Docker存储技术（翻译和总结）

By default all files created inside a container are stored on a writable container layer. This means that:

• The data doesn’t persist when that container no longer exists, and it can be difficult to get the data out of the container if another process needs it.
• A container’s writable layer is tightly coupled to the host machine where the container is running. You can’t easily move the data somewhere else.
• Writing into a container’s writable layer requires a  to manage the filesystem. The storage driver provides a union filesystem, using the Linux kernel. This extra abstraction reduces performance as compared to using data volumes, which write directly to the host filesystem.

默认情况下将数据写入了docker的可读写层，这意味着：

①所有的数据在容器消失后也跟着小时，其它程序很难在容器外获取这些数据。

②容器的可写层和宿主机严重耦合，你想把数据拿到其它地方很费劲。

③但是这样需要一个存储引擎来管理这个文件系统。存储引擎使用linux内核提供一个联合文件系统，这个额外的抽象操作会比使用数据卷这种直接写入宿主文件系统的操作降低性能。

Docker has two options for containers to store files in the host machine, so that the files are persisted even after the container stops: volumes, and bind mounts. If you’re running Docker on Linux you can also use a tmpfs mount.

Docker为Container提供两种存储文件的方式，这样即使容器停止后仍然能够保证文件们被持久保存下来：数据卷、绑定挂载。如果你在linux上运行docker也可以挂载一个 tmpfs 临时文件系统。

Keep reading for more information about these two ways of persisting data.Choose the right type of mount

No matter which type of mount you choose to use, the data looks the same from within the container. It is exposed as either a directory or an individual file in the container’s filesystem.

An easy way to visualize the difference among volumes, bind mounts, and tmpfs mounts is to think about where the data lives on the Docker host.

无论使用什么方式来挂载，对于容器来来看都是一样的，因为在容器来看要么是一个文件要么就是一个目录。可视化的方法来区别 数据卷、绑定挂载和临时文件系统挂载大概是下面的样子：

• Volumes are stored in a part of the host filesystem which is managed by Docker (/var/lib/docker/volumes/ on Linux). Non-Docker processes should not modify this part of the filesystem. Volumes are the best way to persist data in Docker.
• Bind mounts may be stored anywhere on the host system. They may even be important system files or directories. Non-Docker processes on the Docker host or a Docker container can modify them at any time.
• tmpfs mounts are stored in the host system’s memory only, and are never written to the host system’s filesystem.

①数据卷是被docker管理的宿主文件系统的一部分，默认存储在（/var/lib/docker/volumes/）。非docker进程不应该修改这部分文件，数据卷是docker持久化数据最好的选择。

②绑定挂载可以存储在宿主系统的任意位置，这些位置甚至可以是操作系统中重要的系统文件和目录位置。非docker进程和docker容器内的进程都可能修改这部分内容。

③挂载的临时文件系统存储在系统的内存区域，永远不会写入到宿主系统的文件系统。

More details about mount types

• : Created and managed by Docker. You can create a volume explicitly using the docker volume create command, or Docker can create a volume during container or service creation.

数据卷是被docker创建和管理的，你可以使用 docker volume create 显式的创建一个数据卷，或者在创建容器或者服务的时候创建数据卷。

When you create a volume, it is stored within a directory on the Docker host. When you mount the volume into a container, this directory is what is mounted into the container. This is similar to the way that bind mounts work, except that volumes are managed by Docker and are isolated from the core functionality of the host machine.

A given volume can be mounted into multiple containers simultaneously. When no running container is using a volume, the volume is still available to Docker and is not removed automatically. You can remove unused volumes using docker volume prune.

当你创建一个数据卷，它被存储在宿主机的一个目录下。当你挂载到容器中时，这个数据卷可以理解成一个目录，你挂载在容器中的什么位置，在容器内这个位置的数据读写就回到这个数据卷中。这个和绑定挂载类似，只是数据卷是被Docker管理的，并且从宿主机功能上隔离。

一个数据卷可以被同时挂载到多个容器中，没有容器使用数据卷的时候，数据卷仍然可用也不会被自动删除，可以使用 docker volume prune移除已经没有被任何容器使用的数据卷。

When you mount a volume, it may be named or anonymous. Anonymous volumes are not given an explicit name when they are first mounted into a container, so Docker gives them a random name that is guaranteed to be unique within a given Docker host. Besides the name, named and anonymous volumes behave in the same ways.

Volumes also support the use of volume drivers, which allow you to store your data on remote hosts or cloud providers, among other possibilities.

当挂载一个数据卷，可以使用命名的或者匿名的数据卷，如果一个数据卷没有显式的命名，那么挂载的时候会又一个SHA1的字符串名称，这个是docker系统用来保证唯一的ID，除了有名字和没有名字之外，数据卷没有任何区别。

数据卷可以使用数据卷驱动，这样允许你将数据存储在远端主机，设置是云厂商那里（也就是数据卷驱动导致写数据被写到远端）

• : Available since the early days of Docker. Bind mounts have limited functionality compared to volumes. When you use a bind mount, a file or directory on the host machine is mounted into a container. The file or directory is referenced by its full path on the host machine. The file or directory does not need to exist on the Docker host already. It is created on demand if it does not yet exist. Bind mounts are very performant, but they rely on the host machine’s filesystem having a specific directory structure available. If you are developing new Docker applications, consider using named volumes instead. You can’t use Docker CLI commands to directly manage bind mounts.

绑定挂载：Docker最开始就支持这个功能。绑定挂载相对数据卷的功能非常有限。当你使用一个绑定挂载，一个文件或者目录被挂载到容器内。这个文件或目录通过使用宿主机的绝对路径进行索引。这个文件或目录甚至不需要在容器内提前存在，如果不存在可以根据需要自动创建。绑定挂载的性能非常高，但是一来宿主机的文件系统。如果你开发一个新的docker应用，建议用命名数据卷代替，你不能使用Docker的CLI命令直接管理这些绑定挂载。

Bind mounts allow access to sensitive files. One side effect of using bind mounts, for better or for worse, is that you can change the host filesystem via processes running in a container, including creating, modifying, or deleting important system files or directories. This is a powerful ability which can have security implications, including impacting non-Docker processes on the host system.

绑定挂载可以访问敏感文件。绑定挂载的一个副作用就是能够直接通过容器内的程序访问宿主机的文件系统。包括创建、修改、甚至删除重要的系统文件和目录。这个是强大的功能可能导致安全问题，包括影响宿主机上的非docker进程。

• : A tmpfs mount is not persisted on disk, either on the Docker host or within a container. It can be used by a container during the lifetime of the container, to store non-persistent state or sensitive information. For instance, internally, swarm services use tmpfs mounts to mount  into a service’s containers.

挂载临时文件系统：临时文件系统挂载并不会在磁盘上持久化，既不在运行docker的宿主机内，也不在一个容器内。可以被一个容器生命周期内用来存储非持久化数据以及敏感信息。比如swarm服务内部使用 tmpfs 来关在服务容器内的机密信息。

Bind mounts and volumes can both be mounted into containers using the -v or --volume flag, but the syntax for each is slightly different. For tmpfs mounts, you can use the --tmpfs flag. However, in Docker 17.06 and higher, we recommend using the --mount flag for both containers and services, for bind mounts, volumes, or tmpfs mounts, as the syntax is more clear.

绑定挂载和数据卷都可以使用 -v 或者 --volume 标志位来挂载，但是两者的语法有一些差别。对于 tmpfs 的挂载，可以使用 --tmpfs 来进行。在 17.06 之后的版本，无论是容器还是服务都建议使用 --mount 来处理 绑定挂载、数据卷挂载和临时文件系统挂载，因为它的语法更加清晰。

Good use cases for volumes

Volumes are the preferred way to persist data in Docker containers and services. Some use cases for volumes include:

• Sharing data among multiple running containers. If you don’t explicitly create it, a volume is created the first time it is mounted into a container. When that container stops or is removed, the volume still exists. Multiple containers can mount the same volume simultaneously, either read-write or read-only. Volumes are only removed when you explicitly remove them.
• When the Docker host is not guaranteed to have a given directory or file structure. Volumes help you decouple the configuration of the Docker host from the container runtime.
• When you want to store your container’s data on a remote host or a cloud provider, rather than locally.
• When you need to back up, restore, or migrate data from one Docker host to another, volumes are a better choice. You can stop containers using the volume, then back up the volume’s directory (such as /var/lib/docker/volumes/).

数据卷的适合场景：

①多个运行容器之间共享数据。数据卷不会因为容器的停止删除而删除，只有明确的删除指令数据卷才会被删除。多个容器可以同时挂载一个数据卷（可以设置只读、读写权限）。

②Docker的容器系统不一定有指定的目录结构的时候，这样数据卷能够保证docker容器有对应的目录结构。

③当你想讲容器数据存储在元旦主机甚至云服务提供商那里，而不是仅仅存储在本地。

④需要在容器间备份、恢复、迁移数据的场景，你可以停下来容器然后就开始备份数据卷，就和备份一个目录一样。

Good use cases for bind mounts

In general, you should use volumes where possible. Bind mounts are appropriate for the following types of use case:

• Sharing configuration files from the host machine to containers. This is how Docker provides DNS resolution to containers by default, by mounting /etc/resolv.conf from the host machine into each container.
• Sharing source code or build artifacts between a development environment on the Docker host and a container. For instance, you may mount a Maven target/ directory into a container, and each time you build the Maven project on the Docker host, the container gets access to the rebuilt artifacts.If you use Docker for development this way, your production Dockerfile would copy the production-ready artifacts directly into the image, rather than relying on a bind mount.
• When the file or directory structure of the Docker host is guaranteed to be consistent with the bind mounts the containers require.

绑定挂载的适合场景：

①通过宿主机分享配置文件到容器。比如使用宿主机的DNS配置，可以将宿主机的 /etc/resolv.conf绑定挂载到容器里面。

②分享源代码或者构建项目（通过宿主机的开发环境到容器中），这样你编译构建后的产物容器可以直接访问到。如果开发完成后应该CP内容进入镜像，而不是依靠绑定挂载。

Good use cases for tmpfs mounts

tmpfs mounts are best used for cases when you do not want the data to persist either on the host machine or within the container. This may be for security reasons or to protect the performance of the container when your application needs to write a large volume of non-persistent state data.

临时文件系统挂载的适合场景：

当你不希望文件被持久化到宿主机或者容器中时使用，可能因为安全因素、也可能为了性能（内存读写更快嘛）

Tips for using bind mounts or volumes

If you use either bind mounts or volumes, keep the following in mind:

• If you mount an empty volume into a directory in the container in which files or directories exist, these files or directories are propagated (copied) into the volume. Similarly, if you start a container and specify a volume which does not already exist, an empty volume is created for you. This is a good way to pre-populate data that another container needs.
• If you mount a bind mount or non-empty volume into a directory in the container in which some files or directories exist, these files or directories are obscured by the mount, just as if you saved files into /mnt on a Linux host and then mounted a USB drive into /mnt. The contents of /mnt would be obscured by the contents of the USB drive until the USB drive were unmounted. The obscured files are not removed or altered, but are not accessible while the bind mount or volume is mounted.

使用绑定挂载和数据卷的一些提示：

①如果挂载一个空的数据卷到容器，容器内的目录和文件存在的话会被复制到数据卷里面。同理如果你指定一个不存在的数据卷，则这个数据卷会自动创建。因此这是一个好办法给数据卷填充数据。

②如果机型一个绑定挂载或者挂载一个非空的数据卷，如果对应位置有文件则会被掩盖，所有的读写都在挂载的文件系统上，直到umount掉，这个特性在一些场景下用的到。【掩盖但是原文件都在】