Dockerfile完全指南：从基础到生产实践

Dockerfile完全指南：从基础到生产实践

• • 引言：为什么需要Dockerfile？
  • 第一部分：Dockerfile基础指令详解
  • • 1.1 FROM：指定基础镜像
    • 1.2 LABEL：添加元数据
    • 1.3 RUN：执行命令
    • 1.4 COPY vs ADD：文件复制
    • 1.5 WORKDIR：设置工作目录
    • 1.6 ENV：设置环境变量
    • 1.7 ARG：构建参数
    • 1.8 EXPOSE：声明端口
    • 1.9 CMD vs ENTRYPOINT：容器启动命令
    • 1.10 USER：设置运行用户
    • 1.11 VOLUME：数据卷声明
    • 1.12 HEALTHCHECK：健康检查
    • 1.13 SHELL：更改默认shell
    • 1.14 ONBUILD：延迟执行指令
  • 第二部分：Dockerfile最佳实践
  • • 2.1 镜像层优化策略
    • 2.2 构建上下文优化
    • 2.3 安全最佳实践
    • 2.4 多阶段构建
    • 2.5 缓存优化策略
  • 第三部分：高级技巧与模式
  • • 3.1 动态构建配置
    • 3.2 通用基础镜像模式
    • 3.3 初始化脚本模式
    • 3.4 监控和日志集成
    • 3.5 多平台构建
  • 第四部分：实际应用示例
  • • 4.1 完整的Node.js生产环境Dockerfile
    • 4.2 Python Django应用Dockerfile
    • 4.3 微服务配置管理Dockerfile
  • 第五部分：工具与自动化
  • • 5.1 使用Makefile管理Docker构建
    • 5.2 Docker构建CI/CD流水线示例
    • 5.3 常用的Dockerfile工具
  • 第六部分：故障排除与调试
  • • 6.1 Dockerfile构建问题排查
    • 6.2 构建缓存问题
    • 6.3 镜像大小优化检查
  • 总结
  • • 关键要点回顾：
    • 推荐资源：
    • 实用命令速查：

引言：为什么需要Dockerfile？

Dockerfile是Docker生态系统的核心构建组件，它允许我们通过声明式的方式定义容器镜像的构建过程。与手动创建镜像相比，Dockerfile提供了可重复、可版本控制、可自动化的镜像构建方案。

# 一个完整的Dockerfile示例
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci –only=production
COPY . .
RUN npm run build

FROM nginx:alpine
COPY –from=builder /app/dist /usr/share/nginx/html
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

第一部分：Dockerfile基础指令详解

1.1 FROM：指定基础镜像

# 基础镜像选择最佳实践
FROM ubuntu:22.04 # 完整系统镜像（较大）
FROM alpine:3.18 # 轻量级镜像（推荐）
FROM python:3.11-slim # 官方slim版本
FROM node:18-alpine # 生产环境常用
FROM scratch # 空镜像，用于构建最小镜像

# 多阶段构建中的FROM
FROM golang:1.20 AS builder
FROM alpine:latest AS runtime

# 指定架构（多平台支持）
FROM –platform=$BUILDPLATFORM alpine AS build
FROM –platform=$TARGETPLATFORM alpine AS release

1.2 LABEL：添加元数据

# 添加镜像元数据
LABEL maintainer="devops@company.com"
LABEL version="1.0.0"
LABEL description="Production web application"
LABEL com.example.vendor="ACME Corporation"
LABEL com.example.release-date="2024-01-15"
LABEL com.example.version.is-production="true"

# 标准化标签（遵循惯例）
LABEL org.opencontainers.image.title="My Application"
LABEL org.opencontainers.image.description="Web application for XYZ"
LABEL org.opencontainers.image.url="https://example.com"
LABEL org.opencontainers.image.source="https://github.com/example/repo"
LABEL org.opencontainers.image.version="v1.0.0"
LABEL org.opencontainers.image.created="2024-01-15T10:00:00Z"
LABEL org.opencontainers.image.licenses="MIT"

1.3 RUN：执行命令

# RUN指令的多种写法
RUN apt-get update && apt-get install -y \\
curl \\
gnupg \\
python3 \\
&& rm -rf /var/lib/apt/lists/*

# 合并RUN指令减少镜像层
RUN set -eux; \\
apt-get update; \\
apt-get install -y –no-install-recommends \\
ca-certificates \\
wget \\
; \\
rm -rf /var/lib/apt/lists/*; \\
wget -O /tmp/package.tar.gz "https://example.com/package.tar.gz"; \\
tar -xzf /tmp/package.tar.gz -C /usr/local/bin; \\
rm /tmp/package.tar.gz

# 使用特定的用户运行命令
RUN adduser -D -u 1000 appuser && \\
chown -R appuser:appuser /app

1.4 COPY vs ADD：文件复制

# COPY – 简单的文件复制（推荐）
COPY . /app # 复制当前目录所有文件
COPY package.json /app/ # 复制单个文件
COPY src/ /app/src/ # 复制目录
COPY –chown=appuser:appuser . /app # 复制时修改所有者

# 排除文件
COPY . /app/
COPY .dockerignore . # 使用.dockerignore文件

# ADD – 支持URL和解压（谨慎使用）
ADD https://example.com/file.tar.gz /tmp/ # 从URL下载
ADD file.tar.gz /tmp/ # 自动解压tar.gz
ADD –chown=user:group source dest

# 最佳实践：优先使用COPY
# 只有在需要自动解压或从URL下载时才使用ADD

1.5 WORKDIR：设置工作目录

# 设置工作目录
WORKDIR /app # 绝对路径
WORKDIR src # 相对路径（基于之前的工作目录）

# 最佳实践：总是使用WORKDIR而不是RUN cd
# 错误示例：
RUN cd /app && npm install
# 正确示例：
WORKDIR /app
RUN npm install

# 多层目录创建
WORKDIR /usr/src/app

1.6 ENV：设置环境变量

# 设置环境变量
ENV NODE_ENV=production
ENV APP_VERSION=1.0.0
ENV APP_PORT=3000
ENV PATH=/app/node_modules/.bin:$PATH

# 多行环境变量
ENV LANG=C.UTF-8 \\
LC_ALL=C.UTF-8 \\
DEBIAN_FRONTEND=noninteractive

# 构建时参数（ARG）与环境变量（ENV）的区别
ARG BUILD_VERSION
ENV APP_VERSION=${BUILD_VERSION}

1.7 ARG：构建参数

# 定义构建参数
ARG VERSION=latest
ARG USERNAME=admin
ARG PORT=8080

# 使用构建参数
FROM alpine:$VERSION
RUN adduser -D $USERNAME

# 构建时传递参数
# docker build –build-arg VERSION=3.18 –build-arg USERNAME=appuser .

# 预定义ARG（可用于FROM指令前）
ARG NODE_VERSION=18
FROM node:${NODE_VERSION}-alpine

1.8 EXPOSE：声明端口

# 声明容器运行时监听的端口
EXPOSE 80/tcp # HTTP端口
EXPOSE 443/tcp # HTTPS端口
EXPOSE 3000 # 默认为TCP
EXPOSE 53/udp # UDP端口
EXPOSE 8080 9090 # 多个端口

# 注意：EXPOSE只是声明，不会自动映射到主机
# 运行时需要：docker run -p 80:80 image_name

1.9 CMD vs ENTRYPOINT：容器启动命令

# CMD – 提供默认的可执行命令
CMD ["nginx", "-g", "daemon off;"] # exec格式（推荐）
CMD nginx -g "daemon off;" # shell格式
CMD ["python", "app.py"] # 可被docker run覆盖

# ENTRYPOINT – 设置容器的主程序
ENTRYPOINT ["java", "-jar", "app.jar"] # 总是被执行
ENTRYPOINT ["/entrypoint.sh"] # 入口脚本

# 组合使用
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["app"] # 作为参数传递给ENTRYPOINT

# 示例：灵活的参数传递
ENTRYPOINT ["/usr/bin/curl"]
CMD ["–help"] # docker run image 显示帮助
# docker run image https://example.com 执行请求

1.10 USER：设置运行用户

# 设置运行用户（安全最佳实践）
USER nobody # 使用系统用户
USER 1000 # 使用UID
USER appuser:appgroup # 使用用户名和组

# 创建非root用户
RUN addgroup –gid 1000 appgroup && \\
adduser –uid 1000 –gid 1000 –disabled-password –gecos "" appuser

USER appuser

# 在工作目录设置正确的权限
WORKDIR /app
RUN chown -R appuser:appgroup /app
USER appuser

1.11 VOLUME：数据卷声明

# 声明匿名数据卷
VOLUME /var/lib/mysql
VOLUME /data
VOLUME ["/data", "/logs"]

# 使用模式
FROM mysql:8.0
VOLUME /var/lib/mysql # 数据持久化
VOLUME /var/log/mysql # 日志目录

1.12 HEALTHCHECK：健康检查

# 健康检查配置
HEALTHCHECK –interval=30s –timeout=3s –start-period=5s –retries=3 \\
CMD curl -f http://localhost:3000/health || exit 1

# 不同形式的健康检查
HEALTHCHECK CMD pg_isready -U postgres || exit 1
HEALTHCHECK CMD redis-cli ping || exit 1
HEALTHCHECK CMD wget –no-verbose –tries=1 –spider http://localhost:8080/ || exit 1

# 禁用健康检查
HEALTHCHECK NONE

1.13 SHELL：更改默认shell

# 更改默认shell
SHELL ["/bin/bash", "-c"]

# Windows容器
SHELL ["powershell", "-Command"]

1.14 ONBUILD：延迟执行指令

# 基础镜像中使用ONBUILD
FROM node:18-alpine
ONBUILD COPY . /app
ONBUILD RUN npm install
ONBUILD RUN npm run build

# 继承镜像时自动执行
# docker build -t myapp .

第二部分：Dockerfile最佳实践

2.1 镜像层优化策略

# 不好的示例：多层且冗余
FROM ubuntu:22.04
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get install -y wget
RUN apt-get clean
RUN rm -rf /var/lib/apt/lists/*

# 好的示例：合并层、清理缓存
FROM ubuntu:22.04
RUN apt-get update && \\
apt-get install -y \\
curl \\
wget \\
&& apt-get clean \\
&& rm -rf /var/lib/apt/lists/*

# 更好的示例：使用官方slim镜像
FROM python:3.11-slim
RUN apt-get update && \\
apt-get install -y –no-install-recommends \\
build-essential \\
&& apt-get clean \\
&& rm -rf /var/lib/apt/lists/*

2.2 构建上下文优化

# .dockerignore文件示例
# 忽略不需要的文件，减少构建上下文大小
.git
.gitignore
.vscode
.idea
*.log
*.tmp
*.swp
node_modules/
dist/
*.md
Dockerfile*
docker-compose*
.env
*.pem
*.key
secrets/
tests/
coverage/
*.tar.gz
*.zip

# 特殊文件模式
# 所有.txt文件，除了README.txt
*.txt
!README.txt

# 目录排除
**/__pycache__
**/*.pyc
**/.DS_Store

2.3 安全最佳实践

# 安全加固的Dockerfile示例
FROM alpine:3.18

# 1. 使用非root用户
RUN addgroup -g 1000 appgroup && \\
adduser -u 1000 -G appgroup -s /bin/sh -D appuser

# 2. 最小化安装包
RUN apk add –no-cache \\
curl \\
ca-certificates \\
tzdata

# 3. 更新包索引和安全补丁
RUN apk update && apk upgrade –no-cache

# 4. 设置工作目录和权限
WORKDIR /app
RUN chown -R appuser:appgroup /app

# 5. 复制文件并设置权限
COPY –chown=appuser:appgroup app.py /app/

# 6. 切换到非root用户
USER appuser

# 7. 使用只读文件系统（如果可能）
# docker run –read-only image_name

# 8. 健康检查
HEALTHCHECK –interval=30s –timeout=3s –start-period=5s \\
CMD curl -f http://localhost:8080/health || exit 1

# 9. 设置安全相关的环境变量
ENV NODE_ENV=production \\
PYTHONUNBUFFERED=1 \\
PYTHONDONTWRITEBYTECODE=1

CMD ["python", "app.py"]

2.4 多阶段构建

# Go应用多阶段构建
# 第一阶段：构建
FROM golang:1.20-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main .

# 第二阶段：运行
FROM alpine:latest
RUN apk –no-cache add ca-certificates
WORKDIR /root/
COPY –from=builder /app/main .
COPY –from=builder /app/config.yaml .
EXPOSE 8080
CMD ["./main"]

# Node.js应用多阶段构建
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci –only=production
COPY . .
RUN npm run build

FROM nginx:alpine AS production
COPY –from=builder /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

# Java应用多阶段构建
FROM maven:3.8-openjdk-17 AS build
WORKDIR /app
COPY pom.xml .
RUN mvn dependency:go-offline
COPY src ./src
RUN mvn clean package -DskipTests

FROM openjdk:17-jdk-slim
WORKDIR /app
COPY –from=build /app/target/*.jar app.jar
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]

2.5 缓存优化策略

# 优化Docker构建缓存
FROM node:18-alpine

# 1. 复制包管理文件（变化频率低）
COPY package.json package-lock.json ./

# 2. 安装依赖（利用缓存）
RUN npm ci –only=production

# 3. 复制源代码（变化频率高）
COPY . .

# 4. 构建应用
RUN npm run build

# 对于Python项目
FROM python:3.11-slim

WORKDIR /app

# 复制requirements文件（优先）
COPY requirements.txt .
RUN pip install –no-cache-dir -r requirements.txt

# 然后复制源代码
COPY . .

第三部分：高级技巧与模式

3.1 动态构建配置

# 使用构建参数进行动态配置
ARG ENVIRONMENT=production
ARG APP_VERSION=1.0.0

FROM node:18-alpine

# 根据环境安装不同的依赖
RUN if [ "$ENVIRONMENT" = "development" ]; then \\
npm install -g nodemon; \\
fi

# 设置环境特定的配置
ENV NODE_ENV=${ENVIRONMENT}
ENV APP_VERSION=${APP_VERSION}

# 复制不同的配置文件
COPY config/${ENVIRONMENT}.json ./config.json

# 构建命令示例：
# docker build –build-arg ENVIRONMENT=development –build-arg APP_VERSION=2.0.0 .

3.2 通用基础镜像模式

# 创建可重用的基础镜像
# base.Dockerfile
FROM alpine:3.18

# 安装公共依赖
RUN apk add –no-cache \\
bash \\
curl \\
ca-certificates \\
tzdata \\
&& update-ca-certificates

# 设置时区
ENV TZ=Asia/Shanghai

# 创建应用用户
RUN addgroup -g 1000 app && \\
adduser -u 1000 -G app -s /bin/sh -D app

WORKDIR /app

# 应用特定的Dockerfile
FROM mycompany/base:latest

# 安装特定依赖
RUN apk add –no-cache \\
python3 \\
py3-pip

# 复制应用代码
COPY –chown=app:app . .

USER app

CMD ["python3", "app.py"]

3.3 初始化脚本模式

# 使用初始化脚本处理复杂启动逻辑
FROM postgres:15-alpine

# 复制初始化脚本
COPY docker-entrypoint-initdb.d/ /docker-entrypoint-initdb.d/

# 设置脚本可执行权限
RUN chmod +x /docker-entrypoint-initdb.d/*.sh

# 初始化脚本示例：01-init.sh
#!/bin/bash
set -e

psql -v ON_ERROR_STOP=1 –username "$POSTGRES_USER" –dbname "$POSTGRES_DB" <<-EOSQL
CREATE DATABASE appdb;
CREATE USER appuser WITH ENCRYPTED PASSWORD '${APP_DB_PASSWORD}';
GRANT ALL PRIVILEGES ON DATABASE appdb TO appuser;
EOSQL

3.4 监控和日志集成

# 集成监控代理的Dockerfile
FROM python:3.11-slim

# 安装监控代理
RUN apt-get update && \\
apt-get install -y –no-install-recommends \\
wget \\
&& wget -qO /tmp/datadog-install.sh https://raw.githubusercontent.com/DataDog/datadog-agent/master/cmd/agent/install_script.sh \\
&& chmod +x /tmp/datadog-install.sh \\
&& DD_API_KEY=\\${DD_API_KEY} DD_SITE="datadoghq.com" bash /tmp/datadog-install.sh \\
&& apt-get clean \\
&& rm -rf /var/lib/apt/lists/* /tmp/*

# 设置日志驱动（在docker run时指定）
# docker run –log-driver=json-file –log-opt max-size=10m –log-opt max-file=3

WORKDIR /app
COPY requirements.txt .
RUN pip install –no-cache-dir -r requirements.txt
COPY . .

CMD ["ddtrace-run", "python", "app.py"]

3.5 多平台构建

# 支持多平台架构的Dockerfile
# 使用buildx进行多平台构建
# docker buildx build –platform linux/amd64,linux/arm64 -t myapp:latest .

FROM –platform=$BUILDPLATFORM golang:1.20-alpine AS builder
ARG TARGETOS TARGETARCH
WORKDIR /app
COPY . .
RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /app/main .

FROM alpine:3.18
WORKDIR /app
COPY –from=builder /app/main /app/main
RUN apk add –no-cache ca-certificates
EXPOSE 8080
CMD ["/app/main"]

第四部分：实际应用示例

4.1 完整的Node.js生产环境Dockerfile

# Node.js生产环境最佳实践
FROM node:18-alpine AS deps
# 检查是否需要安装特定依赖
RUN apk add –no-cache python3 make g++

WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci –only=production

# 开发依赖阶段（可选）
FROM node:18-alpine AS dev-deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci

# 构建阶段
FROM node:18-alpine AS builder
WORKDIR /app
COPY –from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build

# 生产运行阶段
FROM node:18-alpine AS runner
WORKDIR /app

ENV NODE_ENV=production
ENV PORT=3000
ENV HOST=0.0.0.0

# 创建非root用户
RUN addgroup –system –gid 1001 nodejs
RUN adduser –system –uid 1001 nodejs

# 复制必要文件
COPY –from=builder –chown=nodejs:nodejs /app/.next/standalone ./
COPY –from=builder –chown=nodejs:nodejs /app/.next/static ./.next/static
COPY –from=builder –chown=nodejs:nodejs /app/public ./public

# 健康检查
HEALTHCHECK –interval=30s –timeout=3s –start-period=5s –retries=3 \\
CMD node healthcheck.js

USER nodejs
EXPOSE 3000

CMD ["node", "server.js"]

4.2 Python Django应用Dockerfile

# Python Django应用
FROM python:3.11-slim AS python-base

ENV PYTHONUNBUFFERED=1 \\
PYTHONDONTWRITEBYTECODE=1 \\
PIP_NO_CACHE_DIR=off \\
PIP_DISABLE_PIP_VERSION_CHECK=on \\
POETRY_VERSION=1.4.2 \\
POETRY_HOME="/opt/poetry" \\
POETRY_VIRTUALENVS_IN_PROJECT=true \\
POETRY_NO_INTERACTION=1 \\
PYSETUP_PATH="/opt/pysetup" \\
VENV_PATH="/opt/pysetup/.venv"

ENV PATH="$POETRY_HOME/bin:$VENV_PATH/bin:$PATH"

# 构建阶段
FROM python-base AS builder
RUN apt-get update && \\
apt-get install –no-install-recommends -y \\
curl \\
build-essential

# 安装poetry
RUN curl -sSL https://install.python-poetry.org | python3 –

WORKDIR $PYSETUP_PATH
COPY poetry.lock pyproject.toml ./
RUN poetry install –no-dev

# 运行阶段
FROM python-base AS production
WORKDIR /app

# 创建非root用户
RUN groupadd -r django && useradd -r -g django django

# 从构建阶段复制虚拟环境
COPY –from=builder $VENV_PATH $VENV_PATH
COPY –chown=django:django . .

# 收集静态文件
RUN python manage.py collectstatic –noinput

# 数据库迁移（在实际部署中可能通过其他方式处理）
# RUN python manage.py migrate –noinput

# 设置权限
RUN chown -R django:django /app

USER django

# Gunicorn配置
ENV GUNICORN_CMD_ARGS="–workers=3 –worker-class=gthread –threads=3 –worker-tmp-dir /dev/shm –bind=0.0.0.0:8000"

EXPOSE 8000

CMD ["gunicorn", "config.wsgi:application"]

4.3 微服务配置管理Dockerfile

# 微服务配置管理示例
FROM alpine:3.18 AS config-downloader

ARG ENVIRONMENT=production
ARG CONFIG_VERSION=latest

# 下载配置
RUN apk add –no-cache curl
RUN curl -L -o /config.tar.gz \\
"https://config-server.example.com/configs/${ENVIRONMENT}/${CONFIG_VERSION}.tar.gz"
RUN tar -xzf /config.tar.gz -C /configs

# 应用镜像
FROM node:18-alpine

ARG ENVIRONMENT=production
ENV NODE_ENV=${ENVIRONMENT}

WORKDIR /app

# 安装应用
COPY package*.json ./
RUN npm ci –only=production
COPY . .

# 复制配置
COPY –from=config-downloader /configs/${ENVIRONMENT} ./config

# 健康检查
HEALTHCHECK –interval=30s –timeout=5s –start-period=10s –retries=3 \\
CMD node healthcheck.js

EXPOSE 3000

CMD ["node", "server.js"]

第五部分：工具与自动化

5.1 使用Makefile管理Docker构建

# Makefile for Docker management
.PHONY: help build push run test clean

# Variables
IMAGE_NAME = myapp
IMAGE_TAG = latest
REGISTRY = registry.mycompany.com
NAMESPACE = myteam

help: ## Show this help
@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "\\033[36m%-20s\\033[0m %s\\n", $$1, $$2}' $(MAKEFILE_LIST)

build: ## Build the Docker image
docker build \\
-t $(IMAGE_NAME):$(IMAGE_TAG) \\
-t $(REGISTRY)/$(NAMESPACE)/$(IMAGE_NAME):$(IMAGE_TAG) \\
–build-arg BUILD_DATE=$(shell date -u +"%Y-%m-%dT%H:%M:%SZ") \\
–build-arg VERSION=$(shell git describe –tags –always) \\
–build-arg COMMIT_SHA=$(shell git rev-parse HEAD) \\
.

build-multi: ## Build multi-arch image
docker buildx build \\
–platform linux/amd64,linux/arm64 \\
-t $(REGISTRY)/$(NAMESPACE)/$(IMAGE_NAME):$(IMAGE_TAG) \\
–push .

test: ## Run tests in container
docker run –rm \\
$(IMAGE_NAME):$(IMAGE_TAG) \\
npm test

lint: ## Lint Dockerfile
docker run –rm -i hadolint/hadolint < Dockerfile

scan: ## Security scan
docker scan $(IMAGE_NAME):$(IMAGE_TAG)

push: ## Push image to registry
docker push $(REGISTRY)/$(NAMESPACE)/$(IMAGE_NAME):$(IMAGE_TAG)

run: ## Run container locally
docker run –rm -p 3000:3000 \\
–env-file .env \\
–name $(IMAGE_NAME) \\
$(IMAGE_NAME):$(IMAGE_TAG)

clean: ## Clean up Docker resources
docker system prune -f
docker images | grep none | awk '{print $$3}' | xargs docker rmi -f

5.2 Docker构建CI/CD流水线示例

# .gitlab-ci.yml
stages:
– lint
– test
– build
– scan
– deploy

variables:
DOCKER_HOST: tcp://docker:2375
DOCKER_TLS_CERTDIR: ""
IMAGE_NAME: $CI_REGISTRY_IMAGE
IMAGE_TAG: $CI_COMMIT_SHA

before_script:
– docker info

docker-lint:
stage: lint
image: hadolint/hadolint:latest
script:
– hadolint Dockerfile

docker-test:
stage: test
image: docker:latest
services:
– docker:dind
script:
– docker build ––target test –t $IMAGE_NAME:test .
– docker run ––rm $IMAGE_NAME:test npm test

docker-build:
stage: build
image: docker:latest
services:
– docker:dind
script:
– docker build \\
––build–arg VERSION=$CI_COMMIT_TAG \\
––build–arg COMMIT_SHA=$CI_COMMIT_SHA \\
–t $IMAGE_NAME:$IMAGE_TAG \\
–t $IMAGE_NAME:latest .
– docker push $IMAGE_NAME:$IMAGE_TAG
– docker push $IMAGE_NAME:latest
only:
– main
– tags

security-scan:
stage: scan
image: docker:latest
services:
– docker:dind
script:
– docker pull $IMAGE_NAME:$IMAGE_TAG
– docker scan ––severity high $IMAGE_NAME:$IMAGE_TAG
allow_failure: true

deploy-staging:
stage: deploy
image: alpine:latest
script:
– apk add ––no–cache curl
– curl –X POST $STAGING_WEBHOOK_URL
environment:
name: staging
url: https://staging.myapp.com
only:
– main

deploy-production:
stage: deploy
image: alpine:latest
script:
– apk add ––no–cache curl
– curl –X POST $PRODUCTION_WEBHOOK_URL
environment:
name: production
url: https://myapp.com
only:
– tags

5.3 常用的Dockerfile工具

#!/bin/bash
# docker-tools.sh

# 1. hadolint – Dockerfile linter
docker run –rm -i hadolint/hadolint < Dockerfile

# 2. dive – 镜像分析工具
docker run –rm -it \\
-v /var/run/docker.sock:/var/run/docker.sock \\
wagoodman/dive:latest myimage:latest

# 3. docker-slim – 镜像瘦身
docker-slim build –target myimage:latest

# 4. trivy – 安全扫描
docker run –rm aquasec/trivy:latest image myimage:latest

# 5. buildx – 多平台构建
docker buildx build –platform linux/amd64,linux/arm64 -t myapp:latest .

# 6. dockerfile-language-server – IDE支持
# VS Code扩展：ms-azuretools.vscode-docker

# 7. dockerize – 模板化配置
FROM myapp:latest
RUN wget https://github.com/jwilder/dockerize/releases/download/v0.6.1/dockerize-alpine-linux-amd64-v0.6.1.tar.gz \\
&& tar -C /usr/local/bin -xzvf dockerize-alpine-linux-amd64-v0.6.1.tar.gz
CMD ["dockerize", "-template", "/app/config.tmpl:/app/config.json", "node", "server.js"]

第六部分：故障排除与调试

6.1 Dockerfile构建问题排查

# 调试技巧：添加调试层
FROM alpine:3.18

# 调试：查看构建时的文件
RUN ls -la / && \\
echo "Current directory:" && pwd && \\
echo "Environment:" && env

# 临时添加调试工具
RUN apk add –no-cache busybox-extras # 包含telnet, nc等

# 清理调试命令（最终版本中移除）
# RUN apk del busybox-extras

6.2 构建缓存问题

# 强制重新构建（忽略缓存）
docker build –no-cache -t myapp:latest .

# 从特定阶段重新构建
docker build –target builder -t myapp:builder .

# 清除构建缓存
docker builder prune

# 检查缓存使用情况
docker system df

6.3 镜像大小优化检查

# 分析镜像层
docker history myimage:latest

# 检查各层大小
docker image inspect myimage:latest –format='{{.Size}}' | numfmt –to=iec

# 使用dive进行交互式分析
docker run –rm -it \\
-v /var/run/docker.sock:/var/run/docker.sock \\
wagoodman/dive myimage:latest

总结

关键要点回顾：

推荐资源：

实用命令速查：

# 构建镜像
docker build -t myapp:latest .

# 多阶段构建
docker build –target builder -t myapp:builder .

# 多平台构建
docker buildx build –platform linux/amd64,linux/arm64 -t myapp:latest –push .

# 安全扫描
docker scan myapp:latest

# 分析镜像
docker history myapp:latest
docker image inspect myapp:latest

掌握Dockerfile的编写技巧是容器化部署的基础。通过遵循最佳实践、利用现代工具链、并持续学习社区的新模式，你可以构建出高效、安全、可维护的Docker镜像。记住，好的Dockerfile应该是自文档化的、可重复的、并且专注于单一职责的。