Docker鏡像構建的四種優化方式

鏡像構建的優化

###刪除之間的所有的test：v*鏡像和容器（參考上一篇Docker容器的安裝配置，以及 Dockerfile 的使用方法）###

[root@server1 docker]# docker rmi -f test:v3
Untagged: test:v3				## 刪除鏡像用rmi，刪除容器用rm
[root@server1 docker]# docker rm -f vm1
vm1
[root@server1 docker]# docker rm -f vm2
vm2
[root@server1 docker]# docker rm -f vm3
vm3

構建nginx鏡像

busybox滿足不了nginx的構建需求，所以我們下載rehl7的鏡像：

[root@server1 ~]# docker load -i rhel7.tar 
e1f5733f050b: Loading layer [==================================================>]  147.1MB/147.1MB
[root@server1 ~]# cd docker/
[root@server1 docker]# vim Dockerfile 

FROM rhel7			# 鏡像來自rhel7
EXPOSE 80			# 開放80端口
MAINTAINER [email protected]			# 維護聯繫人
COPY dvd.repo /etc/yum.repos.d/			# 配置yum源
RUN rpmdb --rebuilddb							# 重新構建rpm數據庫，不然會報錯
RUN yum install -y gcc make pcre-devel zlib-devel		# 安裝依賴性
ADD nginx-1.18.0.tar.gz /mnt/			# 複製nginx到/mnt並解壓
WORKDIR /mnt/nginx-1.18.0			# 進入到/mnt/nginx-1.18.0
RUN ./configure --prefix=/usr/local/nginx			# 預安裝
RUN make			
RUN make install				# 編譯安裝
ENTRYPOINT ["/usr/local/nginx/sbin/nginx","-g","dameon off;"]		# 開啓nginx

[root@server1 docker]# cp /etc/yum.repos.d/westos.repo ./dvd.repo      # 建立yum源
[root@server1 docker]# ls
Dockerfile  dvd.repo  nginx-1.18.0.tar.gz  testfile
[root@server1 docker]# docker build -t nginx:v1 .				進行構建
## 這裏我們可以看到dockerfie裏面的各個步驟
Step 1/12 : FROM rhel7
 ---> 0a3eb3fde7fd
Step 2/12 : EXPOSE 80
 ---> Using cache
 ---> d08b343a793d
Step 3/12 : MAINTAINER [email protected]
 ---> Using cache
 ---> 017f4b147a32
Step 4/12 : COPY dvd.repo /etc/yum.repos.d/
 ---> Using cache
 ---> f5d2b9218060
Step 5/12 : RUN rpmdb --rebuilddb
 ---> Running in 163a4532bf45
Removing intermediate container 163a4532bf45
 ---> c0387a3e3e69
Step 6/12 : RUN yum install -y gcc make pcre-devel zlib-devel
 ---> Running in e2d387cdc0b9
Step 7/12 : ADD nginx-1.18.0.tar.gz /mnt/
 ---> 000ce03c7c4e
Step 8/12 : WORKDIR /mnt/nginx-1.18.0
 ---> Running in e539b8ed9a67
Removing intermediate container e539b8ed9a67
 ---> 9ea9d4c3ff3f
Step 9/12 : RUN ./configure --prefix=/usr/local/nginx
 ---> Running in 261812c201ce
Step 10/12 : RUN make
Step 11/12 : RUN make install
Step 12/12 : ENTRYPOINT ["/usr/local/nginx/sbin/nginx","-g","dameon off;"]
 ---> Running in 873edc7d9d94
Removing intermediate container 873edc7d9d94
 ---> 9b7f0c89bf98
Successfully built 9b7f0c89bf98
Successfully tagged nginx:v1

1.清理緩存，清理中間產物

[root@server1 docker]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
nginx               v1                  9b7f0c89bf98        3 minutes ago       303MB
## 他現在有303M 是比較大的
因爲我們再yum安裝的時候會產生緩存，再 /var/cache/yum/裏，
還有解壓後的目錄 nginx-1.18.0

那我們就可以從這裏進行優化。
清理中間產物。

[root@server1 docker]# vim Dockerfile 

RUN yum install -y gcc make pcre-devel zlib-devel && yum clean all			清理緩存
RUN rm -fr /mnt/nginx-1.18.0		刪除中間產物

[root@server1 docker]# docker build -t nginx:v2 .
[root@server1 docker]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
nginx               v2                  aa029b13d29a        12 seconds ago      277MB
nginx               v1                  9b7f0c89bf98        11 minutes ago      303MB
變小了。

2.減少鏡像構建層數

[root@server1 docker]# docker history nginx:v2 
IMAGE               CREATED             CREATED BY                                      SIZE                COMMENT
aa029b13d29a        2 minutes ago       /bin/sh -c #(nop)  ENTRYPOINT ["/usr/local/n…   0B                  
168fc81963e5        2 minutes ago       /bin/sh -c rm -fr /mnt/nginx-1.18.0             0B                  
32531153adcf        2 minutes ago       /bin/sh -c make install                         3.88MB              
afa9d1979fe6        2 minutes ago       /bin/sh -c make                                 12.4MB              
d7fb616f785c        3 minutes ago       /bin/sh -c ./configure --prefix=/usr/local/n…   71.7kB              
1c8cc01a2f4b        3 minutes ago       /bin/sh -c #(nop) WORKDIR /mnt/nginx-1.18.0     0B                  
e7cabc8289c4        3 minutes ago       /bin/sh -c #(nop) ADD file:46b14d1c307d23f50…   6.25MB              
551102a70245        3 minutes ago       /bin/sh -c yum install -y gcc make pcre-deve…   107MB               
c0387a3e3e69        15 minutes ago      /bin/sh -c rpmdb --rebuilddb                    6.64MB              
f5d2b9218060        18 minutes ago      /bin/sh -c #(nop) COPY file:2b3dce3b05892ae2…   76B                 
017f4b147a32        18 minutes ago      /bin/sh -c #(nop)  MAINTAINER [email protected]…   0B                  
d08b343a793d        18 minutes ago      /bin/sh -c #(nop)  EXPOSE 80                    0B                  
0a3eb3fde7fd        5 years ago                                                         140MB               Imported from -

鏡像構建的層數越少，我們的鏡像越小。我們當前有12層，我們可以把能放在一起的放在一層去執行。

FROM rhel7
EXPOSE 80
MAINTAINER [email protected]
COPY dvd.repo /etc/yum.repos.d/
ADD nginx-1.18.0.tar.gz /mnt
WORKDIR /mnt/nginx-1.18.0
RUN rpmdb --rebuilddb && yum install -y gcc make pcre-devel zlib-devel && yum clean all && ./configure --prefix=/usr/local/nginx && make && make install && rm -fr /mnt/nginx-1.18.0
ENTRYPOINT ["/usr/local/nginx/sbin/nginx","-g","dameon off;"]

我們將所有的RUN 都放在了一起，然後將 COPY 和ADD 提前。

[root@server1 docker]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
nginx               v3                  db577ca1f8c7        6 seconds ago       258MB
nginx               v2                  aa029b13d29a        15 minutes ago      277MB
nginx               v1                  9b7f0c89bf98        27 minutes ago      303MB

又小了19M.

3.多階段構建鏡像

• 我們構建nginx的最終目的就是得到 /usr/local/nginx/sbin/nginx 這個二進制程序。
  我們可以再鏡像A中完成構建的過程，再把二進制程序拷貝到B鏡像中去，就極大的優化了空間。

FROM rhel7 as build         #命名爲build
EXPOSE 80
MAINTAINER [email protected]
COPY dvd.repo /etc/yum.repos.d/
ADD nginx-1.18.0.tar.gz /mnt
WORKDIR /mnt/nginx-1.18.0
RUN sed -i 's/CFLAGS="$CFLAGS -g"/#CFLAGS="$CFLAGS -g/g' auto/cc/gcc && rpmdb --rebuilddb && yum install -y gcc make pcre-devel zlib-devel && yum clean all && ./configure --prefix=/usr/local/nginx && make && make install && rm -fr /mnt/nginx-1.18.0

FROM rhel7
EXPOSE 80
MAINTAINER [email protected]
VOLUME ["/usr/local/nginx/html"]			#數據卷，這樣我們再宿主機上配置發佈頁面就行。
COPY --from=build /usr/local/nginx /usr/local/nginx      # 把上面鏡像的目錄拷貝到這個鏡像的目錄中

sed -i ‘s/CFLAGS="$CFLAGS -g"/#CFLAGS="$CFLAGS -g/g’ 是關閉debug。也能減小。

Successfully tagged nginx:v4
[root@server1 docker]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
nginx               v4                  a68855981d36        6 seconds ago       141MB
<none>              <none>              3f21fd924668        8 seconds ago       255MB
nginx               v3                  db577ca1f8c7        20 minutes ago      258MB
nginx               v2                  aa029b13d29a        35 minutes ago      277MB
nginx               v1                  9b7f0c89bf98        About an hour ago   303MB
rhel7               latest              0a3eb3fde7fd        5 years ago         140MB

這樣就只剩下了141M了。而且我們的nginx是以rhel7爲基礎鏡像的，所以說nginx只有1M的大小。

4.使用更加精簡的基礎鏡像

我們要構建nginx的新鏡像，我們就只需要和nginx運行相關的文件，再上面的例子中，rhel7這個基礎鏡像還是比較大的，它裏面的東西我們還是有很多永不上的。

比如：

我們運行apache，就只需要apache的主程序和這些文件就足夠了，nginx也相同。

我們導入兩個精簡的基礎鏡像：

[root@server1 ~]# docker load -i distroless.tar 
668afdbd4462: Loading layer [==================================================>]  18.39MB/18.39MB
Loaded image: gcr.io/distroless/base:latest
[root@server1 ~]# docker load -i nginx.tar 
014cf8bfcb2d: Loading layer [==================================================>]  58.46MB/58.46MB
832a3ae4ac84: Loading layer [==================================================>]  53.91MB/53.91MB
e89b70d28795: Loading layer [==================================================>]  3.584kB/3.584kB
Loaded image: nginx:latest

[root@server1 ~]# mkdir distroless
[root@server1 ~]# cd distroless/
[root@server1 distroless]# vim Dockerfile 

FROM nginx as base
ARG Asia/Shanghai

RUN mkdir -p /opt/var/cache/nginx && \
    cp -a --parents /usr/lib/nginx /opt && \
    cp -a --parents /usr/share/nginx /opt && \
    cp -a --parents /var/log/nginx /opt && \
    cp -aL --parents /var/run /opt && \
    cp -a --parents /etc/nginx /opt && \
    cp -a --parents /etc/passwd /opt && \
    cp -a --parents /etc/group /opt && \
    cp -a --parents /usr/sbin/nginx /opt && \
    cp -a --parents /usr/sbin/nginx-debug /opt && \
    cp -a --parents /lib/x86_64-linux-gnu/ld-*  /opt && \
    cp -a --parents /lib/x86_64-linux-gnu/libpcre.so.*  /opt && \
    cp -a --parents /lib/x86_64-linux-gnu/libz.so.*  /opt && \
    cp -a --parents /lib/x86_64-linux-gnu/libc*  /opt && \
    cp -a --parents /lib/x86_64-linux-gnu/libdl*  /opt && \
    cp -a --parents /lib/x86_64-linux-gnu/libpthread*  /opt && \
    cp -a --parents /lib/x86_64-linux-gnu/libcrypt*  /opt && \
    cp -a --parents /usr/lib/x86_64-linux-gnu/libssl.so.*  /opt && \
    cp -a --parents /usr/lib/x86_64-linux-gnu/libcrypto.so.*  /opt && \
    cp /usr/share/zoneinfo/${TIME_ZONE:-ROC} /opt/etc/localtime

FROM gcr.io/distroless/base
COPY --from=base /opt /
EXPOSE 80 443
ENTRYPOINT ["nginx","-g","daemon off;"]

[root@server1 distroless]# docker build -t nginx:v5 .
[root@server1 distroless]# docker images
REPOSITORY               TAG                 IMAGE ID            CREATED             SIZE
nginx                    v5                  2e1946a440c2        5 seconds ago       26.8MB
<none>                   <none>              715d6019c6ad        6 seconds ago       119MB
nginx                    v4                  a68855981d36        About an hour ago   141MB
<none>                   <none>              3f21fd924668        About an hour ago   255MB
nginx                    v3                  db577ca1f8c7        About an hour ago   258MB
nginx                    v2                  aa029b13d29a        2 hours ago         277MB
nginx                    v1                  9b7f0c89bf98        2 hours ago         303MB

此時就只有26.8M了，所以我們儘量使用精簡的基礎鏡像。

運行：

[root@server1 distroless]# docker run -d --name nginx nginx:v5
40f023d69a69af8912e45dbb5f651dbf33aea67ccf0686f957449e41752963e9
[root@server1 distroless]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
40f023d69a69        nginx:v5            "nginx -g 'daemon of…"   5 seconds ago       Up 4 seconds        80/tcp, 443/tcp     nginx
[root@server1 distroless]# docker inspect nginx		檢查容器
...
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.2",		# 它的ip地址爲這個
...

#訪問：
[root@server1 distroless]# curl 172.17.0.2
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
這裏爲什麼和本機不再同一ip還可以訪問哪？

[root@server1 distroless]# ip a

2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:e4:9b:44 brd ff:ff:ff:ff:ff:ff
    inet 172.25.254.1/24 brd 172.25.254.255 scope global ens3
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fee4:9b44/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:26:3d:ce:55 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0		## 看到了吧
       valid_lft forever preferred_lft forever
    inet6 fe80::42:26ff:fe3d:ce55/64 scope link 
       valid_lft forever preferred_lft forever
9: veth0df22f1@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether a2:c8:79:b7:7b:f3 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::a0c8:79ff:feb7:7bf3/64 scope link 
       valid_lft forever preferred_lft forever

啓動docker之後就會默認添加docker的設備。訪問時先通過docker0 再通過本地的迴環接口

每開啓一個鏡像就會多一個veth的網卡設備。，它會橋接到docker0設備上

[root@server1 distroless]# brctl show
bridge name	bridge id		STP enabled	interfaces
docker0		8000.0242263dce55	no		veth0df22f1
看到了吧。

此時我們的物理機是訪問不了的，因爲容器和外界是隔離的，我們也沒有做端口映射，所以我們應該將容器的80端口映射到server1的80端口上，這樣我們的物理機才能訪問。

[root@server1 distroless]# cd 
[root@server1 ~]# docker run -d -p 80:80 --name nginx nginx:v5
28c25d9ff5b5ecede72238d94fb315471bf00c47b92b4f89b7972fd674e90cbb
[root@server1 ~]# netstat -tnlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      2992/sshd           
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      3103/master         
tcp6       0      0 :::80                   :::*                    LISTEN      5414/docker-proxy   
tcp6       0      0 :::22                   :::*                    LISTEN      2992/sshd           
tcp6       0      0 ::1:25                  :::*                    LISTEN      3103/master 

可見80端口打開了，通過docker-proxy

就可以訪問了