1
FROM ubuntu:22.04          # 层 1: 基础镜像
2
RUN apt-get update         # 层 2: 包索引更新
3
RUN apt-get install -y nginx  # 层 3: 安装 nginx
4
COPY nginx.conf /etc/nginx/  # 层 4: 复制配置
5
EXPOSE 80                  # 元数据（不生成层）
6
CMD ["nginx", "-g", "daemon off;"]  # 元数据（不生成层）

1
# 查看镜像的层
2
docker history myapp
3

4
# IMAGE          CREATED       CREATED BY                                      SIZE
5
# abc123         2 mins ago    CMD ["nginx", "-g", "daemon off;"]              0B
6
# def456         2 mins ago    EXPOSE 80                                       0B
7
# ghi789         2 mins ago    COPY nginx.conf /etc/nginx/                     1.2kB
8
# jkl012         3 mins ago    RUN apt-get install -y nginx                    23.5MB
9
# mno345         3 mins ago    RUN apt-get update                              18.2MB
10
# pqr678         2 weeks ago   /bin/sh -c #(nop) CMD ["/bin/bash"]             0B
11
#                2 weeks ago                                                   77.8MB
12

13
# 注意：RUN 指令生成的层最大，因为包含了文件系统变更

1
# 缓存命中规则：
2
# 1. FROM 指令：检查基础镜像是否变化
3
# 2. COPY/ADD：检查源文件的 checksum 是否变化
4
# 3. RUN：检查命令字符串是否变化（不检查执行结果！）
5

6
# 常见陷阱：RUN apt-get update 的缓存
7
# 如果 apt-get update 的命令字符串未变，Docker 会复用缓存
8
# 但软件包列表可能已更新！
9
# 解决方案：合并 RUN apt-get update && apt-get install

1
# 单阶段构建：镜像包含 Go 编译器（~300MB）
2
FROM golang:1.22
3
WORKDIR /app
4
COPY . .
5
RUN go build -o myapp
6
CMD ["./myapp"]
7
# 最终镜像大小：~800MB

1
# 阶段 1：构建
2
FROM golang:1.22 AS builder
3
WORKDIR /app
4
COPY go.mod go.sum ./
5
RUN go mod download
6
COPY . .
7
RUN CGO_ENABLED=0 go build -o myapp
8

9
# 阶段 2：运行
10
FROM alpine:3.19
11
RUN apk --no-cache add ca-certificates
12
COPY --from=builder /app/myapp /usr/local/bin/myapp
13
EXPOSE 8080
14
CMD ["myapp"]
15
# 最终镜像大小：~15MB（只包含二进制 + Alpine）

1
# 1. cache mount：持久化缓存目录
2
RUN --mount=type=cache,target=/root/.cache/go-build \
3
    go build -o myapp
4

5
# 2. secret mount：安全传递密钥
6
RUN --mount=type=secret,id=github_token \
7
    git clone https://$(cat /run/secrets/github_token)@github.com/repo.git
8

9
# 3. ssh mount：SSH agent 转发
10
RUN --mount=type=ssh git clone git@github.com:repo.git
11

12
# 4. bind mount：只读挂载构建上下文
13
RUN --mount=type=bind,source=.,target=/src \
14
    make -C /src

1
# Go 模块缓存持久化
2
FROM golang:1.22 AS builder
3
WORKDIR /app
4
COPY go.mod go.sum ./
5
RUN --mount=type=cache,target=/go/pkg/mod \
6
    go mod download
7
COPY . .
8
RUN --mount=type=cache,target=/go/pkg/mod \
9
    --mount=type=cache,target=/root/.cache/go-build \
10
    CGO_ENABLED=0 go build -o myapp
11

12
# pip 缓存持久化
13
FROM python:3.12 AS builder
14
COPY requirements.txt .
15
RUN --mount=type=cache,target=/root/.cache/pip \
16
    pip install -r requirements.txt
17
COPY . .
18
CMD ["python", "app.py"]
19

20
# npm 缓存持久化
21
FROM node:20 AS builder
22
COPY package.json package-lock.json ./
23
RUN --mount=type=cache,target=/root/.npm \
24
    npm ci
25
COPY . .
26
RUN --mount=type=cache,target=/root/.npm \
27
    npm run build

1
# 导出缓存到 Registry
2
docker buildx build \
3
  --cache-to=type=registry,ref=myregistry/myapp:cache \
4
  --cache-from=type=registry,ref=myregistry/myapp:cache \
5
  -t myapp .
6

7
# 导出缓存到本地
8
docker buildx build \
9
  --cache-to=type=local,dest=./cache \
10
  --cache-from=type=local,src=./cache \
11
  -t myapp .
12

13
# 导出缓存到 S3
14
docker buildx build \
15
  --cache-to=type=s3,region=us-east-1,bucket=my-cache \
16
  --cache-from=type=s3,region=us-east-1,bucket=my-cache \
17
  -t myapp .

1
# 创建多平台 builder
2
docker buildx create --name multiplatform --use
3

4
# 构建多平台镜像
5
docker buildx build \
6
  --platform linux/amd64,linux/arm64 \
7
  -t myapp:latest \
8
  --push .
9

10
# BuildKit 使用 QEMU 模拟非本机平台

1
# 不好：每条 RUN 生成一个层
2
RUN apt-get update
3
RUN apt-get install -y nginx
4
RUN apt-get install -y redis
5
RUN apt-get clean
6

7
# 好：合并 RUN 指令，减少层数
8
RUN apt-get update && \
9
    apt-get install -y nginx redis && \
10
    apt-get clean && \
11
    rm -rf /var/lib/apt/lists/*

1
# 不好：代码变更导致 npm install 缓存失效
2
COPY . /app
3
RUN npm install
4

5
# 好：先复制 package.json，利用缓存
6
COPY package.json package-lock.json /app/
7
RUN npm install
8
COPY . /app

1
# 使用非 root 用户
2
FROM alpine:3.19
3
RUN adduser -D appuser
4
USER appuser
5
COPY --chown=appuser:appuser . /app
6
WORKDIR /app
7
CMD ["./myapp"]

1
# 最小镜像：静态编译 + scratch
2
FROM golang:1.22 AS builder
3
WORKDIR /app
4
COPY . .
5
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o myapp
6

7
FROM scratch
8
COPY --from=builder /app/myapp /myapp
9
ENTRYPOINT ["/myapp"]
10
# 最终镜像大小：~5MB（只包含静态链接的二进制）

1
#!/bin/bash
2
# 对比不同 Dockerfile 的构建时间和镜像大小
3

4
echo "=== 未优化的 Dockerfile ==="
5
cat > Dockerfile.bad << 'EOF'
6
FROM ubuntu:22.04
7
RUN apt-get update
8
RUN apt-get install -y nginx
9
RUN apt-get install -y curl
10
COPY . /app
11
CMD ["nginx", "-g", "daemon off;"]
12
EOF
13

14
time docker build -t myapp:bad -f Dockerfile.bad .
15
docker images myapp:bad --format "{{.Size}}"
16

17
echo ""
18
echo "=== 优化后的 Dockerfile ==="
19
cat > Dockerfile.good << 'EOF'
20
FROM nginx:alpine AS base
21
FROM base AS builder
22
COPY --from=builder /etc/nginx/nginx.conf /etc/nginx/nginx.conf
23
COPY . /usr/share/nginx/html
24
EXPOSE 80
25
CMD ["nginx", "-g", "daemon off;"]
26
EOF
27

28
time docker build -t myapp:good -f Dockerfile.good .
29
docker images myapp:good --format "{{.Size}}"

1
#!/bin/bash
2
# BuildKit 缓存实验
3

4
# 1. 启用 BuildKit
5
export DOCKER_BUILDKIT=1
6

7
# 2. 第一次构建（无缓存）
8
time docker build --no-cache -t myapp:v1 .
9

10
# 3. 修改源代码
11
echo "// changed" >> main.go
12

13
# 4. 第二次构建（利用缓存）
14
time docker build -t myapp:v2 .
15
# 应该比第一次快很多
16

17
# 5. 查看 BuildKit 缓存
18
docker buildx du
19
docker buildx prune

1
# 在 CI/CD 中集成 Trivy 扫描
2
trivy image --exit-code 1 --severity CRITICAL,HIGH myapp:latest
3

4
# 只在发现高危漏洞时失败
5
trivy image --exit-code 1 --severity CRITICAL myapp:latest
6

7
# 生成 SBOM（软件物料清单）
8
trivy image --format spdx-json --output sbom.json myapp:latest

1
# 使用 cosign 签名镜像
2
cosign sign --key cosign.key myapp:latest
3

4
# 验证镜像签名
5
cosign verify --key cosign.pub myapp:latest
6

7
# 在 Kubernetes 中强制签名验证（Kyverno）
8
# 策略：只允许运行已签名的镜像

1
# Dockerfile.bad — 未优化
2
FROM ubuntu:22.04
3
RUN apt-get update
4
RUN apt-get install -y python3
5
RUN apt-get install -y python3-pip
6
RUN pip3 install flask
7
COPY app.py /app/app.py
8
WORKDIR /app
9
CMD ["python3", "app.py"]

1
# Dockerfile.good — 多阶段构建 + 层合并
2
FROM python:3.12-alpine AS builder
3
RUN pip install --no-cache-dir flask
4
FROM python:3.12-alpine
5
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
6
COPY app.py /app/app.py
7
WORKDIR /app
8
CMD ["python3", "app.py"]

1
# 查看镜像层信息
2
docker history myapp:latest
3

4
# 用 dive 深度分析每一层（需安装 dive）
5
dive myapp:latest
6

7
# 用 Trivy 扫描镜像漏洞
8
trivy image myapp:latest