生产级 Docker 与 Compose 架构实战：在境外优化 VPS 上的容器化编排、存储与安全治理

# 检查现有 Swap
swapon --show

# 创建 2GB Swap 文件（若已有合理 Swap 可跳过）
fallocate -l 2G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=2048
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

# 持久化挂载
echo '/swapfile none swap sw 0 0' >> /etc/fstab

# 优化内存置换倾向（仅在物理内存剩余不足 10% 时才使用 Swap）
sysctl vm.swappiness=10
sysctl vm.vfs_cache_pressure=50
echo 'vm.swappiness=10' >> /etc/sysctl.d/99-docker-system.conf
echo 'vm.vfs_cache_pressure=50' >> /etc/sysctl.d/99-docker-system.conf

# 1. 彻底清理可能残留的历史冲突软件包
apt-get remove -y docker docker-engine docker.io containerd runc 2>/dev/null

# 2. 安装基础通信与安全认证组件
apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    gnupg \
    lsb-release

# 3. 规范配置官方 GPG 密钥环目录
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg

# 4. 写入稳定版仓库配置（以 Debian 系统为例）
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  tee /etc/apt/sources.list.d/docker.list > /dev/null

# 5. 安装核心引擎与 Compose V2 插件
apt-get update
apt-get install -y --no-install-recommends \
    docker-ce \
    docker-ce-cli \
    containerd.io \
    docker-buildx-plugin \
    docker-compose-plugin

# 6. 验证核心组件版本
docker --version
docker compose version

{
  "storage-driver": "overlay2",
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "20m",
    "max-file": "3"
  },
  "live-restore": true,
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 65535,
      "Soft": 65535
    }
  },
  "dns": [
    "1.1.1.1",
    "8.8.8.8"
  ],
  "default-address-pools": [
    {
      "base": "172.24.0.0/16",
      "size": 24
    }
  ]
}

systemctl daemon-reload
systemctl restart docker
systemctl enable docker

ports:
  - "3306:3306"

/opt/production-stack/
├── .env                  # 敏感环境变量（严禁提交至公共代码库）
├── docker-compose.yml    # 编排定义
├── caddy/
│   └── Caddyfile         # 边缘反向代理配置
└── backups/              # 本地冷备份输出目录

# 系统环境参数
COMPOSE_PROJECT_NAME=core_prod
DOMAIN_NAME=api.yourdomain.com

# 数据库机密参数
DB_USER=prod_pguser
DB_PASSWORD=Super_Secret_Postgres_Password_2026
DB_NAME=core_db

# 缓存机密参数
REDIS_PASSWORD=Strong_Redis_Auth_Token_9981

services:
  # ----------------------------------------------------
  # 1. 边缘反向代理与 TLS 终结（仅此服务监听公网端口）
  # ----------------------------------------------------
  proxy:
    image: caddy:2.8-alpine
    container_name: prod_proxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp" # HTTP/3 支持
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - public_net
    deploy:
      resources:
        limits:
          memory: 128M

  # ----------------------------------------------------
  # 2. 核心业务应用层（桥接双网络）
  # ----------------------------------------------------
  app:
    image: node:20-alpine
    container_name: prod_app
    restart: unless-stopped
    working_dir: /usr/src/app
    command: sh -c "node server.js"
    environment:
      NODE_ENV: production
      DATABASE_URL: postgres://${DB_USER}:${DB_PASSWORD}@db:5432/${DB_NAME}
      REDIS_URL: redis://:${REDIS_PASSWORD}@cache:6379/0
    networks:
      - public_net
      - secure_net
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_healthy
    deploy:
      resources:
        limits:
          cpus: '1.5'
          memory: 512M

  # ----------------------------------------------------
  # 3. 持久化数据层（严格隔离于内部安全网）
  # ----------------------------------------------------
  db:
    image: postgres:16-alpine
    container_name: prod_postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ${DB_NAME}
    volumes:
      - pg_data:/var/lib/postgresql/data
    networks:
      - secure_net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 768M

  # ----------------------------------------------------
  # 4. 高速缓存层（密码保护与无公网暴露）
  # ----------------------------------------------------
  cache:
    image: redis:7-alpine
    container_name: prod_redis
    restart: unless-stopped
    command: >
      redis-server 
      --requirepass ${REDIS_PASSWORD}
      --maxmemory 128mb
      --maxmemory-policy allkeys-lru
    volumes:
      - redis_data:/data
    networks:
      - secure_net
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 192M

# ----------------------------------------------------
# 存储卷定义（与宿主机文件系统物理隔离）
# ----------------------------------------------------
volumes:
  caddy_data:
  caddy_config:
  pg_data:
  redis_data:

# ----------------------------------------------------
# 内部网络隔离方案
# ----------------------------------------------------
networks:
  public_net:
    driver: bridge
  secure_net:
    driver: bridge
    internal: true # 强化标志：禁止该网段内容器直接出站访问外网，断绝数据外泄途径

# 安全清理所有无标签的“悬挂”虚悬镜像（不影响运行中服务）
docker image prune -f

# 清除超过 7 天未被任何容器引用的旧构建缓存
docker builder prune -a --filter "until=168h" -f

# 检查当前 Docker 对物理磁盘的真实占用情况
docker system df

cat << 'EOF' > /etc/cron.weekly/docker-maintenance
#!/bin/sh
# 每周自动回收超过 14 天未使用的无用镜像与构建缓存，保持系统盘平稳
docker system prune -a --volumes=false --filter "until=336h" -f > /var/log/docker-prune.log 2>&1
EOF

chmod +x /etc/cron.weekly/docker-maintenance

#!/bin/bash
set -eo pipefail

BACKUP_DIR="/opt/production-stack/backups"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
PROJECT="core_prod"

mkdir -p "${BACKUP_DIR}"

echo "[*] 开始导出 PostgreSQL 数据库转储..."
docker compose -f /opt/production-stack/docker-compose.yml exec -T db \
    pg_dump -U prod_pguser -d core_db | gzip > "${BACKUP_DIR}/db_${TIMESTAMP}.sql.gz"

echo "[*] 开始备份持久化应用数据卷..."
# 利用临时容器打包命名数据卷
docker run --rm \
    -v core_prod_caddy_data:/volume_data:ro \
    -v "${BACKUP_DIR}":/backup \
    alpine tar czf "/backup/caddy_data_${TIMESTAMP}.tar.gz" -C /volume_data .

# 自动清理 14 天前的历史冷备份文件
find "${BACKUP_DIR}" -type f -name "*.tar.gz" -mtime +14 -delete
find "${BACKUP_DIR}" -type f -name "*.sql.gz" -mtime +14 -delete

echo "[✓] 备份完成：${TIMESTAMP}"

0 3 * * * /bin/bash /opt/production-stack/backup.sh > /dev/null 2>&1