Docker 容器化最佳实践：从开发到生产的全流程

为什么选择 Docker？

Docker 解决了"在我机器上能跑"的经典问题：

• 环境一致性：开发、测试、生产完全一致
• 快速部署：秒级启动，弹性伸缩
• 资源隔离：CPU、内存、网络独立
• 版本管理：镜像即代码，可追溯

Dockerfile 编写规范

1. 选择合适的基础镜像

# ❌ 不推荐：镜像太大
FROM ubuntu:latest

# ✅ 推荐：精简版
FROM alpine:3.18

# ✅ 生产环境：指定版本
FROM python:3.11-slim-bookworm

2. 多阶段构建

# 构建阶段
FROM node:18 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# 运行阶段
FROM node:18-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3000
CMD ["node", "dist/index.js"]

镜像大小从 1GB+ 降到 150MB！

3. 层缓存优化

# ❌ 缓存易失效
COPY . .
RUN npm install

# ✅ 利用缓存
COPY package*.json ./
RUN npm install
COPY . .

Docker Compose 开发环境

version: "3.8"
services:
  app:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
      - DB_HOST=db
    volumes:
      - .:/app
      - /app/node_modules
    depends_on:
      - db
  
  db:
    image: postgres:15-alpine
    environment:
      - POSTGRES_PASSWORD=secret
    volumes:
      - pgdata:/var/lib/postgresql/data

volumes:
  pgdata:

生产环境安全加固

1. 非 root 用户运行

RUN addgroup -g 1001 appgroup && \
    adduser -u 1001 -G appgroup -D appuser
USER appuser

2. 只读文件系统

services:
  app:
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true

3. 资源限制

services:
  app:
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 256M

日志与监控

services:
  app:
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

CI/CD 集成

# GitHub Actions
name: Build and Push
on: push
jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: docker/setup-buildx-action@v2
      - uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v4
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

常见问题排查

# 查看容器日志
docker logs -f <container>

# 进入容器调试
docker exec -it <container> /bin/sh

# 查看资源使用
docker stats

# 清理无用资源
docker system prune -a

总结

容器化不是银弹，但遵循最佳实践能让你的部署更可靠、更安全、更高效。