Docker 容器化实战：从零到生产部署
容器化是现代 DevOps 的核心技能。本文从 Dockerfile 编写到 Docker Compose 编排，带你掌握容器化全流程。
1. Dockerfile 最佳实践
多阶段构建
# 构建阶段
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build
# 运行阶段
FROM node:18-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3000
CMD ["node", "dist/server.js"]
减小镜像体积的技巧
# 1. 使用 Alpine 基础镜像
FROM python:3.11-alpine
# 2. 合并 RUN 指令减少层数
RUN apk add --no-cache gcc musl-dev && \
pip install --no-cache-dir -r requirements.txt && \
apk del gcc musl-dev
# 3. 使用 .dockerignore
# .dockerignore 内容：
# .git
# node_modules
# *.md
# .env
2. Docker Compose 编排
Web 应用 + 数据库
version: '3.8'
services:
web:
build: .
ports:
- "3000:3000"
environment:
- DATABASE_URL=postgres://user:pass@db:5432/mydb
- REDIS_URL=redis://cache:6379
depends_on:
db:
condition: service_healthy
cache:
condition: service_started
restart: unless-stopped
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
interval: 30s
timeout: 10s
retries: 3
db:
image: postgres:15-alpine
volumes:
- pgdata:/var/lib/postgresql/data
environment:
- POSTGRES_DB=mydb
- POSTGRES_USER=user
- POSTGRES_PASSWORD=pass
healthcheck:
test: ["CMD-SHELL", "pg_isready -U user -d mydb"]
interval: 10s
timeout: 5s
retries: 5
cache:
image: redis:7-alpine
volumes:
- redisdata:/data
command: redis-server --appendonly yes --maxmemory 256mb
volumes:
pgdata:
redisdata:
3. 安全加固
非 root 用户运行
FROM node:18-alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
WORKDIR /app
COPY --chown=appuser:appgroup . .
USER appuser
CMD ["node", "server.js"]
镜像扫描
# 使用 Trivy 扫描镜像漏洞
trivy image myapp:latest
# 使用 Docker Scout
docker scout cves myapp:latest
4. 日志管理
# docker-compose.yml 中配置日志
services:
web:
logging:
driver: json-file
options:
max-size: "10m"
max-file: "3"
5. CI/CD 自动构建
# .github/workflows/docker.yml
name: Docker Build & Push
on:
push:
branches: [main]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: docker/setup-buildx-action@v3
- uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USER }}
password: ${{ secrets.DOCKER_PASS }}
- uses: docker/build-push-action@v5
with:
push: true
tags: myapp:latest
cache-from: type=gha
cache-to: type=gha,mode=max
总结
Docker 容器化的核心要点：
- 多阶段构建：减小镜像体积
- 非 root 运行：安全加固
- 健康检查：确保服务可用
- 日志管理：便于排查问题
- CI/CD 集成：自动化部署
掌握这些，你就能把应用从容开发到生产了！