Ukukhiqiza kwe-Docker akufinyeleli incike yangasese: hlola lokhu

Iphakethe langasese elixazululwa ngaphandle kwenkinga kumshini wakho lingase lihluleke ngaphakathi kokukhiqiza nge-404 noma ngokuphela kwesikhathi, futhi i-Dockerfile ayivamisile ukuba yimbangela. Isinyathelo sokukhiqiza sisebenza endaweni yegama lenethiwekhi ehlukile, ngombono we-DNS ohlukile nesitoreji semininingwane yokuqinisekisa ehlukile kune-shell ohlole kuso. Dabulula lezi zihlolo ngokulandelana futhi ume kweyokuqala ehlulekayo, ngoba isihlolo ngasinye esilandelayo sicabanga ukuthi esedlule siphumelele. Isinyathelo ngasinye sisho umyalo onquma udaba.

Qala ngokusho i-builder, hhayi i-Dockerfile

I-BuildKit ingaba yasendaweni, kusekhonteyina noma kumshini omunye, futhi ngayinye inenethiwekhi yayo ezenzakalelayo. Gijimisa docker buildx ls futhi ufunde inodi emakwe ngenkanyezi ngaphambi kokushintsha noma yini. Eyodwa docker-container intshayelo noma i-builder yamafu ayihlanganyeli umzila wangasese kukhompyutha yakho yokuphathwa kuphela ngoba uthayiphe umyalo lapho. Uma i-builder esebenzayo ikude, zonke izihlolo ezisele kufanele ziqhutshwe kuleyo hosti, hhayi esiteshini sakho somsebenzi.

I-builder iphinda ithwale ukuhlelwa kwayo kwe-resolver nezinto eziguquguqukayo ze-proxyzayo. Kokubili kufundwa ngesikhathi sokukhiqiza futhi akuzuzwa njengefa kusuka kutheminali eyaqala ukukhiqiza.

Fakazela umzila wenethiwekhi ngaphakathi kwesinyathelo sokukhiqiza

Bhala isigaba sokusetshenziswa kanye esixazulula i-hosti yencike futhi sivule uxhumano kuyo. Lolu wukuphela kohlolo oluphendula umbuzo ku-builder, hhayi ku-shell yakho.

FROM alpine:3.20
RUN apk add --no-cache curl bind-tools  && getent hosts registry.example.internal  && curl -sS -o /dev/null -w "%{http_code}
" https://registry.example.internal/simple/

Akha lelo fayela nge-builder efanayo, imodi yenethiwekhi kanye nokufakwa kwama-secret afanayo okusetshenziswa ukukhiqiza kwakho kwangempela: docker buildx build --builder remote0 -f Dockerfile.probe --progress=plain .. Uma getent kungaphrinti lutho, iphutha lisekuxazululweni kwamagama futhi akukho mininingwane yokuqinisekisa engalilungisa. Uma igama lixazululwa kodwa i-curl ibika ukuphela kwesikhathi, isithiyo umzila noma inqubomgomo yokuphuma phambi kwerejista.

Susa isihloli ngokushesha lapho siphendula. Isigaba sokuxilonga futhi akufanele sisetshenziswe ithegi noma sisetshenziswe push.

Faka imininingwane yokuqinisekisa esikhundleni sokuyikopisha

Lapho umzila usebenza, ukuqinisekisa ukuthi ungubani ukwehluleka okulandelayo emgqeni. Ukufakwa kwe-secret ye-BuildKit kuveza ifayela esinyathelweni RUN esisodwa ngaphandle kokusibhala kusendlalelo, yilokho okudingwa yithuluzi lencike nokumele isithombe singakugcini.

RUN --mount=type=secret,id=npmrc,target=/root/.npmrc     npm ci --omit=dev

I-secret kufanele inikezwe ngaphandle kwe-Dockerfile: docker buildx build --secret id=npmrc,src=/home/me/.npmrc .. Ifayela lihlala kuklayenti futhi alingena emlandweni wesithombe. Eyodwa ARG noma ENV ene-thokheni efanayo ayiwufezekisi lo msebenzi, ngoba zombili zirekhodwa ekuhlelweni kwesithombe.

Isithombe esingeyona i-root sidinga indlela yaso yokuhlosiwe, isibonelo /home/app/.npmrc noma ifayela elilinganayo le-pip, i-Maven noma i-Cargo. Umkhawulo wokufaka kufanele uhambisane nomsebenzisi oqhuba umyalo, uma kungenjalo ithuluzi lizobika ifayela lokuhlela elingekho kodwa elikhona ngempela.

Hlola ukuthi ithuluzi lencike lishiya ini esithombeni

Ukufaka kwesikhashana kugcina imininingwane yokuqinisekisa ngaphandle kosendlalelo, kodwa akuvimbeli ithuluzi ekubhaleni okunye. Abaphathi bamaphakethe bashiya amafayela lock, izikhombisi ze-cache futhi ngezinye izikhathi ikheli lerejista elixazululiwe.

Funda uhlelo lwamafayela oluqediwe esikhundleni sokuthemba i-Dockerfile. docker history --no-trunc image:tag kubala umyalo ngamunye wosendlalelo, futhi docker run --rm image:tag sh -c "ls -a /root" kubonisa okwasinda kukhonteyina esebenzayo. Ngisho nalapho ifayela lafakwa kuphela, ithokheni ebhalwe emugqeni we-log npm ci ngesikhathi kuseyinto yokuvuza.

Funda futhi i-log yokukhiqiza, ngoba --progress=plain iphrinta umphumela wemiyalo ngokwezwi nezwi. Uma ithokheni ivela lapho, yishintshe ngaphambi kwanoma yini enye futhi uyidlulise ngefayela elifundwa yithuluzi buthule.

Qinisekisa ukuthi isithombe sesikhathi sokusebenza asisayidingi indlela yangasese

Ukukhiqiza kanye nohlelo olusebenzayo bangabasebenzisi ababili abehlukene bencike efanayo, futhi indlela yangasese iyadingeka kowokuqala kuphela. Isithombe esiqediwe kufanele siqale, sixazulule izincike zaso zesikhathi sokusebenza futhi sisebenzele ithrafikhi ngaphandle kwemininingwane yokuqinisekisa yokukhiqiza.

Yihlole lapho irejista yangasese ingafinyeleleki khona, noma qala nje ukhonteyina --network none futhi uqinisekise ukuthi uyaqala ngaphandle kwe-secret efakiwe. Ukhonteyina oqala kuphela lapho i-build secret ikhona usaxhumene nendawo yokukhiqiza.

Uma ukhonteyina udinga ngempela irejista ngesikhathi sokusebenza, leso isinqumo sokufinyelela esihlukile, futhi indawo yaso isitoreji sama-secret somhleli, hhayi ukukhiqiza. Bhala phansi izindlela ezimbili ngokwehlukana ukuze kungabi khona ozama ukulungisa ukudonsa kwesikhathi sokusebenza ngefulegi lokukhiqiza. Lapho zonke izihlolo ezinhlanu ziphuma, uphawu lokuqala lunembangela eshiwo esendlalelweni ngasinye, hhayi ukuqagela ngokunethiwekhi kwe-Docker.