Docker Compose编排三层应用：网络隔离、健康检查与启动顺序实战

Docker Engine: 24.0.7
Docker Compose: v2.23.3
Linux Kernel: 5.15.0 (Ubuntu 22.04)

version: "3.8"

# ========== 命名卷声明 ==========
volumes:
  pg_data:                # 数据库持久化卷
    driver: local
  nginx_logs:             # Nginx日志卷

# ========== 自定义网络声明 ==========
networks:
  frontend_net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24    # 显式指定子网，便于防火墙规则
  backend_net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.0.0/24

services:
  # ---------- 1. PostgreSQL 数据库 ----------
  db:
    image: postgres:16.1-alpine
    container_name: app-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: app_user
      POSTGRES_PASSWORD: ${DB_PASSWORD}    # 从.env文件读取，不要明文写入
    volumes:
      - pg_data:/var/lib/postgresql/data
      - ./init-scripts:/docker-entrypoint-initdb.d:ro   # 初始化SQL脚本
    networks:
      - backend_net          # 只接入后端网络，不暴露到宿主机
    ports:
      - "127.0.0.1:5432:5432"    # 仅本机可访问，用于开发调试
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app_user -d myapp"]
      interval: 10s          # 每10秒检查一次
      timeout: 5s            # 单次检查超时5秒
      retries: 5             # 连续5次失败则标记为unhealthy
      start_period: 30s      # 容器启动后宽限30秒，避免启动初期误判
    deploy:
      resources:
        limits:
          memory: 1G         # 限制内存防止OOM

  # ---------- 2. Spring Boot 后端服务 ----------
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    image: myapp-backend:1.0.0
    container_name: app-backend
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy    # 关键：等待数据库健康后才启动
    environment:
      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/myapp
      SPRING_DATASOURCE_USERNAME: app_user
      SPRING_DATASOURCE_PASSWORD: ${DB_PASSWORD}
      SPRING_PROFILES_ACTIVE: prod
      SERVER_PORT: 8080
    volumes:
      - ./logs:/app/logs          # 挂载日志目录到宿主机
    networks:
      - backend_net                # 只与数据库通信
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/actuator/health"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 40s           # Spring Boot启动较慢，需要更长宽限时间
    deploy:
      resources:
        limits:
          memory: 1.5G
          cpus: "1.0"

  # ---------- 3. Nginx 反向代理 ----------
  nginx:
    image: nginx:1.25.3-alpine
    container_name: app-nginx
    restart: unless-stopped
    depends_on:
      backend:
        condition: service_healthy    # 确保后端已就绪
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - ./static:/usr/share/nginx/html:ro    # 前端静态文件
      - nginx_logs:/var/log/nginx
    networks:
      - frontend_net
      - backend_net                # 同时接入两个网络，作为网关
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost/health || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

logging:
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "3"