Docker多阶段构建实践

Docker多阶段构建优化镜像大小和构建效率。

多阶段构建基础

基本语法

# 构建阶段
FROM golang:1.21 AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp

# 运行阶段
FROM alpine:latest
WORKDIR /app
COPY --from=builder /app/myapp .
CMD ["./myapp"]
​

镜像瘦身技巧

选择基础镜像

# 最小化镜像 (~80MB)
FROM alpine:3.19

# 极简镜像 (~5MB)
FROM scratch

# 语言特定
FROM node:20-alpine
FROM golang:1.21-alpine
​

Go应用多阶段构建

# 构建阶段
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY go.* ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o myapp

# 运行阶段
FROM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /app
COPY --from=builder /app/myapp .
CMD ["./myapp"]
​

Node.js多阶段构建

# 构建阶段
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# 运行阶段
FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/package*.json ./
RUN npm ci --production
COPY --from=builder /app/dist ./dist
CMD ["node", "dist/index.js"]
​

减少层数

# 合并命令
RUN apt-get update && \
    apt-get install -y curl git && \
    rm -rf /var/lib/apt/lists/*

# 清理缓存
RUN apk add --no-cache curl && \
    rm -rf /var/cache/apk/*
​

缓存策略

优化层缓存

# 优先复制依赖文件
COPY package*.json ./
RUN npm ci

# 后复制应用代码
COPY . .
​

使用BuildKit缓存

# 缓存挂载
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install -r requirements.txt
​

安全扫描

Trivy扫描

# 扫描镜像
trivy image myapp:latest

# 扫描Dockerfile
trivy config Dockerfile
​

基础镜像安全

# 使用官方镜像
FROM alpine:3.19

# 非root用户
RUN addgroup -g 1000 appuser && \
    adduser -D -u 1000 -G appuser appuser
USER appuser
​

最佳实践

1. 使用多阶段构建减小镜像
2. 选择合适的基础镜像
3. 优化Dockerfile层顺序
4. 定期扫描镜像漏洞
5. 使用非root用户运行

Docker多阶段构建是容器化优化的核心技术。