Ubuntu 26.04 安装 Docker：阿里云、腾讯云镜像源与基础安全配置

curl -fsSL https://get.docker.com | bash -s -- --mirror Aliyun

cat /etc/os-release
dpkg --print-architecture
uname -r

dpkg-query -W -f='${binary:Package}\t${Status}\t${Version}\n' \
  docker-ce docker-ce-cli containerd.io \
  docker.io docker-compose docker-compose-v2 docker-doc \
  docker-buildx podman-docker containerd runc 2>/dev/null || true

sudo grep -RnsE 'docker-ce|download\.docker\.com' \
  /etc/apt/sources.list /etc/apt/sources.list.d \
  2>/dev/null || true

(
  set -eu
  packages=()
  for pkg in docker.io docker-compose docker-compose-v2 docker-doc \
             docker-buildx podman-docker containerd runc; do
    status="$(dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null || true)"
    if [ "$status" = "install ok installed" ]; then
      packages+=("$pkg")
    fi
  done

  if [ "${#packages[@]}" -gt 0 ]; then
    sudo apt-get remove "${packages[@]}"
  fi
)

sudo apt-get -o APT::Update::Error-Mode=any update && \
  sudo apt-get install -y ca-certificates curl gnupg

https://mirrors.aliyun.com/docker-ce

http://mirrors.cloud.aliyuncs.com/docker-ce

(
  set -eu

  . /etc/os-release
  [ "$ID" = "ubuntu" ] || {
    echo "这段配置仅适用于 Ubuntu。" >&2
    exit 1
  }

  MIRROR="https://mirrors.aliyun.com/docker-ce"
  CODENAME="${UBUNTU_CODENAME:-${VERSION_CODENAME:-}}"
  ARCH="$(dpkg --print-architecture)"
  [ -n "$CODENAME" ] || {
    echo "无法确定 Ubuntu 代号。" >&2
    exit 1
  }

  # 已有配置时先检查，避免直接覆盖。
  if [ -e /etc/apt/sources.list.d/docker.sources ]; then
    echo "docker.sources 已存在，请先检查现有配置。" >&2
    exit 1
  fi

  WORK="$(mktemp -d)"
  trap 'rm -rf "$WORK"' EXIT

  # 检查当前发行版的仓库元数据和架构记录。
  curl -fsSL --connect-timeout 10 --max-time 60 \
    "$MIRROR/linux/ubuntu/dists/$CODENAME/Release" \
    -o "$WORK/Release"

  grep -Fq "stable/binary-$ARCH/Packages" "$WORK/Release" || {
    echo "仓库元数据未列出当前架构，请检查镜像同步状态。" >&2
    exit 1
  }

  # 公钥先下载到临时目录，成功后再保存到系统目录。
  curl -fsSL --connect-timeout 10 --max-time 60 \
    "$MIRROR/linux/ubuntu/gpg" \
    -o "$WORK/docker.asc"

  gpg --batch --show-keys "$WORK/docker.asc"

  sudo install -m 0755 -d /etc/apt/keyrings
  sudo install -m 0644 "$WORK/docker.asc" /etc/apt/keyrings/docker.asc

  sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null <<EOF
Types: deb
URIs: $MIRROR/linux/ubuntu
Suites: $CODENAME
Components: stable
Architectures: $ARCH
Signed-By: /etc/apt/keyrings/docker.asc
EOF
)

https://mirrors.cloud.tencent.com/docker-ce

(
  set -eu

  . /etc/os-release
  [ "$ID" = "ubuntu" ] || {
    echo "这段配置仅适用于 Ubuntu。" >&2
    exit 1
  }

  MIRROR="https://mirrors.cloud.tencent.com/docker-ce"
  CODENAME="${UBUNTU_CODENAME:-${VERSION_CODENAME:-}}"
  ARCH="$(dpkg --print-architecture)"
  [ -n "$CODENAME" ] || {
    echo "无法确定 Ubuntu 代号。" >&2
    exit 1
  }

  # 已有配置时先检查，避免直接覆盖。
  if [ -e /etc/apt/sources.list.d/docker.sources ]; then
    echo "docker.sources 已存在，请先检查现有配置。" >&2
    exit 1
  fi

  WORK="$(mktemp -d)"
  trap 'rm -rf "$WORK"' EXIT

  # 检查当前发行版的仓库元数据和架构记录。
  curl -fsSL --connect-timeout 10 --max-time 60 \
    "$MIRROR/linux/ubuntu/dists/$CODENAME/Release" \
    -o "$WORK/Release"

  grep -Fq "stable/binary-$ARCH/Packages" "$WORK/Release" || {
    echo "仓库元数据未列出当前架构，请检查镜像同步状态。" >&2
    exit 1
  }

  # 公钥先下载到临时目录，成功后再保存到系统目录。
  curl -fsSL --connect-timeout 10 --max-time 60 \
    "$MIRROR/linux/ubuntu/gpg" \
    -o "$WORK/docker.asc"

  gpg --batch --show-keys "$WORK/docker.asc"

  sudo install -m 0755 -d /etc/apt/keyrings
  sudo install -m 0644 "$WORK/docker.asc" /etc/apt/keyrings/docker.asc

  sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null <<EOF
Types: deb
URIs: $MIRROR/linux/ubuntu
Suites: $CODENAME
Components: stable
Architectures: $ARCH
Signed-By: /etc/apt/keyrings/docker.asc
EOF
)

sudo apt-get -o APT::Update::Error-Mode=any update && \
  apt-cache policy \
    docker-ce docker-ce-cli containerd.io \
    docker-buildx-plugin docker-compose-plugin

sudo apt-get install -y \
  docker-ce \
  docker-ce-cli \
  containerd.io \
  docker-buildx-plugin \
  docker-compose-plugin

sudo systemctl enable --now docker
sudo systemctl is-active docker
sudo docker version
sudo docker compose version
sudo docker buildx version

sudo systemctl status docker --no-pager
sudo journalctl -u docker -n 100 --no-pager

sudo docker pull ghcr.io/soulteary/hello:latest
sudo docker run --rm --network none ghcr.io/soulteary/hello:latest

curl -fsSL --connect-timeout 10 --max-time 120 \
  https://get.docker.com -o get-docker.sh.download && \
  mv get-docker.sh.download get-docker.sh

less get-docker.sh

sudo sh get-docker.sh --mirror Aliyun --dry-run

sudo sh get-docker.sh --mirror Aliyun

sudo env DOWNLOAD_URL=https://mirrors.cloud.tencent.com/docker-ce \
  sh get-docker.sh --dry-run

sudo env DOWNLOAD_URL=https://mirrors.cloud.tencent.com/docker-ce \
  sh get-docker.sh

curl -fsSL --connect-timeout 10 --max-time 120 \
  https://raw.githubusercontent.com/docker/docker-install/master/install.sh \
  -o get-docker.sh.download && \
  mv get-docker.sh.download get-docker.sh

(
  set -eu
  umask 077
  WORK="$(mktemp -d ./docker-install.XXXXXXXX)"
  trap 'rm -rf "$WORK"' EXIT

  curl -q -fsSL --proto '=https' --proto-redir '=https' \
    --connect-timeout 10 --max-time 120 \
    https://raw.githubusercontent.com/soulteary/docker-install/refs/heads/main/install.sh \
    -o "$WORK/install.sh"

  test -s "$WORK/install.sh"
  sh -n "$WORK/install.sh"
  ln "$WORK/install.sh" ./get-docker-fork.sh
  printf '%s\n' '脚本已保存为 get-docker-fork.sh；尚未执行安装。'
)

less get-docker-fork.sh

sh get-docker-fork.sh --mirror Aliyun --dry-run

sudo sh get-docker-fork.sh --mirror Aliyun

sh get-docker-fork.sh --mirror TencentCloud --dry-run

sudo sh get-docker-fork.sh --mirror TencentCloud

getent ahostsv4 mirrors.cloud.tencent.com

169.254.0.3     STREAM mirrors.cloud.tencent.com
169.254.0.3     DGRAM
169.254.0.3     RAW

TENCENT_CLOUD_INTRANET=1 \
  sh scripts/test-tencent-cloud-mirror.sh ubuntu resolute

{
  "log-driver": "local",
  "log-opts": {
    "max-size": "20m",
    "max-file": "5"
  }
}

(
  set -eu
  if sudo test -e /etc/docker/daemon.json; then
    echo "daemon.json 已存在，请先备份并手动合并日志配置。" >&2
    exit 1
  fi

  CONFIG="$(mktemp)"
  trap 'rm -f "$CONFIG"' EXIT
  cat > "$CONFIG" <<'EOF'
{
  "log-driver": "local",
  "log-opts": {
    "max-size": "20m",
    "max-file": "5"
  }
}
EOF

  sudo dockerd --validate --config-file="$CONFIG"
  sudo install -m 0755 -d /etc/docker
  sudo install -m 0644 "$CONFIG" /etc/docker/daemon.json
  sudo systemctl restart docker
)

sudo systemctl is-active docker
sudo docker info --format '{{.LoggingDriver}}'

ports:
  - "127.0.0.1:8080:80"

dpkg-query -W -f='${binary:Package}\t${Version}\n' \
  docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin \
  | tee docker-package-versions.txt

sudo apt-get -o APT::Update::Error-Mode=any update && \
  apt-cache madison docker-ce docker-ce-cli

sudo apt-get install --only-upgrade \
  docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin

sudo docker info
sudo docker system df
df -h
df -ih

(
  set -eu
  umask 077
  WORK="$(mktemp -d ./docker-install.XXXXXXXX)"
  trap 'rm -rf "$WORK"' EXIT

  cat > "$WORK/install.sh" <<'DOCKER_INSTALL_SNAPSHOT_EOF'
#!/bin/sh
set -e
# Docker Engine for Linux installation script.
#
# This script is intended as a convenient way to configure docker's package
# repositories and to install Docker Engine, This script is not recommended
# for production environments. Before running this script, make yourself familiar
# with potential risks and limitations, and refer to the installation manual
# at https://docs.docker.com/engine/install/ for alternative installation methods.
#
# The script:
#
# - Requires `root` or `sudo` privileges to run.
# - Attempts to detect your Linux distribution and version and configure your
#   package management system for you.
# - Doesn't allow you to customize most installation parameters.
# - Installs dependencies and recommendations without asking for confirmation.
# - Installs the latest stable release (by default) of Docker CLI, Docker Engine,
#   Docker Buildx, Docker Compose, containerd, and runc. When using this script
#   to provision a machine, this may result in unexpected major version upgrades
#   of these packages. Always test upgrades in a test environment before
#   deploying to your production systems.
# - Isn't designed to upgrade an existing Docker installation. When using the
#   script to update an existing installation, dependencies may not be updated
#   to the expected version, resulting in outdated versions.
#
# Source code is available at https://github.com/docker/docker-install/
#
# Usage
# ==============================================================================
#
# To install the latest stable versions of Docker CLI, Docker Engine, and their
# dependencies:
#
# 1. download the script
#
#   $ curl -fsSL https://get.docker.com -o install-docker.sh
#
# 2. verify the script's content
#
#   $ cat install-docker.sh
#
# 3. run the script with --dry-run to verify the steps it executes
#
#   $ sh install-docker.sh --dry-run
#
# 4. run the script either as root, or using sudo to perform the installation.
#
#   $ sudo sh install-docker.sh
#
# Command-line options
# ==============================================================================
#
# --version <VERSION>
# Use the --version option to install a specific version, for example:
#
#   $ sudo sh install-docker.sh --version 23.0
#
# --channel <stable|test>
#
# Use the --channel option to install from an alternative installation channel.
# The following example installs the latest versions from the "test" channel,
# which includes pre-releases (alpha, beta, rc):
#
#   $ sudo sh install-docker.sh --channel test
#
# Alternatively, use the script at https://test.docker.com, which uses the test
# channel as default.
#
# --mirror <Aliyun|AzureChinaCloud|TencentCloud>
#
# Use the --mirror option to install from a mirror supported by this script.
# Available mirrors are "Aliyun" (https://mirrors.aliyun.com/docker-ce),
# "AzureChinaCloud" (https://mirror.azure.cn/docker-ce), and
# "TencentCloud" (https://mirrors.cloud.tencent.com/docker-ce), for example:
#
#   $ sudo sh install-docker.sh --mirror AzureChinaCloud
#   $ sudo sh install-docker.sh --mirror TencentCloud
#
# --setup-repo
#
# Use the --setup-repo option to configure Docker's package repositories without
# installing Docker packages. This is useful when you want to add the repository
# but install packages separately:
#
#   $ sudo sh install-docker.sh --setup-repo
#
# Automatic Service Start
#
# By default, this script automatically starts the Docker daemon and enables the docker
# service after installation if systemd is used as init.
#
# If you prefer to start the service manually, use the --no-autostart option:
#
#   $ sudo sh install-docker.sh --no-autostart
#
# Note: Starting the service requires appropriate privileges to manage system services.
#
# Installing docker-sbx
#
# Set the SBX environment variable to "1" to also install the docker-sbx
# package alongside the regular Docker Engine packages:
#
#   $ curl -fsSL https://get.docker.com | sudo SBX=1 sh
#
# ==============================================================================


# Git commit from https://github.com/docker/docker-install when
# the script was uploaded (Should only be modified by upload job):
SCRIPT_COMMIT_SHA="${LOAD_SCRIPT_COMMIT_SHA}"

# strip "v" prefix if present
VERSION="${VERSION#v}"

# The channel to install from:
#   * stable
#   * test
DEFAULT_CHANNEL_VALUE="stable"
if [ -z "$CHANNEL" ]; then
	CHANNEL=$DEFAULT_CHANNEL_VALUE
fi

DEFAULT_DOWNLOAD_URL="https://download.docker.com"
if [ -z "$DOWNLOAD_URL" ]; then
	DOWNLOAD_URL=$DEFAULT_DOWNLOAD_URL
fi

DEFAULT_REPO_FILE="docker-ce.repo"
if [ -z "$REPO_FILE" ]; then
	REPO_FILE="$DEFAULT_REPO_FILE"
	# Automatically default to a staging repo fora
	# a staging download url (download-stage.docker.com)
	case "$DOWNLOAD_URL" in
		*-stage*) REPO_FILE="docker-ce-staging.repo";;
	esac
fi

mirror=''
DRY_RUN=${DRY_RUN:-}
REPO_ONLY=${REPO_ONLY:-0}
NO_AUTOSTART=${NO_AUTOSTART:-0}
SBX=${SBX:-0}

# Provide a helpful usage statement when --help or any invalid argument is passed
# to the script. Exit code deliberately not included here as error depends on
# argument provided.
usage() {
	echo
	echo "USAGE: "
	echo "    ${0} [--channel <stable|test>] [--mirror <Aliyun|AzureChinaCloud|TencentCloud>] [--version <VERSION>] [--setup-repo] [--no-autostart] [--dry-run] [--help]"
	echo
}

while [ $# -gt 0 ]; do
	case "$1" in
		--channel)
			CHANNEL="$2"
			shift
			;;
		--dry-run)
			DRY_RUN=1
			;;
		--mirror)
			mirror="$2"
			shift
			;;
		--version)
			VERSION="${2#v}"
			shift
			;;
		--setup-repo)
			REPO_ONLY=1
			shift
			;;
		--no-autostart)
			NO_AUTOSTART=1
			;;
		--help)
			usage
			exit 0
			;;
		--*)
			echo "Illegal option $1"
			usage
			exit 1
			;;
	esac
	shift $(( $# > 0 ? 1 : 0 ))
done

case "$mirror" in
	Aliyun)
		DOWNLOAD_URL="https://mirrors.aliyun.com/docker-ce"
		;;
	AzureChinaCloud)
		DOWNLOAD_URL="https://mirror.azure.cn/docker-ce"
		;;
	TencentCloud)
		DOWNLOAD_URL="https://mirrors.cloud.tencent.com/docker-ce"
		;;
	"")
		;;
	*)
		>&2 echo "unknown mirror '$mirror': use 'Aliyun', 'AzureChinaCloud', or 'TencentCloud'."
		exit 1
		;;
esac

case "$CHANNEL" in
	stable|test)
		;;
	*)
		>&2 echo "unknown CHANNEL '$CHANNEL': use either stable or test."
		exit 1
		;;
esac

command_exists() {
	command -v "$@" > /dev/null 2>&1
}

# Quote one argument for commands executed through the POSIX shell in $sh_c.
# A closing quote preserves trailing newlines when the result is captured.
shell_quote() (
	value=$1
	printf "'"
	while :; do
		case "$value" in
			*"'"*)
				printf '%s' "${value%%\'*}" "'\''"
				value=${value#*\'}
				;;
			*)
				printf "%s'" "$value"
				break
				;;
		esac
	done
)

# version_gte checks if the version specified in $VERSION is at least the given
# SemVer (Maj.Minor[.Patch]), or CalVer (YY.MM) version.It returns 0 (success)
# if $VERSION is either unset (=latest) or newer or equal than the specified
# version, or returns 1 (fail) otherwise.
#
# examples:
#
# VERSION=23.0
# version_gte 23.0  // 0 (success)
# version_gte 20.10 // 0 (success)
# version_gte 19.03 // 0 (success)
# version_gte 26.1  // 1 (fail)
version_gte() {
	if [ -z "$VERSION" ]; then
			return 0
	fi
	version_compare "$VERSION" "$1"
}

# version_compare compares two version strings (either SemVer (Major.Minor.Path),
# or CalVer (YY.MM) version strings. It returns 0 (success) if version A is newer
# or equal than version B, or 1 (fail) otherwise. Patch releases and pre-release
# (-alpha/-beta) are not taken into account
#
# examples:
#
# version_compare 23.0.0 20.10 // 0 (success)
# version_compare 23.0 20.10   // 0 (success)
# version_compare 20.10 19.03  // 0 (success)
# version_compare 20.10 20.10  // 0 (success)
# version_compare 19.03 20.10  // 1 (fail)
version_compare() (
	set +x

	yy_a="$(echo "$1" | cut -d'.' -f1)"
	yy_b="$(echo "$2" | cut -d'.' -f1)"
	if [ "$yy_a" -lt "$yy_b" ]; then
		return 1
	fi
	if [ "$yy_a" -gt "$yy_b" ]; then
		return 0
	fi
	mm_a="$(echo "$1" | cut -d'.' -f2)"
	mm_b="$(echo "$2" | cut -d'.' -f2)"

	# trim leading zeros to accommodate CalVer
	mm_a="${mm_a#0}"
	mm_b="${mm_b#0}"

	if [ "${mm_a:-0}" -lt "${mm_b:-0}" ]; then
		return 1
	fi

	return 0
)

# Select the first APT package version matching a literal Docker version prefix.
# Restrict matching to madison's version field, ignoring the epoch and distro
# suffix. Require a component boundary so 24.0.1 cannot select 24.0.10.
# Debian packages use "~" for Docker's "-ce" and pre-release separators.
# Repository ordering is preserved, including the existing test-channel behavior.
select_apt_package_version() (
	# An embedded newline would give grep multiple expressions and could turn a
	# later fragment into an unanchored match. Invalid pins must select nothing.
	case "$1" in
		*'
'*) return ;;
	esac
	pkg_pattern="$(printf '%s\n' "$1" | sed 's/-/~/g; s/[][\\.^$*+?(){}|]/\\&/g')"
	awk -F '|' '{gsub(/^[ \t]+|[ \t]+$/, "", $2); print $2}' |
		grep -E "^([0-9]+:)?$pkg_pattern([.~+-]|$)" | head -1
)

is_dry_run() {
	if [ -z "$DRY_RUN" ]; then
		return 1
	else
		return 0
	fi
}

is_wsl() {
	case "$(uname -r)" in
	*microsoft* ) true ;; # WSL 2
	*Microsoft* ) true ;; # WSL 1
	* ) false;;
	esac
}

is_darwin() {
	case "$(uname -s)" in
	*darwin* ) true ;;
	*Darwin* ) true ;;
	* ) false;;
	esac
}

deprecation_notice() {
	distro=$1
	distro_version=$2
	echo
	printf "\033[91;1mDEPRECATION WARNING\033[0m\n"
	printf "    This Linux distribution (\033[1m%s %s\033[0m) reached end-of-life and is no longer supported by this script.\n" "$distro" "$distro_version"
	echo   "    No updates or security fixes will be released for this distribution, and users are recommended"
	echo   "    to upgrade to a currently maintained version of $distro."
	echo
	printf   "Press \033[1mCtrl+C\033[0m now to abort this script, or wait for the installation to continue."
	echo
	sleep 10
}

get_distribution() {
	lsb_dist=""
	# Every system that we officially support has /etc/os-release
	if [ -r /etc/os-release ]; then
		lsb_dist="$(. /etc/os-release && echo "$ID")"
	fi

	# Normalize Fedora Asahi Remix to fedora
	if [ "$lsb_dist" = "fedora-asahi-remix" ]; then
		lsb_dist="fedora"
	fi

	# Returning an empty string here should be alright since the
	# case statements don't act unless you provide an actual value
	echo "$lsb_dist"
}

start_docker_daemon() {
	# Use systemctl if available (for systemd-based systems)
	if command_exists systemctl; then
		is_dry_run || >&2 echo "Using systemd to manage Docker service"
		if (
			is_dry_run || set -x
			$sh_c "systemctl enable --now docker.service 2>/dev/null"
		); then
			is_dry_run || echo "INFO: Docker daemon enabled and started" >&2
		else
			is_dry_run || echo "WARNING: unable to enable the docker service" >&2
		fi
	else
		# No service management available (container environment)
		if ! is_dry_run; then
			>&2 echo "Note: Running in a container environment without service management"
			>&2 echo "Docker daemon cannot be started automatically in this environment"
			>&2 echo "The Docker packages have been installed successfully"
		fi
	fi
	>&2 echo
}

echo_docker_as_nonroot() {
	if is_dry_run; then
		return
	fi
	if command_exists docker && [ -e /var/run/docker.sock ]; then
		(
			set -x
			$sh_c 'docker version'
		) || true
	fi

	# intentionally mixed spaces and tabs here -- tabs are stripped by "<<-EOF", spaces are kept in the output
	echo
	echo "================================================================================"
	echo
	if version_gte "20.10"; then
		echo "To run Docker as a non-privileged user, consider setting up the"
		echo "Docker daemon in rootless mode for your user:"
		echo
		echo "    dockerd-rootless-setuptool.sh install"
		echo
		echo "Visit https://docs.docker.com/go/rootless/ to learn about rootless mode."
		echo
	fi
	echo
	echo "To run the Docker daemon as a fully privileged service, but granting non-root"
	echo "users access, refer to https://docs.docker.com/go/daemon-access/"
	echo
	echo "WARNING: Access to the remote API on a privileged Docker daemon is equivalent"
	echo "         to root access on the host. Refer to the 'Docker daemon attack surface'"
	echo "         documentation for details: https://docs.docker.com/go/attack-surface/"
	echo
	echo "================================================================================"
	echo
}

# Check if this is a forked Linux distro
check_forked() {

	# Check for lsb_release command existence, it usually exists in forked distros
	if command_exists lsb_release; then
		# A successful upstream probe means we're in a forked distro.
		if lsb_release -a -u > /dev/null 2>&1; then
			# Print info about current distro
			cat <<-EOF
			You're using '$lsb_dist' version '$dist_version'.
			EOF

			# Get the upstream release info
			lsb_dist=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'id' | cut -d ':' -f 2 | tr -d '[:space:]')
			dist_version=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'codename' | cut -d ':' -f 2 | tr -d '[:space:]')

			# Print info about upstream distro
			cat <<-EOF
			Upstream release is '$lsb_dist' version '$dist_version'.
			EOF
		else
			if [ -r /etc/debian_version ] && [ "$lsb_dist" != "ubuntu" ] && [ "$lsb_dist" != "raspbian" ]; then
				if [ "$lsb_dist" = "osmc" ]; then
					# OSMC runs Raspbian
					lsb_dist=raspbian
				else
					# We're Debian and don't even know it!
					lsb_dist=debian
				fi
				dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')"
				case "$dist_version" in
					13|14|forky)
						dist_version="trixie"
					;;
					12)
						dist_version="bookworm"
					;;
					11)
						dist_version="bullseye"
					;;
					10)
						dist_version="buster"
					;;
					9)
						dist_version="stretch"
					;;
					8)
						dist_version="jessie"
					;;
				esac
			fi
		fi
	fi
}

do_install() {
	echo "# Executing docker install script, commit: $SCRIPT_COMMIT_SHA"

	if [ "$REPO_ONLY" != "1" ] && command_exists docker; then
		cat >&2 <<-'EOF'
			Warning: the "docker" command appears to already exist on this system.

			If you already have Docker installed, this script can cause trouble, which is
			why we're displaying this warning and provide the opportunity to cancel the
			installation.

			If you installed the current Docker package using this script and are using it
			again to update Docker, you can ignore this message, but be aware that the
			script resets any custom changes in the deb and rpm repo configuration
			files to match the parameters passed to the script.

			You may press Ctrl+C now to abort this script.
		EOF
		( set -x; sleep 20 )
	fi

	user="$(id -un 2>/dev/null || true)"

	sh_c='sh -c'
	if [ "$user" != 'root' ]; then
		if command_exists sudo; then
			sh_c='sudo -E sh -c'
		elif command_exists su; then
			sh_c='su -c'
		else
			cat >&2 <<-'EOF'
			Error: this installer needs the ability to run commands as root.
			We are unable to find either "sudo" or "su" available to make this happen.
			EOF
			exit 1
		fi
	fi

	if is_dry_run; then
		sh_c="echo"
	fi

	# perform some very rudimentary platform detection
	lsb_dist=$( get_distribution )
	lsb_dist="$(echo "$lsb_dist" | tr '[:upper:]' '[:lower:]')"

	if is_wsl; then
		echo
		echo "WSL DETECTED: We recommend using Docker Desktop for Windows."
		echo "Please get Docker Desktop from https://www.docker.com/products/docker-desktop/"
		echo
		cat >&2 <<-'EOF'

			You may press Ctrl+C now to abort this script.
		EOF
		( set -x; sleep 20 )
	fi

	case "$lsb_dist" in

		ubuntu)
			if command_exists lsb_release; then
				dist_version="$(lsb_release --codename | cut -f2)"
			fi
			if [ -z "$dist_version" ] && [ -r /etc/lsb-release ]; then
				dist_version="$(. /etc/lsb-release && echo "$DISTRIB_CODENAME")"
			fi
		;;

		debian|raspbian)
			dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')"
			case "$dist_version" in
				13)
					dist_version="trixie"
				;;
				12)
					dist_version="bookworm"
				;;
				11)
					dist_version="bullseye"
				;;
				10)
					dist_version="buster"
				;;
				9)
					dist_version="stretch"
				;;
				8)
					dist_version="jessie"
				;;
			esac
		;;

		centos|rhel|rocky)
			if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then
				dist_version="$(. /etc/os-release && echo "$VERSION_ID")"
			fi
		;;

		*)
			if command_exists lsb_release; then
				dist_version="$(lsb_release --release | cut -f2)"
			fi
			if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then
				dist_version="$(. /etc/os-release && echo "$VERSION_ID")"
			fi
		;;

	esac

	# Check if this is a forked Linux distro
	check_forked

	# Print deprecation warnings for distro versions that recently reached EOL,
	# but may still be commonly used (especially LTS versions).
	case "$lsb_dist.$dist_version" in
		centos.8|centos.7|rhel.7)
			deprecation_notice "$lsb_dist" "$dist_version"
			;;
		debian.bullseye|debian.buster|debian.stretch|debian.jessie)
			deprecation_notice "$lsb_dist" "$dist_version"
			;;
		raspbian.buster|raspbian.stretch|raspbian.jessie)
			deprecation_notice "$lsb_dist" "$dist_version"
			;;
		ubuntu.focal|ubuntu.bionic|ubuntu.xenial|ubuntu.trusty)
			deprecation_notice "$lsb_dist" "$dist_version"
			;;
		ubuntu.questing|ubuntu.oracular|ubuntu.mantic|ubuntu.lunar|ubuntu.kinetic|ubuntu.impish|ubuntu.hirsute|ubuntu.groovy|ubuntu.eoan|ubuntu.disco|ubuntu.cosmic)
			deprecation_notice "$lsb_dist" "$dist_version"
			;;
		fedora.*)
			if [ "$dist_version" -lt 43 ]; then
				deprecation_notice "$lsb_dist" "$dist_version"
			fi
			;;
	esac

	# Run setup for each distro accordingly
	case "$lsb_dist" in
		ubuntu|debian|raspbian)
			pre_reqs="ca-certificates curl"
			apt_repo_lsb_dist="$lsb_dist"
			# Docker does not publish a Raspbian Trixie repo; use Debian Trixie instead.
			if [ "$lsb_dist" = "raspbian" ] && [ "$dist_version" = "trixie" ]; then
				apt_repo_lsb_dist="debian"
			fi
			apt_repo="deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] $DOWNLOAD_URL/linux/$apt_repo_lsb_dist $dist_version $CHANNEL"
			(
				if ! is_dry_run; then
					set -x
				fi
				$sh_c 'apt-get -qq update >/dev/null'
				$sh_c "DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 -y -qq install $pre_reqs >/dev/null"
				$sh_c 'install -m 0755 -d /etc/apt/keyrings'
				$sh_c "curl -fsSL \"$DOWNLOAD_URL/linux/$apt_repo_lsb_dist/gpg\" -o /etc/apt/keyrings/docker.asc"
				$sh_c "chmod a+r /etc/apt/keyrings/docker.asc"
				$sh_c "echo \"$apt_repo\" > /etc/apt/sources.list.d/docker.list"
				$sh_c 'apt-get -qq update >/dev/null'
			)

			if [ "$REPO_ONLY" = "1" ]; then
				exit 0
			fi

			pkg_version=""
			cli_pkg_version=""
			if [ -n "$VERSION" ]; then
				if is_dry_run; then
					echo "# WARNING: VERSION pinning is not supported in DRY_RUN"
				else
					search_command="apt-cache madison docker-ce"
					echo "INFO: Searching repository for VERSION '$VERSION'"
					echo "INFO: $search_command"
					pkg_version="$($sh_c "$search_command" | select_apt_package_version "$VERSION")"
					if [ -z "$pkg_version" ]; then
						echo
						echo "ERROR: '$VERSION' not found amongst apt-cache madison results"
						echo
						exit 1
					fi
					pkg_version="=$pkg_version"

					if version_gte "18.09"; then
						search_command="apt-cache madison docker-ce-cli"
						echo "INFO: $search_command"
						cli_pkg_version="$($sh_c "$search_command" | select_apt_package_version "$VERSION")"
						if [ -n "$cli_pkg_version" ]; then
							cli_pkg_version="=$cli_pkg_version"
						fi
					fi
				fi
			fi
			(
				pkgs="docker-ce${pkg_version}"
				if version_gte "18.09"; then
					# older versions didn't ship the cli and containerd as separate packages
					pkgs="$pkgs docker-ce-cli${cli_pkg_version} containerd.io"
				fi
				if version_gte "20.10"; then
					pkgs="$pkgs docker-compose-plugin docker-ce-rootless-extras$pkg_version"
				fi
				if version_gte "23.0"; then
					pkgs="$pkgs docker-buildx-plugin"
				fi
				if version_gte "28.2"; then
					pkgs="$pkgs docker-model-plugin"
				fi
				if [ "$SBX" = "1" ]; then
					pkgs="$pkgs docker-sbx"
				fi
				if ! is_dry_run; then
					set -x
				fi
				apt_flags="-y -qq"
				if [ -n "$pkg_version" ]; then
					apt_flags="$apt_flags --allow-downgrades"
				fi
				$sh_c "DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 $apt_flags install $pkgs >/dev/null"
			)
			if [ "$NO_AUTOSTART" != "1" ]; then
				start_docker_daemon
			fi
			echo_docker_as_nonroot
			exit 0
			;;
		centos|fedora|rhel|rocky)
			repo_file_url="$DOWNLOAD_URL/linux/$lsb_dist/$REPO_FILE"
			repo_file_url_quoted=$(shell_quote "$repo_file_url")
			(
				if ! is_dry_run; then
					set -x
				fi
				if command_exists dnf5; then
					$sh_c "dnf -y -q --setopt=install_weak_deps=False install dnf-plugins-core"
					$sh_c "dnf5 config-manager addrepo --overwrite --save-filename=docker-ce.repo --from-repofile=$repo_file_url_quoted"

					if [ "$CHANNEL" != "stable" ]; then
						$sh_c "dnf5 config-manager setopt \"docker-ce-*.enabled=0\""
						$sh_c "dnf5 config-manager setopt \"docker-ce-$CHANNEL.enabled=1\""
					fi
					$sh_c "dnf makecache"
				elif command_exists dnf; then
					$sh_c "dnf -y -q --setopt=install_weak_deps=False install dnf-plugins-core"
					$sh_c "rm -f /etc/yum.repos.d/docker-ce.repo  /etc/yum.repos.d/docker-ce-staging.repo"
					$sh_c "dnf config-manager --add-repo $repo_file_url_quoted"

					if [ "$CHANNEL" != "stable" ]; then
						$sh_c "dnf config-manager --set-disabled \"docker-ce-*\""
						$sh_c "dnf config-manager --set-enabled \"docker-ce-$CHANNEL\""
					fi
					$sh_c "dnf makecache"
				else
					$sh_c "yum -y -q install yum-utils"
					$sh_c "rm -f /etc/yum.repos.d/docker-ce.repo  /etc/yum.repos.d/docker-ce-staging.repo"
					$sh_c "yum-config-manager --add-repo $repo_file_url_quoted"

					if [ "$CHANNEL" != "stable" ]; then
						$sh_c "yum-config-manager --disable \"docker-ce-*\""
						$sh_c "yum-config-manager --enable \"docker-ce-$CHANNEL\""
					fi
					$sh_c "yum makecache"
				fi
			)

			if [ "$REPO_ONLY" = "1" ]; then
				exit 0
			fi

			pkg_version=""
			cli_pkg_version=""
			if command_exists dnf; then
				pkg_manager="dnf"
				pkg_manager_flags="-y -q --best"
			else
				pkg_manager="yum"
				pkg_manager_flags="-y -q"
			fi
			if [ -n "$VERSION" ]; then
				if is_dry_run; then
					echo "# WARNING: VERSION pinning is not supported in DRY_RUN"
				else
					if [ "$lsb_dist" = "fedora" ]; then
						pkg_suffix="fc$dist_version"
					else
						pkg_suffix="el"
					fi
					pkg_pattern="$(echo "$VERSION" | sed 's/-ce-/\\\\.ce.*/g' | sed 's/-/.*/g').*$pkg_suffix"
					search_command="$pkg_manager list --showduplicates docker-ce | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'"
					echo "INFO: Searching repository for VERSION '$VERSION'"
					echo "INFO: $search_command"
					pkg_version="$($sh_c "$search_command")"
					if [ -z "$pkg_version" ]; then
						echo
						echo "ERROR: '$VERSION' not found amongst $pkg_manager list results"
						echo
						exit 1
					fi
					# Cut out the epoch and prefix with a '-'
					pkg_version="-$(echo "$pkg_version" | cut -d':' -f 2)"

					if version_gte "18.09"; then
						# older versions don't support a cli package
						search_command="$pkg_manager list --showduplicates docker-ce-cli | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'"
						cli_pkg_version="$($sh_c "$search_command" | cut -d':' -f 2)"
					fi
				fi
			fi
			(
				pkgs="docker-ce$pkg_version"
				if version_gte "18.09"; then
					# older versions didn't ship the cli and containerd as separate packages
					if [ -n "$cli_pkg_version" ]; then
						pkgs="$pkgs docker-ce-cli-$cli_pkg_version containerd.io"
					else
						pkgs="$pkgs docker-ce-cli containerd.io"
					fi
				fi
				if version_gte "20.10"; then
					pkgs="$pkgs docker-compose-plugin docker-ce-rootless-extras$pkg_version"
				fi
				if version_gte "23.0"; then
						pkgs="$pkgs docker-buildx-plugin docker-model-plugin"
				fi
				if [ "$SBX" = "1" ]; then
					pkgs="$pkgs docker-sbx"
				fi
				if ! is_dry_run; then
					set -x
				fi
				$sh_c "$pkg_manager $pkg_manager_flags install $pkgs"
			)
			if [ "$NO_AUTOSTART" != "1" ]; then
				start_docker_daemon
			fi
			echo_docker_as_nonroot
			exit 0
			;;
		sles)
			echo "Effective v27.5, please consult SLES distro statement for s390x support."
			exit 1
			;;
		*)
			if [ -z "$lsb_dist" ]; then
				if is_darwin; then
					echo
					echo "ERROR: Unsupported operating system 'macOS'"
					echo "Please get Docker Desktop from https://www.docker.com/products/docker-desktop"
					echo
					exit 1
				fi
			fi
			echo
			echo "ERROR: Unsupported distribution '$lsb_dist'"
			echo
			exit 1
			;;
	esac
	exit 1
}

# wrapped up in a function so that we have some protection against only getting
# half the file during "curl | sh"
do_install
DOCKER_INSTALL_SNAPSHOT_EOF

  printf '%s  %s\n' \
    'fdae16d31d2a87d0056fec49454a2e1475230abe64c52ad900efb65e425399ef' \
    "$WORK/install.sh" | sha256sum -c -
  sh -n "$WORK/install.sh"
  ln "$WORK/install.sh" ./get-docker-fork.sh
  printf '%s\n' '脚本已保存为 get-docker-fork.sh；尚未执行安装。'
)

f6ea53e5f8447c97d1b0d9eca8f2d5bab9637de2

2b9273b4c126ee83f2cf4eea558f415ab0e16c8c946ca7898bd426ac0d819ab2

(
  set -eu
  umask 077
  WORK="$(mktemp -d ./docker-install.XXXXXXXX)"
  trap 'rm -rf "$WORK"' EXIT

  curl -q -fsSL --proto '=https' --proto-redir '=https' \
    --connect-timeout 10 --max-time 120 \
    https://raw.githubusercontent.com/soulteary/docker-install/f6ea53e5f8447c97d1b0d9eca8f2d5bab9637de2/install.sh \
    -o "$WORK/install.sh"

  test -s "$WORK/install.sh"
  printf '%s  %s\n' \
    '2b9273b4c126ee83f2cf4eea558f415ab0e16c8c946ca7898bd426ac0d819ab2' \
    "$WORK/install.sh" | sha256sum -c -
  sh -n "$WORK/install.sh"
  ln "$WORK/install.sh" ./get-docker-fork.sh
  printf '%s\n' '脚本已保存为 get-docker-fork.sh；尚未执行安装。'
)