Dockerfile 详解

docker build -t my_app:1.0 .
#                       │
#                       └── 构建上下文（build context）—— 这个目录下的所有文件会被发送到 Docker Daemon

# .dockerignore
node_modules
.git
*.log
.env
dist
.cache

FROM nginx:1.25

# 多阶段构建中可以有多个 FROM
FROM golang:1.21 AS builder

# 从上一阶段拷贝
FROM alpine:3.18
COPY --from=builder /app/binary /app/binary

WORKDIR /app
# 后面的 RUN / COPY / CMD 都在 /app 下执行
# 如果目录不存在会自动创建

# COPY：从构建上下文复制文件（推荐）
COPY ./src /app/src
COPY --chown=1000:1000 ./config /app/config   # 同时指定所有者

# ADD：除了 COPY 的功能外，还能自动解压 tar 和支持 URL
ADD archive.tar.gz /app/       # 自动解压
ADD https://example.com/file /app/   # 从 URL 下载（不推荐——缺乏缓存控制）

# Shell 形式（默认 /bin/sh -c）
RUN apt-get update && apt-get install -y curl

# Exec 形式
RUN ["apt-get", "update"]
RUN ["apt-get", "install", "-y", "curl"]

# ✅ 好的写法
RUN apt-get update && \
    apt-get install -y --no-install-recommends curl ca-certificates && \
    rm -rf /var/lib/apt/lists/*

ENV APP_HOME=/app \
    APP_PORT=8080 \
    NODE_ENV=production

# 在后续 RUN 中可以使用
RUN echo $APP_HOME

# 声明构建参数
ARG VERSION=1.0

# 在构建时传入
# docker build --build-arg VERSION=2.0 -t app:2.0 .

FROM node:18
ARG NODE_ENV=production
RUN echo "Building for $NODE_ENV"

# Exec 形式（推荐）
CMD ["nginx", "-g", "daemon off;"]

# Shell 形式（会包裹在 /bin/sh -c 中执行）
CMD nginx -g 'daemon off;'

# 作为 ENTRYPOINT 的默认参数
CMD ["--help"]

# Exec 形式（推荐）
ENTRYPOINT ["python3", "main.py"]

# Shell 形式
ENTRYPOINT python3 main.py

# 组合使用示例
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["nginx", "-g", "daemon off;"]

# docker run my_image              → docker-entrypoint.sh nginx -g 'daemon off;'
# docker run my_image postgres     → docker-entrypoint.sh postgres

EXPOSE 8080
EXPOSE 8080/udp
EXPOSE 80/tcp

# 多个端口
EXPOSE 80 443 8080

VOLUME /var/lib/mysql
VOLUME ["/var/log", "/var/lib/mysql"]

# 先创建用户
RUN groupadd -r appuser && useradd -r -g appuser appuser

# 切换到非 root 用户
USER appuser

# 也可以使用 UID:GID
USER 1000:1000

# 检查方式
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
  CMD curl -f http://localhost:8080/health || exit 1

# 检查 MySQL
HEALTHCHECK CMD mysqladmin ping -h localhost || exit 1

# 禁用基础镜像的健康检查
HEALTHCHECK NONE

# Windows 容器
SHELL ["powershell", "-Command"]

# 默认（Linux）
SHELL ["/bin/sh", "-c"]

# 其他 Shell
SHELL ["/bin/bash", "-c"]

LABEL maintainer="user@example.com"
LABEL version="1.0"
LABEL description="My application"

# 一行多标签（减少层数）
LABEL org.opencontainers.image.authors="user@example.com" \
      org.opencontainers.image.version="1.0"

# ======= 第一阶段：编译 =======
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /app/server .

# ======= 第二阶段：运行 =======
FROM alpine:3.18
RUN apk add --no-cache ca-certificates tzdata
COPY --from=builder /app/server /app/server
COPY --from=builder /app/config.yaml /app/config.yaml
USER 1000:1000
EXPOSE 8080
ENTRYPOINT ["/app/server"]

# 缓存 Go 模块下载
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download

# 缓存 apt 包
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y gcc

# 挂载密钥（不留在镜像中）
RUN --mount=type=secret,id=mysecret \
    cat /run/secrets/mysecret

# 启用 BuildKit
DOCKER_BUILDKIT=1 docker build -t my_app .
# 使用密钥文件
docker build --secret id=mysecret,src=./secret.txt -t my_app .

# 指定外部缓存源
docker build --cache-from=my_app:latest -t my_app:1.0 .

# 缓存写入外部（如 registry）
docker build --cache-to=type=registry,ref=myregistry.com/cache:latest .

FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o server .

FROM alpine:3.18
RUN apk add --no-cache ca-certificates
COPY --from=builder /app/server /server
USER 1000
EXPOSE 8080
HEALTHCHECK --interval=30s CMD wget -qO- http://localhost:8080/health || exit 1
ENTRYPOINT ["/server"]

FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .

FROM node:18-alpine
RUN apk add --no-cache tini
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/package.json .
USER node
EXPOSE 3000
ENTRYPOINT ["tini", "--"]
CMD ["node", "dist/main.js"]

FROM python:3.11-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --user --no-cache-dir -r requirements.txt

FROM python:3.11-slim
COPY --from=builder /root/.local /root/.local
WORKDIR /app
COPY . .
ENV PATH=/root/.local/bin:$PATH
USER 1000
ENTRYPOINT ["python", "main.py"]