一、确认Docker版本
[root@rocky8 ~]#docker versionClient: Docker Engine - Community Version:29.9.2 API version:1.56Go version: go1.26.10 Git commit: a82e528 Built: Tue Oct2018:47:522026OS/Arch: linux/amd64 Context: default Server: Docker Engine - Community Engine: Version:29.9.2 API version:1.56(minimum version1.40)Go version: go1.26.10 Git commit: 0367cbe Built: Tue Oct2018:44:102026OS/Arch: linux/amd64 Experimental:falsecontainerd: Version: v2.4.2 GitCommit: b7a25261e029d68978bbf290df0a62fc819b3c51 runc: Version:1.5.2 GitCommit: v1.5.2-0-g29dd3dc2 docker-init: Version:0.19.0 GitCommit: de40ad0二、升级cgroup
[root@rocky8 ~]#docker info | grep "Storage Driver"Storage Driver: overlay2 WARNING: Supportforcgroup v1 is deprecated and planned to be removed by no later than May2029(https://github.com/moby/moby/issues/51111)#官方说明：cgroup v1 已官方弃用，但维护到 2029 年 5 月（Rocky 8 / Alma 8 EOL）# 确认当前是 v1[root@rocky8 ~]#stat -fc %T /sys/fs/cgroup/tmpfs# tmpfs = v1# 启用 v2：加内核参数[root@rocky8 ~]#grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=1"#重启生效[root@rocky8 ~]#reboot# 重启后验证[root@rocky8 ~]#stat -fc %T /sys/fs/cgroup/cgroup2fs#cgroup2fs = v2[root@rocky8 ~]#docker info | grep -i cgroupCgroup Driver: systemd Cgroup Version:2cgroupns[root@rocky8 ~]#docker info 2>&1 | grep -i "cgroup v1"[root@rocky8 ~]##没有输出了——WARNING 消失了#注意：启用 cgroup v2 后，某些老版本容器运行时/监控工具可能不兼容。生产环境先测试。长期：升级 OS Rocky9+ 默认 cgroup v2，升级后 WARNING 自然消失。三、rocky8 推荐 daemon.json
[root@rocky8 ~]#curl -I https://gh4nhz1o.mirror.aliyuncs.comHTTP/2200date: Wed,28Oct202612:35:58 GMT vary: Accept-Encoding cache-control: no-cache#阿里云镜像加速器的规则是：只有阿里云 ECS 才能访问，且从 ECS 内网/VPC 访问返回200。#阿里云 mirror 排第一位，用阿里云内网加速，拉镜像更快。[root@rocky8 ~]#cat /etc/docker/daemon.json{"registry-mirrors":["https://gh4nhz1o.mirror.aliyuncs.com","https://docker.m.daocloud.io","https://docker.1ms.run"],"storage-driver":"overlay2","exec-opts":["native.cgroupdriver=systemd"],"data-root":"/data/docker","live-restore":true,"no-new-privileges":true,"userland-proxy":false,"log-driver":"json-file","log-opts":{"max-size":"100m","max-file":"3"},"dns":["223.5.5.5","180.76.76.76"],"max-concurrent-downloads":8,"max-concurrent-uploads":4,"default-ulimits":{"nofile":{"Name":"nofile","Soft":65536,"Hard":65536}}}3.1配置项说明
| 配置项 | 值 | 作用 | 级别 |
|---|---|---|---|
data-root | /data/docker | 数据盘独立，避免撑爆系统盘 | 必选 |
storage-driver | overlay2 | 官方推荐，性能最优 | 必选 |
exec-opts | systemd | cgroup 驱动匹配，K8s 兼容 | 必选 |
registry-mirrors | 阿里云加速 + 第三方 | 阿里云内网加速，拉镜像更快 | 必选 |
live-restore | true | dockerd 重启不杀容器 | 必选 |
no-new-privileges | true | 防止容器提权逃逸 | 必选 |
log-driver | json-file + 100m×3 | 日志轮转，防磁盘爆 | 必选 |
dns | 223.5.5.5 / 180.76.76.76 | 全局 DNS，覆盖宿主机 | 推荐 |
userland-proxy | false | 用 iptables 替代用户态代理，性能更好 | 推荐 |
max-concurrent-downloads | 8 | 并行拉取，加速 | 推荐 |
| max-concurrent-uploads | 4 | 提高上传速度，避免打满带宽 | 推荐 |
default-ulimits | nofile 65536 | 默认文件描述符限制 | 推荐 |
3.2重启生效
# 语法检查[root@rocky8 ~]#cat /etc/docker/daemon.json | python3 -m json.tool# 重启生效[root@rocky8 ~]#systemctl daemon-reload[root@rocky8 ~]#systemctl restart docker3.3验证
[root@rocky8 ~]#docker info | grep -A5 "Registry Mirrors"Registry Mirrors: https://gh4nhz1o.mirror.aliyuncs.com/ https://docker.m.daocloud.io/ https://docker.1ms.run/ Live Restore Enabled:trueFirewall Backend: iptables[root@rocky8 ~]#docker info | grep "Storage Driver"Storage Driver: overlay2[root@rocky8 ~]#docker info | grep "Docker Root Dir"Docker Root Dir: /data/docker[root@rocky8 ~]#docker info | grep "Live Restore"Live Restore Enabled:true四、开启 Docker Tab 补全
Docker 官方包已经带了补全脚本，只是可能没加载
#确认补全脚本存在[root@rocky8 ~]#ls /usr/share/bash-completion/completions/docker/usr/share/bash-completion/completions/docker# 装 bash-completion（如果没装）[root@rocky8 ~]#dnf install -y bash-completion# 当前 shell 立即生效[root@rocky8 ~]#source /usr/share/bash-completion/bash_completion[root@rocky8 ~]#source /usr/share/bash-completion/completions/docker# 测试dockerpu<Tab># → pulldockerp<Tab><Tab># → pause plugin port ps pull push#永久生效（重登自动加载）：cat>>~/.bashrc<<'EOF' source /usr/share/bash-completion/bash_completion source /usr/share/bash-completion/completions/docker EOF4.1docker compose（V2 插件）补全
Docker CLI 自带补全生成器：# 生成 compose 子命令补全[root@rocky8 ~]#docker completion bash > /etc/bash_completion.d/docker-compose# 立即生效[root@rocky8 ~]#source /etc/bash_completion.d/docker-compose#测试：dockercompose<Tab><Tab># up down build ps logs exec run ...#注：V2 插件补全脚本叫 docker-compose 是为了兼容历史习惯，实际补全的是 docker compose 子命令。
