Docker 撰写主机卷数据不在容器文件夹中

Question

我正在尝试将 gitlab 添加到我的 nextcloud vps。像往常一样，我的 SSL 证书有问题。容器文件夹为空，而主机文件夹不是。主机内容未添加到容器卷。容器文件夹为空（/etc/gitlab/ssl）。

version: '2'
services:
  proxy:
    image: jwilder/nginx-proxy
    container_name: proxy
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./proxy/conf.d:/etc/nginx/conf.d
      - ./proxy/vhost.d:/etc/nginx/vhost.d
      - ./proxy/html:/usr/share/nginx/html
      - ./proxy/certs:/etc/nginx/certs:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - proxy-tier
    restart: always

  letsencrypt-companion:
    image: alastaircoote/docker-letsencrypt-nginx-proxy-companion
    container_name: letsencrypt-companion
    volumes_from:
      - proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./proxy/certs:/etc/nginx/certs:rw
    restart: always

  web:
    image: nginx
    container_name: nextcloud_webserver
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    links:
      - app
      - collabora
    volumes_from:
      - app
    environment:
      - VIRTUAL_HOST=${DOMAIN}
      - VIRTUAL_NETWORK=nginx-proxy
      - VIRTUAL_PORT=80
      - LETSENCRYPT_HOST=${DOMAIN}
      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}
networks:
      - proxy-tier
    restart: always

  app:
    image: nextcloud:fpm
    container_name: nextcloud_fpm
    links:
      - db
    volumes:
      - ./nextcloud/apps:/var/www/html/apps
      - ./nextcloud/config:/var/www/html/config
      - ./nextcloud/data:/var/www/html/data
    networks:
      - proxy-tier
    restart: always

  db:
    image: mariadb
    container_name: db
    volumes:
      - ./nextcloud/db:/var/lib/mysql
    environment:
- MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
    networks:
      - proxy-tier
    restart: always

  redis:
    image: redis
    container_name: redis
    networks:
      - proxy-tier
    restart: always

  collabora:
    image: collabora/code
    container_name: collabora
    cap_add:
      - MKNOD
    environment:
      - domain=${DOMAIN}
    networks:
      - proxy-tier
    restart: always

  gitlab:
    image: gitlab/gitlab-ce:latest
    container_name: gitlab
    restart: always
    hostname: ${GITDOMAIN}
    environment:
      VIRTUAL_HOST: ${GITDOMAIN}
      VIRTUAL_NETWORK: nginx-proxy
      VIRTUAL_PORT: 80
      LETSENCRYPT_HOST: ${GITDOMAIN}
      LETSENCRYPT_EMAIL: ${LETSENCRYPT_EMAIL}
      GITLAB_OMNIBUS_CONFIG: |
          external_url "https://${GITDOMAIN}"
          nginx['ssl_certificate'] = "/etc/gitlab/ssl/fullchain.pem"
          nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/key.pem"
          # Add any other gitlab.rb configuration here, each on its own line
    volumes:
      - ./gitlab/config:/etc/gitlab
      - ./gitlab/logs:/var/log/gitlab
      - ./gitlab/data:/var/opt/gitlab
      - /opt/nextcloud-docker/.examples/proxy/certs/${GITDOMAIN}:/etc/gitlab/ssl:rw
    networks:
      - proxy-tier

networks:
  proxy-tier:
    external:
      name: nginx-proxy

2017/08/19 09:26:17 [emerg] 6465＃0：BIO_new_file（“/etc/gitlab/ssl/fullchain.pem”）失败（SSL：错误：02001002：系统库：fopen：没有这样的文件或目录：fopen（'/etc/gitlab/ssl/fullchain.pem'，'r'）错误：2006D080：BIO例程：BIO_new_file：没有这样的文件）

docker inspect gitlab

{
                "Type": "bind",
                "Source": "/opt/nextcloud-docker/.examples/proxy/certs/domain",
                "Destination": "/etc/gitlab/ssl",
                "Mode": "rw",
                "RW": true,
                "Propagation": "rprivate"
            }

"Volumes": {
                "/etc/gitlab": {},
                "/etc/gitlab/ssl": {},
                "/var/log/gitlab": {},
                "/var/opt/gitlab": {}
            },

也许这/etc/gitlab会掩盖/etc/gitlab/ssl。我读过有关容器掩盖主机文件的文章，这对我来说非常令人困惑和新奇。我该如何调试此问题？

Answer 1

事实证明，gitlab 在启动时总是显示 nginx error.log。所以 ssl 证书已经存在并且可以正常工作。我仍然无法配置端口以与 jwilder nginx-proxy 配合使用。所以这是我的最后一个配置的外观和工作原理：

将 .env 符号链接到gitlab-docker$ln -s ../.env .env

nextcloud官方docker-compose.yml： ./docker-compose.yml

version: '2'
services:
  proxy:
    image: jwilder/nginx-proxy
    container_name: proxy
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./proxy/conf.d:/etc/nginx/conf.d
      - ./proxy/vhost.d:/etc/nginx/vhost.d
      - ./proxy/html:/usr/share/nginx/html
      - ./proxy/certs:/etc/nginx/certs:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - proxy-tier
    restart: always

  letsencrypt-companion:
    image: alastaircoote/docker-letsencrypt-nginx-proxy-companion
    container_name: letsencrypt-companion
    volumes_from:
      - proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./proxy/certs:/etc/nginx/certs:rw
    restart: always

  web:
    image: nginx
    container_name: nextcloud_webserver
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    links:
      - app
      - collabora
    volumes_from:
      - app
    environment:
      - VIRTUAL_HOST=${DOMAIN}
      - VIRTUAL_NETWORK=nginx-proxy
      - VIRTUAL_PORT=80
      - LETSENCRYPT_HOST=${DOMAIN}
      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}
    networks:
      - proxy-tier
    restart: always

  app:
    image: nextcloud:fpm
    container_name: nextcloud_fpm
    links:
      - db
    volumes:
      - ./nextcloud/apps:/var/www/html/apps
      - ./nextcloud/config:/var/www/html/config
      - ./nextcloud/data:/var/www/html/data
    networks:
      - proxy-tier
    restart: always

  db:
    image: mariadb
    container_name: db
    volumes:
      - ./nextcloud/db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
    networks:
      - proxy-tier
    restart: always

  redis:
    image: redis
    container_name: redis
    networks:
      - proxy-tier
    restart: always

  collabora:
    image: collabora/code
    container_name: collabora
    cap_add:
      - MKNOD
    environment:
      - domain=${DOMAIN}
    networks:
      - proxy-tier
    restart: always

networks:
  proxy-tier:
    external:
      name: nginx-proxy

./gitlab-docker/docker-compose.yml

version: '2'

services:
  gitlab:
    image: gitlab/gitlab-ce:latest
    container_name: gitlab
    restart: always
    hostname: ${GITDOMAIN}
    environment:
      VIRTUAL_HOST: ${GITDOMAIN}
      VIRTUAL_NETWORK: nginx-proxy
      VIRTUAL_PORT: 80
      LETSENCRYPT_HOST: ${GITDOMAIN}
      LETSENCRYPT_EMAIL: ${LETSENCRYPT_EMAIL}
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://${GITDOMAIN}'
        nginx['ssl_certificate'] = "/etc/gitlab/ssl/fullchain.pem"
        nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/key.pem"
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        nginx['proxy_set_headers'] = {  "X-Forwarded-Proto" => "https", "X-Forwarded-Ssl" => "on" }
        # Add any other gitlab.rb configuration here, each on its own line
    ports:
      - '3022:22'
    volumes:
      - gitcerts:/etc/gitlab/ssl:ro
      - ../gitlab/config:/etc/gitlab
      - ../gitlab/logs:/var/log/gitlab
      - ../gitlab/data:/var/opt/gitlab
    networks:
      - proxy-tier

networks:
  proxy-tier:
    external:
      name: nginx-proxy

volumes:
  gitcerts:
    driver_opts:
      type: none
      device: /opt/nextcloud-docker/.examples/proxy/certs/${GITDOMAIN}
      o: bind

• 注意命名卷以访问 gitlab 的证书（docker volume ls列出卷并docker volume inspect $name显示挂载点，在我的情况下是 /var/lib/docker/volumes/gitlabdocker_gitcerts/_data）。
• 还要注意 gitlab 的具体监听指令，感谢下面的指导。

致谢：

• https://gitlab.com/gitlab-org/omnibus-gitlab/issues/1307
• https://github.com/jwilder/nginx-proxy/issues/309#issuecomment-163556850 （用于解释 jwilder/nginx-proxy 的工作原理）