.2 Gunicorn调优配置创建gunicorn_config.pyimport multiprocessing bind 0.0.0.0:8000 workers multiprocessing.cpu_count() * 2 1 worker_class gthread threads 4 max_requests 1000 max_requests_jitter 50 timeout 30 keepalive 2 accesslog - errorlog -14.3 数据库连接池配置对于Django项目在settings.py中添加DATABASES { default: { ENGINE: django.db.backends.postgresql, NAME: mydb, USER: user, PASSWORD: password, HOST: db, PORT: 5432, OPTIONS: { connect_timeout: 5, options: -c statement_timeout5000, }, CONN_MAX_AGE: 300, } }15. 成本优化策略15.1 资源限制与分配在docker-compose.yml中合理设置资源限制services: webapp: # ...其他配置 deploy: resources: limits: cpus: 1 memory: 1G reservations: cpus: 0.5 memory: 512M15.2 镜像大小优化多阶段构建Dockerfile优化# 构建阶段 FROM python:3.9 as builder WORKDIR /app COPY requirements.txt . RUN pip install --user --no-cache-dir -r requirements.txt # 清理阶段 FROM builder as cleaner RUN find /usr/local/lib/python3.9 -type d -name __pycache__ -exec rm -rf {} RUN find /usr/local/lib/python3.9 -type d -name tests -exec rm -rf {} RUN find /root/.local/lib/python3.9 -type d -name __pycache__ -exec rm -rf {} # 运行时阶段 FROM python:3.9-slim WORKDIR /app COPY --fromcleaner /root/.local /root/.local COPY --fromcleaner /usr/local/lib/python3.9 /usr/local/lib/python3.9 COPY . . ENV PATH/root/.local/bin:$PATH EXPOSE 8000 CMD [gunicorn, --bind, 0.0.0.0:8000, app.wsgi:application]15.3 自动缩放策略使用Docker Swarm或Kubernetes实现自动缩放services: webapp: # ...其他配置 deploy: mode: replicated replicas: 2 resources: limits: cpus: 0.5 memory: 512M update_config: parallelism: 1 delay: 10s restart_policy: condition: on-failure placement: constraints: - node.role worker16. 本地开发与生产一致性16.1 开发环境配置创建docker-compose.override.ymlversion: 3.8 services: webapp: volumes: - .:/app environment: - DJANGO_SETTINGS_MODULEapp.settings.development - DEBUG1 ports: - 8000:8000 command: python manage.py runserver 0.0.0.0:800016.2 热重载配置配置开发环境支持代码热更新services: webapp: # ...其他配置 volumes: - .:/app environment: - PYTHONUNBUFFERED1 - FLASK_ENVdevelopment command: watchmedo auto-restart --directory/app --pattern*.py --recursive -- python app.py16.3 开发工具集成配置VS Code开发容器{ name: Python Web App, dockerComposeFile: docker-compose.yml, service: webapp, workspaceFolder: /app, settings: { python.pythonPath: /usr/local/bin/python, python.linting.enabled: true, python.linting.pylintEnabled: true, python.formatting.provider: black }, extensions: [ ms-python.python, ms-python.vscode-pylance ] }17. 多环境管理策略17.1 环境变量管理创建.env文件# 公共配置 APP_ENVproduction SECRET_KEYyour-secret-key DEBUG0 # 数据库配置 DB_HOSTdb DB_PORT5432 DB_NAMEmydb DB_USERuser DB_PASSWORDpassword在docker-compose.yml中引用services: webapp: # ...其他配置 env_file: - .env17.2 多环境Compose文件创建docker-compose.prod.ymlversion: 3.8 services: webapp: environment: - DJANGO_SETTINGS_MODULEapp.settings.production deploy: replicas: 3 resources: limits: cpus: 1 memory: 1G使用不同环境docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d17.3 配置管理工具使用confd动态管理配置services: confd: image: kelseyhightower/confd volumes: - ./confd:/etc/confd - ./nginx/nginx.conf:/etc/nginx/nginx.conf.tmpl command: -watch -backend env -onetime environment: - NGINX_WORKER_PROCESSESauto - NGINX_WORKER_CONNECTIONS4096对应的模板文件nginx.conf.tmplworker_processes {{getenv NGINX_WORKER_PROCESSES}}; events { worker_connections {{getenv NGINX_WORKER_CONNECTIONS}}; }18. 扩展与高可用架构18.1 数据库集群配置使用PostgreSQL主从复制services: db: image: postgres:13 environment: - POSTGRES_USERuser - POSTGRES_PASSWORDpassword - POSTGRES_DBmydb volumes: - pg_data:/var/lib/postgresql/data networks: - db_network deploy: placement: constraints: - node.role manager db_replica: image: postgres:13 environment: - POSTGRES_USERuser - POSTGRES_PASSWORDpassword - POSTGRES_DBmydb - POSTGRES_HOST_AUTH_METHODtrust volumes: - pg_replica_data:/var/lib/postgresql/data command: bash -c echo \host replication replicator 0.0.0.0/0 md5\ /var/lib/postgresql/data/pg_hba.conf docker-entrypoint.sh postgres networks: - db_network depends_on: - db18.2 应用水平扩展使用Docker Swarm模式docker swarm init docker stack deploy -c docker-compose.yml myapp扩展服务实例docker service scale myapp_webapp518.3 全局服务发现使用Consul进行服务发现services: consul: image: consul ports: - 8500:8500 volumes: - consul_data:/consul/data command: agent -server -bootstrap-expect1 -client0.0.0.0 -ui registrator: image: gliderlabs/registrator volumes: - /var/run/docker.sock:/tmp/docker.sock command: -internal consul://consul:8500 depends_on: - consul19. 迁移与升级策略19.1 版本升级流程创建备份docker-compose exec db pg_dump -U user mydb backup.sql停止服务docker-compose down更新镜像版本services: webapp: image: myapp:v2.0逐步升级docker-compose up -d db docker-compose up -d webapp19.2 数据迁移方案使用Flyway进行数据库迁移services: flyway: image: flyway/flyway volumes: - ./db/migrations:/flyway/sql command: