Dockerfile最佳实践：镜像优化

# .dockerignore 示例内容dockerignore_content = """.git.githubnode_modules__pycache__*.pyc*.pyotests/docs/*.md.env.venvmodels/*.bindata/raw/*"""

# 推荐的 Dockerfile 指令排序示例dockerfile_example = """FROM nvidia/cuda:12.1-runtime-ubuntu22.04 # 第1层：系统依赖（变化频率最低）RUN apt-get update && apt-get install -y \\    python3 python3-pip \\    && rm -rf /var/lib/apt/lists/* # 第2层：Python依赖（变化频率中等）COPY requirements.txt /app/requirements.txtRUN pip install --no-cache-dir -r /app/requirements.txt # 第3层：应用代码（变化频率最高）COPY . /appWORKDIR /app"""

# 非root运行的Dockerfile配置示例security_config = """# 创建专用用户RUN groupadd -r appuser && useradd -r -g appuser -s /usr/sbin/nologin appuser # 拷贝代码并设置权限COPY --chown=appuser:appuser . /appRUN chmod -R 550 /app && mkdir -p /app/logs && chown appuser:appuser /app/logs # 切换到非root用户USER appuser"""

# HEALTHCHECK 配置示例healthcheck_config = """HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \\    CMD curl -f http://localhost:8080/health || exit 1"""

# CI 流水线检查清单自动化验证示例import subprocessimport sys def run_check(name, cmd):    """运行单项检查"""    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)    status = "PASS" if result.returncode == 0 else "FAIL"    print(f"[{status}] {name}")    return result.returncode == 0 checks = [    ("hadolint", "hadolint Dockerfile"),    ("trivy-critical", "trivy image --severity CRITICAL --exit-code 1 myimage:latest"),    ("non-root", "docker inspect myimage:latest --format '{{.Config.User}}'"),]results = [run_check(name, cmd) for name, cmd in checks]if all(results):    print("All checks passed!")else:    print("Some checks failed!")    sys.exit(1)

import subprocessimport jsonimport osimport sysfrom dataclasses import dataclass, fieldfrom typing import List, Dict, Optionalfrom datetime import datetime  @dataclassclass DockerfileRule:    """Dockerfile 最佳实践规则"""    rule_id: str    name: str    severity: str  # critical, warning, info    description: str    fix: str  @dataclassclass CheckResult:    """检查结果"""    rule: DockerfileRule    passed: bool    message: str    line_number: int = 0  class DockerfileLinter:    """Dockerfile 最佳实践检查器"""     def __init__(self):        self.rules = self._init_rules()        self.results: List[CheckResult] = []     def _init_rules(self) -> List[DockerfileRule]:        return [            DockerfileRule("DL001", "no-latest-tag", "warning",                          "不应使用latest标签作为基础镜像",                          "使用具体的版本标签如 ubuntu:22.04"),            DockerfileRule("DL002", "use-no-cache", "warning",                          "apt-get install 应配合 --no-cache 或在同层清理缓存",                          "在同一RUN层中添加 rm -rf /var/lib/apt/lists/*"),            DockerfileRule("DL003", "non-root-user", "critical",                          "生产容器不应以root用户运行",                          "添加USER指令切换到非root用户"),            DockerfileRule("DL004", "has-healthcheck", "warning",                          "生产镜像应配置HEALTHCHECK",                          "添加HEALTHCHECK指令定期检查应用健康状态"),            DockerfileRule("DL005", "has-label", "info",                          "镜像应包含LABEL元数据",                          "添加LABEL记录maintainer/version等信息"),            DockerfileRule("DL006", "no-env-secrets", "critical",                          "不应在ENV中设置密钥等敏感信息",                          "使用运行时环境变量或Docker Secret注入密钥"),            DockerfileRule("DL007", "copy-order", "info",                          "COPY指令应按变化频率排序",                          "先拷贝requirements.txt安装依赖，再拷贝应用代码"),            DockerfileRule("DL008", "multi-stage", "info",                          "建议使用多阶段构建减小镜像体积",                          "使用FROM...AS定义构建阶段，最终阶段只包含运行时依赖"),        ]     def lint(self, dockerfile_content: str) -> List[CheckResult]:        """检查 Dockerfile 内容"""        lines = dockerfile_content.strip().split('\n')        self.results = []        has_user = False        has_healthcheck = False        has_label = False        from_line = ""        copy_lines = []         for i, line in enumerate(lines, 1):            stripped = line.strip()            if stripped.startswith('#') or not stripped:                continue            upper = stripped.upper()             if upper.startswith('FROM'):                from_line = stripped                if ':latest' in stripped or ':' not in stripped.split()[1] if len(stripped.split()) > 1 else False:                    self.results.append(CheckResult(                        self.rules[0], False,                        f"第{i}行使用了latest标签或无版本标签", i))             if upper.startswith('USER'):                user = stripped.split()[1] if len(stripped.split()) > 1 else ""                if user.lower() != 'root':                    has_user = True             if upper.startswith('HEALTHCHECK'):                has_healthcheck = True             if upper.startswith('LABEL'):                has_label = True             if upper.startswith('ENV'):                sensitive_keys = ['password', 'secret', 'api_key', 'token', 'private_key']                for sk in sensitive_keys:                    if sk in stripped.lower():                        self.results.append(CheckResult(                            self.rules[5], False,                            f"第{i}行ENV中包含敏感信息'{sk}'", i))             if upper.startswith('COPY'):                copy_lines.append((i, stripped))             if 'apt-get install' in stripped:                next_lines = ' '.join(l.strip() for l in lines[i:min(i+3, len(lines))])                if 'rm -rf /var/lib/apt/lists' not in next_lines and '--no-install-recommends' not in stripped:                    pass         if not has_user:            self.results.append(CheckResult(                self.rules[2], False, "缺少USER指令，容器将以root运行"))        else:            self.results.append(CheckResult(                self.rules[2], True, "已配置非root用户"))         if not has_healthcheck:            self.results.append(CheckResult(                self.rules[3], False, "缺少HEALTHCHECK指令"))        else:            self.results.append(CheckResult(                self.rules[3], True, "已配置HEALTHCHECK"))         if not has_label:            self.results.append(CheckResult(                self.rules[4], False, "缺少LABEL元数据"))        else:            self.results.append(CheckResult(                self.rules[4], True, "已配置LABEL"))         return self.results     def generate_report(self) -> Dict:        """生成检查报告"""        critical = [r for r in self.results if not r.passed and r.rule.severity == 'critical']        warnings = [r for r in self.results if not r.passed and r.rule.severity == 'warning']        infos = [r for r in self.results if not r.passed and r.rule.severity == 'info']        passed = [r for r in self.results if r.passed]        return {            'total_rules': len(self.results),            'passed': len(passed),            'failed': len(self.results) - len(passed),            'critical': len(critical),            'warnings': len(warnings),            'info': len(infos),            'details': [                {                    'rule_id': r.rule.rule_id,                    'name': r.rule.name,                    'severity': r.rule.severity,                    'passed': r.passed,                    'message': r.message,                    'line': r.line_number,                    'fix': r.rule.fix                }                for r in self.results            ]        }  def generate_good_dockerfile() -> str:    """生成符合最佳实践的 Dockerfile 示例"""    return '''FROM nvidia/cuda:12.1-runtime-ubuntu22.04 LABEL maintainer="team@example.com"LABEL org.opencontainers.image.version="1.0.0"LABEL org.opencontainers.image.created="2024-01-15"LABEL model.version="2.1.0" RUN groupadd -r appuser && useradd -r -g appuser -s /usr/sbin/nologin appuser RUN apt-get update && apt-get install -y --no-install-recommends \\    python3 \\    python3-pip \\    curl \\    && rm -rf /var/lib/apt/lists/* WORKDIR /app COPY requirements.txt .RUN pip install --no-cache-dir -r requirements.txt COPY --chown=appuser:appuser src/ ./src/COPY --chown=appuser:appuser models/ ./models/ RUN chmod -R 550 /app && mkdir -p /app/logs && chown appuser:appuser /app/logs HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \\    CMD curl -f http://localhost:8080/health || exit 1 USER appuserEXPOSE 8080CMD ["python3", "src/main.py"]'''  if __name__ == "__main__":    good_dockerfile = generate_good_dockerfile()    linter = DockerfileLinter()    results = linter.lint(good_dockerfile)    report = linter.generate_report()    print(json.dumps(report, indent=2, ensure_ascii=False))     print("\n--- 不良 Dockerfile 检查 ---")    bad_dockerfile = '''FROM ubuntu:latestENV API_KEY=sk-123456RUN apt-get install python3COPY . /appCMD ["python3", "app.py"]'''    linter2 = DockerfileLinter()    results2 = linter2.lint(bad_dockerfile)    report2 = linter2.generate_report()    print(json.dumps(report2, indent=2, ensure_ascii=False))