Docker image build

Voir :

Docker Buildx / BuildKit

https://docs.docker.com/build/building/best-practices/

https://docs.openshift.com/container-platform/4.17/openshift_images/create-images.html

https://docs.oracle.com/en/operating-systems/oracle-linux/podman/security.html#security

Exemple de Dockerfile pour Dokuwiki

https://www.docker.com/blog/docker-best-practices-using-tags-and-labels-to-manage-docker-image-sprawl/

https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry

https://blog.stephane-robert.info/docs/conteneurs/moteurs-conteneurs/

https://aws.amazon.com/fr/blogs/france/demystifier-entrypoint-et-cmd-dans-docker/

Ansible :

https://oneuptime.com/blog/post/2026-03-18-use-podman-with-ansible/view

Outils / Méthode / Container Image Builders :

Docker / Dockerfile

Buildah

* Buildpacks / pack https://blog.stephane-robert.info/docs/conteneurs/images-conteneurs/build/buildpacks/

openshift-imagebuilder

Source-To-Image (S2I)

Kaniko https://blog.stephane-robert.info/docs/conteneurs/images-conteneurs/build/kaniko/

S2I

CNB

Paketo

umoci

Bonnes pratiques

Voir :

https://www.sysdig.com/learn-cloud-native/dockerfile-best-practices

https://collabnix.com/running-docker-containers-as-root/

https://www.docker.com/blog/understanding-the-docker-user-instruction/

https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

https://blog.stephane-robert.info/docs/conteneurs/outils/hadolint/

https://medium.com/@SecurityArchitect/hardening-container-images-best-practices-and-examples-for-docker-e941263cab13

https://github.com/nicolargo/glances/issues/3359

Quand cela est possible préférer COPY à ADD. Voir https://docs.docker.com/build/building/best-practices/

Immediately before your ENTRYPOINT or CMD directive, you then add a USER

Ne pas utiliser sudo mais gosu ou su-exec

Vérif Dockerfile Conrainerfile avec Hadolint

Voir :

https://blog.stephane-robert.info/docs/conteneurs/outils/hadolint/

podman run --rm -i docker.io/hadolint/hadolint < Dockerfile

Exemple de Dockerfile et script

https://github.com/browserless/chrome/blob/master/start.sh

start.sh

#!/bin/bash set -e # When docker restarts, this file is still there, # so we need to kill it just in case [ -f /tmp/.X99-lock ] && rm -f /tmp/.X99-lock _kill_procs() { kill -TERM $node kill -TERM $xvfb } # Relay quit commands to processes trap _kill_procs SIGTERM SIGINT Xvfb :99 -screen 0 1024x768x16 -nolisten tcp -nolisten unix & xvfb=$! export DISPLAY=:99 dumb-init -- node ./build/index.js $@ & node=$! wait $node wait $xvfb

Dockerfile

CMD ["./start.sh"]

Buildha

voir https://www.grottedubarbu.fr/buildah-basics/

docker build

buildah bud -t myapp:latest .

L'option bud est en réalité une version courte de l'option build-using-dockerfile

Modification d'image

# Copier nginx vers la registry locale
crane copy nginx:1.27.3-alpine localhost:5000/nginx:1.27.3-alpine --platform linux/amd64
# Aplatir l'image
crane flatten localhost:5000/nginx:1.27.3-alpine \
-t localhost:5000/nginx:1.27.3-alpine-flat

Source : https://blog.stephane-robert.info/docs/conteneurs/outils/crane/

Autres

RUN apk add --no-cache shadow

export DOCKER_BUILDKIT=0