DCEU 18: Dockerfile Best Practices
3 likes2,811 views
This document discusses best practices for writing Dockerfiles. It begins with a refresher on images, Dockerfile build processes, and areas for improvement. Examples are provided of optimizing a sample Dockerfile to improve build caching, reduce image size, and increase reproducibility. Specific techniques covered include ordering commands to leverage caching, using official base images, multi-stage builds, and build arguments. Benchmarks show the optimized Dockerfile builds faster and produces smaller images.
![FROM debian
COPY . /app
RUN apt-get update
RUN apt-get -y install openjdk-8-jdk ssh emacs
CMD ["java", "-jar", "/app/target/app.jar"]
Let’s improve this Dockerfile](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-11-320.jpg)
![Let’s improve this Dockerfile
FROM debian
COPY . /app
RUN apt-get update
RUN apt-get -y install openjdk-8-jdk ssh emacs vim
CMD ["java", "-jar", "/app/target/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-12-320.jpg)
![Order matters for caching
FROM debian
COPY . /app
RUN apt-get update
RUN apt-get -y install openjdk-8-jdk ssh vim
COPY . /app
CMD ["java", "-jar", "/app/target/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-13-320.jpg)
![Order matters for caching
FROM debian
RUN apt-get update
RUN apt-get -y install openjdk-8-jdk ssh vim
COPY . /app
CMD ["java", "-jar", "/app/target/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-14-320.jpg)
![More specific COPY to limit cache bust
FROM debian
RUN apt-get update
RUN apt-get -y install openjdk-8-jdk ssh vim
COPY . /app
COPY target/app.jar /app
CMD ["java", "-jar", "/app/target/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-15-320.jpg)
![More specific COPY to limit cache bust
FROM debian
RUN apt-get update
RUN apt-get -y install openjdk-8-jdk ssh vim
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]
Pro Tip! Use COPY, not ADD for local files](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-16-320.jpg)
![More specific COPY to limit cache bust
FROM debian
RUN apt-get update
RUN apt-get -y install openjdk-8-jdk ssh vim
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-17-320.jpg)
![Identify cacheable "units"
FROM debian
RUN apt-get update
RUN apt-get -y install openjdk-8-jdk ssh vim
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-18-320.jpg)
![Line buddies: apt-get update & install
FROM debian
RUN apt-get update
RUN apt-get -y install openjdk-8-jdk ssh vim
RUN apt-get update && apt-get -y install
openjdk-8-jdk ssh vim
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-19-320.jpg)
![Line buddies: apt-get update & install
FROM debian
RUN apt-get update && apt-get -y install
openjdk-8-jdk ssh vim
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-20-320.jpg)
![Remove unnecessary dependencies
FROM debian
RUN apt-get update && apt-get -y install
openjdk-8-jdk ssh vim
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-21-320.jpg)
![Remove unnecessary dependencies
FROM debian
RUN apt-get update && apt-get -y install
openjdk-8-jdk
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-22-320.jpg)
![Use --no-install-recommends
FROM debian
RUN apt-get update &&
apt-get -y install --no-install-recommends
openjdk-8-jdk
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-23-320.jpg)
![Remove package manager cache
FROM debian
RUN apt-get update &&
apt-get -y install --no-install-recommends
openjdk-8-jdk
&& rm -rf /var/lib/apt/lists/*
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-24-320.jpg)
![Remove package manager cache
FROM debian
RUN apt-get update &&
apt-get -y install --no-install-recommends
openjdk-8-jdk
&& rm -rf /var/lib/apt/lists/*
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-25-320.jpg)
![Reuse official images when possible
FROM debian
RUN apt-get update &&
apt-get -y install --no-install-recommends
openjdk-8-jdk
&& rm -rf /var/lib/apt/lists/*
FROM openjdk
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-26-320.jpg)
![Reuse official images when possible
FROM openjdk
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-28-320.jpg)
![Use more specific tags
FROM openjdk:latest
FROM openjdk:8
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-29-320.jpg)
![Use more specific tags
FROM openjdk:8
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-30-320.jpg)
![Use more specific tags
FROM openjdk:8-jre
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-32-320.jpg)
![Use more specific tags
FROM openjdk:8-jre
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-33-320.jpg)
![Look for minimal flavors
FROM openjdk:8-jre-slim
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-34-320.jpg)
![Look for minimal flavors
FROM openjdk:8-jre-slim
FROM openjdk:8-jre-alpine
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-35-320.jpg)
![Look for minimal flavors
FROM openjdk:8-jre-alpine
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-37-320.jpg)
![Look for reproducibility
FROM openjdk:8-jre-alpine
COPY target/app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-38-320.jpg)
![Build from source in a consistent environment
FROM openjdk:8-jre-alpine
FROM maven:3.6-jdk-8-alpine
COPY app.jar /app
COPY pom.xml /app/
COPY src /app/src
RUN cd /app && mvn -e -B package
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-40-320.jpg)
![Build from source in a consistent environment
FROM maven:3.6-jdk-8-alpine
COPY pom.xml /app/
COPY src /app/src
RUN cd /app && mvn -e -B package
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-41-320.jpg)
![Build from source in a consistent environment
FROM maven:3.6-jdk-8-alpine
WORKDIR /app
COPY pom.xml /app/.
COPY src /app./src
RUN cd /app && mvn -e -B package
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-42-320.jpg)
![Build from source in a consistent environment
FROM maven:3.6-jdk-8-alpine
WORKDIR /app
COPY pom.xml .
COPY src ./src
RUN mvn -e -B package
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-43-320.jpg)
![Cache dependencies
FROM maven:3.6-jdk-8-alpine
WORKDIR /app
COPY pom.xml .
RUN mvn -e -B dependency:resolve
COPY src ./src
RUN mvn -e -B package
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-44-320.jpg)
![Cache dependencies
FROM maven:3.6-jdk-8-alpine
WORKDIR /app
COPY pom.xml .
RUN mvn -e -B dependency:resolve
COPY src ./src
RUN mvn -e -B package
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-45-320.jpg)
![Identify build dependencies
FROM maven:3.6-jdk-8-alpine
WORKDIR /app
COPY pom.xml .
RUN mvn -e -B dependency:resolve
COPY src ./src
RUN mvn -e -B package
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-46-320.jpg)
![FROM maven:3.6-jdk-8-alpine AS builder
WORKDIR /app
COPY pom.xml .
RUN mvn -e -B dependency:resolve
COPY src ./src
RUN mvn -e -B package
CMD ["java", "-jar", "/app/app.jar"]
FROM openjdk:8-jre-alpine
COPY --from=builder /app/target/app.jar /
CMD ["java", "-jar", "/app.jar"]
Multi-stage builds to remove build deps](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-48-320.jpg)
![FROM maven:3.6-jdk-8-alpine AS builder
WORKDIR /app
COPY pom.xml .
RUN mvn -e -B dependency:resolve
COPY src ./src
RUN mvn -e -B package
FROM openjdk:8-jre-alpine
COPY --from=builder /app/target/app.jar /
CMD ["java", "-jar", "/app.jar"]
Multi-stage builds to remove build deps](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-49-320.jpg)
![FROM maven:3.6-jdk-8-alpine AS builder
...
FROM openjdk:8-jre-jessie AS release-jessie
COPY --from=builder /app/target/app.jar /
CMD ["java", "-jar", "/app.jar"]
FROM openjdk:8-jre-alpine AS release-alpine
COPY --from=builder /app/target/app.jar /
CMD ["java", "-jar", "/app.jar"]
docker build --target X](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-52-320.jpg)
![FROM maven:3.6-jdk-8-alpine AS builder
...
FROM openjdk:8-jre-jessie AS release-jessie
COPY --from=builder /app/target/app.jar /
CMD ["java", "-jar", "/app.jar"]
FROM openjdk:8-jre-alpine AS release-alpine
COPY --from=builder /app/target/app.jar /
CMD ["java", "-jar", "/app.jar"]
docker build --target X](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-53-320.jpg)
![FROM maven:3.6-jdk-8-alpine AS builder
...
FROM openjdk:8-jre-jessie AS release-jessie
COPY --from=builder /app/app.jar /
CMD ["java", "-jar", "/app.jar"]
FROM openjdk:8-jre-alpine AS release-alpine
COPY --from=builder /app/app.jar /
CMD ["java", "-jar", "/app.jar"]
docker build --target X](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-54-320.jpg)
![ARG flavor=alpine
FROM maven:3.6-jdk-8-alpine AS builder
...
FROM openjdk:8-jre-$flavor AS release
COPY --from=builder /app/target/app.jar /
CMD ["java", "-jar", "/app.jar"]
Global ARG: docker build --build-arg K=V](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-55-320.jpg)
![FROM maven:3.6-jdk-8-alpine AS builder
...
FROM openjdk:8-jre-alpine AS release
COPY --from=builder /app/target/app.jar /
CMD ["java", "-jar", "/app.jar"]
FROM builder AS dev
RUN apk add --no-cache strace
ENTRYPOINT ["ash"]
Various environments: build, dev, test, lint, ...](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-57-320.jpg)
![FROM maven:3.6-jdk-8-alpine AS builder
...
FROM tiborvass/whalesay AS assets
RUN whalesay "¡Hola DockerCon!" > /out/assets.html
FROM openjdk:8-jre-alpine AS release
COPY --from=builder /app/app.jar /
COPY --from=assets /out /assets
CMD ["java", "-jar", "/app.jar"]
Multi-stage: build concurrently](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-59-320.jpg)
![# syntax = docker/dockerfile:1.0-experimental
# syntax=docker/dockerfile:1.0-experimental
FROM maven:3.6-jdk-8-alpine AS builder
WORKDIR /app
COPY . /app
RUN mvn -e -B package
FROM openjdk:8-jre-alpine
COPY --from=builder /app/app.jar /
CMD ["java", "-jar", "/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-65-320.jpg)
![Context mounts (v18.09 only)
# syntax=docker/dockerfile:1.0-experimental
FROM maven:3.6-jdk-8-alpine AS builder
WORKDIR /app
COPY . /app
RUN --mount=target=. mvn -e -B package -DoutputDirectory=/
FROM openjdk:8-jre-alpine
COPY --from=builder /app/app.jar /
CMD ["java", "-jar", "/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-66-320.jpg)
![Context mounts (v18.09 only)
# syntax=docker/dockerfile:1.0-experimental
FROM maven:3.6-jdk-8-alpine AS builder
WORKDIR /app
RUN --mount=target=. mvn -e -B package -DoutputDirectory=/
FROM openjdk:8-jre-alpine
COPY --from=builder /app.jar /
CMD ["java", "-jar", "/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-67-320.jpg)
![Application cache (v18.09 only)
# syntax=docker/dockerfile:1.0-experimental
FROM maven:3.6-jdk-8-alpine AS builder
WORKDIR /app
RUN --mount=target=. --mount=type=cache,target=/root/.m2
&& mvn package -DoutputDirectory=/
FROM openjdk:8-jre-alpine
COPY --from=builder /app.jar /
CMD ["java", "/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-68-320.jpg)
![Run as an unprivileged user
FROM openjdk:8-jre-alpine
RUN addgroup -g 50 -S appuser
&& adduser -D -S -h /app -s /sbin/nologin
-u 1000 -G appuser appuser
USER appuser:appuser
COPY app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-74-320.jpg)
![Run as an unprivileged user
FROM openjdk:8u181-jre-alpine
RUN addgroup -g 50 -S appuser
&& adduser -D -S -h /app -s /sbin/nologin
-u 1000 -G appuser appuser
USER appuser:appuser
COPY app.jar /app
CMD ["java", "-jar", "/app/app.jar"]](https://image.slidesharecdn.com/dceu18dockerfilebestpractices-181214184623/85/DCEU-18-Dockerfile-Best-Practices-75-320.jpg)
Ad
More Related Content
What's hot (20)
Similar to DCEU 18: Dockerfile Best Practices (20)
Ad
More from Docker, Inc. (20)
Ad
Recently uploaded (20)
DCEU 18: Dockerfile Best Practices
- 1. Tibor Vass Docker, Inc. Dockerfile Best Practices Sebastiaan van Stijn Docker, Inc. @tiborvass @thaJeztah
- 2. Dockerfile A blueprint to build Docker images Popular: 1+ million Dockerfiles on GitHub
- 4. Use latest Docker, enable BuildKit today! Docker client: export DOCKER_BUILDKIT=1 Docker daemon config: { "features": {"buildkit": true} } Windows support coming soon
- 6. image: template to instantiate running containers. References list of filesystem layers layer: a list of changes to a rootfs copy-on-write filesystem: allows smaller disk usage Quick refresher on Images
- 7. Quick refresher on Build Parse Dockerfile and get build steps to perform build caching: no need to perform build steps where files or RUN line have not changed, reuse cached layers build context: local files that can be copied to the image
- 9. - Consistency/Repeatability - (Incremental) build time - Image size - Maintainability Areas of improvements
- 10. -rw-r--r-- 1 656 Dec 4 12:20 Dockerfile drwxr-xr-x 2 6.1M Dec 4 09:44 docs/ -rw-r--r-- 1 1.7K Dec 3 09:48 pom.xml -rw-r--r-- 1 1.0K Dec 4 10:12 README.md drwxr-xr-x 4 44K Dec 3 09:48 src/ drwxr-xr-x 2 17M Dec 4 09:50 target/ Basic Java Spring Hello world web app Example project
- 11. FROM debian COPY . /app RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh emacs CMD ["java", "-jar", "/app/target/app.jar"] Let’s improve this Dockerfile
- 12. Let’s improve this Dockerfile FROM debian COPY . /app RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh emacs vim CMD ["java", "-jar", "/app/target/app.jar"]
- 13. Order matters for caching FROM debian COPY . /app RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY . /app CMD ["java", "-jar", "/app/target/app.jar"]
- 14. Order matters for caching FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY . /app CMD ["java", "-jar", "/app/target/app.jar"]
- 15. More specific COPY to limit cache bust FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY . /app COPY target/app.jar /app CMD ["java", "-jar", "/app/target/app.jar"]
- 16. More specific COPY to limit cache bust FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"] Pro Tip! Use COPY, not ADD for local files
- 17. More specific COPY to limit cache bust FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 18. Identify cacheable "units" FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 19. Line buddies: apt-get update & install FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim RUN apt-get update && apt-get -y install openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 20. Line buddies: apt-get update & install FROM debian RUN apt-get update && apt-get -y install openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 21. Remove unnecessary dependencies FROM debian RUN apt-get update && apt-get -y install openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 22. Remove unnecessary dependencies FROM debian RUN apt-get update && apt-get -y install openjdk-8-jdk COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 23. Use --no-install-recommends FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 24. Remove package manager cache FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk && rm -rf /var/lib/apt/lists/* COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 25. Remove package manager cache FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk && rm -rf /var/lib/apt/lists/* COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 26. Reuse official images when possible FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk && rm -rf /var/lib/apt/lists/* FROM openjdk COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 27. Reuse official images when possible - Reduce time spent on maintenance (frequently updated with fixes) - Reduce size (shared layers between images) - Pre-configured for container use - Built by smart people - Bonus: scanned for vulnerabilities on Docker Hub
- 28. Reuse official images when possible FROM openjdk COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 29. Use more specific tags FROM openjdk:latest FROM openjdk:8 COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 30. Use more specific tags FROM openjdk:8 COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 31. Use more specific tags Read the image's documentation on Docker Hub https://hub.docker.com/_/openjdk
- 32. Use more specific tags FROM openjdk:8-jre COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 33. Use more specific tags FROM openjdk:8-jre COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 34. Look for minimal flavors FROM openjdk:8-jre-slim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 35. Look for minimal flavors FROM openjdk:8-jre-slim FROM openjdk:8-jre-alpine COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 36. Look for minimal flavors REPOSITORY TAG SIZE openjdk 8 624MB openjdk 8-jre 443MB openjdk 8-jre-slim 204MB openjdk 8-jre-alpine 83MB
- 37. Look for minimal flavors FROM openjdk:8-jre-alpine COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 38. Look for reproducibility FROM openjdk:8-jre-alpine COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 39. Build from source in a consistent environment - Build environment is described in the Dockerfile - Correct versions of build tools installed - Prevent inconsistencies between environments - There may be system dependencies - The "source of truth" is the source code not the build artifact
- 40. Build from source in a consistent environment FROM openjdk:8-jre-alpine FROM maven:3.6-jdk-8-alpine COPY app.jar /app COPY pom.xml /app/ COPY src /app/src RUN cd /app && mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
- 41. Build from source in a consistent environment FROM maven:3.6-jdk-8-alpine COPY pom.xml /app/ COPY src /app/src RUN cd /app && mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
- 42. Build from source in a consistent environment FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml /app/. COPY src /app./src RUN cd /app && mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
- 43. Build from source in a consistent environment FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
- 44. Cache dependencies FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
- 45. Cache dependencies FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
- 46. Identify build dependencies FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
- 47. Multi-stage builds to remove build deps FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package
- 48. FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"] FROM openjdk:8-jre-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] Multi-stage builds to remove build deps
- 49. FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package FROM openjdk:8-jre-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] Multi-stage builds to remove build deps
- 50. - Moby: 16 stages https://github.com/moby/moby/blob/master/Dockerfile - BuildKit: 44 stages https://github.com/moby/buildkit/blob/master/hack/do ckerfiles/test.buildkit.Dockerfile Projects with many stages
- 51. - Separate build from runtime environment (shrinking image size) - Slight variations on images - DRY (Don’t Repeat Yourself) - Build/dev/test/lint environments - Concurrent stages - Platform-specific stages Multi-stage usecases
- 52. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-jessie AS release-jessie COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM openjdk:8-jre-alpine AS release-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] docker build --target X
- 53. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-jessie AS release-jessie COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM openjdk:8-jre-alpine AS release-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] docker build --target X
- 54. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-jessie AS release-jessie COPY --from=builder /app/app.jar / CMD ["java", "-jar", "/app.jar"] FROM openjdk:8-jre-alpine AS release-alpine COPY --from=builder /app/app.jar / CMD ["java", "-jar", "/app.jar"] docker build --target X
- 55. ARG flavor=alpine FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-$flavor AS release COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] Global ARG: docker build --build-arg K=V
- 56. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-alpine AS lint RUN wget https://github.com/checkstyle/checkstyle/releases/download/checkstyle-8.15/checkstyle-8.15-all.jar COPY checks.xml . COPY src /src RUN java -jar checkstyle-8.15-all.jar -c checks.xml /src Various environments: build, dev, test, lint, ...
- 57. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-alpine AS release COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM builder AS dev RUN apk add --no-cache strace ENTRYPOINT ["ash"] Various environments: build, dev, test, lint, ...
- 58. FROM maven:3.6-jdk-8-alpine AS builder ... RUN mvn -e -B package -DskipTests FROM builder AS unit-test RUN mvn -e -B test FROM release AS integration-test RUN apk add --no-cache curl RUN ./test/run.sh Various environments: build, dev, test, lint, ...
- 59. FROM maven:3.6-jdk-8-alpine AS builder ... FROM tiborvass/whalesay AS assets RUN whalesay "¡Hola DockerCon!" > /out/assets.html FROM openjdk:8-jre-alpine AS release COPY --from=builder /app/app.jar / COPY --from=assets /out /assets CMD ["java", "-jar", "/app.jar"] Multi-stage: build concurrently
- 60. Benchmarks Based on github.com/moby/moby Dockerfile, master branch. Smaller is better. Time for full build from empty state 2.0x faster
- 61. Benchmarks Based on github.com/moby/moby Dockerfile, master branch. Smaller is better. Repeated build with matching cache 7.2x faster
- 62. Benchmarks Based on github.com/moby/moby Dockerfile, master branch. Smaller is better. Repeated build with new source code 2.5x faster
- 63. Some new Dockerfile features in v18.09
- 64. “Supercharged Docker Build with BuildKit” BlackBelt session Wednesday 12pm - What’s new - New Dockerfile features (RUN --mount, secrets, ssh, syntax customization)
- 65. # syntax = docker/dockerfile:1.0-experimental # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY . /app RUN mvn -e -B package FROM openjdk:8-jre-alpine COPY --from=builder /app/app.jar / CMD ["java", "-jar", "/app.jar"]
- 66. Context mounts (v18.09 only) # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY . /app RUN --mount=target=. mvn -e -B package -DoutputDirectory=/ FROM openjdk:8-jre-alpine COPY --from=builder /app/app.jar / CMD ["java", "-jar", "/app.jar"]
- 67. Context mounts (v18.09 only) # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app RUN --mount=target=. mvn -e -B package -DoutputDirectory=/ FROM openjdk:8-jre-alpine COPY --from=builder /app.jar / CMD ["java", "-jar", "/app.jar"]
- 68. Application cache (v18.09 only) # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app RUN --mount=target=. --mount=type=cache,target=/root/.m2 && mvn package -DoutputDirectory=/ FROM openjdk:8-jre-alpine COPY --from=builder /app.jar / CMD ["java", "/app.jar"]
- 69. We went from: - inconsistent build/dev/test environments - bloated image - slow build and incremental build times (cache busts) To: - consistent build/dev/test environments - minimal image - very fast build and incremental build times Improvements recap
- 70. Read more on blog posts https://medium.com/@tonistiigi/advanced- multi-stage-build-patterns-6f741b852fae https://medium.com/@tonistiigi/build-secrets-an d-ssh-forwarding-in-docker-18-09-ae8161d066
- 71. • Multi-stage, multi-stage, multi-stage • Enable BuildKit • Supercharged Docker Build with BuildKit in BlackBelt session on Wednesday at 12pm Thank you!
- 72. Take A Breakout Survey Access your session and/or workshop surveys for the conference at any time by tapping the Sessions link on the navigation menu or block on the home screen. Find the session/workshop you attended and tap on it to view the session details. On this page, you will find a link to the survey.
- 74. Run as an unprivileged user FROM openjdk:8-jre-alpine RUN addgroup -g 50 -S appuser && adduser -D -S -h /app -s /sbin/nologin -u 1000 -G appuser appuser USER appuser:appuser COPY app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 75. Run as an unprivileged user FROM openjdk:8u181-jre-alpine RUN addgroup -g 50 -S appuser && adduser -D -S -h /app -s /sbin/nologin -u 1000 -G appuser appuser USER appuser:appuser COPY app.jar /app CMD ["java", "-jar", "/app/app.jar"]
- 76. # syntax=docker/dockerfile:1.0-experimental FROM ... RUN --mount=type=secret,id=mysecret,required ... $ docker build --secret id=mysecret,src=/local/secret . Build secrets
- 77. # syntax=docker/dockerfile:1.0-experimental FROM ... RUN --mount=type=ssh git clone [email protected]:myorg/myproject.git $ docker build --ssh default SSH
- 78. Docker Product / Feature Icons Container Image Registry Control Plane Product symbols: • OK to change size (proportionally) • OK to change color • NO changes to shapes, direction, or design • (ok to change ”service” design) Service (swarm) Pod (kubernetes) Group of containers or
- 79. Icons
- 80. Computer, PC, terminal, laptop, device Mobile watch Server, data center Storage database NetworkGlobe, location Layer, vm VM Edge DeviceDevelop dev Cloud
- 81. Repair tune CI / CD Metrics, alert, dashboard Monitor, logging, operations configure Relationship, hierarchy, process, integration, arrows, cycle Check
- 82. Calendar, date CI / CD Clocks, speed, time Security, secure, Scan, key, sign, encrypt firewall Process, relationship, hierarchy, cycle integrate Chain, brokentrust
- 83. People MiscPeople executive architect practitioner developer Generic male Operator, support Hands - Shake Agreement - button group Generic female Generic speaker
- 84. • 20+ Websites for Incredible Free Stock Photos − https://mymodernmet.com/best-free-stock-photography-websites/ − Includes sites focusing on food, nature, places, vintage, humorous/whimsical as well as general photo sites • 21 Amazing Sites With Breathtaking Free Stock Photos − https://blog.snappa.com/free-stock-photos/
- 85. Generic Block Diagrams Calls to Action Summary Groups