|
...
|
...
|
@@ -14,9 +14,9 @@ specific set of instructions. You can learn the basics on the
|
|
14
|
14
|
you’re new to writing `Dockerfile`s, you should start there.
|
|
15
|
15
|
|
|
16
|
16
|
This document covers the best practices and methods recommended by Docker,
|
|
17
|
|
-Inc., for creating easy-to-use, effective `Dockerfile`s. We strongly suggest
|
|
18
|
|
-you follow these recommendations (in fact, if you’re creating an Official
|
|
19
|
|
-Image, you *must* adhere to these practices).
|
|
|
17
|
+Inc. and the Docker Community for creating easy-to-use, effective
|
|
|
18
|
+`Dockerfile`s. We strongly suggest you follow these recommendations (in fact,
|
|
|
19
|
+if you’re creating an Official Image, you *must* adhere to these practices).
|
|
20
|
20
|
|
|
21
|
21
|
You can see many of these practices and recommendations in action in the [buildpack-deps `Dockerfile`](https://github.com/docker-library/buildpack-deps/blob/master/jessie/Dockerfile).
|
|
22
|
22
|
|
|
...
|
...
|
@@ -34,10 +34,11 @@ set-up and configuration.
|
|
34
|
34
|
|
|
35
|
35
|
### Use a [`.dockerignore` file](https://docs.docker.com/reference/builder/#the-dockerignore-file)
|
|
36
|
36
|
|
|
37
|
|
-For faster uploading and efficiency, you should make use of a `.dockerignore`
|
|
38
|
|
-file to exclude files or directories from the build context. For example, unless
|
|
39
|
|
-`.git` is needed by your build process or scripts, you should add it to
|
|
40
|
|
-`.dockerignore`, which can save many megabytes worth of upload time.
|
|
|
37
|
+For faster uploading and efficiency during `docker build`, you should make use
|
|
|
38
|
+of a `.dockerignore` file to exclude files or directories from the build
|
|
|
39
|
+context and final image. For example, unless`.git` is needed by your build
|
|
|
40
|
+process or scripts, you should add it to `.dockerignore`, which can save many
|
|
|
41
|
+megabytes worth of upload time.
|
|
41
|
42
|
|
|
42
|
43
|
### Avoid installing unnecessary packages
|
|
43
|
44
|
|
|
...
|
...
|
@@ -95,14 +96,18 @@ backslashes.
|
|
95
|
95
|
Probably the most common use-case for `RUN` is an application of `apt-get`.
|
|
96
|
96
|
When using `apt-get`, here a few things to keep in mind:
|
|
97
|
97
|
|
|
98
|
|
-* Don’t do simply `RUN apt-get update` on a single line. This will cause
|
|
|
98
|
+* Don’t do `RUN apt-get update` on a single line. This will cause
|
|
99
|
99
|
caching issues if the referenced archive gets updated, which will make your
|
|
100
|
100
|
subsequent `apt-get install` fail without comment.
|
|
101
|
101
|
|
|
102
|
102
|
* For the most part, to keep your code more readable and maintainable, avoid
|
|
103
|
103
|
`RUN apt-get install -y package-foo && apt-get install -y package-bar`.
|
|
104
|
104
|
|
|
105
|
|
-* Avoid `RUN apt-get upgrade` or `dist-upgrade`, since many of the “essential” packages from the base images will fail to upgrade inside an unprivileged container. If a base package is out of date, you should contact its maintainers. If you know there’s a particular package, `foo`, that needs to be updated, use `apt-get install -y foo` and it will update automatically.
|
|
|
105
|
+* Avoid `RUN apt-get upgrade` or `dist-upgrade`, since many of the “essential”
|
|
|
106
|
+packages from the base images will fail to upgrade inside an unprivileged
|
|
|
107
|
+container. If a base package is out of date, you should contact its
|
|
|
108
|
+maintainers. If you know there’s a particular package, `foo`, that needs to be
|
|
|
109
|
+updated, use `apt-get install -y foo` and it will update automatically.
|
|
106
|
110
|
|
|
107
|
111
|
* Do use `RUN apt-get update && apt-get install -y package-bar package-foo
|
|
108
|
112
|
package-baz`. Writing the instruction this way not only makes it easier to read
|
|
...
|
...
|
@@ -111,7 +116,7 @@ will naturally be busted and the latest versions will be installed with no
|
|
111
|
111
|
further coding or manual intervention required.
|
|
112
|
112
|
|
|
113
|
113
|
* Further natural cache-busting can be realized by version-pinning packages
|
|
114
|
|
-(e.g., `package-foo=1.3.*`) since it will force retrieval of that version
|
|
|
114
|
+(e.g., `package-foo=1.3.*`). This will force retrieval of that version
|
|
115
|
115
|
regardless of what’s in the cache.
|
|
116
|
116
|
Forming your `apt-get` code this way will greatly ease maintenance and reduce
|
|
117
|
117
|
failures due to unanticipated changes in required packages.
|
|
...
|
...
|
@@ -120,8 +125,9 @@ failures due to unanticipated changes in required packages.
|
|
120
|
120
|
|
|
121
|
121
|
Below is a well-formed `RUN` instruction that demonstrates the above
|
|
122
|
122
|
recommendations. Note that the last package, `s3cmd`, specifies a version
|
|
123
|
|
-`1.1.0*`, which will bust the `apt-get` cache and force the installation of
|
|
124
|
|
-that version (which in this case had a new, required feature).
|
|
|
123
|
+`1.1.0*`. If the image previously used an older version, specifying the new one
|
|
|
124
|
+will cause a cache bust of `apt-get update` and ensure the installation of
|
|
|
125
|
+the new version (which in this case had a new, required feature).
|
|
125
|
126
|
|
|
126
|
127
|
RUN apt-get update && apt-get install -y \
|
|
127
|
128
|
aufs-tools \
|
|
...
|
...
|
@@ -146,14 +152,14 @@ that version (which in this case had a new, required feature).
|
|
146
|
146
|
### [`CMD`](https://docs.docker.com/reference/builder/#cmd)
|
|
147
|
147
|
|
|
148
|
148
|
The `CMD` instruction should be used to run the software contained by your
|
|
149
|
|
-image, along with any arguments. `CMD` should almost always be used in the
|
|
|
149
|
+image, along with any arguments. `CMD` should almost always be used in the
|
|
150
|
150
|
form of `CMD [“executable”, “param1”, “param2”…]`. Thus, if the image is for a
|
|
151
|
151
|
service (Apache, Rails, etc.), you would run something like
|
|
152
|
152
|
`CMD ["apache2","-DFOREGROUND"]`. Indeed, this form of the instruction is
|
|
153
|
153
|
recommended for any service-based image.
|
|
154
|
154
|
|
|
155
|
155
|
In most other cases, `CMD` should be given an interactive shell (bash, python,
|
|
156
|
|
-perl, etc). For example, `CMD ["perl", "-de0"]`, `CMD ["python"]`, or
|
|
|
156
|
+perl, etc), for example, `CMD ["perl", "-de0"]`, `CMD ["python"]`, or
|
|
157
|
157
|
`CMD [“php”, “-a”]`. Using this form means that when you execute something like
|
|
158
|
158
|
`docker run -it python`, you’ll get dropped into a usable shell, ready to go.
|
|
159
|
159
|
`CMD` should rarely be used in the manner of `CMD [“param”, “param”]` in
|
|
...
|
...
|
@@ -163,11 +169,11 @@ works.
|
|
163
|
163
|
|
|
164
|
164
|
### [`EXPOSE`](https://docs.docker.com/reference/builder/#expose)
|
|
165
|
165
|
|
|
166
|
|
-The `EXPOSE` instruction is the way you tell the users of your image where to
|
|
167
|
|
-connect. Consequently, you should use the common, traditional port for your
|
|
168
|
|
-application. For example, an image containing the Apache web server would use
|
|
169
|
|
-`EXPOSE 80` while an image containing MongoDB would use `EXPOSE 27017` and so
|
|
170
|
|
-on.
|
|
|
166
|
+The `EXPOSE` instruction indicates the ports on which a container will listen
|
|
|
167
|
+for connections. Consequently, you should use the common, traditional port for
|
|
|
168
|
+your application. For example, an image containing the Apache web server would
|
|
|
169
|
+use `EXPOSE 80`, while an image containing MongoDB would use `EXPOSE 27017` and
|
|
|
170
|
+so on.
|
|
171
|
171
|
|
|
172
|
172
|
For external access, your users can execute `docker run` with a flag indicating
|
|
173
|
173
|
how to map the specified port to the port of their choice.
|
|
...
|
...
|
@@ -207,9 +213,10 @@ not immediately obvious. Consequently, the best use for `ADD` is local tar file
|
|
207
|
207
|
auto-extraction into the image, as in `ADD rootfs.tar.xz /`.
|
|
208
|
208
|
|
|
209
|
209
|
Because image size matters, using `ADD` to fetch packages from remote URLs is
|
|
210
|
|
-strongly discouraged; you should use `curl` or `wget` instead. That way you can, where possible, delete the files you no longer need after they’ve been
|
|
211
|
|
-extracted without having to add another layer in your image. For example, you
|
|
212
|
|
-should avoid doing things like:
|
|
|
210
|
+strongly discouraged; you should use `curl` or `wget` instead. That way you can
|
|
|
211
|
+delete the files you no longer need after they’ve been extracted and you won't
|
|
|
212
|
+have to add another layer in your image. For example, you should avoid doing
|
|
|
213
|
+things like:
|
|
213
|
214
|
|
|
214
|
215
|
ADD http://example.com/big.tar.xz /usr/src/things/
|
|
215
|
216
|
RUN tar -xJf /usr/src/things/big.tar.xz -C /usr/src/things
|
|
...
|
...
|
@@ -218,9 +225,9 @@ should avoid doing things like:
|
|
218
|
218
|
And instead, do something like:
|
|
219
|
219
|
|
|
220
|
220
|
RUN mdkir -p /usr/src/things \
|
|
221
|
|
- && curl -SL http://example.com/big.tar.gz \
|
|
222
|
|
- | tar -xJC /usr/src/things \
|
|
223
|
|
- && make -C /usr/src/things all
|
|
|
221
|
+ && curl -SL http://example.com/big.tar.gz \
|
|
|
222
|
+ | tar -xJC /usr/src/things \
|
|
|
223
|
+ && make -C /usr/src/things all
|
|
224
|
224
|
|
|
225
|
225
|
For other items (files, directories) that do not require `ADD`’s tar
|
|
226
|
226
|
auto-extraction capability, you should always use `COPY`.
|
|
...
|
...
|
@@ -311,9 +318,9 @@ Images built from `ONBUILD` should get a separate tag, for example:
|
|
311
|
311
|
`ruby:1.9-onbuild` or `ruby:2.0-onbuild`.
|
|
312
|
312
|
|
|
313
|
313
|
Be careful when putting `ADD` or `COPY` in `ONBUILD`. The “onbuild” image will
|
|
314
|
|
-fail catastrophically if it is missing the the resource being added. Adding a
|
|
315
|
|
-separate tag, as recommended above, will help mitigate this by allowing the
|
|
316
|
|
-`Dockerfile` author to make a choice.
|
|
|
314
|
+fail catastrophically if the new build's context is missing the resource being
|
|
|
315
|
+added. Adding a separate tag, as recommended above, will help mitigate this by
|
|
|
316
|
+allowing the `Dockerfile` author to make a choice.
|
|
317
|
317
|
|
|
318
|
318
|
## Examples For Official Repositories
|
|
319
|
319
|
|