目录

完整的daemon.json配置模板

linux系统

windows系统

所有支持热更新的配置

热更新生效

公司有自签的https证书，环境不一样(dev,uat.prod)，相应 的docker registry也不一样，因此每次修改daemon.json添加insecure-registries后都是要重启docker才能保证添加的insecure-registries生效了。
 

这两天在看docker官方文档，发现其实insecure-registries是热更新的，修改后不需要重启docker，只需要发送相应的信号即可生效。

完整的daemon.json配置模板

https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file

linux系统

/etc/docker/daemon.json

{
  "authorization-plugins": [],
  "data-root": "",
  "dns": [],
  "dns-opts": [],
  "dns-search": [],
  "exec-opts": [],
  "exec-root": "",
  "experimental": false,
  "features": {},
  "storage-driver": "",
  "storage-opts": [],
  "labels": [],
  "live-restore": true,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file":"5",
    "labels": "somelabel",
    "env": "os,customer"
  },
  "mtu": 0,
  "pidfile": "",
  "cluster-store": "",
  "cluster-store-opts": {},
  "cluster-advertise": "",
  "max-concurrent-downloads": 3,
  "max-concurrent-uploads": 5,
  "default-shm-size": "64M",
  "shutdown-timeout": 15,
  "debug": true,
  "hosts": [],
  "log-level": "",
  "tls": true,
  "tlsverify": true,
  "tlscacert": "",
  "tlscert": "",
  "tlskey": "",
  "swarm-default-advertise-addr": "",
  "api-cors-header": "",
  "selinux-enabled": false,
  "userns-remap": "",
  "group": "",
  "cgroup-parent": "",
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 64000,
      "Soft": 64000
    }
  },
  "init": false,
  "init-path": "/usr/libexec/docker-init",
  "ipv6": false,
  "iptables": false,
  "ip-forward": false,
  "ip-masq": false,
  "userland-proxy": false,
  "userland-proxy-path": "/usr/libexec/docker-proxy",
  "ip": "0.0.0.0",
  "bridge": "",
  "bip": "",
  "fixed-cidr": "",
  "fixed-cidr-v6": "",
  "default-gateway": "",
  "default-gateway-v6": "",
  "icc": false,
  "raw-logs": false,
  "allow-nondistributable-artifacts": [],
  "registry-mirrors": [],
  "seccomp-profile": "",
  "insecure-registries": [],
  "no-new-privileges": false,
  "default-runtime": "runc",
  "oom-score-adjust": -500,
  "node-generic-resources": ["NVIDIA-GPU=UUID1", "NVIDIA-GPU=UUID2"],
  "runtimes": {
    "cc-runtime": {
      "path": "/usr/bin/cc-runtime"
    },
    "custom": {
      "path": "/usr/local/bin/my-runc-replacement",
      "runtimeArgs": [
        "--debug"
      ]
    }
  },
  "default-address-pools":[
    {"base":"172.80.0.0/16","size":24},
    {"base":"172.90.0.0/16","size":24}
  ]
}

windows系统

配置文件默认位于：%programdata%\docker\config\daemon.json

{
  "authorization-plugins": [],
  "data-root": "",
  "dns": [],
  "dns-opts": [],
  "dns-search": [],
  "exec-opts": [],
  "experimental": false,
  "features":{},
  "storage-driver": "",
  "storage-opts": [],
  "labels": [],
  "log-driver": "",
  "mtu": 0,
  "pidfile": "",
  "cluster-store": "",
  "cluster-advertise": "",
  "max-concurrent-downloads": 3,
  "max-concurrent-uploads": 5,
  "shutdown-timeout": 15,
  "debug": true,
  "hosts": [],
  "log-level": "",
  "tlsverify": true,
  "tlscacert": "",
  "tlscert": "",
  "tlskey": "",
  "swarm-default-advertise-addr": "",
  "group": "",
  "default-ulimits": {},
  "bridge": "",
  "fixed-cidr": "",
  "raw-logs": false,
  "allow-nondistributable-artifacts": [],
  "registry-mirrors": [],
  "insecure-registries": []
}

所有支持热更新的配置

debug: it changes the daemon to debug mode when set to true.

cluster-store: it reloads the discovery store with the new address.

cluster-store-opts: it uses the new options to reload the discovery store.

cluster-advertise: it modifies the address advertised after reloading.

labels: it replaces the daemon labels with a new set of labels.

live-restore: Enables keeping containers alive during daemon downtime.

max-concurrent-downloads: it updates the max concurrent downloads for each pull.

max-concurrent-uploads: it updates the max concurrent uploads for each push.

default-runtime: it updates the runtime to be used if not is specified at container creation. It defaults to “default” which is the runtime shipped with the official docker packages.

runtimes: it updates the list of available OCI runtimes that can be used to run containers.

authorization-plugin: it specifies the authorization plugins to use.

allow-nondistributable-artifacts: Replaces the set of registries to which the daemon will push nondistributable artifacts with a new set of registries.

insecure-registries: it replaces the daemon insecure registries with a new set of insecure registries. If some existing insecure registries in daemon’s configuration are not in newly reloaded insecure resgitries, these existing ones will be removed from daemon’s config.

registry-mirrors: it replaces the daemon registry mirrors with a new set of registry mirrors. If some existing registry mirrors in daemon’s configuration are not in newly reloaded registry mirrors, these existing ones will be removed from daemon’s config.

shutdown-timeout: it replaces the daemon’s existing configuration timeout with a new timeout for shutting down all containers.

features: it explicitly enables or disables specific features.

热更新生效

修改完daemon.json后，只需要执行以下指令即可

sudo kill -SIGHUP $(pidof dockerd)