Ginin Docker ba ya isa ga wata dogaro ta sirri: duba wannan

Fakiti na sirri da ke warwarewa lafiya a na’urarka zai iya kasawa a cikin ginin da 404 ko da ƙarewar lokaci, kuma ba safai Dockerfile ke zama dalili ba. Matakin ginin yana gudana a wani fili na cibiyar sadarwa daban, da wani kallo na DNS da wani ajiyar shaida daban fiye da harsashin da ka gwada a ciki. Bi waɗannan binciken a jere ka tsaya a farkon wanda ya kasa, domin kowane bincike na gaba yana ɗauka cewa na baya ya wuce. Kowane mataki yana ambaton umarnin da zai warware batun.

Fara da ambaton maginin, ba Dockerfile ba

BuildKit na iya zama na gida, cikin kwano ko a wata na’ura, kuma kowanne yana da nasa cibiyar sadarwar da aka saba. Gudanar da docker buildx ls ka karanta kumburin da aka yi masa alamar tauraro kafin ka canza komai. Wani docker-container direba ko maginin girgije ba ya raba hanyar sirri a kan kwamfutar tafi-da-gidanka kawai saboda ka buga umarnin a can. Idan maginin da ke aiki yana nesa, kowane sauran bincike dole ya gudana a kan wannan mai masaukin, ba a kan tashar aikinka ba.

Maginin kuma yana ɗauke da nasa tsarin mai warwarewa da masu canjin proxy. Dukan biyu ana karanta su a lokacin gini kuma ba a gado su daga tashar da ta fara ginin ba.

Tabbatar da hanyar cibiyar sadarwa daga cikin matakin gini

Rubuta wani mataki na wucin gadi wanda zai warware mai masaukin dogaron kuma ya buɗe haɗi zuwa gare shi. Wannan shi ne gwaji ɗaya tilo da ke amsa tambayar ga maginin maimakon ga harsashinka.

FROM alpine:3.20
RUN apk add --no-cache curl bind-tools  && getent hosts registry.example.internal  && curl -sS -o /dev/null -w "%{http_code}
" https://registry.example.internal/simple/

Gina wannan fayil ɗin da wannan maginin, yanayin cibiyar sadarwa da kuma yadda ake ɗora sirri irin na ainihin gininka: docker buildx build --builder remote0 -f Dockerfile.probe --progress=plain .. Idan getent bai buga komai ba, matsalar tana cikin warware suna kuma babu wata shaida da za ta gyara shi. Idan sunan ya warware amma curl ya ba da labarin ƙarewar lokaci, shamakin shi ne hanya ko manufar fita da ke gaban rijista.

Share mai binciken da zarar ya amsa. Matakin bincike ne kuma bai kamata a taɓa yi masa tag ko turawa ba.

Ɗora shaidar maimakon kwafa ta

Da zarar hanyar ta yi aiki, tabbatarwa ita ce kasawa ta gaba a jere. Ɗora sirrin BuildKit yana buɗe fayil ga mataki RUN ɗaya ba tare da rubuta shi cikin wani Layer ba, wanda shi ne abin da kayan aikin dogaro ke buƙata kuma abin da hoton bai kamata ya riƙe ba.

RUN --mount=type=secret,id=npmrc,target=/root/.npmrc     npm ci --omit=dev

Dole a kawo sirrin daga wajen Dockerfile: docker buildx build --secret id=npmrc,src=/home/me/.npmrc .. Fayil ɗin yana zama a wurin abokin ciniki kuma ba ya shiga tarihin hoton. Wani ARG ko ENV da wannan alama ba ya yin wannan aikin, domin dukan biyu ana rubuta su cikin tsarin hoton.

Hoton da ba shi da root yana buƙatar nasa hanyar manufa, kamar /home/app/.npmrc ko fayil ɗin da ya dace da pip, Maven ko Cargo. Makasudin ɗorawa dole ya dace da mai amfani da ke gudanar da umarnin, in ba haka ba kayan aikin zai ba da labarin wani fayil ɗin tsari da ya ɓace wanda a zahiri yana nan.

Bincika abin da kayan aikin dogaro ke bari cikin hoton

Ɗorawa na wucin gadi yana ajiye shaidar a wajen Layer, amma ba ya hana kayan aikin rubuta wani abu. Masu kula da fakiti suna barin fayilolin lock, manyan fayilolin cache da wani lokacin adireshin rijista da aka warware.

Karanta tsarin fayil ɗin da ya ƙare maimakon amincewa da Dockerfile. docker history --no-trunc image:tag yana lissafa kowane umarnin Layer, kuma docker run --rm image:tag sh -c "ls -a /root" yana nuna abin da ya tsira cikin kwanon da ke gudana. Ko da an ɗora fayil ɗin ne kawai, alamar da aka rubuta a layin log npm ci lokacin gudanar da ita har yanzu ɓarna ce.

Karanta log ɗin ginin kuma, domin --progress=plain yana buga fitar da umarni daidai. Idan alamar ta bayyana a can, juya ta kafin komai kuma ka wuce ta cikin fayil ɗin da kayan aikin ke karantawa a hankali.

Tabbatar cewa hoton aiki bai ƙara buƙatar hanyar sirri ba

Ginin da aikace-aikacen da ke gudana masu amfani biyu ne daban-daban na wannan dogaro, kuma na farko ne kawai ke buƙatar hanyar sirri. Hoton da ya ƙare ya kamata ya fara, ya warware dogaron aikinsa kuma ya ba da zirga-zirga ba tare da shaidar ginin ba.

Gwada shi inda ba za a iya isa ga rijistar sirri ba, ko kawai fara kwanon da --network none ka tabbatar yana tashi ba tare da ɗorarren sirrin ba. Kwanon da ke farawa ne kawai idan sirrin ginin yana nan har yanzu yana da alaƙa da yanayin ginin.

Idan kwanon yana buƙatar rijistar a lokacin aiki da gaske, wannan wata shawara ce ta damar daban, kuma tana cikin ajiyar sirrin mai tsara ayyuka ba cikin ginin ba. Rubuta hanyoyin biyu daban domin kada wani ya yi ƙoƙarin gyara jan aiki da tutar gini. Idan dukan binciken biyar sun wuce, alamun asalin yana da dalilin da aka ambata a kowane mataki maimakon zato game da cibiyar sadarwar Docker.