Voir :

• Docker Buildx / BuildKit
• https://docs.docker.com/build/building/best-practices/
• https://docs.openshift.com/container-platform/4.17/openshift_images/create-images.html
• https://docs.oracle.com/en/operating-systems/oracle-linux/podman/podman-SecurityRecommendations.html
• Exemple de Dockerfile pour Dokuwiki

Outils / Méthode / Container Image Builders :

• Docker / Dockerfile
• Buildah
• openshift-imagebuilder
• Source-To-Image (S2I)
• Buildpacks / pack
• Kaniko
• S2I
• CNB
• Paketo
• umoci

Voir :

• https://www.sysdig.com/learn-cloud-native/dockerfile-best-practices

Quand cela est possible préférer COPY à ADD. Voir https://docs.docker.com/build/building/best-practices/

Immediately before your ENTRYPOINT or CMD directive, you then add a USER

Ne pas utiliser sudo mais gosu ou su-exec

• https://cloud.theodo.com/en/blog/docker-processes-container
• https://ahmet.im/blog/minimal-init-process-for-containers/
• https://github.com/antontkv/docker-and-pid1

https://github.com/browserless/chrome/blob/master/start.sh

start.sh

#!/bin/bash
set -e
 
# When docker restarts, this file is still there,
# so we need to kill it just in case
[ -f /tmp/.X99-lock ] && rm -f /tmp/.X99-lock
 
_kill_procs() {
  kill -TERM $node
  kill -TERM $xvfb
}
 
# Relay quit commands to processes
trap _kill_procs SIGTERM SIGINT
 
Xvfb :99 -screen 0 1024x768x16 -nolisten tcp -nolisten unix &
xvfb=$!
 
export DISPLAY=:99
 
dumb-init -- node ./build/index.js $@ &
node=$!
 
wait $node
wait $xvfb

Dockerfile

CMD ["./start.sh"]

voir https://www.grottedubarbu.fr/buildah-basics/

docker build

buildah bud -t myapp:latest .

L'option bud est en réalité une version courte de l'option build-using-dockerfile