1
# 基础镜像声明
2
FROM node:20-alpine
3

4
# 维护者信息
5
LABEL maintainer="dev@example.com"
6

7
# 环境变量设置
8
ENV NODE_ENV=production APP_PORT=3000
9

10
# 工作目录设置
11
WORKDIR /app
12

13
# 文件复制
14
COPY package*.json ./
15

16
# 依赖安装
17
RUN npm ci --only=production
18

19
# 源代码复制
20
COPY . .
21

22
# 端口暴露
23
EXPOSE 3000
24

25
# 容器启动命令
26
CMD ["node", "app.js"]

1
# 基本格式
2
FROM <image>[:<tag>]
3

4
# 带平台指定
5
FROM --platform=<platform> <image>[:<tag>]
6

7
# 多阶段构建命名
8
FROM <image>[:<tag>] AS <name>

1
# 使用官方Node.js 20 LTS镜像作为基础
2
FROM node:20-alpine
3

4
# 多阶段构建中命名阶段
5
FROM node:20-alpine AS builder
6

7
# 跨平台构建
8
FROM --platform=linux/amd64 nginx:alpine

1
# 单行多个标签
2
LABEL maintainer="your-email@example.com" \
3
      version="1.0.0" \
4
      description="This is a sample Node.js application" \
5
      org.opencontainers.image.source="https://github.com/user/repo"
6

7
# 使用反向DNS命名避免冲突
8
LABEL com.example.project="myapp" \
9
      com.example.team="backend" \
10
      com.example.build-date="2024-11-29"

1
# 定义构建参数
2
ARG NODE_VERSION=20
3
ARG ALPINE_VERSION=3.19
4

5
# 在FROM指令中使用
6
FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION}
7

8
ARG BUILD_ENV=production
9
ARG BUILD_DATE
10
ARG GIT_COMMIT
11

12
# 转换为环境变量
13
ENV BUILD_ENV=${BUILD_ENV} \
14
    BUILD_DATE=${BUILD_DATE} \
15
    GIT_COMMIT=${GIT_COMMIT}
16

17
RUN echo "Building for ${BUILD_ENV} environment"

1
# 单个变量（传统格式）
2
ENV NODE_ENV production
3

4
# 多个变量（推荐格式）
5
ENV APP_PORT=3000 \
6
    APP_HOME=/app \
7
    DB_HOST=localhost \
8
    DB_PORT=5432 \
9
    LOG_LEVEL=info
10

11
# 引用其他环境变量
12
ENV PATH="/app/bin:${PATH}"

1
# 设置绝对路径工作目录
2
WORKDIR /app
3

4
# 复制文件到当前工作目录
5
COPY package.json .
6

7
# 使用相对路径（相对于上一个WORKDIR）
8
WORKDIR src
9
# 现在工作目录是/app/src
10

11
COPY . .
12

13
# 再次切换到父目录
14
WORKDIR ..
15
# 现在工作目录回到/app

1
# 复制单个文件
2
COPY package.json .
3

4
# 复制多个文件
5
COPY package.json package-lock.json ./
6

7
# 复制整个目录
8
COPY src ./src
9

10
# 复制并设置文件所有者
11
COPY --chown=node:node . .
12

13
# 复制时排除特定文件（通过.dockerignore）
14
COPY . .

1
# 版本控制
2
.git
3
.gitignore
4
.github
5

6
# 依赖目录
7
node_modules
8
bower_components
9

10
# 构建输出
11
dist
12
build
13
*.log
14

15
# IDE配置
16
.vscode
17
.idea
18
*.swp
19

20
# 测试文件
21
test
22
tests
23
**/*.test.js
24
coverage
25

26
# 文档和说明
27
README.md
28
CHANGELOG.md
29
docs
30

31
# 环境配置
32
.env
33
.env.local
34
docker-compose.yml
35
Dockerfile

1
# 复制并自动解压tar文件
2
ADD app.tar.gz /app
3

4
# 复制远程文件（不推荐）
5
ADD https://example.com/file.txt /app/
6

7
# 普通文件复制（推荐用COPY）
8
ADD config.json /app/

1
# shell形式（推荐用于复杂命令）
2
RUN apt-get update && apt-get install -y \
3
    git \
4
    curl \
5
    vim \
6
    && rm -rf /var/lib/apt/lists/*
7

8
# exec形式（推荐用于简单命令）
9
RUN ["npm", "install", "--production"]
10
RUN ["/bin/bash", "-c", "echo hello"]
11

12
# 多行命令优化示例
13
RUN set -ex && \
14
    apt-get update && \
15
    apt-get install -y --no-install-recommends \
16
        ca-certificates \
17
        wget && \
18
    wget -O /usr/local/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v1.2.5/dumb-init_1.2.5_amd64 && \
19
    chmod +x /usr/local/bin/dumb-init && \
20
    apt-get purge -y --auto-remove wget && \
21
    rm -rf /var/lib/apt/lists/*

1
# 定义单个挂载点
2
VOLUME /data
3

4
# 定义多个挂载点
5
VOLUME ["/var/log", "/var/db"]
6

7
# 使用JSON数组格式
8
VOLUME ["/app/uploads", "/app/cache"]

1
# 暴露TCP端口（默认）
2
EXPOSE 3000
3

4
# 暴露UDP端口
5
EXPOSE 53/udp
6

7
# 同时暴露TCP和UDP端口
8
EXPOSE 80/tcp 80/udp
9

10
# 暴露多个端口
11
EXPOSE 8080 8443 9090

1
# exec形式（推荐）
2
CMD ["npm", "start"]
3

4
# shell形式
5
CMD npm start
6

7
# 作为ENTRYPOINT的默认参数
8
CMD ["--port", "3000"]

1
# exec形式（推荐）
2
ENTRYPOINT ["node", "app.js"]
3

4
# shell形式
5
ENTRYPOINT node app.js
6

7
# 与CMD组合使用
8
ENTRYPOINT ["node"]
9
CMD ["app.js"]

1
# 定义入口点和默认参数
2
ENTRYPOINT ["node"]
3
CMD ["app.js"]
4

5
# 运行时可以覆盖CMD
6
# docker run myapp server.js  -> 实际执行：node server.js
7
# docker run myapp            -> 实际执行：node app.js

1
# ============================================
2
# 阶段1：依赖安装
3
# ============================================
4
FROM node:20-alpine AS deps
5

6
WORKDIR /app
7

8
COPY package*.json ./
9
RUN npm ci --only=production
10

11
# ============================================
12
# 阶段2：构建阶段
13
# ============================================
14
FROM node:20-alpine AS builder
15

16
WORKDIR /app
17

18
COPY package*.json ./
19
RUN npm ci
20
COPY . .
21
RUN npm run build
22

23
# ============================================
24
# 阶段3：最终运行镜像
25
# ============================================
26
FROM node:20-alpine AS runner
27

28
WORKDIR /app
29

30
ENV NODE_ENV=production
31

32
# 从deps阶段复制生产依赖
33
COPY --from=deps /app/node_modules ./node_modules
34
# 从builder阶段复制构建产物
35
COPY --from=builder /app/dist ./dist
36
COPY --from=builder /app/package.json ./
37

38
RUN addgroup --system --gid 1001 nodejs && \
39
    adduser --system --uid 1001 nextjs
40

41
USER nextjs
42

43
EXPOSE 3000
44

45
CMD ["node", "dist/main.js"]

1
# ============================================
2
# 构建阶段
3
# ============================================
4
FROM golang:1.22-alpine AS builder
5

6
WORKDIR /app
7

8
COPY go.* ./
9
RUN go mod download
10

11
COPY . .
12

13
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo \
14
    -ldflags="-s -w" -o main .
15

16
# ============================================
17
# 最终阶段：使用scratch镜像
18
# ============================================
19
FROM scratch
20

21
# 从builder阶段复制二进制文件
22
COPY --from=builder /app/main /main
23

24
# 复制ca证书（用于HTTPS请求）
25
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
26

27
EXPOSE 8080
28

29
USER 1000:1000
30

31
ENTRYPOINT ["/main"]

1
FROM ubuntu:22.04
2

3
RUN apt-get update
4
RUN apt-get install -y nodejs npm
5
COPY . .
6
RUN npm install
7
CMD ["node", "app.js"]
8
# 镜像大小：约600MB

1
FROM node:20-alpine AS builder
2

3
WORKDIR /app
4

5
COPY package*.json ./
6
RUN npm ci --only=production
7

8
FROM node:20-alpine
9

10
WORKDIR /app
11
COPY --from=builder /app/node_modules ./node_modules
12
COPY . .
13

14
RUN addgroup -g 1001 -S nodejs && \
15
    adduser -S -u 1001 nodejs
16

17
USER nodejs
18
EXPOSE 3000
19
CMD ["node", "app.js"]
20
# 镜像大小：约150MB，减少75%

1
FROM alpine:3.19
2

3
# 合并安装命令，使用虚拟包管理构建依赖
4
RUN apk add --no-cache --virtual .build-deps \
5
        gcc musl-dev python3-dev && \
6
    apk add --no-cache python3 py3-pip && \
7
    apk del .build-deps
8

9
# 清理包管理器缓存
10
RUN rm -rf /var/cache/apk/*

1
FROM node:20-alpine
2
WORKDIR /app
3
COPY . .
4
RUN npm install
5
# 问题：每次源代码变化都会导致npm install重新执行

1
FROM node:20-alpine
2
WORKDIR /app
3
COPY package*.json ./
4
RUN npm ci --only=production
5
COPY . .
6
# 优势：只有依赖变化时才重新安装

1
FROM node:20-alpine
2

3
# 第一层：复制依赖定义文件
4
COPY package.json package-lock.json ./
5
RUN npm ci --only=production
6
# 缓存点1：依赖安装层
7

8
# 第二层：复制配置文件
9
COPY tsconfig.json ./
10
COPY .eslintrc.json ./
11
# 缓存点2：配置文件层
12

13
# 第三层：复制源代码
14
COPY src ./src
15
# 缓存点3：源代码层
16

17
RUN npm run build

1
FROM node:20-alpine
2

3
# 方案1：使用镜像自带的非root用户
4
RUN mkdir -p /app && chown -R node:node /app
5
WORKDIR /app
6
USER node
7

8
# 方案2：创建自定义用户
9
RUN addgroup -g 1001 -S appgroup && \
10
    adduser -S -u 1001 -G appgroup appuser
11
WORKDIR /app
12
RUN chown -R appuser:appgroup /app
13
USER appuser
14

15
# 方案3：使用数字UID（推荐用于Kubernetes）
16
RUN addgroup -g 1000 appgroup && \
17
    adduser -u 1000 -G appgroup -s /bin/sh -D appuser
18
USER 1000:1000

1
# ❌ 错误：直接写入敏感信息
2
ENV DATABASE_PASSWORD=supersecret
3

4
# ✅ 正确：使用ARG但不转ENV
5
ARG GITHUB_TOKEN
6
RUN git clone https://${GITHUB_TOKEN}@github.com/user/repo.git && \
7
    rm -rf .git
8
# ARG不会保留在最终镜像中
9

10
# ✅ 正确：使用BuildKit secrets
11
# docker build --secret id=npmrc,src=$HOME/.npmrc .
12
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
13
    npm install private-package

1
FROM node:20-alpine
2

3
WORKDIR /app
4

5
COPY package*.json ./
6
RUN npm ci --only=production
7

8
# 使用npm audit检查依赖漏洞
9
RUN npm audit --audit-level=moderate || \
10
    (npm audit fix && npm audit --audit-level=moderate)
11

12
COPY . .
13

14
USER node
15
CMD ["node", "app.js"]

1
# 使用特定版本镜像
2
FROM node:20.11.0-alpine3.19
3

4
# 安装安全更新
5
RUN apk update && \
6
    apk upgrade --no-cache
7

8
WORKDIR /app
9

10
# 最小权限原则
11
RUN addgroup -g 1001 -S nodejs && \
12
    adduser -S -u 1001 nextjs -G nodejs
13

14
COPY --chown=nextjs:nodejs package*.json ./
15

16
# 安装时检查漏洞
17
RUN npm ci --only=production && \
18
    npm audit --audit-level=high
19

20
COPY --chown=nextjs:nodejs . .
21

22
# 删除不必要的文件
23
RUN rm -rf .git .github docs tests *.md
24

25
# 设置只读权限
26
RUN chmod -R 555 /app && \
27
    chmod -R 777 /app/tmp
28

29
# 切换到非root用户
30
USER nextjs
31

32
EXPOSE 3000
33

34
# 使用dumb-init处理信号
35
ENTRYPOINT ["/usr/bin/dumb-init", "--"]
36
CMD ["node", "server.js"]

1
FROM node:20-alpine
2

3
# 开发环境添加调试工具
4
RUN if [ "$NODE_ENV" = "development" ]; then \
5
    apk add --no-cache \
6
        curl wget vim strace \
7
        && npm install -g nodemon; \
8
    fi
9

10
WORKDIR /app
11
COPY . .
12

13
# 开发环境使用nodemon热重载
14
CMD if [ "$NODE_ENV" = "development" ]; then \
15
        nodemon app.js; \
16
    else \
17
        node app.js; \
18
    fi

1
variables:
2
  DOCKER_DRIVER: overlay2
3
  IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
4

5
stages:
6
  - build
7
  - test
8
  - deploy
9

10
build:
11
  stage: build
12
  image: docker:latest
13
  services:
14
    - docker:dind
15
  before_script:
16
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
17
  script:
18
    - docker build
19
        --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
20
        --build-arg VCS_REF=$CI_COMMIT_SHA
21
        --cache-from $CI_REGISTRY_IMAGE:latest
22
        -t $IMAGE_TAG
23
        -t $CI_REGISTRY_IMAGE:latest
24
        .
25
    - docker push $IMAGE_TAG
26
    - docker push $CI_REGISTRY_IMAGE:latest
27

28
test:
29
  stage: test
30
  image: $IMAGE_TAG
31
  script:
32
    - npm test
33

34
security_scan:
35
  stage: test
36
  image: aquasec/trivy:latest
37
  script:
38
    - trivy image --severity HIGH,CRITICAL $IMAGE_TAG

1
name: Docker Build and Push
2

3
on:
4
  push:
5
    branches: [ main, develop ]
6
  pull_request:
7
    branches: [ main ]
8

9
env:
10
  REGISTRY: ghcr.io
11
  IMAGE_NAME: ${{ github.repository }}
12

13
jobs:
14
  build:
15
    runs-on: ubuntu-latest
16
    permissions:
17
      contents: read
18
      packages: write
19

20
    steps:
21
      - name: Checkout
22
        uses: actions/checkout@v4
23

24
      - name: Set up Docker Buildx
25
        uses: docker/setup-buildx-action@v3
26

27
      - name: Log in to Container Registry
28
        uses: docker/login-action@v3
29
        with:
30
          registry: ${{ env.REGISTRY }}
31
          username: ${{ github.actor }}
32
          password: ${{ secrets.GITHUB_TOKEN }}
33

34
      - name: Extract metadata
35
        id: meta
36
        uses: docker/metadata-action@v5
37
        with:
38
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
39
          tags: |
40
            type=ref,event=branch
41
            type=ref,event=pr
42
            type=semver,pattern={{version}}
43
            type=sha,prefix={{branch}}-
44

45
      - name: Build and push
46
        uses: docker/build-push-action@v5
47
        with:
48
          context: .
49
          push: true
50
          tags: ${{ steps.meta.outputs.tags }}
51
          labels: ${{ steps.meta.outputs.labels }}
52
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
53
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
54
          build-args: |
55
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
56
            VCS_REF=${{ github.sha }}

1
# syntax=docker/dockerfile:1
2
# ============================================
3
# 阶段1：依赖安装
4
# ============================================
5
FROM node:20-alpine AS deps
6

7
RUN apk add --no-cache libc6-compat
8

9
WORKDIR /app
10

11
# 利用pnpm提升安装速度
12
RUN npm install -g pnpm
13
COPY package.json pnpm-lock.yaml* ./
14

15
RUN --mount=type=cache,target=/root/.pnpm-store \
16
    pnpm install --frozen-lockfile --prod
17

18
# ============================================
19
# 阶段2：构建阶段
20
# ============================================
21
FROM node:20-alpine AS builder
22

23
WORKDIR /app
24

25
COPY --from=deps /app/node_modules ./node_modules
26
COPY . .
27

28
# 安装开发依赖并构建
29
RUN npm install -g pnpm && \
30
    pnpm install --frozen-lockfile && \
31
    pnpm build && \
32
    pnpm prune --prod
33

34
# ============================================
35
# 阶段3：最终运行镜像
36
# ============================================
37
FROM node:20-alpine AS runner
38

39
WORKDIR /app
40

41
ENV NODE_ENV=production \
42
    PORT=3000 \
43
    HOSTNAME="0.0.0.0"
44

45
# 创建非root用户
46
RUN addgroup --system --gid 1001 nodejs && \
47
    adduser --system --uid 1001 nextjs && \
48
    mkdir -p /app/.next && \
49
    chown -R nextjs:nodejs /app
50

51
# 从构建阶段复制文件
52
COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist
53
COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
54
COPY --from=builder --chown=nextjs:nodejs /app/package.json ./
55

56
USER nextjs
57

58
EXPOSE 3000
59

60
# 健康检查
61
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
62
  CMD node -e "require('http').get('http://localhost:3000/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"
63

64
CMD ["node", "dist/main.js"]

1
# ============================================
2
# 多阶段构建：Python FastAPI应用
3
# ============================================
4
FROM python:3.11-slim as builder
5

6
WORKDIR /app
7

8
# 安装构建依赖
9
RUN apt-get update && apt-get install -y --no-install-recommends \
10
    gcc \
11
    python3-dev \
12
    && rm -rf /var/lib/apt/lists/*
13

14
# 安装Python依赖到自定义目录
15
COPY requirements.txt .
16
RUN pip install --user --no-cache-dir -r requirements.txt
17

18
# ============================================
19
# 最终运行镜像
20
# ============================================
21
FROM python:3.11-slim
22

23
WORKDIR /app
24

25
# 设置Python环境变量
26
ENV PYTHONDONTWRITEBYTECODE=1 \
27
    PYTHONUNBUFFERED=1 \
28
    PATH=/root/.local/bin:$PATH
29

30
# 从builder复制已安装的包
31
COPY --from=builder /root/.local /root/.local
32

33
# 创建非root用户
34
RUN useradd -m -u 1000 appuser && \
35
    chown -R appuser:appuser /app
36

37
# 复制应用代码
38
COPY --chown=appuser:appuser . .
39

40
USER appuser
41

42
EXPOSE 8000
43

44
# 使用uvicorn运行
45
HEALTHCHECK CMD curl --fail http://localhost:8000/health || exit 1
46

47
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

1
# ============================================
2
# 构建阶段
3
# ============================================
4
FROM golang:1.22-alpine AS builder
5

6
# 安装构建依赖
7
RUN apk add --no-cache \
8
    ca-certificates \
9
    git \
10
    make \
11
    tzdata
12

13
WORKDIR /app
14

15
# 利用go mod缓存
16
COPY go.mod go.sum ./
17
RUN --mount=type=cache,target=/go/pkg/mod \
18
    go mod download && \
19
    go mod verify
20

21
COPY . .
22

23
# 编译二进制文件
24
RUN --mount=type=cache,target=/go/pkg/mod \
25
    --mount=type=cache,target=/root/.cache/go-build \
26
    CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
27
    go build -a -installsuffix cgo \
28
    -ldflags="-s -w -X main.version=$(git describe --tags --always) -X main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
29
    -o /app/server ./cmd/server
30

31
# ============================================
32
# 最终运行镜像
33
# ============================================
34
FROM scratch
35

36
# 从builder复制文件
37
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
38
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
39
COPY --from=builder /app/server /server
40

41
# 使用非root用户
42
USER 65534:65534
43

44
EXPOSE 8080
45

46
ENTRYPOINT ["/server"]

1
# ============================================
2
# 构建阶段：构建前端资源
3
# ============================================
4
FROM node:20-alpine AS builder
5

6
WORKDIR /app
7

8
COPY package*.json ./
9
RUN npm ci
10

11
COPY . .
12
RUN npm run build
13

14
# ============================================
15
# 最终运行镜像
16
# ============================================
17
FROM nginx:alpine
18

19
# 删除默认nginx配置
20
RUN rm /etc/nginx/conf.d/default.conf
21
# 复制自定义配置
22
COPY nginx.conf /etc/nginx/conf.d/
23

24
# 从builder复制构建产物
25
COPY --from=builder /app/dist /usr/share/nginx/html
26

27
# 创建非root用户运行nginx
28
RUN addgroup -g 101 -S nginx && \
29
    adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx && \
30
    chown -R nginx:nginx /usr/share/nginx/html && \
31
    chown -R nginx:nginx /var/cache/nginx && \
32
    chown -R nginx:nginx /var/log/nginx && \
33
    chmod -R 755 /usr/share/nginx/html
34

35
USER nginx
36

37
# 健康检查
38
HEALTHCHECK --interval=30s --timeout=3s CMD wget --quiet --tries=1 --spider http://localhost/ || exit 1
39

40
EXPOSE 80
41

42
CMD ["nginx", "-g", "daemon off;"]

1
server {
2
    listen 80;
3
    server_name _;
4

5
    root /usr/share/nginx/html;
6
    index index.html;
7

8
    # 开启gzip压缩
9
    gzip on;
10
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
11

12
    # SPA路由支持
13
    location / {
14
        try_files $uri $uri/ /index.html;
15
    }
16

17
    # 静态资源缓存
18
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
19
        expires 1y;
20
        add_header Cache-Control "public, immutable";
21
    }
22
}