stateDiagram-v2
    [*] --> Created: docker create
    Created --> Running: docker start
    Running --> Paused: docker pause
    Paused --> Running: docker unpause
    Running --> Restarting: 进程退出 + restart policy
    Restarting --> Running: 重启成功
    Restarting --> Exited: 重启失败
    Running --> Exited: docker stop / 进程退出
    Created --> Exited: 启动失败
    Exited --> Running: docker start
    Exited --> Removing: docker rm
    Running --> Removing: docker rm -f
    Paused --> Removing: docker rm -f
    Removing --> Dead: 清理失败
    Removing --> [*]: 删除成功
    Dead --> [*]: docker rm -f
    
    note right of Created
        已分配 ID 和配置
        未启动进程
    end note
    
    note right of Running
        进程正在运行
        可接收信号
    end note
    
    note right of Paused
        cgroup freeze
        进程挂起
    end note
    
    note right of Exited
        进程已退出
        容器未删除
    end note
    
    note right of Dead
        清理失败
        需手动干预
    end note

flowchart TB
    subgraph API["API 层"]
        ContainerRouter[Container Router]
    end
    
    subgraph Core["容器核心"]
        Daemon[Daemon]
        ContainerStore[容器注册表<br/>Store]
        Container[Container 对象]
        State[State 状态机]
        ExecStore[Exec 存储]
    end
    
    subgraph Operations["容器操作"]
        CreateOp[创建操作<br/>create.go]
        StartOp[启动操作<br/>start.go]
        StopOp[停止操作<br/>stop.go]
        ExecOp[执行操作<br/>exec.go]
        AttachOp[附加操作<br/>attach.go]
        LogsOp[日志操作<br/>logs.go]
    end
    
    subgraph Runtime["运行时层"]
        LibcontainerdClient[libcontainerd Client]
        OCI[OCI Spec 生成器]
        HealthCheck[健康检查器]
        Monitor[监控器<br/>事件监听]
    end
    
    subgraph External["外部依赖"]
        ContainerdD[containerd]
        NetworkMgr[libnetwork]
        VolumeMgr[VolumeService]
        ImageSvc[ImageService]
    end
    
    ContainerRouter --> Daemon
    Daemon --> ContainerStore
    ContainerStore --> Container
    Container --> State
    
    Daemon --> CreateOp
    Daemon --> StartOp
    Daemon --> StopOp
    Daemon --> ExecOp
    Daemon --> AttachOp
    Daemon --> LogsOp
    
    StartOp --> OCI
    StartOp --> LibcontainerdClient
    StartOp --> HealthCheck
    StartOp --> Monitor
    
    LibcontainerdClient --> ContainerdD
    StartOp --> NetworkMgr
    CreateOp --> VolumeMgr
    CreateOp --> ImageSvc
    
    Monitor -.监听退出事件.-> State

- **Container 对象**：每个容器的完整状态与配置

  ```go
  type Container struct {
      ID          string
      Name        string
      Config      *container.Config      // 用户配置
      HostConfig  *container.HostConfig  // 宿主机配置
      State       *State                  // 运行状态
      Created     time.Time
      Path        string                  // 容器文件系统路径
      NetworkSettings *network.Settings
      LogPath     string
      mu          sync.Mutex
  }

**2. 容器操作层**：

- **创建操作**：
  - 验证镜像存在
  - 分配容器 ID（SHA256 随机生成）
  - 初始化容器目录结构
  - 预分配网络端点（但不连接）
  - 持久化配置到 `config.v2.json`

- **启动操作**：
  - 验证容器状态（未运行）
  - 准备文件系统（挂载卷、镜像层）
  - 生成 OCI Runtime Spec
  - 调用 containerd 创建并启动 Task
  - 连接网络端点
  - 启动健康检查
  - 启动日志收集

- **停止操作**：
  - 发送 SIGTERM 信号
  - 等待超时（默认 10 秒）
  - 超时后发送 SIGKILL
  - 断开网络连接
  - 停止健康检查

**3. 运行时层**：

- **libcontainerd Client**：封装 containerd gRPC 调用
- **OCI Spec 生成器**：将 Docker 配置转换为 OCI Runtime Spec
  - Namespaces（PID/NET/IPC/UTS/Mount）
  - Cgroups（CPU/内存/设备限制）
  - Mounts（卷、tmpfs、bind mount）
  - Process（命令、环境变量、用户）
  - Capabilities（Linux 权限）
  - Seccomp/AppArmor/SELinux 配置

- **健康检查器**：定时执行健康检查命令
- **监控器**：订阅容器退出事件、OOM 事件

---

## 容器启动完整时序图

```mermaid
sequenceDiagram
    autonumber
    participant Client as docker CLI
    participant Router as Container Router
    participant Daemon as Daemon
    participant Store as Container Store
    participant Container as Container
    participant Image as Image Service
    participant Network as libnetwork
    participant Volume as Volume Service
    participant OCI as OCI Spec Generator
    participant Containerd as libcontainerd
    participant ContainerdD as containerd
    
    Note over Client: docker create --name web -p 8080:80 nginx
    Client->>Router: POST /containers/create
    Router->>Daemon: ContainerCreate(config)
    
    Note over Daemon: 阶段1: 验证与准备
    Daemon->>Image: GetImage("nginx:latest")
    Image-->>Daemon: 镜像信息
    
    Daemon->>Daemon: 分配容器 ID (64位十六进制)
    Daemon->>Daemon: 生成容器名称或使用指定名称
    
    Note over Daemon: 阶段2: 创建容器对象
    Daemon->>Container: New(ID, config)
    Container->>Container: 初始化 State
    Container->>Container: 初始化 NetworkSettings
    
    Note over Daemon: 阶段3: 预分配网络
    Daemon->>Network: CreateSandbox(containerID)
    Network->>Network: 分配 IP 地址
    Network-->>Daemon: Sandbox ID
    
    Note over Daemon: 阶段4: 准备卷
    Daemon->>Volume: CreateVolumes(hostConfig)
    Volume-->>Daemon: 卷挂载点
    
    Note over Daemon: 阶段5: 持久化
    Daemon->>Container: ToDisk()
    Container->>Container: 写入 config.v2.json
    Container->>Container: 写入 hostconfig.json
    
    Daemon->>Store: Add(container)
    Store->>Store: 更新索引 (byID, byName)
    
    Daemon-->>Router: {Id: "abc123..."}
    Router-->>Client: 201 Created
    
    Note over Client: docker start web
    Client->>Router: POST /containers/web/start
    Router->>Daemon: ContainerStart(ctx, "web")
    
    Note over Daemon: 阶段6: 状态验证
    Daemon->>Store: Get("web")
    Store-->>Daemon: Container 对象
    
    Daemon->>Container: Lock()
    Daemon->>Container: CheckState()
    alt Container.State.Running
        Daemon-->>Router: 304 Not Modified (幂等)
    else Container.State.Dead
        Daemon-->>Router: 409 Conflict
    end
    
    Note over Daemon: 阶段7: 准备文件系统
    Daemon->>Image: Mount(container.ID, container.BaseFS)
    Image->>Image: 挂载镜像层 (overlay2)
    Image-->>Daemon: 容器根路径
    
    Daemon->>Volume: Mount(container.MountPoints)
    Volume-->>Daemon: 挂载完成
    
    Note over Daemon: 阶段8: 生成 OCI Spec
    Daemon->>OCI: CreateSpec(container)
    OCI->>OCI: 配置 Namespaces
    OCI->>OCI: 配置 Cgroups
    OCI->>OCI: 配置 Mounts
    OCI->>OCI: 配置 Process
    OCI->>OCI: 配置 Security (seccomp/apparmor)
    OCI-->>Daemon: OCI Runtime Spec
    
    Note over Daemon: 阶段9: 创建 containerd Task
    Daemon->>Containerd: CreateTask(spec)
    Containerd->>ContainerdD: gRPC Create
    ContainerdD->>ContainerdD: 启动 containerd-shim
    ContainerdD->>ContainerdD: shim 调用 runc create
    ContainerdD-->>Containerd: Task 句柄
    
    Note over Daemon: 阶段10: 启动 Task
    Daemon->>Containerd: Start(task)
    Containerd->>ContainerdD: gRPC Start
    ContainerdD->>ContainerdD: runc start
    ContainerdD-->>Containerd: PID
    Containerd-->>Daemon: Task Running
    
    Note over Daemon: 阶段11: 连接网络
    Daemon->>Network: ConnectToNetwork(sandbox, endpoint)
    Network->>Network: 配置 veth pair
    Network->>Network: 配置 iptables 规则
    Network->>Network: 配置端口映射
    Network-->>Daemon: 网络连接成功
    
    Note over Daemon: 阶段12: 启动附加服务
    Daemon->>Container: StartHealthCheck()
    Daemon->>Container: StartLogCollection()
    Daemon->>Container: StartMonitor()
    
    Note over Daemon: 阶段13: 更新状态
    Daemon->>Container: State.SetRunning(pid)
    Daemon->>Container: State.StartedAt = time.Now()
    
    Daemon->>Daemon: 触发容器启动事件
    Daemon->>Container: Unlock()
    
    Daemon-->>Router: 成功
    Router-->>Client: 204 No Content
    
    Note over ContainerdD: 容器运行中...
    
    Note over ContainerdD: 进程退出
    ContainerdD-->>Containerd: Task Exit Event
    Containerd-->>Daemon: OnTaskExit(containerID, exitCode)
    
    Daemon->>Container: Lock()
    Daemon->>Container: State.SetStopped(exitCode)
    Daemon->>Container: State.FinishedAt = time.Now()
    
    alt 配置了重启策略
        Daemon->>Container: State.SetRestarting()
        Daemon->>Daemon: 延迟后重新启动
    end
    
    Daemon->>Daemon: 触发容器退出事件
    Daemon->>Container: Unlock()

  lowerdir=/var/lib/docker/overlay2/l/AAA:/var/lib/docker/overlay2/l/BBB
  upperdir=/var/lib/docker/overlay2/<container-id>/diff
  workdir=/var/lib/docker/overlay2/<container-id>/work

**阶段9-10：containerd Task 创建与启动**

- **时长**：80-150ms
- **containerd-shim 职责**：
  - 作为容器进程的父进程（reparenting）
  - 处理容器进程的 stdout/stderr
  - 监听容器退出事件
  - 在 dockerd 重启时保持容器运行
- **runc create**：
  - 创建 cgroup 层级结构
  - 创建网络命名空间（或加入现有命名空间）
  - 创建 PID/IPC/UTS/Mount 命名空间
  - 设置 seccomp/AppArmor/SELinux 配置
- **runc start**：
  - 执行容器入口进程（exec）
  - 应用资源限制
  - 切换到容器根文件系统（pivot_root）

**阶段11：连接网络**

- **时长**：40-80ms
- **bridge 模式**：
  - 创建 veth pair（vethXXX ↔ eth0）
  - 将 vethXXX 连接到 docker0 网桥
  - 将 eth0 移动到容器网络命名空间
  - 配置 IP 地址和路由
  - 配置 iptables 规则（端口映射、SNAT）
- **overlay 模式**：
  - 创建 VXLAN 隧道
  - 配置跨主机路由

**阶段12：启动附加服务**

- **健康检查**：
  - 解析 HEALTHCHECK 指令
  - 启动定时器（默认 30 秒间隔）
  - 执行健康检查命令（在容器内 exec）
  - 更新健康状态（starting → healthy/unhealthy）
- **日志收集**：
  - 打开容器 stdout/stderr 流
  - 通过 log driver 写入日志后端（json-file/syslog/...）
  - 支持日志轮转（max-size/max-file）
- **监控器**：
  - 订阅 containerd 事件流
  - 监听容器退出、OOM、execDie 事件

**阶段13：状态更新**

- **时长**：<1ms
- **状态字段**：
  - Running: true
  - Paused: false
  - Restarting: false
  - Pid: <容器主进程 PID>
  - StartedAt: <启动时间戳>
- **事件触发**：

  ```json
  {
    "Type": "container",
    "Action": "start",
    "Actor": {
      "ID": "abc123...",
      "Attributes": {
        "image": "nginx:latest",
        "name": "web"
      }
    }
  }

func (daemon *Daemon) ContainerStart(ctx context.Context, name string) error {
    container, err := daemon.GetContainer(name)
    
    container.Lock() // 获取容器锁
    defer container.Unlock()
    
    // 状态检查与修改在锁保护下进行
    if container.Running {
        return nil // 幂等
    }
    
    // 启动逻辑...
}

type Store struct {
    byID   map[string]*Container
    byName map[string]*Container
    mu     sync.RWMutex
}

func (s *Store) Get(nameOrID string) *Container {
    s.mu.RLock()
    defer s.mu.RUnlock()
    return s.byID[nameOrID]
}

func (s *Store) Add(c *Container) {
    s.mu.Lock()
    defer s.mu.Unlock()
    s.byID[c.ID] = c
    s.byName[c.Name] = c
}

const defaultStartTimeout = 30 * time.Second

ctx, cancel := context.WithTimeout(ctx, startTimeout)
defer cancel()

if err := daemon.containerd.Start(ctx, container.ID); err != nil {
    if errors.Is(err, context.DeadlineExceeded) {
        // 清理已创建的资源
        daemon.cleanupContainer(container)
    }
    return err
}

func (daemon *Daemon) ContainerStop(ctx context.Context, name string, opts backend.ContainerStopOptions) error {
    timeout := 10 // 默认 10 秒
    if opts.Timeout != nil {
        timeout = *opts.Timeout
    }
    
    // 发送 SIGTERM
    daemon.kill(container, syscall.SIGTERM)
    
    // 等待退出或超时
    select {
    case <-container.Wait(ctx, container.WaitConditionNotRunning):
        return nil
    case <-time.After(time.Duration(timeout) * time.Second):
        // 超时后发送 SIGKILL
        daemon.kill(container, syscall.SIGKILL)
    }
}

type RestartPolicy struct {
    Name              string // no/always/on-failure/unless-stopped
    MaximumRetryCount int
}

func (daemon *Daemon) autoRestart(container *Container, exitCode int) {
    policy := container.HostConfig.RestartPolicy
    
    switch policy.Name {
    case "always":
        daemon.containerStart(ctx, container)
    case "on-failure":
        if exitCode != 0 {
            if container.RestartCount < policy.MaximumRetryCount {
                time.Sleep(backoff(container.RestartCount))
                daemon.containerStart(ctx, container)
            }
        }
    case "unless-stopped":
        if !container.HasBeenManuallyStop {
            daemon.containerStart(ctx, container)
        }
    }
}

// 监听 containerd 事件
go daemon.processContainerdEvents(ctx)

func (daemon *Daemon) processContainerdEvents(ctx context.Context) {
    for {
        events, errs := daemon.containerd.Subscribe(ctx)
        for {
            select {
            case evt := <-events:
                daemon.handleContainerdEvent(evt)
            case err := <-errs:
                log.Errorf("containerd event stream error: %v", err)
                // 等待重连
                time.Sleep(1 * time.Second)
                goto Reconnect
            }
        }
    Reconnect:
    }
}

// daemon 启动时恢复容器状态
func (daemon *Daemon) restore() {
    containers := daemon.loadContainersFromDisk()
    
    for _, c := range containers {
        if c.IsRunning() {
            // 重新连接到 containerd Task
            task, err := daemon.containerd.LoadContainer(ctx, c.ID)
            if err != nil {
                log.Errorf("Failed to restore container %s: %v", c.ID, err)
                c.SetStopped(unknownExitCode)
                continue
            }
            
            // 恢复状态
            c.Pid = int(task.Pid())
            
            // 重新订阅事件
            go daemon.monitorContainer(c)
            
            // 重新连接日志流
            daemon.attachContainerStreams(c)
        }
    }
}

func (daemon *Daemon) ContainerCreate(...) error {
    // 创建容器目录
    if err := os.MkdirAll(container.Root, 0700); err != nil {
        if errors.Is(err, syscall.ENOSPC) {
            return errdefs.System(errors.New("no space left on device"))
        }
        return err
    }
    
    // 写入配置文件
    if err := container.ToDisk(); err != nil {
        os.RemoveAll(container.Root) // 清理
        return err
    }
}

// 前缀匹配优化
func (s *Store) Get(nameOrID string) *Container {
    // 精确匹配 O(1)
    if c, ok := s.byID[nameOrID]; ok {
        return c
    }
    
    // 短 ID 前缀匹配（至少 12 位）
    if len(nameOrID) >= 12 {
        for id, c := range s.byID {
            if strings.HasPrefix(id, nameOrID) {
                return c
            }
        }
    }
    
    return nil
}

func (daemon *Daemon) ContainersStart(ctx context.Context, ids []string) error {
    var wg sync.WaitGroup
    sem := semaphore.NewWeighted(10) // 最多并发 10 个
    
    for _, id := range ids {
        wg.Add(1)
        sem.Acquire(ctx, 1)
        
        go func(id string) {
            defer wg.Done()
            defer sem.Release(1)
            
            daemon.ContainerStart(ctx, id)
        }(id)
    }
    
    wg.Wait()
}

// 使用带缓冲 channel 避免阻塞
type LogCollector struct {
    buffer chan *LogMessage
}

func (lc *LogCollector) Collect(msg *LogMessage) {
    select {
    case lc.buffer <- msg:
    default:
        // 缓冲区满，丢弃旧消息
        <-lc.buffer
        lc.buffer <- msg
    }
}

# CPU 限制
docker run -d \
  --cpus=2.0 \              # 使用 2 个 CPU
  --cpu-shares=1024 \       # CPU 权重
  nginx

# 内存限制
docker run -d \
  --memory=1g \             # 最大内存 1GB
  --memory-swap=1g \        # 禁用 swap
  --memory-reservation=512m \ # 软限制
  --oom-kill-disable \      # 禁止 OOM killer
  nginx

# 磁盘 I/O 限制
docker run -d \
  --blkio-weight=500 \      # I/O 权重 (10-1000)
  --device-read-bps=/dev/sda:1mb \  # 读限速
  --device-write-bps=/dev/sda:1mb \ # 写限速
  nginx

FROM nginx
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost/ || exit 1

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3",
    "compress": "true",
    "labels": "app,env"
  }
}

# 生产环境推荐配置
docker run -d \
  --restart=unless-stopped \  # 除非手动停止否则自动重启
  --health-cmd="curl -f http://localhost/health" \
  --health-interval=30s \
  nginx

{
  "Image": "nginx:latest",
  "Cmd": ["nginx", "-g", "daemon off;"],
  "Env": ["NODE_ENV=production"],
  "ExposedPorts": {
    "80/tcp": {}
  },
  "HostConfig": {
    "PortBindings": {
      "80/tcp": [{"HostPort": "8080"}]
    },
    "Memory": 536870912,
    "CpuShares": 512,
    "Binds": ["myvolume:/data"],
    "RestartPolicy": {
      "Name": "unless-stopped",
      "MaximumRetryCount": 3
    }
  },
  "NetworkingConfig": {
    "EndpointsConfig": {
      "mynet": {
        "IPAMConfig": {
          "IPv4Address": "172.18.0.10"
        }
      }
    }
  }
}

{
  "Id": "abc123def456...",
  "Warnings": []
}

// 文件: daemon/server/router/container/container.go
type containerRouter struct {
    backend Backend
    routes  []router.Route
}

func (c *containerRouter) initRoutes() {
    c.routes = []router.Route{
        router.NewHeadRoute("/containers/{name:.*}/archive", c.headContainersArchive),
        router.NewGetRoute("/containers/json", c.getContainersJSON),
        router.NewGetRoute("/containers/{name:.*}/json", c.getContainersByName),
        router.NewGetRoute("/containers/{name:.*}/logs", c.getContainersLogs),
        router.NewGetRoute("/containers/{name:.*}/stats", c.getContainersStats),
        router.NewGetRoute("/containers/{name:.*}/top", c.getContainersTop),
        router.NewGetRoute("/containers/{name:.*}/changes", c.getContainersChanges),
        router.NewPostRoute("/containers/create", c.postContainersCreate),
        router.NewPostRoute("/containers/{name:.*}/start", c.postContainersStart),
        router.NewPostRoute("/containers/{name:.*}/stop", c.postContainersStop),
        router.NewPostRoute("/containers/{name:.*}/restart", c.postContainersRestart),
        router.NewPostRoute("/containers/{name:.*}/kill", c.postContainersKill),
        router.NewPostRoute("/containers/{name:.*}/pause", c.postContainersPause),
        router.NewPostRoute("/containers/{name:.*}/unpause", c.postContainersUnpause),
        router.NewDeleteRoute("/containers/{name:.*}", c.deleteContainers),
    }
}

func (c *containerRouter) getContainersJSON(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
    if err := httputils.ParseForm(r); err != nil { return err }
    filter, err := filters.FromJSON(r.Form.Get("filters"))
    if err != nil { return err }

    config := &backend.ContainerListOptions{
        All:     httputils.BoolValue(r, "all"),
        Size:    httputils.BoolValue(r, "size"),
        Since:   r.Form.Get("since"),
        Before:  r.Form.Get("before"),
        Filters: filter,
    }
    if tmpLimit := r.Form.Get("limit"); tmpLimit != "" {
        if limit, err := strconv.Atoi(tmpLimit); err == nil { config.Limit = limit } else { return err }
    }

    containers, err := c.backend.Containers(ctx, config)
    if err != nil { return err }

    version := httputils.VersionFromContext(ctx)
    if versions.LessThan(version, "1.46") {
        for _, c := range containers { c.HostConfig.Annotations = nil }
    }
    if versions.LessThan(version, "1.48") {
        for _, c := range containers { c.ImageManifestDescriptor = nil }
    }
    return httputils.WriteJSON(w, http.StatusOK, containers)
}

// API Handler
func (c *containerRouter) postContainersCreate(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    name := r.Form.Get("name")
    
    // 解码请求体
    req, err := runconfig.DecodeCreateRequest(r.Body, c.backend.RawSysInfo())
    config := req.Config
    hostConfig := req.HostConfig
    networkingConfig := req.NetworkingConfig
    
    // 处理默认网络
    if hostConfig.NetworkMode == "" || hostConfig.NetworkMode.IsDefault() {
        hostConfig.NetworkMode = networkSettings.DefaultNetwork
    }
    
    // 调用后端创建容器
    ccr, err := c.backend.ContainerCreate(ctx, backend.ContainerCreateConfig{
        Name:             name,
        Config:           config,
        HostConfig:       hostConfig,
        NetworkingConfig: networkingConfig,
        Platform:         platform,
    })
    
    return httputils.WriteJSON(w, http.StatusCreated, ccr)
}

HTTP Handler (postContainersCreate)
  ↓
backend.ContainerCreate()
  ↓
daemon.ContainerCreate()
  ↓
daemon.containerCreate()
  ├─ 1. 验证镜像存在
  │   └─ ImageService.GetImage()
  ├─ 2. 分配容器 ID
  │   └─ generateIDAndName()
  ├─ 3. 创建容器对象
  │   └─ container.NewContainer()
  ├─ 4. 预分配网络
  │   └─ libnetwork.CreateSandbox()
  ├─ 5. 准备卷
  │   └─ VolumeService.CreateVolumes()
  └─ 6. 持久化配置
      └─ Container.ToDisk()

// API Handler
func (c *containerRouter) postContainersStart(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    if err := c.backend.ContainerStart(ctx, vars["name"], r.Form.Get("checkpoint"), r.Form.Get("checkpoint-dir")); err != nil {
        return err
    }
    w.WriteHeader(http.StatusNoContent)
    return nil
}

// Backend Implementation
func (daemon *Daemon) ContainerStart(ctx context.Context, name string, checkpoint string, checkpointDir string) error {
    container, err := daemon.GetContainer(name)
    
    return daemon.containerStart(ctx, daemon.config(), container, checkpoint, checkpointDir, true)
}

// Core Logic
func (daemon *Daemon) containerStart(ctx context.Context, container *container.Container) error {
    container.Lock()
    defer container.Unlock()
    
    // 1. 状态检查
    if container.Running {
        return nil // 幂等
    }
    
    // 2. 准备文件系统
    if err := daemon.Mount(container); err != nil {
        return err
    }
    
    // 3. 生成 OCI Spec
    spec, err := daemon.createSpec(ctx, container)
    
    // 4. 创建并启动 containerd Task
    task, err := daemon.containerd.Create(ctx, container.ID, spec)
    if err := task.Start(ctx); err != nil {
        return err
    }
    
    // 5. 连接网络
    if err := daemon.initializeNetworking(container); err != nil {
        return err
    }
    
    // 6. 启动健康检查
    container.StartHealthCheck()
    
    // 7. 更新状态
    container.SetRunning(task.Pid())
    daemon.LogContainerEvent(container, "start")
    
    return nil
}

HTTP Handler (postContainersStart)
  ↓
backend.ContainerStart()
  ↓
daemon.ContainerStart()
  ↓
daemon.containerStart()
  ├─ 1. 状态验证
  ├─ 2. 挂载文件系统
  │   └─ ImageService.Mount()
  ├─ 3. 生成 OCI Spec
  │   └─ daemon.createSpec()
  ├─ 4. containerd Task 创建与启动
  │   ├─ containerd.Create()
  │   └─ task.Start()
  ├─ 5. 网络连接
  │   └─ libnetwork.ConnectEndpoint()
  ├─ 6. 启动附加服务
  │   ├─ StartHealthCheck()
  │   └─ StartLogCollection()
  └─ 7. 状态更新
      └─ container.SetRunning()

// API Handler
func (c *containerRouter) postContainersStop(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    var options backend.ContainerStopOptions
    
    // 解析信号参数（API v1.42+）
    if versions.GreaterThanOrEqualTo(version, "1.42") {
        options.Signal = r.Form.Get("signal")
    }
    
    // 解析超时参数
    if tmpSeconds := r.Form.Get("t"); tmpSeconds != "" {
        valSeconds, _ := strconv.Atoi(tmpSeconds)
        options.Timeout = &valSeconds
    }
    
    if err := c.backend.ContainerStop(ctx, vars["name"], options); err != nil {
        return err
    }
    
    w.WriteHeader(http.StatusNoContent)
    return nil
}

// Core Logic
func (daemon *Daemon) ContainerStop(ctx context.Context, name string, options backend.ContainerStopOptions) error {
    container, err := daemon.GetContainer(name)
    
    container.Lock()
    defer container.Unlock()
    
    if !container.Running {
        return nil // 幂等
    }
    
    // 1. 确定超时时间
    timeout := 10
    if options.Timeout != nil {
        timeout = *options.Timeout
    }
    
    // 2. 确定信号
    signal := container.StopSignal()
    if options.Signal != "" {
        signal = options.Signal
    }
    
    // 3. 发送信号
    if err := daemon.kill(container, signal); err != nil {
        return err
    }
    
    // 4. 等待退出或超时
    if timeout > 0 {
        select {
        case <-container.Wait(ctx, container.WaitConditionNotRunning):
            // 容器正常退出
        case <-time.After(time.Duration(timeout) * time.Second):
            // 超时，发送 SIGKILL
            daemon.kill(container, "SIGKILL")
        }
    } else if timeout == 0 {
        // 立即 SIGKILL
        daemon.kill(container, "SIGKILL")
    }
    
    // 5. 断开网络
    daemon.disconnectFromNetwork(container)
    
    // 6. 更新状态
    container.SetStopped(&exitStatus{ExitCode: exitCode})
    
    return nil
}

{
  "id": ["abc123"],
  "name": ["web"],
  "label": ["env=prod", "app=nginx"],
  "status": ["created", "restarting", "running", "removing", "paused", "exited", "dead"],
  "ancestor": ["nginx:latest"],
  "volume": ["myvolume"],
  "network": ["mynet"],
  "health": ["healthy", "unhealthy", "starting", "none"]
}

[
  {
    "Id": "abc123def456...",
    "Names": ["/web"],
    "Image": "nginx:latest",
    "ImageID": "sha256:def456...",
    "Command": "nginx -g 'daemon off;'",
    "Created": 1678886400,
    "State": "running",
    "Status": "Up 2 hours",
    "Ports": [
      {
        "PrivatePort": 80,
        "PublicPort": 8080,
        "Type": "tcp"
      }
    ],
    "Labels": {
      "env": "production"
    },
    "SizeRw": 1024,
    "SizeRootFs": 133521408,
    "HostConfig": {
      "NetworkMode": "bridge"
    },
    "NetworkSettings": {
      "Networks": {
        "bridge": {
          "IPAddress": "172.17.0.2",
          "Gateway": "172.17.0.1",
          "MacAddress": "02:42:ac:11:00:02"
        }
      }
    },
    "Mounts": [
      {
        "Type": "volume",
        "Name": "myvolume",
        "Source": "/var/lib/docker/volumes/myvolume/_data",
        "Destination": "/data",
        "Mode": "rw",
        "RW": true
      }
    ]
  }
]

{
  "AttachStdin": true,
  "AttachStdout": true,
  "AttachStderr": true,
  "Tty": false,
  "Cmd": ["bash", "-c", "echo hello"],
  "Env": ["FOO=bar"],
  "WorkingDir": "/app",
  "User": "root",
  "Privileged": false
}

{
  "Id": "exec123abc..."
}

// API Handler
func (c *containerRouter) postContainerExecCreate(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    var config container.ExecOptions
    if err := httputils.ReadJSON(r, &config); err != nil {
        return err
    }
    
    execID, err := c.backend.ContainerExecCreate(ctx, vars["name"], &config)
    if err != nil {
        return err
    }
    
    return httputils.WriteJSON(w, http.StatusCreated, &container.ExecCreateResponse{
        ID: execID,
    })
}

// Core Logic
func (daemon *Daemon) ContainerExecCreate(ctx context.Context, name string, config *container.ExecOptions) (string, error) {
    cntr, err := daemon.GetContainer(name)
    
    if !cntr.IsRunning() {
        return "", errNotRunning(cntr.ID)
    }
    
    // 1. 创建 exec 配置
    execConfig := &container.ExecConfig{
        ID:            stringid.GenerateRandomID(),
        Container:     cntr,
        Cmd:           config.Cmd,
        Env:           config.Env,
        WorkingDir:    config.WorkingDir,
        User:          config.User,
        Privileged:    config.Privileged,
        Tty:           config.Tty,
        AttachStdin:   config.AttachStdin,
        AttachStdout:  config.AttachStdout,
        AttachStderr:  config.AttachStderr,
        DetachKeys:    config.DetachKeys,
    }
    
    // 2. 注册 exec
    daemon.registerExecCommand(cntr, execConfig)
    
    return execConfig.ID, nil
}