Docker运维一键排查Shell脚本,6大功能搞定容器90%线上故障

# 移动到系统全局命令目录
mv triage /usr/local/bin/
# 添加执行权限
chmod +x /usr/local/bin/triage

triage

# 查看帮助
triage -h
triage --help
# 1. 排查容器重启/崩溃问题
triage restart 容器名/容器ID
# 2. 排查端口占用/映射问题
triage port 8080
# 3. 排查Docker磁盘占用爆满
triage disk
# 4. 排查容器网络/DNS故障
triage net
# 5. 排查镜像体积/构建缓存
triage image
# 6. 容器安全合规检查
triage sec 容器名/容器ID

triage restart my-api

triage port 8080

triage disk

triage net

#!/usr/bin/env bash
set -euo pipefail
usage() {
  cat <<'EOF'
Docker ops triage (one command).
Usage:
  triage restart <container>
  triage port <port>
  triage disk
  triage net
  triage image
  triage sec <container>
Examples:
  triage restart my-api
  triage port 8080
  triage disk
  triage net
  triage image
  triage sec my-api
EOF
}
need_cmd() { command -v "$1" >/dev/null 2>&1; }
hr() { echo; echo "------------------------------------------------------------"; echo; }
must_docker() {
  if ! need_cmd docker; then
    echo "docker not found in PATH." >&2
    exit 1
  fi
}
cmd_restart() {
  must_docker
  local C="${1:-}"
  if [[ -z "${C}" ]]; then
    echo "Missing <container>" >&2
    exit 2
  fi
echo "== docker ps (matching) =="
docker ps -a --format 'table {{.ID}}\t{{.Names}}\t{{.Status}}\t{{.Image}}' | (head -n 1; grep -E "(^|\\s)${C}(\\s|$)" || true)
hr
echo "== docker inspect (state) =="
docker inspect -f 'Name={{.Name}} Status={{.State.Status}} ExitCode={{.State.ExitCode}} OOMKilled={{.State.OOMKilled}} Error={{.State.Error}} StartedAt={{.State.StartedAt}} FinishedAt={{.State.FinishedAt}}' "${C}" 2>/dev/null || true
hr
echo "== last 200 logs =="
docker logs --tail 200 "${C}" 2>/dev/null || true
hr
echo "== restart policy / healthcheck =="
docker inspect -f 'RestartPolicy={{json .HostConfig.RestartPolicy}} Healthcheck={{json .Config.Healthcheck}}' "${C}" 2>/dev/null || true
hr
echo "== hints =="
echo "- ExitCode=137 often means SIGKILL (commonly OOMKilled)."
echo "- If Healthcheck keeps failing, container may be restarted by orchestrator policies."
echo "- If logs show bind errors, check host port conflicts (triage port <port>)."
}
cmd_port() {
  must_docker
  local PORT="${1:-}"
  if [[ -z "${PORT}" ]]; then
    echo "Missing <port>" >&2
    exit 2
  fi
echo "== docker ps port publish mapping =="
docker ps --format 'table {{.ID}}\t{{.Names}}\t{{.Ports}}' | (head -n 1; grep -E "(:|\\b)${PORT}->" || true)
hr
echo "== host listeners (ss/netstat) =="
if need_cmd ss; then
  ss -lntup 2>/dev/null | grep -E ":(?:${PORT})\\b" || true
elif need_cmd netstat; then
  netstat -lntup 2>/dev/null | grep -E ":(?:${PORT})\\b" || true
else
  echo "ss/netstat not found."
fi
hr
echo "== docker-proxy process (if exists) =="
ps -ef 2>/dev/null | grep -E "docker-proxy.*:${PORT}\\b" | grep -v grep || true
hr
echo "== hints =="
echo "- If you see 0.0.0.0:${PORT}->... in docker ps, the host port is published by Docker."
echo "- If host is listening on 127.0.0.1:${PORT}, external clients can't reach it."
echo "- If container listens only on 127.0.0.1 inside, publish won't help; it must listen on 0.0.0.0 in the container."
}
cmd_disk() {
  must_docker
  echo "== docker system df =="
  docker system df || true
  hr
  echo "== docker system df -v (top part) =="
  docker system df -v 2>/dev/null | sed -n '1,200p' || true
  hr
  echo "== /var/lib/docker usage (top 20 dirs) =="
  if [[ -d /var/lib/docker ]]; then
    du -h --max-depth=2 /var/lib/docker 2>/dev/null | sort -h | tail -n 20 || true
  else
    echo "/var/lib/docker not found (non-Linux host or custom data-root)."
    echo "Check: docker info | grep -i 'Docker Root Dir'"
    docker info 2>/dev/null | grep -i 'Docker Root Dir' || true
  fi
  hr
  echo "== largest container logs (json-file) top 20 =="
  if [[ -d /var/lib/docker/containers ]]; then
    find /var/lib/docker/containers -name '*-json.log' -type f -printf '%s %p\n' 2>/dev/null \
      | sort -n | tail -n 20 | awk '{printf "%.2fMB %s\n",$1/1024/1024,$2}' || true
  fi
  hr
  echo "== hints =="
  echo "- Biggest offenders are usually: images, build cache, volumes, and container json logs."
  echo "- Safe cleanups: docker system prune -f (unused objects), docker image prune -a -f (unused images)."
  echo "- Long-term: configure logging max-size/max-file to cap json-file logs."
}
cmd_net() {
  must_docker
  echo "== docker networks =="
  docker network ls || true
  hr
  echo "== docker info (network related) =="
  docker info 2>/dev/null | egrep -i 'Server Version|Cgroup|Security Options|Docker Root Dir|Registry Mirrors|Live Restore|Network' || true
  hr
  echo "== resolv.conf inside a running container (first one) =="
  local CID
  CID="$(docker ps -q | head -n 1 || true)"
  if [[ -n "${CID}" ]]; then
    docker exec "${CID}" sh -lc 'echo "container: $(hostname)"; cat /etc/resolv.conf; ip route 2>/dev/null || true' 2>/dev/null || true
  else
    echo "No running container found."
  fi
  hr
  echo "== host resolv.conf =="
  cat /etc/resolv.conf 2>/dev/null || true
  hr
  echo "== hints =="
  echo "- If only domain fails inside container, check DNS server in /etc/resolv.conf."
  echo "- MTU issues often show: small requests ok, large requests timeout (blackhole)."
  echo "- For bridge networks, iptables/nft rules and FORWARD policy can break connectivity."
}
cmd_image() {
  must_docker
  echo "== docker version =="
  docker version 2>/dev/null | sed -n '1,120p' || true
  hr
  echo "== largest images (top 20) =="
  docker images --format '{{.Repository}}:{{.Tag}} {{.ID}} {{.Size}}' 2>/dev/null | head -n 20 || true
  hr
  echo "== build cache / system df =="
  docker system df -v 2>/dev/null | sed -n '1,220p' || true
  hr
  echo "== hints =="
  echo "- Use multi-stage builds; keep runtime image minimal."
  echo "- Split dependency layers to maximize cache hits."
  echo "- Pin base image versions for reproducibility."
}
cmd_sec() {
  must_docker
  local C="${1:-}"
  if [[ -z "${C}" ]]; then
    echo "Missing <container>" >&2
    exit 2
  fi
  echo "== inspect security-related fields =="
  docker inspect -f 'Name={{.Name}} User={{.Config.User}} Privileged={{.HostConfig.Privileged}} ReadonlyRootfs={{.HostConfig.ReadonlyRootfs}} NetworkMode={{.HostConfig.NetworkMode}} PidMode={{.HostConfig.PidMode}} IpcMode={{.HostConfig.IpcMode}}' "${C}" 2>/dev/null || true
  hr
  docker inspect -f 'CapAdd={{json .HostConfig.CapAdd}} CapDrop={{json .HostConfig.CapDrop}} SecurityOpt={{json .HostConfig.SecurityOpt}}' "${C}" 2>/dev/null || true
  hr
  echo "== mounts =="
  docker inspect -f 'Mounts={{json .Mounts}}' "${C}" 2>/dev/null | sed -n '1,200p' || true
  hr
  echo "== hints =="
  echo "- Prefer non-root user; avoid privileged and host PID/IPC unless necessary."
  echo "- Use read-only rootfs + writable volumes for data."
  echo "- Drop capabilities by default; add only what is needed."
}
main() {
  local cmd="${1:-}"
  if [[ -z "${cmd}" || "${cmd}" == "-h" || "${cmd}" == "--help" ]]; then
    usage
    exit 0
  fi
  shift || true
  case "${cmd}" in
    restart) cmd_restart "${1:-}" ;;
    port)    cmd_port "${1:-}" ;;
    disk)    cmd_disk ;;
    net)     cmd_net ;;
    image)   cmd_image ;;
    sec)     cmd_sec "${1:-}" ;;
    *)
      echo "Unknown command: ${cmd}" >&2
      usage >&2
      exit 2
      ;;
  esac
}
main "$@"