Docker 6th Birthday: multis-stage builds, docker supercharged

Some best practices on using multi-stage build to supercharge your docker build process, also some details about Buildkit for improved build experience

Transcript

1. #DockerBDay #docker #build
2. Mohamed Ez-zarghili GraalVM @OracleLabs $ whoami | echo "@$(xargs)" → @ezzarghili
3. @ezzarghili Some concepts
4. @ezzarghili Image & layers
5. @ezzarghili Consistency Reusability Maintainability Build time Image size What to improve
6. @ezzarghili FROM maven:3.6.0-jdk-8-alpine WORKDIR /app COPY pom.xml . COPY src ./src RUN mvn -e -B package ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"]
7. @ezzarghili FROM maven:3.6.0-jdk-8-alpine WORKDIR /app COPY pom.xml . COPY src ./src RUN mvn -e -B package ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"]
8. @ezzarghili FROM maven:3.6.0-jdk-8-alpine WORKDIR /app COPY pom.xml . COPY src ./src RUN mvn -e -B package ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"] FROM openjdk:8-jre-alpine COPY --from=0 /app/target/hello.jar /hello.jar ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"]
9. @ezzarghili FROM maven:3.6.0-jdk-8-alpine AS builder WORKDIR /app COPY pom.xml . COPY src ./src RUN mvn -e -B package FROM openjdk:8-jre-alpine COPY --from=builder /app/target/hello.jar /hello.jar ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"]
10. @ezzarghili FROM maven:3.6.0-jdk-8-alpine AS builder .... FROM openjdk:8-jre-alpine AS alpine-release COPY --from=builder /app/target/hello.jar /hello.jar ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"] FROM openjdk:8-jre-slim AS slim-release COPY --from=builder /app/target/hello.jar /hello.jar ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"]
11. @ezzarghili ARG release=alpine FROM maven:3.6.0-jdk-8-alpine AS builder WORKDIR /app COPY pom.xml . COPY src ./src RUN mvn -e -B package FROM openjdk:8-jre-${release} AS alpine-release COPY --from=builder /app/target/hello.jar /hello.jar ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"] FROM openjdk:8-jre-${release} AS slim-release COPY --from=builder /app/target/hello.jar /hello.jar ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"] docker build --build-arg release=slime -t ezzarghili/hellodocker:alpine-release .
12. @ezzarghili FROM maven:3.6.0-jdk-8-alpine AS builder WORKDIR /app COPY pom.xml . COPY src ./src RUN mvn -e -B package -DskipTests FROM openjdk:8-jre-alpine AS release COPY --from=builder /app/target/hello.jar /hello.jar ENTRYPOINT [ "java" , "-cp", "/hello.jar", "Hello"] FROM builder AS test RUN mvn -e -B test FROM release AS debug RUN apk add --no-cache strace ENTRYPOINT [ "ash"]
13. @ezzarghili FROM maven:3.6.0-jdk-8-alpine AS builder ... FROM openjdk:8-jre-alpine AS keystore WORKDIR / COPY --from=ezzarghili/scratch-cacert /etc/ssl/certs/ca-certificates.crt ca-certificates.crt RUN keytool -import -noprompt \ -file ca-certificates.crt \ -storepass changeit \ -keystore $JAVA_HOME/lib/security/cacerts \ -alias certs && cp $JAVA_HOME/lib/security/cacerts cacert FROM openjdk:8-jre-alpine AS release COPY --from=builder /app/target/hello.jar /hello.jar COPY --from=keystore cacert $JAVA_HOME/lib/security/cacerts ENTRYPOINT [ "java" , "-cp", "/hello.jar" , "Hello"]
14. @ezzarghili Key features: • Automatic garbage collection • Extendable frontend formats • Concurrent dependency resolution • Efficient instruction caching • Build cache import/export • Nested build job invocations • Distributable workers • Multiple output formats • Pluggable architecture • Execution without root privileges Read the proposal from https://github.com/moby/moby/issues/32925 Buildkit dockerd -D --experimental export DOCKER_BUILDKIT=1
15. @ezzarghili FROM maven:3.6.0-jdk-8-alpine AS builder ... FROM openjdk:8-jre-alpine AS keystore WORKDIR / COPY --from=ezzarghili/scratch-cacert /etc/ssl/certs/ca-certificates.crt ca-certificates.crt RUN keytool -import -noprompt \ -file ca-certificates.crt \ -storepass changeit \ -keystore $JAVA_HOME/lib/security/cacerts \ -alias certs && cp $JAVA_HOME/lib/security/cacerts cacert FROM openjdk:8-jre-alpine AS release COPY --from=builder /app/target/hello.jar /hello.jar COPY --from=keystore cacert $JAVA_HOME/lib/security/cacerts ENTRYPOINT [ "java" , "-cp", "/hello.jar" , "Hello"]
16. @ezzarghili Not using Buildkit
17. @ezzarghili Using Buildkit
18. ... Thank you https://dockr.ly/2TxXT6p Docker doc https://bit.ly/2OqXula Buildkit https://bit.ly/2FvY4u4 Advanced multi-stage build patterns DockerConEU 17 & 18 Sessions Resources @ezzarghili