CentOS 7.9下Jumpserver堡垒机全组件Docker化部署指南（含Nginx配置避坑）

CentOS 7.9下Jumpserver堡垒机全组件Docker化部署实战在运维安全领域堡垒机已成为企业IT基础设施中不可或缺的一环。作为开源堡垒机的代表Jumpserver凭借其完善的审计功能和易用性赢得了众多技术团队的青睐。本文将带您完成从零开始的全组件Docker化部署特别针对CentOS 7.9环境下的实际痛点提供解决方案。1. 环境准备与规划1.1 系统基础配置部署前需确保系统环境清洁且网络畅通。执行以下命令进行基础检查# 检查系统版本 cat /etc/redhat-release # 查看内核版本 uname -a # 验证SELinux状态 getenforce若SELinux处于Enforcing状态需临时禁用并修改配置文件setenforce 0 sed -i s/SELINUXenforcing/SELINUXdisabled/g /etc/selinux/config提示生产环境中如需保持SELinux开启需额外配置容器安全策略这会使部署复杂度显著增加。1.2 资源分配建议根据实际使用规模推荐以下资源配置方案组件最小内存推荐内存CPU核心存储空间核心服务2GB4GB220GBMySQL数据库1GB2GB150GBRedis缓存512MB1GB15GB全部组件4GB8GB4100GB1.3 网络拓扑设计合理的网络规划能有效避免后期连接问题[外部用户] ←→ [Nginx:80] ←→ [Jumpserver:8080] ←→ [Guacamole:8081] ←→ [Koko:5000/2222]建议提前规划好以下端口使用80/443Web访问入口2222SSH接入端口3306MySQL数据库6379Redis服务8080核心API服务5000Web Terminal8081远程桌面代理2. Docker环境搭建2.1 最新版Docker安装CentOS 7官方源的Docker版本较旧建议使用官方仓库# 卸载旧版本 yum remove docker* -y # 安装依赖 yum install -y yum-utils device-mapper-persistent-data lvm2 # 添加仓库 yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo # 安装Docker yum install -y docker-ce docker-ce-cli containerd.io # 启动服务 systemctl enable --now docker验证安装docker --version docker-compose --version2.2 镜像加速配置国内环境建议配置镜像加速器mkdir -p /etc/docker cat /etc/docker/daemon.json EOF { registry-mirrors: [ https://hub-mirror.c.163.com, https://mirror.baidubce.com ], exec-opts: [native.cgroupdriversystemd] } EOF systemctl restart docker3. 全组件部署实战3.1 使用Docker Compose编排创建docker-compose.yml文件实现一键部署version: 3 services: mysql: image: mysql:5.7 container_name: jms_mysql environment: MYSQL_ROOT_PASSWORD: Jumpserver123 MYSQL_DATABASE: jumpserver MYSQL_USER: jumpserver MYSQL_PASSWORD: Jumpserver123 volumes: - /data/mysql:/var/lib/mysql restart: always redis: image: redis:6 container_name: jms_redis command: redis-server --requirepass Jumpserver123 volumes: - /data/redis:/data restart: always core: image: jumpserver/jms_all:v2.28.5 container_name: jms_core depends_on: - mysql - redis environment: DB_HOST: mysql DB_PORT: 3306 DB_NAME: jumpserver DB_USER: jumpserver DB_PASSWORD: Jumpserver123 REDIS_HOST: redis REDIS_PORT: 6379 REDIS_PASSWORD: Jumpserver123 volumes: - /data/jumpserver/data:/opt/jumpserver/data - /data/jumpserver/logs:/opt/jumpserver/logs ports: - 8080:8080 - 8070:8070 restart: always koko: image: jumpserver/jms_koko:v2.28.5 container_name: jms_koko depends_on: - core environment: CORE_HOST: http://core:8080 BOOTSTRAP_TOKEN: Jumpserver123 ports: - 2222:2222 - 5000:5000 restart: always guacamole: image: jumpserver/jms_guacamole:v2.28.5 container_name: jms_guacamole depends_on: - core environment: JUMPSERVER_SERVER: http://core:8080 BOOTSTRAP_TOKEN: Jumpserver123 ports: - 8081:8080 restart: always nginx: image: nginx:1.21 container_name: jms_nginx depends_on: - core - koko - guacamole volumes: - ./nginx.conf:/etc/nginx/conf.d/default.conf - /data/jumpserver/ui/lina:/usr/share/nginx/html/ui - /data/jumpserver/ui/luna:/usr/share/nginx/html/luna ports: - 80:80 - 443:443 restart: always启动服务docker-compose up -d3.2 关键配置详解数据库连接配置首次启动后需进入core容器初始化数据库docker exec -it jms_core bash cd /opt/jumpserver/utils/ ./make_migrations.shBootstrap Token获取在core容器内查看生成的tokencat /opt/jumpserver/config.yml | grep BOOTSTRAP时区设置所有容器建议统一时区environment: TZ: Asia/Shanghai4. Nginx高级配置4.1 完整代理配置示例创建nginx.conf文件server { listen 80; server_name jumpserver.example.com; client_max_body_size 100m; location /ui/ { try_files $uri / /index.html; alias /usr/share/nginx/html/ui/; } location /luna/ { try_files $uri / /index.html; alias /usr/share/nginx/html/luna/; } location /media/ { add_header Content-Encoding gzip; proxy_pass http://core:8080; } location /static/ { proxy_pass http://core:8080; } location /koko/ { proxy_pass http://koko:5000; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location /guacamole/ { proxy_pass http://guacamole:8080/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location /ws/ { proxy_pass http://core:8070; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location /api/ { proxy_pass http://core:8080; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location /core/ { proxy_pass http://core:8080; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location / { rewrite ^/(.*)$ /ui/$1 last; } }4.2 HTTPS配置最佳实践申请证书后添加SSL配置server { listen 443 ssl; server_name jumpserver.example.com; ssl_certificate /path/to/cert.pem; ssl_certificate_key /path/to/key.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; # 其他配置与HTTP版本相同 } server { listen 80; server_name jumpserver.example.com; return 301 https://$host$request_uri; }5. 运维与故障排查5.1 日常维护命令查看服务状态docker-compose ps docker-compose logs -f core备份策略# 数据库备份 docker exec jms_mysql mysqldump -u jumpserver -pJumpserver123 jumpserver backup.sql # 配置文件备份 tar czvf jumpserver_backup.tar.gz /data/jumpserver5.2 常见问题解决组件通信失败检查容器网络是否互通docker network inspect bridge验证各组件日志中的连接地址是否正确WebSocket连接问题确保Nginx配置中包含正确的Upgrade头proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade;性能优化建议调整MySQL缓存参数为Redis增加最大内存限制对频繁访问的静态资源启用浏览器缓存部署完成后访问http://服务器IP即可进入登录界面默认管理员账号为admin/admin。首次登录后请立即修改密码并配置邮件服务以便密码找回。