Loading...

Back to Details

multi-stage-dockerfile

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Your goal is to help me create efficient multi-stage Dockerfiles that follow best practices, resulting in smaller, more secure container images.

我的目标是帮助你创建遵循最佳实践的高效多阶段Dockerfile，从而生成体积更小、安全性更高的容器镜像。

Multi-Stage Structure

多阶段构建结构

Use a builder stage for compilation, dependency installation, and other build-time operations
Use a separate runtime stage that only includes what's needed to run the application
Copy only the necessary artifacts from the builder stage to the runtime stage
Use meaningful stage names with the
```
AS
```
keyword (e.g.,
```
FROM node:18 AS builder
```
)
Place stages in logical order: dependencies → build → test → runtime

使用builder阶段来完成编译、依赖安装及其他构建时操作
使用独立的运行时阶段，仅包含运行应用所需的内容
仅将必要的构建产物从builder阶段复制到运行时阶段
使用
```
AS
```
关键字为阶段指定有意义的名称（例如：
```
FROM node:18 AS builder
```
）
按逻辑顺序排列阶段：依赖安装 → 构建 → 测试 → 运行时

Base Images

基础镜像

Start with official, minimal base images when possible
Specify exact version tags to ensure reproducible builds (e.g.,
```
python:3.11-slim
```
not just
```
python
```
)
Consider distroless images for runtime stages where appropriate
Use Alpine-based images for smaller footprints when compatible with your application
Ensure the runtime image has the minimal necessary dependencies

尽可能使用官方的轻量基础镜像
指定确切的版本标签以确保构建可复现（例如：使用
```
python:3.11-slim
```
而非仅
```
python
```
）
在合适的场景下，运行时阶段可考虑使用无发行版（distroless）镜像
当应用兼容时，使用基于Alpine的镜像以减小镜像体积
确保运行时镜像仅包含必要的最小依赖

Layer Optimization

镜像层优化

Organize commands to maximize layer caching
Place commands that change frequently (like code changes) after commands that change less frequently (like dependency installation)
Use
```
.dockerignore
```
to prevent unnecessary files from being included in the build context
Combine related RUN commands with
```
&&
```
to reduce layer count
Consider using COPY --chown to set permissions in one step

组织命令以最大化利用镜像层缓存
将频繁变更的命令（如代码修改）放在变更较少的命令（如依赖安装）之后
使用
```
.dockerignore
```
文件避免不必要的文件进入构建上下文
使用
```
&&
```
将相关的RUN命令合并，以减少镜像层数量
可考虑使用COPY --chown在一步操作中设置文件权限

Security Practices

安全实践

Avoid running containers as root - use
```
USER
```
instruction to specify a non-root user
Remove build tools and unnecessary packages from the final image
Scan the final image for vulnerabilities
Set restrictive file permissions
Use multi-stage builds to avoid including build secrets in the final image

避免以root用户运行容器——使用
```
USER
```
指令指定非root用户
从最终镜像中移除构建工具和不必要的包
扫描最终镜像以排查漏洞
设置严格的文件权限
使用多阶段构建避免构建密钥被包含在最终镜像中

Performance Considerations

性能考量

Use build arguments for configuration that might change between environments
Leverage build cache efficiently by ordering layers from least to most frequently changing
Consider parallelization in build steps when possible
Set appropriate environment variables like NODE_ENV=production to optimize runtime behavior
Use appropriate healthchecks for the application type with the HEALTHCHECK instruction

使用构建参数处理不同环境中可能变更的配置
通过按变更频率从低到高排序镜像层，高效利用构建缓存
尽可能在构建步骤中实现并行化
设置合适的环境变量，如NODE_ENV=production，以优化运行时性能
根据应用类型，使用HEALTHCHECK指令配置合适的健康检查