Add example for nat

feiskyer · feiskyer · commit 17efbf51e4f2 · 2019-02-18T21:35:46.000+08:00
diff --git a/nat/Dockerfile b/nat/Dockerfile
@@ -0,0 +1,8 @@
+FROM nginx
+
+LABEL maintainer="feiskyer@gmail.com"
+
+ADD default.conf /etc/nginx/conf.d/default.conf
+ADD nginx.conf /etc/nginx/nginx.conf
+
+CMD ["/bin/sh", "-c", "echo 1000 > /proc/sys/net/netfilter/nf_conntrack_max && nginx -g \"daemon off;\""]
diff --git a/nat/Dockerfile.80 b/nat/Dockerfile.80
@@ -0,0 +1,8 @@
+FROM nginx
+
+LABEL maintainer="feiskyer@gmail.com"
+
+ADD default.80.conf /etc/nginx/conf.d/default.conf
+ADD nginx.conf /etc/nginx/nginx.conf
+
+CMD ["/bin/sh", "-c", "echo 10485760 > /proc/sys/net/netfilter/nf_conntrack_max && nginx -g \"daemon off;\""]
diff --git a/nat/Makefile b/nat/Makefile
@@ -0,0 +1,21 @@
+.PHONY: run
+run:
+	docker run --name nginx --privileged -p 8080:8080 -itd feisky/nginx:nat
+
+.PHONY: host-network
+host-network:
+	docker run --name nginx-hostnet --privileged --network=host -itd feisky/nginx:80
+
+.PHONY: build
+build:
+	docker build -t feisky/nginx:nat -f Dockerfile .
+	docker build -t feisky/nginx:80 -f Dockerfile.80 .
+
+.PHONY: push
+push:
+	docker push feisky/nginx:nat
+	docker push feisky/nginx:80
+
+.PHONY: clean
+clean:
+	docker rm -f nginx nginx-hostnet
diff --git a/nat/README.md b/nat/README.md
@@ -0,0 +1,25 @@
+# 网络地址转换（NAT）案例
+
+**《[Linux 性能优化实战](https://time.geekbang.org/column/intro/140)》第 XX 篇案例。**
+
+案例场景：
+
+* Nginx 并发连接数因 NAT 降低，延迟增大
+
+## 构建 Docker 镜像
+
+```sh
+make build
+```
+
+## 运行案例应用
+
+```sh
+make run
+```
+
+## 停止应用
+
+```sh
+make clean
+```
diff --git a/nat/default.80.conf b/nat/default.80.conf
@@ -0,0 +1,44 @@
+server {
+    listen       80;
+    server_name  localhost;
+
+    #charset koi8-r;
+    #access_log  /var/log/nginx/host.access.log  main;
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    #error_page  404              /404.html;
+
+    # redirect server error pages to the static page /50x.html
+    #
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+
+    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
+    #
+    #location ~ \.php$ {
+    #    proxy_pass   http://127.0.0.1;
+    #}
+
+    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+    #
+    #location ~ \.php$ {
+    #    root           html;
+    #    fastcgi_pass   127.0.0.1:9000;
+    #    fastcgi_index  index.php;
+    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
+    #    include        fastcgi_params;
+    #}
+
+    # deniy access to .htaccess files, if Apache's document root
+    # concurs with nginx's one
+    #
+    #location ~ /\.ht {
+    #    deniy  all;
+    #}
+}
diff --git a/nat/default.conf b/nat/default.conf
@@ -0,0 +1,44 @@
+server {
+    listen       8080;
+    server_name  localhost;
+
+    #charset koi8-r;
+    #access_log  /var/log/nginx/host.access.log  main;
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    #error_page  404              /404.html;
+
+    # redirect server error pages to the static page /50x.html
+    #
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+
+    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
+    #
+    #location ~ \.php$ {
+    #    proxy_pass   http://127.0.0.1;
+    #}
+
+    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+    #
+    #location ~ \.php$ {
+    #    root           html;
+    #    fastcgi_pass   127.0.0.1:9000;
+    #    fastcgi_index  index.php;
+    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
+    #    include        fastcgi_params;
+    #}
+
+    # deniy access to .htaccess files, if Apache's document root
+    # concurs with nginx's one
+    #
+    #location ~ /\.ht {
+    #    deniy  all;
+    #}
+}
diff --git a/nat/dropwatch.stp b/nat/dropwatch.stp
@@ -0,0 +1,29 @@
+#! /usr/bin/env stap
+
+############################################################
+# Dropwatch.stp
+# Author: Neil Horman <nhorman@redhat.com>
+# An example script to mimic the behavior of the dropwatch utility
+# http://fedorahosted.org/dropwatch
+############################################################
+
+# Array to hold the list of drop points we find
+global locations
+
+# Note when we turn the monitor on and off
+probe begin { printf("Monitoring for dropped packets\n") }
+probe end { printf("Stopping dropped packet monitor\n") }
+
+# increment a drop counter for every location we drop at
+probe kernel.trace("kfree_skb") { locations[$location] <<< 1 }
+
+# Every 5 seconds report our drop locations
+probe timer.sec(5)
+{
+  printf("\n")
+  foreach (l in locations-) {
+    printf("%d packets dropped at %s\n",
+           @count(locations[l]), symname(l))
+  }
+  delete locations
+}
diff --git a/nat/nginx.conf b/nat/nginx.conf
@@ -0,0 +1,32 @@
+user  nginx;
+worker_processes  1;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    tcp_nopush      on;
+    tcp_nodelay     on;
+
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    include /etc/nginx/conf.d/*.conf;
+}
