RocketMQ 5.1.0 + Dashboard Docker 生产部署方案 RocketMQ 5.1.0 Dashboard Docker 生产部署方案部署日期2026-07-09组件apache/rocketmq:5.1.0 · apacherocketmq/rocketmq-dashboard:2.0.0架构单 NameServer 单 Broker已知单点风险资源受限下的生产取舍鉴权Broker ACL (plain_acl.yml) Dashboard 凭证架构概览[客户端] → NameServer(:9876) → Broker(:10911) ← Dashboard(:8080) ↓ rmq-exporter(:5557) ← Prometheus 容器网络rocketmq-net (bridge)Step 0 — 宿主机 OS 调参必做cat/etc/sysctl.confEOF vm.max_map_count262144 vm.overcommit_memory1 net.core.somaxconn32768 net.ipv4.tcp_max_syn_backlog16384 EOFsysctl-pcat/etc/security/limits.confEOF * soft nofile 655350 * hard nofile 655350 EOFStep 1 — 创建 Docker 网络并获取子网段必须先建网络再查子网再写配置文件顺序不能乱。dockernetwork create rocketmq-net查询子网用于后续 plain_acl.yml 白名单配置dockernetwork inspect rocketmq-net--format{{range .IPAM.Config}}{{.Subnet}}{{end}}# 示例输出172.23.0.0/16将子网转换为 ACL 白名单格式取前三段加.*Docker 子网ACL 白名单格式172.23.0.0/16172.23.0.*172.18.0.0/16172.18.0.*192.168.100.0/24192.168.100.*⚠️ RocketMQ ACL只支持单通配符172.23.0.*不支持双通配符172.23.*.*。双通配符会被内部转成 CIDR 格式172.23.0.0/16而 ACL 又不支持 CIDR导致启动崩溃。Step 2 — 准备目录与配置文件mkdir-p/data/rocketmq/namesrv/logs/rocketmqlogsmkdir-p/data/rocketmq/broker/{conf,logs,store}mkdir-p/data/rocketmq/console/conf# 设置目录权限rocketmq 用户 UID3000chown-R3000:3000 /data/rocketmq/namesrv/logschown-R3000:3000 /data/rocketmq/broker/logschown-R3000:3000 /data/rocketmq/broker/storebroker.conf路径/data/rocketmq/broker/conf/broker.confbrokerClusterNameDefaultCluster brokerNamebroker-a brokerId0 brokerRoleASYNC_MASTER flushDiskTypeASYNC_FLUSH namesrvAddrnamesrv:9876 # ⚠️ 填宿主机真实 IP否则客户端从 NameServer 拿到容器内网 IP 无法连接 brokerIP1172.27.191.15 # 生产必须关闭防止业务代码写错 Topic 名乱建 autoCreateTopicEnablefalse autoCreateSubscriptionGroupfalse # ACL 鉴权 aclEnabletrue # 消息保留 deleteWhen04 fileReservedTime72 # CommitLog 单文件 1GB mapedFileSizeCommitLog1073741824 # 存储路径 storePathRootDir/home/rocketmq/store storePathCommitLog/home/rocketmq/store/commitlogplain_acl.yml路径/data/rocketmq/broker/conf/plain_acl.yml使用 python3 写入避免 heredoc 换行丢失问题将172.23.0.*替换为 Step 1 查到的实际子网python3-c content globalWhiteRemoteAddresses: - 172.18.0.* accounts: - accessKey: rocketmqAdmin secretKey: AdminRmq2024! admin: true defaultTopicPerm: PUB|SUB defaultGroupPerm: SUB topicPerms: [] groupPerms: [] - accessKey: appUser secretKey: AppRmq2024! admin: false defaultTopicPerm: PUB|SUB defaultGroupPerm: SUB topicPerms: [] groupPerms: [] open(/data/rocketmq/broker/conf/plain_acl.yml, w).write(content) print(written) 验证文件格式两个账号之间必须有空行cat/data/rocketmq/broker/conf/plain_acl.ymlStep 3 — 启动容器⚠️ 关键约束-e KEYvalue内部不能用\换行所有 JVM 参数必须写在一行!字符在 bash 双引号中触发 history expansion用\!转义或执行前set H健康检查用bash -c /dev/tcp/localhost/PORT容器内无ss/netstat① NameServerdockerrun-d\--namenamesrv\--networkrocketmq-net\--restartunless-stopped\--ulimitnofile655350\--memory512m --memory-swap512m\--cpus0.5\-p9876:9876\-v/data/rocketmq/namesrv/logs:/home/rocketmq/logs\-eJAVA_OPT_EXT-server -Xms256m -Xmx256m\--health-cmdbash -c /dev/tcp/localhost/9876\--health-interval15s --health-timeout5s --health-retries3\apache/rocketmq:5.1.0shmqnamesrv② Brokerdockerrun-d\--namebroker\--networkrocketmq-net\--restartunless-stopped\--ulimitnofile655350\--memory2g --memory-swap2g\--cpus4\-p10909:10909\-p10911:10911\-p10912:10912\-v/data/rocketmq/broker/conf/broker.conf:/home/rocketmq/rocketmq-5.1.0/conf/broker.conf\-v/data/rocketmq/broker/conf/plain_acl.yml:/home/rocketmq/rocketmq-5.1.0/conf/plain_acl.yml\-v/data/rocketmq/broker/logs:/home/rocketmq/logs\-v/data/rocketmq/broker/store:/home/rocketmq/store\-eJAVA_OPT_EXT-server -Xms1g -Xmx1g -XX:HeapDumpOnOutOfMemoryError -XX:HeapDumpPath/home/rocketmq/logs/heapdump.hprof\--health-cmdbash -c /dev/tcp/localhost/10911\--health-interval30s --health-timeout10s --health-retries3\apache/rocketmq:5.1.0\shmqbroker-c/home/rocketmq/rocketmq-5.1.0/conf/broker.conf③ Dashboardstyletang/rocketmq-console-ng不支持 ACL必须用apacherocketmq/rocketmq-dashboard:2.0.0。2.0.0内部端口 8080。JAVA_OPTS对该镜像无效entrypoint 不展开此变量必须用SPRING_APPLICATION_JSON传配置。dockerrun-d\--namerocketmq-dashboard\--networkrocketmq-net\--restartunless-stopped\--memory512m --memory-swap512m\--cpus0.5\-p8080:8080\-eSPRING_APPLICATION_JSON{rocketmq:{config:{namesrvAddr:namesrv:9876,isVIPChannel:false,accessKey:rocketmqAdmin,secretKey:AdminRmq2024!}}}\apacherocketmq/rocketmq-dashboard:2.0.0④ Prometheus Exporter监控dockerrun-d\--namermq-exporter\--networkrocketmq-net\--restartunless-stopped\--memory256m\-p5557:5557\-eROCKETMQ_CONFIG_NAMESRVADDRnamesrv:9876\-eROCKETMQ_CONFIG_WEBTELEMETRYPATH/metrics\-erocketmq.config.accessKeyrocketmqAdmin\-erocketmq.config.secretKeyAdminRmq2024!\apache/rocketmq-exporter:0.0.2Prometheusscrape_configs加入http://YOUR_HOST:5557/metricsGrafana 导入 Dashboard ID10477。Step 4 — 验证# 查看所有容器状态dockerps--formattable {{.Names}}\t{{.Status}}\t{{.Ports}}# Broker 日志确认 ACL 加载无 AclException 即正常dockerlogs broker21|grep-iacl\|boot success\|exception|tail-10# NameServer 验证 Broker 注册dockerexecnamesrvshmqadmin clusterList-nlocalhost:9876# 访问 Dashboard# http://YOUR_HOST_IP:8080修改 plain_acl.yml 后的正确流程⚠️docker restart会保留容器 overlay 层导致仍读旧文件。必须重建容器。# 1. 修改宿主机文件用 python3 写避免 heredoc 换行问题python3-c.../data/rocketmq/broker/conf/plain_acl.yml# 2. 验证宿主机文件正确cat/data/rocketmq/broker/conf/plain_acl.yml# 3. 删容器重建不要用 restartdockerrm-fbrokerdockerrun-d...# 完整启动命令关键注意事项汇总项目说明brokerIP1必须填宿主机真实 IP否则客户端无法连接ACL 白名单格式只支持单通配符172.23.0.*不支持172.23.*.*会崩也不支持 CIDR修改 ACL 文件后必须docker rm -fdocker run重建不能restart-e中的 JVM 参数不能用\换行所有参数写一行!字符bash 双引号内需转义\!或先执行set H日志目录权限chown -R 3000:3000设置 rocketmq UID健康检查命令容器无ss/netstat用bash -c /dev/tcp/localhost/PORTConsole 选型styletang/rocketmq-console-ng不支持 ACL必须用rocketmq-dashboard:2.0.0autoCreateTopicEnablefalse生产必须关闭Topic 通过 Dashboard 或 mqadmin 预先创建plain_acl.yml热更新修改后60 秒内自动生效但 overlay 问题需重建容器资源分配参考8核16G宿主机容器--memory--cpus堆内存namesrv512m0.5256mbroker2g41gdashboard512m0.5256mrmq-exporter256m0.25—客户端 ACL 配置参考Java方案 Arocketmq-spring-boot-starter推荐# application-test.ymlrocketmq:name-server:localhost:9876producer:group:your-group# 不写 access-key / secret-key 不启用 ACL# application-prod.ymlrocketmq:name-server:172.16.0.6:9876producer:group:your-groupaccess-key:appUsersecret-key:AppRmq2024!方案 B手动构建 Producer# application-test.ymlrocketmq:acl.enabled:false# application-prod.ymlrocketmq:acl.enabled:trueacl.access-key:appUseracl.secret-key:AppRmq2024!ConfigurationpublicclassRocketMQConfig{Value(${rocketmq.acl.enabled:false})privatebooleanaclEnabled;Value(${rocketmq.acl.access-key:})privateStringaccessKey;Value(${rocketmq.acl.secret-key:})privateStringsecretKey;Bean(destroyMethodshutdown)publicDefaultMQProducerproducer()throwsMQClientException{RPCHookhookaclEnabled?newAclClientRPCHook(newSessionCredentials(accessKey,secretKey)):null;DefaultMQProducerproducernewDefaultMQProducer(your-group,hook);producer.setNamesrvAddr(172.16.0.6:9876);producer.start();returnproducer;}}端口汇总端口组件用途9876NameServer客户端注册/查询10909BrokerfastRemoting10911Brokerremoting主通信端口10912BrokerHA 同步预留8080DashboardWeb UI5557rmq-exporterPrometheus 指标