10 . Docker 中的 DockerFile 解析(各种指令说明)
10 . Docker 中的 DockerFile 解析(各种指令说明)
文章目录
- 10 . Docker 中的 DockerFile 解析(各种指令说明)
- 1. DockerFile 构建过程解析
- 2. DockerFile 常用保留字指令
- 3. 案例：
- 4. 虚悬镜像
- 5. 最后：
Docker file 是用来构建 Docker 镜像的文本文件，是由一条条构建镜像所需的指令和参数构成的脚本。
官方地址：https://docs.docker.com/engine/reference/builder/
1. DockerFile 构建过程解析
Docker file 内容基础知识
- 每条保留字指令都必须为大写字母 且后面要跟随至少一个参数。
- 指令按照从上到下，顺序执行。
#表示注释- 每条指令都会创建一个新的镜像层并对镜像进行提交。
Docker执行 Dockerfile的大致流程
- docker 从基础镜像运行一个容器
- 执行一条指令并对容器作出修改
- 执行类似 docker commit 的操作提交一个新的镜像层。
- docker 再基于刚提交的镜像运行一个新容器
- 执行 dockerfile 中的下一条指令直到所有指令都执行完成。
从应用软件的角度来看，Dockerfile、Docker镜像与Docker容器分别代表软件的三个不同阶段，
-
Dockerfile是软件的原材料
-
Docker镜像是软件的交付品
-
Docker容器则可以认为是软件镜像的运行态，也即依照镜像运行的容器实例
Dockerfile面向开发，Docker镜像成为交付标准，Docker容器则涉及部署与运维，三者缺一不可，合力充当Docker体系的基石。
- Dockerfile，需要定义一个Dockerfile，Dockerfile定义了进程需要的一切东西。Dockerfile涉及的内容包括执行代码或者是文件、环境变量、依赖包、运行时环境、动态链接库、操作系统的发行版、服务进程和内核进程(当应用进程需要和系统服务和内核进程打交道，这时需要考虑如何设计namespace的权限控制)等等;
- Docker镜像，在用 Dockerfile 定义一个文件之后，docker build 时会产生一个Docker镜像，当运行 Docker镜像时会真正开始提供服务;
2. DockerFile 常用保留字指令
参考 tomcat8 的dockerfile入门：https://github.com/docker-library/tomcat/blob/master/Dockerfile.template
{{
include "from"
;
include "shared"
-}}
FROM {{ from }}
ENV CATALINA_HOME /usr/local/tomcat
ENV PATH $CATALINA_HOME/bin:$PATH
RUN mkdir -p "$CATALINA_HOME"
WORKDIR $CATALINA_HOME
# let "Tomcat Native" live somewhere isolated
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR
ENV TOMCAT_MAJOR {{ major }}
ENV TOMCAT_VERSION {{ .version }}
ENV TOMCAT_SHA512 {{ .sha512 }}
{{ if java_variant == "jdk" then ( -}}
RUN set -eux; \
\
{{ if is_apt then ( -}}
savedAptMark="$(apt-mark showmanual)"; \
apt-get update; \
apt-get install -y --no-install-recommends \
ca-certificates \
curl \
gnupg \
; \
{{ ) else ( -}}
# http://yum.baseurl.org/wiki/YumDB.html
if ! command -v yumdb > /dev/null; then \
yum install -y --setopt=skip_missing_names_on_install=False yum-utils; \
yumdb set reason dep yum-utils; \
fi; \
# a helper function to "yum install" things, but only if they aren't installed (and to set their "reason" to "dep" so "yum autoremove" can purge them for us)
_yum_install_temporary() { ( set -eu +x; \
local pkg todo=''; \
for pkg; do \
if ! rpm --query "$pkg" > /dev/null 2>&1; then \
todo="$todo $pkg"; \
fi; \
done; \
if [ -n "$todo" ]; then \
set -x; \
yum install -y --setopt=skip_missing_names_on_install=False $todo; \
yumdb set reason dep $todo; \
fi; \
) }; \
_yum_install_temporary gzip tar; \
{{ ) end -}}
\
ddist() { \
local f="$1"; shift; \
local distFile="$1"; shift; \
local mvnFile="${1:-}"; \
local success=; \
local distUrl=; \
for distUrl in \
# https://apache.org/history/mirror-history.html
"https://dlcdn.apache.org/$distFile" \
# if the version is outdated, we have to pull from the archive
"https://archive.apache.org/dist/$distFile" \
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
; do \
if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
success=1; \
break; \
fi; \
done; \
[ -n "$success" ]; \
}; \
\
ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
curl -fL -o upstream-KEYS {{ "https://www.apache.org/dist/tomcat/tomcat-\(major)/KEYS" | @sh }}; \
gpg --batch --import upstream-KEYS; \
# filter upstream KEYS file to *just* known/precomputed fingerprints
printf '' > filtered-KEYS; \
# see https://www.apache.org/dist/tomcat/tomcat-{{ major }}/KEYS
for key in \
{{
# docker run --rm buildpack-deps:bookworm-curl bash -c 'wget -qO- https://www.apache.org/dist/tomcat/tomcat-11/KEYS | gpg --batch --import &> /dev/null && gpg --batch --list-keys --with-fingerprint --with-colons' | awk -F: '$1 == "pub" && $2 == "-" { pub = 1 } pub && $1 == "fpr" { fpr = $10 } $1 == "sub" { pub = 0 } pub && fpr && $1 == "uid" && $2 == "-" { print "\t\t\t#", $10; print "\t\t\t\"" fpr "\","; pub = 0 } END { print "\t\t\t# trailing comma 👀\n\t\t\tempty" }'
{
"11": [
# Mark E D Thomas <markt@apache.org>
"A9C5DF4D22E99998D9875A5110C01C5A2F6059E7",
# Remy Maucherat <remm@apache.org>
"48F8E69F6390C9F25CFEDCD268248959359E722B",
# trailing comma 👀
empty
],
"10": [
# Mark E D Thomas <markt@apache.org>
"A9C5DF4D22E99998D9875A5110C01C5A2F6059E7",
# Christopher Schultz <chris@christopherschultz.net>
"5C3C5F3E314C866292F359A8F3AD5C94A67F707E",
# trailing comma 👀
empty
],
"9": [
# Mark E D Thomas <markt@apache.org>
"DCFD35E0BF8CA7344752DE8B6FB21E8933C60243",
# Mark E D Thomas <markt@apache.org>
"A9C5DF4D22E99998D9875A5110C01C5A2F6059E7",
# Remy Maucherat <remm@apache.org>
"48F8E69F6390C9F25CFEDCD268248959359E722B",
# trailing comma 👀
empty
],
} | .[major] // error("missing GPG keys")
| map(
-}}
{{ @sh }} \
{{ ) | add -}}
; do \
gpg --batch --fingerprint "$key"; \
gpg --batch --export --armor "$key" >> filtered-KEYS; \
done; \
{{ if vendor_variant | contains("al2") then "" else ( -}}
gpgconf --kill all; \
{{ ) end -}}
rm -rf "$GNUPGHOME"; \
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
gpg --batch --import filtered-KEYS; \
gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
tar -xf tomcat.tar.gz --strip-components=1; \
rm bin/*.bat; \
rm tomcat.tar.gz*; \
{{ if vendor_variant | contains("al2") then "" else ( -}}
gpgconf --kill all; \
{{ ) end -}}
rm -rf "$GNUPGHOME"; \
\
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
mv webapps webapps.dist; \
mkdir webapps; \
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
\
nativeBuildDir="$(mktemp -d)"; \
tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
{{ if is_apt then ( -}}
apt-get install -y --no-install-recommends \
dpkg-dev \
gcc \
libapr1-dev \
libssl-dev \
make \
; \
{{ ) else ( -}}
_yum_install_temporary \
apr-devel \
gcc \
make \
openssl11-devel \
; \
{{ ) end -}}
( \
export CATALINA_HOME="$PWD"; \
cd "$nativeBuildDir/native"; \
{{ if is_apt then ( -}}
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
{{ ) else "" end -}}
aprConfig="$(command -v apr-1-config)"; \
./configure \
{{ if is_apt then ( -}}
--build="$gnuArch" \
{{ ) else "" end -}}
--libdir="$TOMCAT_NATIVE_LIBDIR" \
--prefix="$CATALINA_HOME" \
--with-apr="$aprConfig" \
--with-java-home="$JAVA_HOME" \
{{ if is_native_ge_2 then "" else ( -}}
--with-ssl \
{{ ) end -}}
; \
nproc="$(nproc)"; \
make -j "$nproc"; \
make install; \
); \
rm -rf "$nativeBuildDir"; \
rm bin/tomcat-native.tar.gz; \
\
{{ if is_apt then ( -}}
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
apt-mark auto '.*' > /dev/null; \
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
| awk '/=>/ { print $(NF-1) }' \
| xargs -rt readlink -e \
| sort -u \
| xargs -rt dpkg-query --search \
| cut -d: -f1 \
| sort -u \
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
| xargs -r apt-mark manual \
; \
\
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
rm -rf /var/lib/apt/lists/*; \
{{ ) else ( -}}
# mark any explicit dependencies as manually installed
find "$TOMCAT_NATIVE_LIBDIR" -type f -executable -exec ldd '{}' ';' \
| awk '/=>/ && $(NF-1) != "=>" { print $(NF-1) }' \
| xargs -rt readlink -e \
| sort -u \
| xargs -rt rpm --query --whatprovides \
| sort -u \
| tee "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt" \
| xargs -r yumdb set reason user \
; \
\
# clean up anything added temporarily and not later marked as necessary
yum autoremove -y; \
yum clean all; \
rm -rf /var/cache/yum; \
{{ ) end -}}
\
# sh removes env vars it doesn't support (ones with periods)
# https://github.com/docker-library/tomcat/issues/77
find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
\
# fix permissions (especially for running as non-root)
# https://github.com/docker-library/tomcat/issues/35
chmod -R +rX .; \
chmod 1777 logs temp work; \
\
# smoke test
catalina.sh version
{{ ) else ( -}}
COPY --from=tomcat:{{ .version }}-jdk{{ java_version }}-{{ vendor_variant }} $CATALINA_HOME $CATALINA_HOME
RUN set -eux; \
{{ if is_apt then ( -}}
apt-get update; \
xargs -rt apt-get install -y --no-install-recommends < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
rm -rf /var/lib/apt/lists/*
{{ ) else ( -}}
xargs -rt yum install -y --setopt=skip_missing_names_on_install=False < "$TOMCAT_NATIVE_LIBDIR/.dependencies.txt"; \
yum clean all; \
rm -rf /var/cache/yum
{{ ) end -}}
{{ ) end -}}
# verify Tomcat Native is working properly
RUN set -eux; \
nativeLines="$(catalina.sh configtest 2>&1)"; \
nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
nativeLines="$(echo "$nativeLines" | sort -u)"; \
if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
echo >&2 "$nativeLines"; \
exit 1; \
fi
EXPOSE 8080
{{ if vendor_variant | contains("temurin") then ( -}}
# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
ENTRYPOINT []
{{ ) else "" end -}}
CMD ["catalina.sh", "run"]
ENV MY_PATH /usr/mytest
这个环境变量可以在后续的任何RUN指令中使用，这就如同在命令前面指定了环境变量前缀一样；
也可以在其它指令中直接使用这些环境变量，比如：WORKDIR $MY_PATH
3. 案例：
- 要求：
Centos7镜像具备vim+ifconfig+jdk8
JDK的下载镜像地址：https://www.oracle.com/java/technologies/downloads/#java8
没有找到的话，这个地址也可以下载https://mirrors.yangxingzhen.com/jdk/
- 编写：
准备编写Dockerfile文件 ，注意：关键字大写，同时注意，该文件名必须是：Dockerfile ，首字母大写的 D。
FROM centos
MAINTAINER zzyy<zzyybs@126.com>
ENV MYPATH /usr/local
WORKDIR $MYPATH
#安装vim编辑器
RUN yum -y install vim
#安装ifconfig命令查看网络IP
RUN yum -y install net-tools
#安装java8及lib库
RUN yum -y install glibc.i686
RUN mkdir /usr/local/java
#ADD 是相对路径jar,把jdk-8u171-linux-x64.tar.gz添加到容器中,安装包必须要和Dockerfile文件在同一位置
ADD jdk-8u171-linux-x64.tar.gz /usr/local/java/
#配置java环境变量
ENV JAVA_HOME /usr/local/java/jdk1.8.0_171
ENV JRE_HOME $JAVA_HOME/jre
ENV CLASSPATH $JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:$JRE_HOME/lib:$CLASSPATH
ENV PATH $JAVA_HOME/bin:$PATH
EXPOSE 80
CMD echo $MYPATH
CMD echo "success--------------ok"
CMD /bin/bash
- 构建：
docker build -t 新镜像名字:TAG .
`.` 注意，最后面是有一个 “空格 .”的，不可以漏了。
docker build -t centosjava8:1.5 .
注意，上面TAG后面有个空格，有个点
- 运行：
docker run -it 新镜像名字:TAG
docker run -it centosjava8:1.5 /bin/bash
再体会下UnionFS（联合文件系统）:
4. 虚悬镜像
虚悬镜像是什么 ？
**是，仓库名、标签都是的镜像，俗称dangling ** 。
演示：
Dockerfile写一个
vim Dockerfilefrom ubuntu CMD echo 'action is success'docker build .
- 查看：
docker image ls -f dangling=true
- 删除：
docker image prune虚悬镜像已经失去存在价值，可以删除
5. 最后：
“在这个最后的篇章中，我要表达我对每一位读者的感激之情。你们的关注和回复是我创作的动力源泉，我从你们身上吸取了无尽的灵感与勇气。我会将你们的鼓励留在心底，继续在其他的领域奋斗。感谢你们，我们总会在某个时刻再次相遇。”
