一、确认Docker版本[rootrocky8 ~]#docker versionClient: Docker Engine - Community Version:29.9.2 API version:1.56Go version: go1.26.10 Git commit: a82e528 Built: Tue Oct2018:47:522026OS/Arch: linux/amd64 Context: default Server: Docker Engine - Community Engine: Version:29.9.2 API version:1.56(minimum version1.40)Go version: go1.26.10 Git commit: 0367cbe Built: Tue Oct2018:44:102026OS/Arch: linux/amd64 Experimental:falsecontainerd: Version: v2.4.2 GitCommit: b7a25261e029d68978bbf290df0a62fc819b3c51 runc: Version:1.5.2 GitCommit: v1.5.2-0-g29dd3dc2 docker-init: Version:0.19.0 GitCommit: de40ad0二、升级cgroup[rootrocky8 ~]#docker info | grep Storage DriverStorage Driver: overlay2 WARNING: Supportforcgroup v1 is deprecated and planned to be removed by no later than May2029(https://github.com/moby/moby/issues/51111)#官方说明cgroup v1 已官方弃用但维护到 2029 年 5 月Rocky 8 / Alma 8 EOL# 确认当前是 v1[rootrocky8 ~]#stat -fc %T /sys/fs/cgroup/tmpfs# tmpfs v1# 启用 v2加内核参数[rootrocky8 ~]#grubby --update-kernelALL --argssystemd.unified_cgroup_hierarchy1#重启生效[rootrocky8 ~]#reboot# 重启后验证[rootrocky8 ~]#stat -fc %T /sys/fs/cgroup/cgroup2fs#cgroup2fs v2[rootrocky8 ~]#docker info | grep -i cgroupCgroup Driver: systemd Cgroup Version:2cgroupns[rootrocky8 ~]#docker info 21 | grep -i cgroup v1[rootrocky8 ~]##没有输出了——WARNING 消失了#注意启用 cgroup v2 后某些老版本容器运行时/监控工具可能不兼容。生产环境先测试。长期升级 OS Rocky9 默认 cgroup v2升级后 WARNING 自然消失。三、rocky8 推荐 daemon.json[rootrocky8 ~]#curl -I https://gh4nhz1o.mirror.aliyuncs.comHTTP/2200date: Wed,28Oct202612:35:58 GMT vary: Accept-Encoding cache-control: no-cache#阿里云镜像加速器的规则是只有阿里云 ECS 才能访问且从 ECS 内网/VPC 访问返回200。#阿里云 mirror 排第一位用阿里云内网加速拉镜像更快。[rootrocky8 ~]#cat /etc/docker/daemon.json{registry-mirrors:[https://gh4nhz1o.mirror.aliyuncs.com,https://docker.m.daocloud.io,https://docker.1ms.run],storage-driver:overlay2,exec-opts:[native.cgroupdriversystemd],data-root:/data/docker,live-restore:true,no-new-privileges:true,userland-proxy:false,log-driver:json-file,log-opts:{max-size:100m,max-file:3},dns:[223.5.5.5,180.76.76.76],max-concurrent-downloads:8,max-concurrent-uploads:4,default-ulimits:{nofile:{Name:nofile,Soft:65536,Hard:65536}}}3.1配置项说明配置项值作用级别data-root/data/docker数据盘独立避免撑爆系统盘必选storage-driveroverlay2官方推荐性能最优必选exec-optssystemdcgroup 驱动匹配K8s 兼容必选registry-mirrors阿里云加速 第三方阿里云内网加速拉镜像更快必选live-restoretruedockerd 重启不杀容器必选no-new-privilegestrue防止容器提权逃逸必选log-driverjson-file 100m×3日志轮转防磁盘爆必选dns223.5.5.5 / 180.76.76.76全局 DNS覆盖宿主机推荐userland-proxyfalse用 iptables 替代用户态代理性能更好推荐max-concurrent-downloads8并行拉取加速推荐max-concurrent-uploads4提高上传速度避免打满带宽推荐default-ulimitsnofile 65536默认文件描述符限制推荐3.2重启生效# 语法检查[rootrocky8 ~]#cat /etc/docker/daemon.json | python3 -m json.tool# 重启生效[rootrocky8 ~]#systemctl daemon-reload[rootrocky8 ~]#systemctl restart docker3.3验证[rootrocky8 ~]#docker info | grep -A5 Registry MirrorsRegistry Mirrors: https://gh4nhz1o.mirror.aliyuncs.com/ https://docker.m.daocloud.io/ https://docker.1ms.run/ Live Restore Enabled:trueFirewall Backend: iptables[rootrocky8 ~]#docker info | grep Storage DriverStorage Driver: overlay2[rootrocky8 ~]#docker info | grep Docker Root DirDocker Root Dir: /data/docker[rootrocky8 ~]#docker info | grep Live RestoreLive Restore Enabled:true四、开启 Docker Tab 补全Docker 官方包已经带了补全脚本只是可能没加载#确认补全脚本存在[rootrocky8 ~]#ls /usr/share/bash-completion/completions/docker/usr/share/bash-completion/completions/docker# 装 bash-completion如果没装[rootrocky8 ~]#dnf install -y bash-completion# 当前 shell 立即生效[rootrocky8 ~]#source /usr/share/bash-completion/bash_completion[rootrocky8 ~]#source /usr/share/bash-completion/completions/docker# 测试dockerpuTab# → pulldockerpTabTab# → pause plugin port ps pull push#永久生效重登自动加载cat~/.bashrcEOF source /usr/share/bash-completion/bash_completion source /usr/share/bash-completion/completions/docker EOF4.1docker composeV2 插件补全Docker CLI 自带补全生成器# 生成 compose 子命令补全[rootrocky8 ~]#docker completion bash /etc/bash_completion.d/docker-compose# 立即生效[rootrocky8 ~]#source /etc/bash_completion.d/docker-compose#测试dockercomposeTabTab# up down build ps logs exec run ...#注V2 插件补全脚本叫 docker-compose 是为了兼容历史习惯实际补全的是 docker compose 子命令。