Riba:
- Ikon fahimtar kwantena da ra'ayoyin Dockerfile, umarni na asali da dabaru na Layer, da samun bayanan sirri na samar da Dockerfile mai shirye-shiryen samarwa.
- Ability don rage girman girman hoto da haɓaka saurin turawa da tsaro tare da ginin matakai da yawa da ƙananan hoton tushe
- Ikon yin amfani da ka'idodin tsaro na rashin saka sirrin a cikin hoton, gudanar da shi tare da mai amfani mara izini maimakon tushen, da kuma duba hoton.
Jumlar "Yana gudana akan kwamfuta ta" ita ce jumla mafi tsada a tarihin software. Lambar guda ɗaya ta fashe akan wata uwar garken daban saboda nau'in laburare daban-daban. Fasahar kwantena tana magance ainihin wannan matsala: tana sanya aikace-aikacenku tare da duk abin da yake buƙatar gudanarwa - ɗakunan karatu, lokacin aiki, saituna - cikin fakitin ɗaukuwa guda ɗaya. Wannan kunshin yana aiki daidai iri ɗaya a ko'ina. Mafi yawan kayan aikin kwantena shine Docker.
Bayanin kwantena ana kiransa Dockerfile: fayil ɗin rubutu ne wanda ke yin bayani akan tsari daga wane tushe aikace-aikacenku zai fara, waɗanne fayiloli za a kwafi, da waɗanne umarni za su gudana. An samar da hoto daga wannan girke-girke; Lokacin da aka kunna hoton, ya zama akwati. AI ya kware sosai wajen rubuta Dockerfile kuma - mafi mahimmanci - ƙarawa da tsare shi. Amma aikin ku ne fahimtar abin da girke-girken da aka samar ke yi da kuma inda zai iya tona asirin.
Umarnin asali na Dockerfile
Don duba Dockerfile, ya kamata ku san ainihin umarnin:
- 'DAGA': Yana zaɓar hoton tushe (misali python: 3.12-slim). Wannan shi ne inda girma da tsaro na hoton suka fi fitowa daga.
- 'WORKDIR': Yana ƙayyade kundin adireshin aiki.
- `COPY` / `ADD`: Kwafi fayiloli zuwa hoton.
- `RUN`: Yana gudanar da umarni yayin ginawa (misali shigar da abin dogaro). Kowane RUN yana ƙirƙirar sabon Layer.
- `ENV`: Yana bayyana canjin yanayi.
- 'EXPOSE': Takaddun waɗanne tashar jiragen ruwa da kwantena ke sauraro.
- 'CMD' / 'ENTRYPOINT': Yana ƙayyade umarnin da zai gudana lokacin da akwati ya fara.
Mahimmin ra'ayi shine Layer: Docker yana adana kowane umarni azaman Layer. Idan kun sanya matakan canzawa akai-akai a ƙarshen, matakan da ba su canzawa za su fito daga cache kuma ginin zai yi sauri.
Tukwici: Manyan levers guda biyu don rage girman hoto sune: (1) zabar ƙaramin hoton tushe kamar siriri ko tsayi; (2) ta yin amfani da ginin matakai da yawa - watsi da kayan aikin gini a mataki ɗaya kuma kawai aika samfurin ƙarshe zuwa hoto na bakin ciki. AI na iya ƙwarewa wajen aiwatar da waɗannan biyun a duk lokacin da yake so.
Me yasa ƙaramin hoton yake da mahimmanci? Domin girman hoto ba batun faifai ba ne kawai. Babban hoto yana ɗaukar tsawon lokaci don cirewa tare da kowane turawa, yana ɗaukar ƙarin sarari a cikin wurin yin rajista, yana rage jinkirin fara sabbin Pods yayin da yake sikeli, kuma saboda ya ƙunshi ƙarin fakiti, yana ba da babban wurin kai hari — wato, buɗe sarari don maharan ya yi amfani da shi. Yin amfani da hoton 100 MB maimakon hoton 1 GB; Yana rage lokacin turawa, yana rage farashi kuma yana ƙara tsaro. Haɓaka Dockerfile yana samun waɗannan fa'idodi guda uku lokaci guda. Bayyana maƙasudin "ƙananan hoto na ƙarshe" a sarari yayin tambayar AI don ingantaccen Dockerfile; don haka, yana ba da fifikon raba lokacin tattarawa da watsar da fakitin da ba dole ba.
Mataki-mataki: Haɓaka da haɓaka Dockerfile tare da AI
- Bayyana aikace-aikacen. Harshe, sigar, umarnin shigarwa, tashar tashar da aka saurare.
- A sa a samar da daftarin farko. Nemi Dockerfile mai sauƙi mai aiki.
- Inganta shi. Tambayi AI iri ɗaya don gina matakai masu yawa, ƙaramin hoto na tushe da haɓaka oda na Layer.
- Duba tsaro. Asirin yana kunshe, yana gudana azaman tushen, shin akwai wasu kayan aikin da ba dole ba?
- Gina kuma auna girman. Duba girman tare da hotunan docker bayan ginin docker.
- Duba Bincika sanannun lahani tare da na'urar daukar hotan takardu kamar docker scout ko trivy.
Tsaro: takamaiman hatsarori
Tsaron kwantena yana da sauƙin kulawa. Dokoki guda uku:
- Kar a sanya Sirri a cikin hoton. Layuka kamar ENV API_KEY=... ko COPY .env suna rubuta sirrin har abada zuwa sassan hoton; Duk wanda ya karbi hoton zai iya karantawa. Bada sirrin a lokacin aiki azaman canjin yanayi ko daga rumbun ajiya.
- Gudu a matsayin tushen. Ta hanyar tsoho, kwantena suna gudana azaman tushen; Budewa na iya juyawa zuwa tserewa daga akwati. Je zuwa ga mai amfani mara izini tare da umarnin USER.
- Hoton tushe karami kuma na zamani. Hotunan masu kumbura duka suna da hankali kuma suna da ƙarin rauni. Zaɓi slim/alpine, gyara sigar (kada ku yi amfani da: latest).
Tsanaki: Ko da kun yi amfani da sirri a cikin RUN sannan ku share shi, ya kasance a cikin tsakiyar kayan aiki kuma ana iya karanta shi ta tarihin docker. Idan ana buƙatar sirri yayin gini, yi amfani da tsarin sirrin Docker, ba ENV/COPY ba.
Teburin tasiri na ingantawa
fasaha
Me yake aikatawa
Tasiri na yau da kullun
siriri/Hoton tushe mai tsayi
Yi watsi da fakitin da ba dole ba
900MB → 120MB
Gina matakai da yawa
Ban da kayan aikin gini
700MB → 90MB
.dockerignor
Ba ya haɗa fayilolin da ba dole ba a cikin ginin
Gina da sauri, ƙaramin mahallin
Rarraba matakin
Yana ƙara bugun cache
Gina min 5 → 40 seconds
Sigar gyarawa (:15)
Maimaituwa + tsaro
Yana hana lalacewa kwatsam
uku mini lokuta
Hoton 1 - 1.1 GB ya rage zuwa 95 MB. Hoton Node.js na ƙungiya ɗaya shine 1.1 GB; Kowane turawa ya ɗauki mintuna. Sun gaya wa AI "inganta wannan tare da ginin matakai da yawa da tsayi". AI ya raba lokacin tattarawa kuma ya motsa fayilolin da aka samar kawai zuwa hoton bakin ciki; Sakamakon ya kasance 95 MB, lokacin turawa ya ragu da kashi ɗaya bisa uku.
Case 2 - asirin da aka binne. Wani injiniya ya lura da layin ENV DB_PASSWORD=asirin_prod a cikin Dockerfile da YZ ya samar. AI ta sanya kalmar sirri a cikin hoton don haka zai "yi aiki". Injiniyan ya cire wannan kuma ya canza shi zuwa karanta kalmar sirri daga canjin yanayi a lokacin aiki. In ba haka ba, duk wanda ya ɗauki hoton zai iya karanta kalmar sirri.
Case 3 - hadarin tushen tserewa. Wani kayan aikin dubawa ya ba da rahoton cewa hoton da AI ta samar yana gudana azaman tushen kuma yana ɗauke da lahani mai mahimmanci. Ƙungiyar ta ƙara USER appuser kuma ta tura hoton tushe zuwa sigar yanzu; an share scan. Darasi: Bincika kowane hoto kafin bugawa kuma nuna shi ga masu amfani mara izini.
Samfura huɗu masu kwafi
1) Samar da Ingantaccen Dockerfile:
Rubuta Dockerfile na shirye-shiryen samarwa don aikace-aikacen [LANGUAGE/FRAMEWORK].Jagora: - Yi amfani da ginin matakai da yawa; sanya hoton ƙarshe ya zama mafi ƙanƙanci.- Hoton tushe siriri / mai tsayi kuma an gyara sigar (kada ku yi amfani da ": latest") - Gudanar da akwati tare da mai amfani mara izini, BA tushen ba.- KADA KA saka sirrin a cikin hoton; Jira canjin yanayi a lokacin aiki. - Ƙara .dockerignore shawara. Umurnin shigarwa: [X], tashar sauraro: [Y].
2) Haɓaka Dockerfile na yanzu:
Duba wannan Dockerfile don rage girman da sauri. Ba da shawarar sauye-sauye na kankare dangane da tsari na Layer, ginawa mai yawa, hoton tushe da fakitin da ba a iya amfani da su ba; Rubuta kimanta girman girman / tasirin saurin kowane canji. Dockerfile: [CONTENT]
3) Binciken tsaro:
Bincika wannan Dockerfile don tsaro: shin akwai wasu sirrin da aka haɗa, masu amfani da tushe, sigar da ba a gyara ba, kayan aikin da ba dole ba, hotunan tushe na zamani? Jera abubuwan da aka gano cikin tsari mai mahimmanci da kowane gyara. Dockerfile: [CONTENT]
4) Gina warware kuskure:
Menene ke haifar da kuskuren gina docker da yadda za a magance shi? Ka ba ni tushen tushen da mafita tare da ƙananan canje-canje. Kada ku samar da ƙima ta gaske inda kuka ga Asirin, yi amfani da mai riƙewa. Kuskure: [LOG] Dockerfile: [CONTENT]
Rauni mai ƙarfi / Ƙarfi mai ƙarfi
Rauni: "Rubuta Dockerfile don aikace-aikacen Node na."
Sakamako: babban hoton tushe, tushen mai amfani, mataki ɗaya, mai yuwuwa mai rauni ga asirce; Fitarwa ba tare da la'akari da girma da tsaro ba.
Ƙarfafa: "Rubuta Dockerfile mai shirye-shiryen samarwa don aikace-aikacen Node 20 na: ginawa mai yawa, node: 20-alpine tushe image (daidaitaccen sigar), gudana tare da USER mara izini, saka sirrin, sauraron tashar tashar jiragen ruwa 3000, dist/server.js node node dist/server.js. Hakanan bayar da shawarar .dockerignore."
Bambanci: sigar gaggawa ta biyu tana ba da dabarun ingantawa, tsarin tsaro da umarnin shiga; Fitowar ta zama ƙarami, mai lafiya kuma mai amfani kai tsaye.
Kuskuren gama gari
- Saka Sirrin cikin hoton tare da `ENV`/`COPY`. Ya kasance a cikin yadudduka kuma ana karanta shi baya.
- Gudu a matsayin tushen. Tsallake umarnin USER babban haɗari ne na tsaro.
- Amfani da `: latest`. Yana haifar da gine-ginen da ba za a iya maimaitawa ba da rushewar da ba zato ba tsammani.
- Tsallake gina matakai da yawa. Kayan aikin tattarawa ba dole ba ne su toshe hoton ƙarshe.
- Kar a rubuta '.dockerignore'. Manyan kundayen adireshi kamar .git da node_modules suna cikin ginin.
- Buga hoton ba tare da duba shi ba. Samar da raunin da aka sani ba tare da sanin su ba.
A takaice
Kwantena suna sanya aikace-aikacen cikin fakiti masu ɗaukar hoto waɗanda ke aiki iri ɗaya a ko'ina; girke-girke shine Dockerfile. AI yana da ƙarfi wajen samar da shirye-shiryen samarwa da ingantaccen Dockerfiles - amma kuna buƙatar fayyace buƙatar ginin matakai da yawa, ƙananan hotunan tushe, babu masu amfani mara izini, kuma babu sirri. Rage girman hoton yana saurin tura aiki; Rashin sanya sirrin, guje wa tushen, da duba hoton yana tabbatar da tsaro. Alhakin ku ne don tabbatar da abin da kowane girke-girke yake yi da inda ya zubo.
Aikin aikace-aikace
Zaɓi app mai sauƙi. Shin AI ta samar da Dockerfile tare da samfurin "Ingantacciyar Ƙarfin Dockerfile". Sannan: (1) A duba sirrin da aka saka da tushen mai amfani tare da samfurin "Check Security"; (2) idan zai yiwu, gina docker kuma auna girman tare da hotunan docker; (3) lura da wace dabara za ta fi tasiri wajen rage hoton a matsayin mataki na gaba.
jerin abubuwan dubawa
- [ ] Na ƙara sigar harshe/tsarin aiki, umarnin shigarwa, da tashar jiragen ruwa zuwa ga faɗaɗawa.
- [ ] Babu wani sirrin da aka saka a cikin Dockerfile; ana sa ran a asirce lokacin gudu.
- [ ] Akwatin yana gudana tare da USER mara izini, ba tushen ba.
- [ ] Hoton tushe karami ne (slim/alpine) kuma sigar sa tana gyarawa (ba: latest).
- [ ] Na yi amfani da ginin matakai da yawa da .dockerignore.
- [ ] Na duba hoton tare da na'urar daukar hoto mai rauni.