{{tag>Brouillon}} # Docker image build Voir : * [[https://docs.docker.com/build/concepts/overview/|Docker Buildx / BuildKit]] * https://docs.docker.com/build/building/best-practices/ * https://docs.openshift.com/container-platform/4.17/openshift_images/create-images.html * https://docs.oracle.com/en/operating-systems/oracle-linux/podman/security.html#security * [[docker_install_dokuwiki|Exemple de Dockerfile pour Dokuwiki]] * https://www.docker.com/blog/docker-best-practices-using-tags-and-labels-to-manage-docker-image-sprawl/ * https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry * https://blog.stephane-robert.info/docs/conteneurs/moteurs-conteneurs/ * https://aws.amazon.com/fr/blogs/france/demystifier-entrypoint-et-cmd-dans-docker/ Ansible : * https://oneuptime.com/blog/post/2026-03-18-use-podman-with-ansible/view Outils / Méthode / Container Image Builders : * Docker / Dockerfile * Buildah * * Buildpacks / pack https://blog.stephane-robert.info/docs/conteneurs/images-conteneurs/build/buildpacks/ * openshift-imagebuilder * [[https://github.com/openshift/source-to-image|Source-To-Image (S2I)]] * Kaniko https://blog.stephane-robert.info/docs/conteneurs/images-conteneurs/build/kaniko/ * S2I * CNB * Paketo * umoci ## Bonnes pratiques Voir : * https://www.sysdig.com/learn-cloud-native/dockerfile-best-practices * https://collabnix.com/running-docker-containers-as-root/ * https://www.docker.com/blog/understanding-the-docker-user-instruction/ * https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html * https://blog.stephane-robert.info/docs/conteneurs/outils/hadolint/ * https://medium.com/@SecurityArchitect/hardening-container-images-best-practices-and-examples-for-docker-e941263cab13 * https://github.com/nicolargo/glances/issues/3359 Quand cela est possible préférer `COPY` à `ADD`. Voir https://docs.docker.com/build/building/best-practices/ Immediately before your ENTRYPOINT or CMD directive, you then add a USER Ne pas utiliser `sudo` mais `gosu` ou `su-exec` ### Vérif Dockerfile Conrainerfile avec Hadolint Voir : * https://blog.stephane-robert.info/docs/conteneurs/outils/hadolint/ ~~~bash podman run --rm -i docker.io/hadolint/hadolint < Dockerfile ~~~ ## Exemple de Dockerfile et script https://github.com/browserless/chrome/blob/master/start.sh `start.sh` ~~~bash #!/bin/bash set -e # When docker restarts, this file is still there, # so we need to kill it just in case [ -f /tmp/.X99-lock ] && rm -f /tmp/.X99-lock _kill_procs() { kill -TERM $node kill -TERM $xvfb } # Relay quit commands to processes trap _kill_procs SIGTERM SIGINT Xvfb :99 -screen 0 1024x768x16 -nolisten tcp -nolisten unix & xvfb=$! export DISPLAY=:99 dumb-init -- node ./build/index.js $@ & node=$! wait $node wait $xvfb ~~~ `Dockerfile` ~~~ CMD ["./start.sh"] ~~~ ## Buildha voir https://www.grottedubarbu.fr/buildah-basics/ docker build ~~~bash buildah bud -t myapp:latest . ~~~ L'option `bud` est en réalité une version courte de l'option `build-using-dockerfile` ## Modification d'image ~~~ # Copier nginx vers la registry locale crane copy nginx:1.27.3-alpine localhost:5000/nginx:1.27.3-alpine --platform linux/amd64 # Aplatir l'image crane flatten localhost:5000/nginx:1.27.3-alpine \ -t localhost:5000/nginx:1.27.3-alpine-flat ~~~ Source : https://blog.stephane-robert.info/docs/conteneurs/outils/crane/ ## Autres `RUN apk add --no-cache shadow` ~~~bash export DOCKER_BUILDKIT=0 ~~~