docker镜像构建企业级示例

示例（在centos容器中源码编译nginx（单介构建））

• 单介构建：只有一个from指令

包准备

• 上传镜像centos-7.tar.gz

• 导入centos7镜像

[root@docker-node1 ~]# docker load -i centos-7.tar.gz

• 上传源码包nginx-1.26.1.tar.gz
• 将nginx源码包放到上下文路径下

[root@docker-node1 ~]# cp nginx-1.26.1.tar.gz docker/
[root@docker-node1 ~]# cd docker/
[root@docker-node1 docker]# ls
nginx-1.26.1.tar.gz

为centos容器提供网络源

• 宿主机光盘中的包作为容器的yum网络源

[root@docker-node1 ~]# yum install httpd -y

[root@docker-node1 ~]# vim /etc/httpd/conf/httpd.conf

添加企业7的ISO文件

[root@docker-node1 ~]# mkdir /var/www/html/rhel7[root@docker-node1 ~]# mount /dev/sr
sr0  sr1[root@docker-node1 ~]# mount /dev/sr1 /var/www/html/rhel7/

[root@docker-node1 ~]# systemctl restart httpd

[root@docker-node1 ~]# ifconfig

• 运行centos7镜像，容器名为centos

[root@docker-node1 ~]# docker run -d --name centos centos:7 sleep 10000

• 查看centos容器的详细信息

[root@docker-node1 ~]# docker inspect centos

• 我们发现宿主机和centos容器的网络是通的

[root@docker-node1 ~]# ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2) 56(84) 比特的数据。
64 比特，来自 172.17.0.2: icmp_seq=1 ttl=64 时间=0.341 毫秒
64 比特，来自 172.17.0.2: icmp_seq=2 ttl=64 时间=0.156 毫秒
64 比特，来自 172.17.0.2: icmp_seq=3 ttl=64 时间=0.070 毫秒

• 进入centos容器，添加yum源

[root@docker-node1 ~]# docker exec -it centos /bin/sh
sh-4.2# cd /etc/yum.repos.d/
sh-4.2# rm -rf *
sh-4.2# vi centos7.repo
[rhel7]
name=rhel7
baseurl=http://172.17.0.1:8080/rhel7/
gpgcheck=0
sh-4.2#     #ctrl+p+q退出不停止容器
[root@docker-node1 ~]#

提交为新的centos镜像

[root@docker-node1 ~]# docker commit -a "huazi" -m "add yum repo" centos centos:repo

[root@docker-node1 ~]# docker images centos:repo
REPOSITORY   TAG       IMAGE ID       CREATED              SIZE
centos       repo      c618983b610f   About a minute ago   204MB[root@docker-node1 ~]# docker history centos:repo
IMAGE          CREATED          CREATED BY                                       SIZE      COMMENT
c618983b610f   44 seconds ago   sleep 10000                                      72B       add yum repo
eeb6ee3f44bd   3 years ago      /bin/sh -c #(nop)  CMD ["/bin/bash"]             0B
<missing>      3 years ago      /bin/sh -c #(nop)  LABEL org.label-schema.sc…   0B
<missing>      3 years ago      /bin/sh -c #(nop) ADD file:b3ebbe8bd304723d4…   204MB

编写dockerfile文件

[root@docker-node1 ~]# cd docker
[root@docker-node1 docker]# vim dockerfile
FROM centos:repo
LABEL Mail=[e-mail]
ADD nginx-1.26.1.tar.gz /mnt
WORKDIR /mnt/nginx-1.26.1
RUN yum install gcc make pcre-devel openssl-devel -y
RUN ./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module
RUN make
RUN make install
EXPOSE 80 443
VOLUME ["/usr/local/nginx/html"]
CMD ["/usr/local/nginx/sbin/nginx","-g","daemon off"][root@docker-node1 docker]# ls
dockerfile  nginx-1.26.1.tar.gz

构建镜像

[root@docker-node1 docker]# docker build -t nginx:centos7 .

[root@docker-node1 docker]# docker history nginx:centos7
IMAGE          CREATED              CREATED BY                                       SIZE      COMMENT
939f29314f9a   About a minute ago   CMD ["/usr/local/nginx/sbin/nginx" "-g" "dae…   0B        buildkit.dockerfile.v0
<missing>      About a minute ago   VOLUME [/usr/local/nginx/html]                   0B        buildkit.dockerfile.v0
<missing>      About a minute ago   EXPOSE map[443/tcp:{} 80/tcp:{}]                 0B        buildkit.dockerfile.v0
<missing>      About a minute ago   RUN /bin/sh -c make install # buildkit           6.11MB    buildkit.dockerfile.v0
<missing>      About a minute ago   RUN /bin/sh -c make # buildkit                   20.6MB    buildkit.dockerfile.v0
<missing>      About a minute ago   RUN /bin/sh -c ./configure --prefix=/usr/loc…   78.9kB    buildkit.dockerfile.v0
<missing>      About a minute ago   RUN /bin/sh -c yum install gcc make pcre-dev…   118MB     buildkit.dockerfile.v0
<missing>      About a minute ago   WORKDIR /mnt/nginx-1.26.1                        0B        buildkit.dockerfile.v0
<missing>      About a minute ago   ADD nginx-1.26.1.tar.gz /mnt # buildkit          7.35MB    buildkit.dockerfile.v0
<missing>      About a minute ago   LABEL Mail=[e-mail]                       0B        buildkit.dockerfile.v0
<missing>      About a minute ago   /bin/sh                                          68B       add centos7.repo
<missing>      3 years ago          /bin/sh -c #(nop)  CMD ["/bin/bash"]             0B
<missing>      3 years ago          /bin/sh -c #(nop)  LABEL org.label-schema.sc…   0B
<missing>      3 years ago          /bin/sh -c #(nop) ADD file:b3ebbe8bd304723d4…   204MB

[root@docker-node1 docker]# docker images nginx:centos7
REPOSITORY   TAG       IMAGE ID       CREATED              SIZE
nginx        centos7   939f29314f9a   About a minute ago   356MB

• 我们发现构建出来的镜像大小为356MB

如何优化自己构建的镜像大小

• 因为一个指令为一层，所以我们可以减少层数，来优化镜像大小

[root@docker-node1 docker]# vim dockerfile
FROM centos:repo
LABEL Mail=[e-mail]
ADD nginx-1.26.1.tar.gz /mnt
WORKDIR /mnt/nginx-1.26.1
RUN yum install gcc make pcre-devel openssl-devel -y && ./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module && make && make install && rm -rf /mnt/nginx-1.26.1 && yum clean all
EXPOSE 80 443
VOLUME ["/usr/local/nginx/html"]
CMD ["/usr/local/nginx/sbin/nginx","-g","daemon off"]

[root@docker-node1 docker]# docker build -t nginx2:centos7 .

[root@docker-node1 docker]# docker images nginx2:centos7
REPOSITORY   TAG       IMAGE ID       CREATED          SIZE
nginx2       centos7   643164382b66   41 seconds ago   292MB

• 我们发现镜像大小变小了

多介构建

• 一个dockerfile中有多个from指令

FROM centos:repo AS build  #AS标记为build阶段
LABEL Mail=[e-mail]
ADD nginx-1.26.1.tar.gz /mnt
WORKDIR /mnt/nginx-1.26.1
RUN yum install gcc make pcre-devel openssl-devel -y && ./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module && make && make install && rm -rf /mnt/nginx-1.26.1 && yum clean allFROM centos:repo
LABEL mail=[e-mail]
COPY --from=build /usr/local/nginx  /usr/local/nginx  #将build阶段中的/usr/local/nginx复制到当前阶段中的/usr/local/nginx
EXPOSE 80 443
VOLUME ["/usr/local/nginx/html"]
CMD ["/usr/local/nginx/sbin/nginx","-g","daemon off"]

[root@docker-node1 docker]# docker build -t nginx3:centos7 .

[root@docker-node1 docker]# docker images nginx3:centos7
REPOSITORY   TAG       IMAGE ID       CREATED          SIZE
nginx3       centos7   27a5c3dd15c1   14 seconds ago   210MB

• 我们发现镜像大小变小了

ldd命令

当你对一个可执行文件或共享库使用ldd命令时，它会列出该文件所依赖的所有共享库，以及这些共享库在文件系统中的路径

基本用法

ldd <可执行文件或共享库>

示例

假设你有一个名为my_program的可执行文件，你可以使用以下命令来查看它的共享库依赖关系：

ldd my_program

输出可能类似于：

    linux-vdso.so.1 (0x00007fffdc9d7000)libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f8a6c61c000)libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f8a6c22b000)/lib64/ld-linux-x86-64.so.2 (0x00007f8a6c91b000)

这里，my_program依赖于libm.so.6（数学库）、libc.so.6（C标准库）和ld-linux-x86-64.so.2（动态链接器/加载器）

镜像优化方案

• 选择最精简的基础镜像
• 减少镜像的层数
• 清理镜像构建的中间产物