💡 핵심 요약 (Executive Summary)
본 가이드는 colima 핵심 가이드 및 실전 아키텍처의 핵심 개념, 실전 구성 명령어 및 아키텍처 베스트 프랙티스를 다룹니다. 클라우드 네이티브 및 인프라 엔지니어링 실무에 즉시 활용 가능하도록 체계적으로 정리했습니다.
📑 Table of Contents
Exec
bash
#템플릿 지정
colima template
#기존 vm 삭제 (템플릿내 insecure변경 적용)
colima delete
#정지
colima stop
#시작
colima start
#vm 접근
colima sshFeatures
TLS 신뢰
required:
DockerDaemon 수정-archived
bash
#mac에서 수행
sudo mkdir -p /etc/docker/ssl
sudo mkdir -p /etc/docker/certs.d/$mydomain
ca=$(k get secret -n $ns $secret -o=jsonpath='{.data.ca\.crt}')
cert=$(k get secret -n $ns $secret -o=jsonpath='{.data.tls\.crt}')
key=$(k get secret -n $ns $secret -o=jsonpath='{.data.tls\.key}')
echo $ca | base64 -d | sudo tee /etc/docker/ssl/ca.pem
echo $cert | base64 -d | sudo tee /etc/docker/ssl/cert.pem
echo $key | base64 -d | sudo tee /etc/docker/ssl/key.pem
# 사설 CA인증서 신뢰위치
sudo cp /etc/docker/ssl/ca.pem /etc/docker/certs.d/$mydomain/ca.crt
colima delete
colima template
>>>
# SSL Mountpoint
mounts:
- location: /etc/docker/ssl
writable: false
# 사설 CA인증서 신뢰위치
- location: /etc/docker/certs.d/$mydomain
writable: false
# Docker Daemon Setting
docker:
insecure-registries:
- cmp.registry.io:8080
tlsverify: true
tlscacert: /etc/docker/ssl/ca.pem
tlscert: /etc/docker/ssl/cert.pem
tlskey: /etc/docker/ssl/key.pem
<<<
colima start
# 등록 확인
colima ssh
cat /etc/docker/daemon.json
>>>
{
"exec-opts": [
"native.cgroupdriver=cgroupfs"
],
"features": {
"buildkit": true
},
"insecure-registries": [
"cmp.registry.io:8080"
],
"tlscacert": "/etc/docker/ssl/ca.pem",
"tlscert": "/etc/docker/ssl/cert.pem",
"tlskey": "/etc/docker/ssl/key.pem",
"tlsverify": true
}
<<<
bash
export ca_crt="./ca.crt"
export secured_registry=harbor.Enterprise Cloud.myregistry.internal.com
export registry_ip=10.255.57.88
export colima_template="~/.colima/_templates/default.yaml"
sudo mkdir -p /etc/docker/certs.d/$secured_registry
sudo cp $ca_crt /etc/docker/certs.d/$secured_registry/ca.crt
colima delete
export mount_item=$(cat << EOF | yq -pyaml -ojson | jq '.mounts'
mounts:
- location: /etc/docker/certs.d/$secured_registry
writable: false
EOF
)
yq -i ".mounts += $mount_item" \
~/.colima/_templates/default.yaml
# 둘중 하나만 동작함
yq -i ".network.dns += \"8.8.8.8\"" \
~/.colima/_templates/default.yaml
# yq -i ".network.dnsHosts.\"$secured_registry\" = \"$registry_ip\"" \
# ~/.colima/_templates/default.yaml
export provision_script=$(cat <<EOF
echo '$registry_ip $secured_registry' | sudo tee -a /etc/hosts
mkdir -p /usr/local/share/ca-certificates
ln -sf /etc/docker/certs.d/$secured_registry/ca.crt /usr/local/share/ca-certificates/ 2>/dev/null || true
update-ca-certificates
EOF
)
yq -i ".provision += [{\"mode\": \"system\", \"script\": \"$provision_script\"}] | .provision[].script style=\"literal\"" \
~/.colima/_templates/default.yaml
colima start
colima ssh ls /etc/docker/certs.d/
colima ssh ls /usr/local/share/ca-certificates/
colima ssh cat /etc/hosts
colima ssh sudo update-ca-certificates
colima ssh sudo systemctl restart docker
docker login $secured_registryContainer 실행전 Colima-Checking
bash
port=3306
image="mysql:8.0"
container_name="spring-mysql"
MYSQL_ROOT_PASSWORD=root
MYSQL_DATABASE=spring_db
brew install colima docker
colima start
containerID=$(docker ps -a | grep $image | awk '{print $1}')
if [ -n "$containerID" ]; then
docker start $containerID
else
docker run --name $container_name \
-p $port:$port \
-e MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD \
-e MYSQL_DATABASE=$MYSQL_DATABASE \
-d $image
fi
Leave a Reply