dockerfile 维护的最佳实践? [英] Best practice for dockerfile maintain?

问题描述

我有一个 Dockerfile 如下所示:

I have a Dockerfile something like follows:

FROM openjdk:8u151

# others here

我有 2 个关于基本映像的问题:

I have 2 questions about the base image:

通常，我从 dockerhub 获取它，比如说 openjdk:8u151，我可以从 dockerhub的openjdk仓库.

Usually, I get it from dockerhub, let's say openjdk:8u151, I can get it from dockerhub's openjdk repository.

如果我可以从任何本地docker命令中获取所有标签，那么我无需访问web获取标签，效率真的有点低吗?

If I could get all tags from any local docker command, then I no need to visit web to get the tags, really a little low efficiency?

我的意思是如果我的基本图像总是在那里?

I mean if my base image always there?

看上面的openjdk repo，是官方repo.

Look at the above openjdk repo, it is an offical repo.

我发现只有 8u151 可供我选择.但我认为在这个过程中应该有很多 jdk8 发布，所以那里也应该有很多 jdk8 图像，比如 8u101，8u163等

I found there is only 8u151 left for me to choose. But I think there should be a lots of jdk8 release during the process, so should also a lots of jdk8 images there, something like 8u101, 8u163 etc.

那么我能猜到维护者会为 openjdk 删除一些旧图像吗?那么如果发生这种情况，我的 Dockerfile 是如何工作的?如果我的上游删除那里的图像，我应该始终更改我的基本图像吗?维持这种东西对我来说真的很糟糕.

So can I guess the maintainer will delete some old images for openjdk? Then if this happen, how my Dockerfile work? I should always change my base image if my upstream delete there image? Really terrible for me to maintain such kind of thing.

即使 openjdk 真的只生成一个版本的 jdk8.我的困惑仍然无法避免，因为 dockerhub 确实为用户提供了 delete 按钮.

Even if the openjdk really just generate one release of jdk8. My puzzle still cannot be avoided, as dockerhub really afford the delete button for users.

什么是最佳做法，请提出建议，谢谢.

What's the best practice, please suggest, thanks.

推荐答案

如何获取标签?

请参阅如何列出远程注册表上 Docker 映像的所有标签?".
API就够了

See "How to list all tags for a Docker image on a remote registry?".
The API is enough

例如，访问:

https://registry.hub.docker.com/v2/repositories/library/java/tags/?page_size=100&page=2

基础镜像安全吗?

只要您将自己构建的镜像保存在注册表中(rpublic 镜像或自托管镜像)，是的:您至少可以基于您所做的镜像构建新镜像.
或者，即使基础镜像消失了，您仍然可以在自己的镜像中保留它的图层，并且可以重新标记它(前提是构建缓存可用).
例如，请参阅有没有办法在 docker 映像中标记前一层或恢复提交?".
请参阅我可以运行 docker 映像的中间层吗?"中的注意事项.

As long as you save your own built image in a registry (eithe rpublic one, or a self-hosted one), yes: you will be able to at least build new images based on the one you have done.
Or, even if the base image disappears, you still have its layers in your own image, and can re-tag it (provided the build cache is available).
See for instance "Is there a way to tag a previous layer in a docker image or revert a commit?".
See caveats in "can I run an intermediate layer of docker image?".

这篇关于dockerfile 维护的最佳实践?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！