docker＋centos7＋nginx1.2.0+ldap ＋jupyter實戰

---

最近在搭建JupyterHub 的時候遇到只支持python3，爲了滿足在大數據平臺需要python2的問題，只能選擇搭建Jupyter，但是Jupyter不支持ldap權限認證，只能使用Nginx 對jupyter端口鏡像權限認證。本文主要分析怎麼製作和部署centos7 docker images，在docker裏面編譯部署nginx 幷包含ldap模塊，然後再分析怎麼配置jupyter。

---

1、下載包

nginx:http://nginx.org/download/nginx-1.12.0.tar.gz
ldap模塊：https://codeload.github.com/kvspb/nginx-auth-ldap/zip/master
環境依賴pcre：https://sourceforge.net/projects/pcre/files/pcre/8.39/

最後的包結構如下：
[root@213128086 nginx]# tree
.
├── Dockerfile
├── nginx-1.12.0.zip
├── nginx-auth-ldap.zip
├── nginx.conf
├── pcre-8.39.zip
└── start.sh

0 directories, 6 files

2、dockerfile

FROM   docker.io/centos:centos7.2.1511
MAINTAINER  "https://github.com/ouyangshourui"
RUN yum -y install net-tools
RUN yum -y install openssh-server
RUN yum -y install openssh-clients
RUN yum -y  install krb5-workstation krb5-libs krb5-auth-dialog 1.3
RUN yum -y install nss-pam-ldapd
RUN yum -y install authconfig
RUN yum -y install initscripts
RUN echo "root:123456" | chpasswd
RUN systemctl enable sshd
RUN yum -y install unzip
RUN yum -y install  gcc-c++ gcc 
RUN yum -y install zlib-devel
RUN yum -y install openldap-devel
RUN yum -y install openssl*
ADD pcre-8.39.zip  /opt/
ADD nginx-1.12.0.zip /opt
ADD nginx-auth-ldap.zip /opt
WORKDIR /opt/
RUN unzip pcre-8.39.zip
RUN unzip nginx-1.12.0.zip
RUN unzip nginx-auth-ldap.zip
WORKDIR /opt/pcre-8.39
RUN    /opt/pcre-8.39/configure && make && make install
WORKDIR /opt/nginx-1.12.0
RUN /opt/nginx-1.12.0/configure  --add-module=../nginx-auth-ldap  && make && make install
ADD nginx.conf /opt
RUN \cp /opt/nginx.conf /usr/local/nginx/conf/nginx.conf
# nginx start command : /usr/local/sbin/nginx
# change nginx command :vim /usr/local/nginx/conf/nginx.conf  && /usr/local/sbin/nginx -s reload
ADD start.sh /opt
RUN chmod 755 /opt/start.sh
ENTRYPOINT ["/opt/start.sh"]

3、nginx.conf配置

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

#    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
#                      '$status $body_bytes_sent "$http_referer" '
#                      '"$http_user_agent" "$http_x_forwarded_for"';

#    access_log  logs/access.log  main;

    sendfile        on;
    tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    auth_ldap_cache_enabled on;
    auth_ldap_cache_expiration_time 10000;
    auth_ldap_cache_size 1000;

    ldap_server LDAP_IDC {
        url "ldap://10.10.128.11:389/ou=People,dc=idc,dc=wanda-group,dc=net?uid?sub?(objectClass=*)";
        #binddn "cn=Manager,dc=idc,dc=wanda-group,dc=net";
        binddn "uid=jupyter,ou=People,dc=idc,dc=wanda-group,dc=net";
        binddn_passwd "123456";
        group_attribute member;
        group_attribute_is_dn on;
        satisfy any;
        require user "uid=ourui,ou=People,dc=idc,dc=wanda-group,dc=net";
    }

# jupyter idc_analysis_user

    server {
       listen           11012;
       server_name      _;

       location / {
           #Login message that the user will see when entering your website:
           auth_ldap "Please enter your ldap user";
           auth_ldap_servers LDAP_IDC;
           proxy_pass http://10.10.128.52:10051/;
           proxy_set_header Referer http://10.10.128.52:10051/;
      }

       location ~* /(api/kernels/[^/]+/(channels|iopub|shell|stdin)|terminals/websocket)/? {
           proxy_pass http://10.10.128.52:10051;
           proxy_set_header Referer http://10.10.128.52:10051;
           # websocket support
           proxy_http_version    1.1;
           proxy_set_header Upgrade "websocket";
           proxy_set_header Connection "Upgrade";
      }

   }


}

3、start.sh配置

#!/bin/sh
/usr/local/nginx/sbin/nginx
tail -f /dev/null

4、docker啓動

docker run  --name nginx_test_ourui  --net=host -v /etc/hosts:/etc/hosts     -v /etc/localtime:/etc/localtime:ro -d    centos:nginxtestourui /sbin/init 

[root@213128086 nginx]# docker -exec -it nginx_test_ourui bash
flag provided but not defined: -exec
See ‘/usr/bin/docker-current –help’.
[root@213128086 nginx]# docker exec -it nginx_test_ourui bash
bash: warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory
bash: warning: setlocale: LC_COLLATE: cannot change locale (en_US.UTF-8): No such file or directory
bash: warning: setlocale: LC_MESSAGES: cannot change locale (en_US.UTF-8): No such file or directory
bash: warning: setlocale: LC_NUMERIC: cannot change locale (en_US.UTF-8): No such file or directory
bash: warning: setlocale: LC_TIME: cannot change locale (en_US.UTF-8): No such file or directory
[root@CDNDC-213128086 nginx-1.12.0]# ps -ef|grep nginx
root 9 1 0 08:16 ? 00:00:00 nginx: master process /usr/local/nginx/sbin/nginx
nobody 10 9 0 08:16 ? 00:00:00 nginx: worker process
root 47 30 0 08:21 ? 00:00:00 grep –color=auto nginx
[root@213128086 nginx-1.12.0]# ss -pan|grep 11012
tcp LISTEN 0 511 :11012 :* users:((“nginx”,pid=9,fd=6))

4、登錄jupyter

11012 爲轉發端口，http://10.10.128.52:10051 爲jupyter地址。