update

huataihuang · Aug 25, 2023 · cb5e643 · cb5e643
1 parent 2a5cba7
commit cb5e643
Show file tree

Hide file tree

Showing 13 changed files with 99 additions and 9 deletions.
diff --git a/source/docker/images/docker_image_prune.rst b/source/docker/images/docker_image_prune.rst
@@ -0,0 +1,53 @@
+.. _docker_image_prune:
+
+======================
+Docker清理镜像
+======================
+
+在生产环境长期运行的容器服务器，你会发现磁盘空间越来越少，例如 :ref:`trace_disk_space_usage`_  :
+
+.. literalinclude:: ../../shell/bash/trace_disk_space_usage/du_large_dir
+   :caption: 查找消耗磁盘空间最大的目录
+
+输出类似:
+
+.. literalinclude:: ../../shell/bash/trace_disk_space_usage/du_large_dir_output
+   :caption: 查找消耗磁盘空间最大的目录输出案例(占用最大空间的的是容器镜像)
+   :emphasize-lines: 1
+
+上述这是一个简单案例，实际上我在生产环境见过消耗了几百G甚至上T的镜像存储空间，大多数是因为历史上反复更新发布导致很多无用的镜像堆积在本地。
+
+``prune``
+===========
+
+``docker`` 提供了一个非常实用的 ``image`` 子命令 ``prune`` 用于清理不再使用的镜像:
+
+.. literalinclude:: docker_image_prune/docker_image_prune
+   :caption: ``docker image prune`` 没有任何参数则仅删除dangling镜像(即没有任何容器使用的镜像)
+
+这里使用了 ``-f`` 参数是为了避免交互，否则默认会提示是否进行
+
+注意，不使用任何参数，则只会删除dangling镜像(没有任何容器使用的镜像)。如果要删除没有任何现存容器使用的所有镜像，则加上 ``-a`` 参数:
+
+.. literalinclude:: docker_image_prune/docker_image_prune_all
+   :caption: ``docker image prune`` 使用 ``-a`` 参数会删除所有没有现有容器关联的镜像，更为彻底
+
+可以限制停止多少小时前的容器奖项:
+
+.. literalinclude:: docker_image_prune/docker_image_prune_24h
+   :caption: ``docker image prune`` 指定24小时前停止容器关联镜像
+
+其他方法
+===========
+
+其实不用 ``prune`` 也能清理镜像，就是使用 ``rmi`` ，例如:
+
+.. literalinclude:: docker_image_prune/docker_rmi
+   :caption: 使用 ``docker rmi`` 清理不再使用的镜像
+
+这里虽然使用 ``rmi`` 删除所有镜像，但是实际上如果正在使用的 image 是不会删除的，只会提示一个无法删除信息。遮掩，实际上就完成了无效镜像的清理。
+
+参考
+=======
+
+- `Prune unused Docker objects <https://docs.docker.com/config/pruning/>`_
diff --git a/source/docker/images/docker_image_prune/docker_image_prune b/source/docker/images/docker_image_prune/docker_image_prune
@@ -0,0 +1 @@
+docker image prune -f
diff --git a/source/docker/images/docker_image_prune/docker_image_prune_24h b/source/docker/images/docker_image_prune/docker_image_prune_24h
@@ -0,0 +1 @@
+docker container prune --filter "until=24h"
diff --git a/source/docker/images/docker_image_prune/docker_image_prune_all b/source/docker/images/docker_image_prune/docker_image_prune_all
@@ -0,0 +1 @@
+docker image prune -a
diff --git a/source/docker/images/docker_image_prune/docker_rmi b/source/docker/images/docker_image_prune/docker_rmi
@@ -0,0 +1,2 @@
+docker images | awk '{print $1}' | tee image_list
+for image in `cat image_list`;do docker rmi $image;done
diff --git a/source/docker/images/index.rst b/source/docker/images/index.rst
@@ -18,6 +18,7 @@ Docker 镜像
    dockerfile_best-practices.rst
    dockerfile_entrypoint_vs_cmd.rst
    inspect_docker_image.rst
+   docker_image_prune.rst
 
 .. only::  subproject and html
 

diff --git a/source/kubernetes/concepts/architecture/k8s_garbage_collecttion.rst b/source/kubernetes/concepts/architecture/k8s_garbage_collecttion.rst
@@ -34,7 +34,7 @@ kubelet ``image-gc-high-threshold``
 
 这个参数可以在 ``kubelet`` 启动配置文件 ``/etc/kubernetes/kubelet.env`` 中设置 (见 ``/etc/systemd/system/kubelet.service`` )
 
-
+此外，除了 Kubernetes 垃圾回收机制中 kubelet ``image-gc-high-threshold`` 方法外，也可以直接使用 :ref:`docker_image_prune`
 
 参考
 =======

diff --git a/source/linux/ubuntu_linux/admin/apt.rst b/source/linux/ubuntu_linux/admin/apt.rst
@@ -116,6 +116,24 @@ proxy.conf
 
    sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys A507B2BBA7803E3B
 
+第三方 :ref:`grafana` 仓库
+----------------------------
+
+在安装 :ref:`grafana` 以及升级过程中，也遇到(Grafana)服务器证书更换的问题，此时无法升级软件，报错也类似如上(不过这次这个证书是Grafana提供的，非Ubuntu):
+
+.. literalinclude:: apt/grafana_pub_key_error
+   :caption: ``apt`` 更新时遇到Grafana网站证书更新报错
+   :emphasize-lines: 1
+
+.. note::
+
+   这里除了 Grafana Pub Key 错误之外，另外几行报错是 :ref:`install_pcp` 之前的方法因为JForg免费仓库关闭服务导致，后续再更新 :ref:`install_pcp` 方法
+
+这个问题的解决方法类似，执行一下命令更新服务器存储的Grafana证书(方法参见 `Welcome to Grafana Labs's package repository <https://packages.grafana.com/>`_ ):
+
+.. literalinclude:: apt/update_grafana_pub_key
+   :caption: ``apt`` 更新Grafana网站证书
+
 .. _apt_hold:
 
 apt hold保持包不更新

diff --git a/source/linux/ubuntu_linux/admin/apt/grafana_pub_key_error b/source/linux/ubuntu_linux/admin/apt/grafana_pub_key_error
@@ -0,0 +1,5 @@
+W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://packages.grafana.com/oss/deb stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 963FA27710458545
+E: Failed to fetch https://performancecopilot.jfrog.io/artifactory/pcp-deb-release/dists/jammy/InRelease  Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
+E: The repository 'https://performancecopilot.jfrog.io/artifactory/pcp-deb-release jammy InRelease' is no longer signed.
+N: Updating from such a repository can't be done securely, and is therefore disabled by default.
+N: See apt-secure(8) manpage for repository creation and user configuration details.
diff --git a/source/linux/ubuntu_linux/admin/apt/update_grafana_pub_key b/source/linux/ubuntu_linux/admin/apt/update_grafana_pub_key
@@ -0,0 +1,3 @@
+mkdir -p /etc/apt/keyrings/
+wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg
+echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" | tee /etc/apt/sources.list.d/grafana.list
diff --git a/source/shell/bash/trace_disk_space_usage.rst b/source/shell/bash/trace_disk_space_usage.rst
@@ -26,17 +26,16 @@ ncdu
 
 那么我们在脚本中该如何找到占用最大的目录呢？
 
-虽然我们可以使用 ``du -sh *`` 一级级查找，但是在脚本中需要使用一条命令来找到最多消耗的目录::
+虽然我们可以使用 ``du -sh *`` 一级级查找，但是在脚本中需要使用一条命令来找到最多消耗的目录:
 
-   du -Sh | sort -rh | head -5
+.. literalinclude:: trace_disk_space_usage/du_large_dir
+   :caption: 查找消耗磁盘空间最大的目录
 
-输出类似::
+输出类似:
 
-   1.2G ./var/lib/containerd/io.containerd.content.v1.content/blobs/sha256
-   445M ./usr/bin
-   332M ./run/containerd/io.containerd.runtime.v2.task/k8s.io/6bd8822f911f8cbbc51826a3c2d37c0016ec44a8138c9d835fb5dbae99db269f/rootfs/usr/bin
-   328M ./home/huatai/z-k8s-dev
-   318M .
+.. literalinclude:: trace_disk_space_usage/du_large_dir_output
+   :caption: 查找消耗磁盘空间最大的目录输出案例(占用最大空间的的是容器镜像)
+   :emphasize-lines: 1
 
 为何要使用 ``-S`` 参数而不是常用的 ``-s`` (小写)参数呢？
 

diff --git a/source/shell/bash/trace_disk_space_usage/du_large_dir b/source/shell/bash/trace_disk_space_usage/du_large_dir
@@ -0,0 +1 @@
+du -Sh | sort -rh | head -5
diff --git a/source/shell/bash/trace_disk_space_usage/du_large_dir_output b/source/shell/bash/trace_disk_space_usage/du_large_dir_output
@@ -0,0 +1,5 @@
+1.2G ./var/lib/containerd/io.containerd.content.v1.content/blobs/sha256
+445M ./usr/bin
+332M ./run/containerd/io.containerd.runtime.v2.task/k8s.io/6bd8822f911f8cbbc51826a3c2d37c0016ec44a8138c9d835fb5dbae99db269f/rootfs/usr/bin
+328M ./home/huatai/z-k8s-dev
+318M .