Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:docker_image_build [2025/10/09 21:47] – Jean-Baptiste
+++ tech:docker_image_build [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon}}
+# Docker image build
+Voir :
+* [[https://docs.docker.com/build/concepts/overview/|Docker Buildx / BuildKit]]
+* https://docs.docker.com/build/building/best-practices/
+* https://docs.openshift.com/container-platform/4.17/openshift_images/create-images.html
+* https://docs.oracle.com/en/operating-systems/oracle-linux/podman/security.html#security
+* [[docker_install_dokuwiki|Exemple de Dockerfile pour Dokuwiki]]
+* https://www.docker.com/blog/docker-best-practices-using-tags-and-labels-to-manage-docker-image-sprawl/
+* https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
+* https://blog.stephane-robert.info/docs/conteneurs/moteurs-conteneurs/
+* https://aws.amazon.com/fr/blogs/france/demystifier-entrypoint-et-cmd-dans-docker/
+Ansible :
+* https://oneuptime.com/blog/post/2026-03-18-use-podman-with-ansible/view
+Outils / Méthode /  Container Image Builders :
+* Docker / Dockerfile
+* Buildah
+* * Buildpacks / pack https://blog.stephane-robert.info/docs/conteneurs/images-conteneurs/build/buildpacks/
+* openshift-imagebuilder
+* [[https://github.com/openshift/source-to-image|Source-To-Image (S2I)]]
+* Kaniko https://blog.stephane-robert.info/docs/conteneurs/images-conteneurs/build/kaniko/
+* S2I
+* CNB
+* Paketo
+* umoci
+## Bonnes pratiques
+Voir :
+  * https://www.sysdig.com/learn-cloud-native/dockerfile-best-practices
+  * https://collabnix.com/running-docker-containers-as-root/
+  * https://www.docker.com/blog/understanding-the-docker-user-instruction/
+  * https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
+  * https://blog.stephane-robert.info/docs/conteneurs/outils/hadolint/
+  * https://medium.com/@SecurityArchitect/hardening-container-images-best-practices-and-examples-for-docker-e941263cab13
+  * https://github.com/nicolargo/glances/issues/3359
+Quand cela est possible préférer `COPY` à `ADD`. Voir https://docs.docker.com/build/building/best-practices/
+Immediately before your ENTRYPOINT or CMD directive, you then add a USER
+Ne pas utiliser `sudo` mais `gosu` ou `su-exec`
+### Vérif Dockerfile Conrainerfile avec Hadolint
+Voir :
+* https://blog.stephane-robert.info/docs/conteneurs/outils/hadolint/
+~~~bash
+podman run --rm -i docker.io/hadolint/hadolint < Dockerfile
+~~~
+## Exemple de Dockerfile et script
+https://github.com/browserless/chrome/blob/master/start.sh
+`start.sh`
+~~~bash
+#!/bin/bash
+set -e
+# When docker restarts, this file is still there,
+# so we need to kill it just in case
+[ -f /tmp/.X99-lock ] && rm -f /tmp/.X99-lock
+_kill_procs() {
+  kill -TERM $node
+  kill -TERM $xvfb
+}
+# Relay quit commands to processes
+trap _kill_procs SIGTERM SIGINT
+Xvfb :99 -screen 0 1024x768x16 -nolisten tcp -nolisten unix &
+xvfb=$!
+export DISPLAY=:99
+dumb-init -- node ./build/index.js $@ &
+node=$!
+wait $node
+wait $xvfb
+~~~
+`Dockerfile`
+~~~
+CMD ["./start.sh"]
+~~~
+## Buildha
+voir https://www.grottedubarbu.fr/buildah-basics/
+docker build
+~~~bash
+buildah bud -t myapp:latest .
+~~~
+L'option `bud` est en réalité une version courte de l'option `build-using-dockerfile`
+## Modification d'image
+~~~
+# Copier nginx vers la registry locale
+crane copy nginx:1.27.3-alpine localhost:5000/nginx:1.27.3-alpine --platform linux/amd64
+# Aplatir l'image
+crane flatten localhost:5000/nginx:1.27.3-alpine \
+  -t localhost:5000/nginx:1.27.3-alpine-flat
+~~~
+Source : https://blog.stephane-robert.info/docs/conteneurs/outils/crane/
+## Autres
+`RUN apk add --no-cache shadow`
+~~~bash
+export DOCKER_BUILDKIT=0
+~~~