一、
最近由于某些場景下需要使用nmap，而nmap的rpm安裝包在源目標機器上使用有軟件沖突，因此，計劃使用docker部署nmap
具體計劃為
1、使用centos的基礎鏡像，在有網環境下，通過配置阿里云的yum倉庫，在centos基礎鏡像內編譯安裝好nmap
2、制作多版centos鏡像，盡量優化制作出的鏡像大小，合理瘦身，以方便制作出的鏡像上傳和下載
3、在多版鏡像中挑選最小的鏡像，測試鏡像功能是否符合預期
二、
制作鏡像前的準備工作
主要是nmap的源碼包和阿里云的yum倉庫文件
阿里云的yum倉庫文件 兩個文件都修改完成，可以直接使用了，和Dockerfile放置在同一個目錄下，名字分別為CentOS-Base.repo和epel.repo
# CentOS-Base.repo
#
# The mirror system uses the connecting IP address of the client and the
# update status of each mirror to pick mirrors that are updated to and
# geographically close to the client. You should use this for CentOS updates
# unless you are manually picking other mirrors.
#
# If the mirrorlist= does not work for you, as a fall back you can try the
# remarked out baseurl= line instead.
#
#[base]
name=CentOS-7 - Base - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/7/os/$basearch/http://mirrors.aliyuncs.com/centos/7/os/$basearch/http://mirrors.cloud.aliyuncs.com/centos/7/os/$basearch/
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7#released updates
[updates]
name=CentOS-7 - Updates - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/7/updates/$basearch/http://mirrors.aliyuncs.com/centos/7/updates/$basearch/http://mirrors.cloud.aliyuncs.com/centos/7/updates/$basearch/
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7#additional packages that may be useful
[extras]
name=CentOS-7 - Extras - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/7/extras/$basearch/http://mirrors.aliyuncs.com/centos/7/extras/$basearch/http://mirrors.cloud.aliyuncs.com/centos/7/extras/$basearch/
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-7 - Plus - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/7/centosplus/$basearch/http://mirrors.aliyuncs.com/centos/7/centosplus/$basearch/http://mirrors.cloud.aliyuncs.com/centos/7/centosplus/$basearch/
gpgcheck=1
enabled=0
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7#contrib - packages by Centos Users
[contrib]
name=CentOS-7 - Contrib - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/7/contrib/$basearch/http://mirrors.aliyuncs.com/centos/7/contrib/$basearch/http://mirrors.cloud.aliyuncs.com/centos/7/contrib/$basearch/
gpgcheck=1
enabled=0
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
[epel]
name=Extra Packages for Enterprise Linux 7 - $basearch
baseurl=http://mirrors.aliyun.com/epel/7/$basearch
failovermethod=priority
enabled=1
gpgcheck=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7[epel-debuginfo]
name=Extra Packages for Enterprise Linux 7 - $basearch - Debug
baseurl=http://mirrors.aliyun.com/epel/7/$basearch/debug
failovermethod=priority
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
gpgcheck=0[epel-source]
name=Extra Packages for Enterprise Linux 7 - $basearch - Source
baseurl=http://mirrors.aliyun.com/epel/7/SRPMS
failovermethod=priority
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
gpgcheck=0
[root@k8s-master dockerbuild]# cat epel.repo
[epel]
name=Extra Packages for Enterprise Linux 7 - $basearch
baseurl=http://mirrors.aliyun.com/epel/7/$basearch
failovermethod=priority
enabled=1
gpgcheck=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7[epel-debuginfo]
name=Extra Packages for Enterprise Linux 7 - $basearch - Debug
baseurl=http://mirrors.aliyun.com/epel/7/$basearch/debug
failovermethod=priority
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
gpgcheck=0[epel-source]
name=Extra Packages for Enterprise Linux 7 - $basearch - Source
baseurl=http://mirrors.aliyun.com/epel/7/SRPMS
failovermethod=priority
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
gpgcheck=0
nmap-7.91源碼下載地址：https://nmap.org/dist/nmap-7.91.tar.bz2?，該軟件下載后和Dockerfile放置在同一個目錄下
三、
第一版dockers build
FROM centos_vim:latest
COPY CentOS-Base.repo /etc/yum.repos.d/
COPY epel.repo /etc/yum.repos.d/
ADD nmap-7.91.tar.bz2 /root/
RUN cd /root/nmap-7.91/ &&yum install gcc gcc-c++ make -y && ./configure --prefix=/usr/local/nmap&&make &&make install &&make clean&& cd /root/&& rm -rf /root/nmap-7.91&&yum clean all
ENTRYPOINT [ "/usr/bin/tail", "-f", "/etc/yum.repos.d/epel.repo;" ]
build命令基本不變的：
docker build -t centos-vim-nmap:v2 .此時，我們觀察鏡像大小，可以看到鏡像還是比較大的，大概400多M，直接用docker images也是可以印證到的：
[root@k8s-master dockerbuild]# docker history centos-vim-nmap:v2
IMAGE CREATED CREATED BY SIZE COMMENT
cef198ffbf5d 8 hours ago /bin/sh -c #(nop) ENTRYPOINT ["/usr/bin/tai… 0B
eba73e85c735 8 hours ago /bin/sh -c cd /root/nmap-7.91/ &&yum install… 151MB
4af8cec1f126 9 hours ago /bin/sh -c #(nop) ADD file:6f98802f7e9d7e895… 52.6MB
d63ddcc9393a 9 hours ago /bin/sh -c #(nop) COPY file:d41ffd9b2808e586… 664B
c075338a9174 9 hours ago /bin/sh -c #(nop) COPY file:d7d3b8798da7098c… 2.32kB
962cf7473955 3 years ago /bin/sh -c #(nop) CMD ["/bin/bash" "-D"] 0B
<missing> 3 years ago /bin/sh -c #(nop) EXPOSE 22 0B
<missing> 3 years ago /bin/sh -c yum -y install vim net-tools && y… 73.3MB
<missing> 3 years ago /bin/sh -c #(nop) MAINTAINER by jesse (jess… 0B
<missing> 8 years ago /bin/sh -c #(nop) CMD ["/bin/bash"] 0B
<missing> 8 years ago /bin/sh -c #(nop) LABEL license=GPLv2 0B
<missing> 8 years ago /bin/sh -c #(nop) LABEL vendor=CentOS 0B
<missing> 8 years ago /bin/sh -c #(nop) LABEL name=CentOS Base Im… 0B
<missing> 8 years ago /bin/sh -c #(nop) ADD file:b3bdbca0669a03490… 195MB
<missing> 8 years ago /bin/sh -c #(nop) MAINTAINER The CentOS Pro… 0B [root@k8s-master dockerbuild]# docker images |grep centos
centos-vim-nmap v1 ba4aaefb21f0 8 hours ago 299MB
centos-vim-nmap v2 cef198ffbf5d 8 hours ago 472MB
centos_vim v1 69b8e7c0ec9f 28 hours ago 824MB
centos_vim v d0f1a760bf9f 28 hours ago 824MB
centos_vim latest 962cf7473955 3 years ago 268MB
第二版docker build
這一版采用多階段構建，其實RUN命令是可以簡化的，不過不影響最終的容器大小，主要是COPY --from=build /usr/local/nmap /usr/local/nmap 把編譯產出物直接拷貝到下一個階段了
FROM centos_vim:latest AS build
COPY CentOS-Base.repo /etc/yum.repos.d/
COPY epel.repo /etc/yum.repos.d/
ADD nmap-7.91.tar.bz2 /root/
RUN cd /root/nmap-7.91/ &&yum install gcc gcc-c++ make -y && ./configure --prefix=/usr/local/nmap&&make &&make install &&make clean&& cd /root/&& rm -rf /root/nmap-7.91&&yum clean all
FROM centos_vim:latest
COPY --from=build /usr/local/nmap /usr/local/nmap
ENTRYPOINT [ "/usr/bin/tail", "-f", "/etc/yum.repos.d/epel.repo;" ]
看build history可以看到明顯變小了，只有300M了
[root@k8s-master dockerbuild]# docker history centos-vim-nmap:v1
IMAGE CREATED CREATED BY SIZE COMMENT
ba4aaefb21f0 8 hours ago /bin/sh -c #(nop) ENTRYPOINT ["/usr/bin/tai… 0B
28424c28af89 8 hours ago /bin/sh -c #(nop) COPY dir:c798ee1e3e91fcd7d… 31MB
962cf7473955 3 years ago /bin/sh -c #(nop) CMD ["/bin/bash" "-D"] 0B
<missing> 3 years ago /bin/sh -c #(nop) EXPOSE 22 0B
<missing> 3 years ago /bin/sh -c yum -y install vim net-tools && y… 73.3MB
<missing> 3 years ago /bin/sh -c #(nop) MAINTAINER by jesse (jess… 0B
<missing> 8 years ago /bin/sh -c #(nop) CMD ["/bin/bash"] 0B
<missing> 8 years ago /bin/sh -c #(nop) LABEL license=GPLv2 0B
<missing> 8 years ago /bin/sh -c #(nop) LABEL vendor=CentOS 0B
<missing> 8 years ago /bin/sh -c #(nop) LABEL name=CentOS Base Im… 0B
<missing> 8 years ago /bin/sh -c #(nop) ADD file:b3bdbca0669a03490… 195MB
<missing> 8 years ago /bin/sh -c #(nop) MAINTAINER The CentOS Pro… 0B docker build的錯誤示范
也就是把RUN命令拆開，不做任何清理，那么這個鏡像會多大呢？
FROM centos_vim:latest
COPY CentOS-Base.repo /etc/yum.repos.d/
COPY epel.repo /etc/yum.repos.d/
ADD nmap-7.91.tar.bz2 /root/
RUN cd /root/nmap-7.91/
WORKDIR /root/nmap-7.91/
RUN yum install gcc gcc-c++ make -y && ./configure --prefix=/usr/local/nmap&&make &&make install
ENTRYPOINT [ "/usr/bin/tail", "-f", "/etc/yum.repos.d/epel.repo;" ]
build命令：
docker build -t centos-vim-nmap:v3 .build history 查看鏡像大小，預估為800多M
[root@k8s-master dockerbuild]# docker history centos-vim-nmap:v3
IMAGE CREATED CREATED BY SIZE COMMENT
7bd9da6a6834 24 seconds ago /bin/sh -c #(nop) ENTRYPOINT ["/usr/bin/tai… 0B
5638397f6bee 24 seconds ago /bin/sh -c yum install gcc gcc-c++ make -y &… 491MB
cc92fafc4d7f 2 minutes ago /bin/sh -c #(nop) WORKDIR /root/nmap-7.91 0B
ae1d0b5fc823 4 minutes ago /bin/sh -c cd /root/nmap-7.91/ 0B
4af8cec1f126 9 hours ago /bin/sh -c #(nop) ADD file:6f98802f7e9d7e895… 52.6MB
d63ddcc9393a 9 hours ago /bin/sh -c #(nop) COPY file:d41ffd9b2808e586… 664B
c075338a9174 9 hours ago /bin/sh -c #(nop) COPY file:d7d3b8798da7098c… 2.32kB
962cf7473955 3 years ago /bin/sh -c #(nop) CMD ["/bin/bash" "-D"] 0B
<missing> 3 years ago /bin/sh -c #(nop) EXPOSE 22 0B
<missing> 3 years ago /bin/sh -c yum -y install vim net-tools && y… 73.3MB
<missing> 3 years ago /bin/sh -c #(nop) MAINTAINER by jesse (jess… 0B
<missing> 8 years ago /bin/sh -c #(nop) CMD ["/bin/bash"] 0B
<missing> 8 years ago /bin/sh -c #(nop) LABEL license=GPLv2 0B
<missing> 8 years ago /bin/sh -c #(nop) LABEL vendor=CentOS 0B
<missing> 8 years ago /bin/sh -c #(nop) LABEL name=CentOS Base Im… 0B
<missing> 8 years ago /bin/sh -c #(nop) ADD file:b3bdbca0669a03490… 195MB
<missing> 8 years ago /bin/sh -c #(nop) MAINTAINER The CentOS Pro… 0B [root@k8s-master dockerbuild]# docker images |grep centos
centos-vim-nmap v3 7bd9da6a6834 2 minutes ago 811MB
centos-vim-nmap v1 ba4aaefb21f0 8 hours ago 299MB
centos-vim-nmap v2 cef198ffbf5d 8 hours ago 472MB
centos_vim v1 69b8e7c0ec9f 28 hours ago 824MB
centos_vim v d0f1a760bf9f 28 hours ago 824MB
centos_vim latest 962cf7473955 3 years ago 268MB
可以發現，如果不做任何清理，RUN命令拆分開后，build的鏡像是和直接commit鏡像基本一致的
三、
nmap的功能測試
1、
docker? run 鏡像
docker run -itd --name=centos centos-vim-nmap:v1 /bin/bash2、
直接運行nmap
[root@k8s-master dockerbuild]# docker exec -it centos /usr/local/nmap/bin/nmap 182.61.244.181
Starting Nmap 7.91 ( https://nmap.org ) at 2025-07-19 13:24 UTC
Nmap scan report for 182.61.244.181
Host is up (0.0096s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
32768/tcp open filenet-tmsNmap done: 1 IP address (1 host up) scanned in 4.87 seconds
[root@k8s-master ~]# docker exec -it centos /usr/local/nmap/bin/nmap -iL /root/ip.txt -sS
Starting Nmap 7.91 ( https://nmap.org ) at 2025-07-19 13:27 UTC
Nmap scan report for 192.168.123.15
Host is up (0.0000040s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
5432/tcp open postgresqlNmap done: 1 IP address (1 host up) scanned in 6.71 seconds
可以看到，nmap是從容器內向外掃描，數據鏈路會多一層，這些需要特別注意噢
