# 基础镜像
FROM ubuntu:20.04

# 维护者信息
MAINTAINER Your Name

# 环境变量
ENV DEBIAN_FRONTEND=noninteractive

# 安装依赖
RUN apt-get update && apt-get install -y \
nginx \
curl \
wget \
&& rm -rf /var/lib/apt/lists/*

# 复制文件
COPY index.html /var/www/html/

# 暴露端口
EXPOSE 80

# 工作目录
WORKDIR /var/www/html

# 启动命令
CMD [“nginx”, “-g”, “daemon off;”]

# 第一阶段：构建
FROM node:14 as builder
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build

# 第二阶段：运行
FROM nginx:alpine
COPY –from=builder /app/build /usr/share/nginx/html
EXPOSE 80
CMD [“nginx”, “-g”, “daemon off;”]

风哥风哥提示：多阶段构建可以显著减小最终镜像的大小，只包含运行所需的文件，不包含构建工具和依赖。

3. 镜像构建

3.1 基本构建命令

# 基本构建
$ docker build -t myapp:latest .

# 指定Dockerfile
$ docker build -t myapp:latest -f Dockerfile.prod .

# 指定构建上下文
$ docker build -t myapp:latest /path/to/context

# 使用构建参数
$ docker build -t myapp:latest –build-arg VERSION=1.0.0 .

# 构建缓存
$ docker build –no-cache -t myapp:latest .

# 查看构建历史
$ docker history myapp:latest

# 构建时指定标签
$ docker build -t myapp:1.0.0 -t myapp:latest .

# 合理使用缓存
FROM ubuntu:20.04

# 先安装依赖，再复制代码
RUN apt-get update && apt-get install -y \
python3 \
python3-pip \
&& rm -rf /var/lib/apt/lists/*

# 复制requirements.txt，单独安装依赖
COPY requirements.txt .
RUN pip3 install -r requirements.txt

# 最后复制代码
COPY . .

# 使用多阶段构建
FROM golang:1.16 as builder
WORKDIR /app
COPY . .
RUN go build -o app .

FROM alpine:3.14
WORKDIR /app
COPY –from=builder /app/app .
EXPOSE 8080
CMD [“./app”]

# 使用 BuildKit
$ DOCKER_BUILDKIT=1 docker build -t myapp:latest .

# 并行构建
$ docker buildx build -t myapp:latest –platform linux/amd64,linux/arm64 .

# 创建 .dockerignore 文件
$ cat .dockerignore
node_modules/
npm-debug.log
yarn-error.log
build/
dist/
*.log
*.env

# 测试 .dockerignore
$ docker build -t myapp:latest –progress=plain .

# 减小构建上下文
$ find . -type f -not -path “*/node_modules/*” -not -path “*/build/*” | wc -l

学习交流加群风哥微信: itpux-com

4. 镜像仓库管理

4.1 Docker Hub

# 登录Docker Hub
$ docker login

# 标记镜像
$ docker tag myapp:latest username/myapp:latest

# 推送镜像
$ docker push username/myapp:latest

# 拉取镜像
$ docker pull username/myapp:latest

# 搜索镜像
$ docker search nginx

# 查看镜像详情
$ docker inspect username/myapp:latest

# 运行私有镜像仓库
$ docker run -d -p 5000:5000 –name registry registry:2

# 标记镜像
$ docker tag myapp:latest fgedudb:5000/myapp:latest

# 推送镜像
$ docker push fgedudb:5000/myapp:latest

# 拉取镜像
$ docker pull fgedudb:5000/myapp:latest

# 查看仓库中的镜像
$ curl http://fgedudb:5000/v2/_catalog

# 查看镜像标签
$ curl http://fgedudb:5000/v2/myapp/tags/list

# 安装Harbor
$ wget https://github.com/goharbor/harbor/releases/download/v2.3.0/harbor-online-installer-v2.3.0.tgz
$ tar xvf harbor-online-installer-v2.3.0.tgz
$ cd harbor

# 配置Harbor
$ cp harbor.yml.tmpl harbor.yml
$ vi harbor.yml
# 修改hostname、port、admin password等配置

# 安装Harbor
$ ./install.sh

# 登录Harbor
$ docker login harbor.fgedu.net.cn

# 推送镜像到Harbor
$ docker tag myapp:latest harbor.fgedu.net.cn/library/myapp:latest
$ docker push harbor.fgedu.net.cn/library/myapp:latest

# 从Harbor拉取镜像
$ docker pull harbor.fgedu.net.cn/library/myapp:latest

学习交流加群风哥QQ113257174

5. 镜像标签管理

5.1 标签命名规范

• 版本标签：如 v1.0.0, 1.2.3
• 分支标签：如 master, develop
• 环境标签：如 dev, test, prod
• 日期标签：如 20210101
• commit标签：如 abc123
• latest标签：表示最新版本

5.2 标签管理命令

# 列出本地镜像
$ docker images

# 标记镜像
$ docker tag myapp:latest myapp:1.0.0
$ docker tag myapp:latest myapp:stable

# 移除标签
$ docker rmi myapp:1.0.0

# 重命名镜像
$ docker tag oldname:latest newname:latest
$ docker rmi oldname:latest

# 查看镜像历史
$ docker history myapp:latest

# 查看镜像元数据
$ docker inspect myapp:latest

# 使用 Alpine 基础镜像
FROM alpine:3.14

# 最小化层数
FROM alpine:3.14
RUN apk add –no-cache nginx && rm -rf /var/cache/apk/*

# 清理临时文件
FROM ubuntu:20.04
RUN apt-get update && apt-get install -y nginx && rm -rf /var/lib/apt/lists/*

# 使用多阶段构建
FROM golang:1.16 as builder
WORKDIR /app
COPY . .
RUN go build -o app .

FROM alpine:3.14
WORKDIR /app
COPY –from=builder /app/app .
EXPOSE 8080
CMD [“./app”]

# 压缩镜像
$ docker save myapp:latest | gzip > myapp.tar.gz
$ docker load < myapp.tar.gz

# 使用构建缓存
FROM ubuntu:20.04
RUN apt-get update && apt-get install -y nginx
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY . .

# 使用 BuildKit
$ DOCKER_BUILDKIT=1 docker build -t myapp:latest .

# 并行构建
$ docker buildx build -t myapp:latest –platform linux/amd64,linux/arm64 .

# 使用缓存镜像
$ docker pull myapp:latest || true
$ docker build –cache-from myapp:latest -t myapp:latest .

# 优化 COPY 命令
COPY package*.json ./
RUN npm install
COPY . .

# 使用 dive 分析镜像
$ docker run –rm -it \
-v /var/run/docker.sock:/var/run/docker.sock \
wagoodman/dive:latest myapp:latest

# 查看镜像大小
$ docker images –format “{{.Repository}}:{{.Tag}} {{.Size}}”

# 查看镜像层大小
$ docker history myapp:latest

# 比较镜像大小
$ docker images | grep myapp

author:www.itpux.com

7. 镜像安全

7.1 镜像安全最佳实践

# 使用官方基础镜像
FROM nginx:alpine

# 定期更新基础镜像
FROM nginx:alpine@sha256:abc123…

# 最小化镜像
FROM alpine:3.14
RUN apk add –no-cache nginx && rm -rf /var/cache/apk/*

# 以非root用户运行
FROM alpine:3.14
RUN adduser -D -u 1000 nginx
USER nginx

# 避免使用ADD
COPY index.html /var/www/html/

# 清理临时文件
RUN apt-get update && apt-get install -y nginx && rm -rf /var/lib/apt/lists/*

# 使用只读文件系统
FROM alpine:3.14
RUN apk add –no-cache nginx
VOLUME [“/var/cache/nginx”]
CMD [“nginx”, “-g”, “daemon off;”]

# 使用 Trivy 扫描镜像
$ docker run –rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image myapp:latest

# 使用 Clair 扫描镜像
$ docker run –rm -v /var/run/docker.sock:/var/run/docker.sock quay.io/coreos/clair-scanner:latest -c http://fgedudb:6060 –ip 172.17.0.1 myapp:latest

# 使用 Docker Scan
$ docker scan myapp:latest

# 扫描结果分析
# 查看高危漏洞
$ docker run –rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image –severity HIGH,CRITICAL myapp:latest

# 生成扫描报告
$ docker run –rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image –format json –output trivy-result.json myapp:latest

# 配置 seccomp
FROM alpine:3.14
RUN apk add –no-cache nginx
COPY seccomp.json /etc/seccomp.json
CMD [“nginx”, “-g”, “daemon off;”]

# 配置 AppArmor
FROM alpine:3.14
RUN apk add –no-cache nginx
CMD [“nginx”, “-g”, “daemon off;”]

# 配置 SELinux
FROM alpine:3.14
RUN apk add –no-cache nginx
CMD [“nginx”, “-g”, “daemon off;”]

# 限制容器能力
FROM alpine:3.14
RUN apk add –no-cache nginx
CMD [“nginx”, “-g”, “daemon off;”]

# 清理悬空镜像
$ docker image prune

# 清理所有未使用的镜像
$ docker image prune -a

# 清理特定镜像
$ docker rmi myapp:latest

# 批量清理
$ docker images | grep “” | awk ‘{print $3}’ | xargs docker rmi

# 清理所有镜像
$ docker rmi $(docker images -q)

# 导出镜像
$ docker save -o myapp.tar myapp:latest

# 导入镜像
$ docker load -i myapp.tar

# 导出多个镜像
$ docker save -o images.tar myapp:latest nginx:alpine

# 压缩导出
$ docker save myapp:latest | gzip > myapp.tar.gz

# 从压缩文件导入
$ gunzip -c myapp.tar.gz | docker load

# 列出镜像标签
$ docker images | grep myapp

# 保留特定版本
$ docker tag myapp:latest myapp:v1.0.0

# 删除旧版本
$ docker rmi myapp:old-version

# 批量标记
$ for i in {1..10}; do docker tag myapp:latest myapp:v1.0.$i; done

# 批量删除
$ for i in {1..10}; do docker rmi myapp:v1.0.$i; done

# GitHub Actions 配置
$ cat .github/workflows/scan.yml
name: Security Scan

on:
push:
branches: [ master ]
pull_request:
branches: [ master ]

jobs:
scan:
runs-on: ubuntu-latest
steps:
– uses: actions/checkout@v2
– name: Build image
run: docker build -t myapp:latest .
– name: Scan image
uses: aquasecurity/trivy-action@master
with:
image-ref: ‘myapp:latest’
format: ‘table’
exit-code: ‘1’
ignore-unfixed: true
severity: ‘CRITICAL,HIGH’

# GitLab CI 配置
$ cat .gitlab-ci.yml
scan:
stage: test
script:
– docker build -t myapp:latest .
– docker run –rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image –severity HIGH,CRITICAL myapp:latest
only:
– master
– merge_requests

# 查看扫描结果
$ docker run –rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image myapp:latest

# 导出扫描报告
$ docker run –rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image –format json –output trivy-result.json myapp:latest

# 解析扫描报告
$ jq ‘.Results[].Vulnerabilities[] | select(.Severity == “CRITICAL”)’ trivy-result.json

# 自动修复漏洞
# 更新基础镜像
FROM alpine:3.15

# 安装安全补丁
RUN apk update && apk upgrade

# 移除有漏洞的包
RUN apk del vulnerable-package && apk add secure-package

# 生产环境镜像策略
1. 使用固定标签：避免使用latest标签
2. 签名镜像：确保镜像完整性
3. 扫描镜像：部署前进行安全扫描
4. 镜像分层：合理组织镜像层
5. 镜像缓存：使用缓存提高构建速度
6. 镜像仓库：使用企业级镜像仓库
7. 镜像备份：定期备份重要镜像
8. 镜像审计：记录镜像的创建和使用
9. 镜像版本控制：管理镜像的版本历史
10. 镜像生命周期：制定镜像的生命周期策略

# 示例生产环境Dockerfile
FROM alpine:3.15 as builder
WORKDIR /app
COPY package*.json ./
RUN npm install –production
COPY . .
RUN npm run build

FROM alpine:3.15
WORKDIR /app
RUN adduser -D -u 1000 appuser
USER appuser
COPY –from=builder /app/build /app/build
COPY –from=builder /app/node_modules /app/node_modules
EXPOSE 3000
CMD [“npm”, “start”]