5.2.3 多阶段构建与优化 #

# 传统方式 - 问题示例
FROM golang:1.19

WORKDIR /app
COPY . .
RUN go build -o main .

EXPOSE 8080
CMD ["./main"]

# 问题：
# 1. 最终镜像包含完整的 Go 编译环境（~800MB）
# 2. 包含源代码和构建工具
# 3. 安全风险较高
# 4. 部署和传输效率低

# 多阶段构建 - 解决方案
FROM golang:1.19-alpine AS builder
WORKDIR /app
COPY . .
RUN go build -o main .

FROM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /root/
COPY --from=builder /app/main .
EXPOSE 8080
CMD ["./main"]

# 优势：
# 1. 最终镜像只有 ~10MB
# 2. 不包含源代码和构建工具
# 3. 安全性更高
# 4. 部署效率显著提升

# 第一阶段：构建阶段
FROM golang:1.19-alpine AS builder

# 设置工作目录
WORKDIR /app

# 复制 go mod 文件
COPY go.mod go.sum ./

# 下载依赖
RUN go mod download

# 复制源代码
COPY . .

# 构建应用
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main .

# 第二阶段：运行阶段
FROM alpine:latest

# 安装 CA 证书
RUN apk --no-cache add ca-certificates

# 设置工作目录
WORKDIR /root/

# 从构建阶段复制二进制文件
COPY --from=builder /app/main .

# 暴露端口
EXPOSE 8080

# 运行应用
CMD ["./main"]

# 使用有意义的阶段名称
FROM golang:1.19-alpine AS dependencies
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download

FROM dependencies AS builder
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o main .

FROM alpine:latest AS runtime
RUN apk --no-cache add ca-certificates
WORKDIR /app
COPY --from=builder /app/main .
EXPOSE 8080
CMD ["./main"]

# 第一阶段：依赖管理
FROM golang:1.19-alpine AS dependencies

# 安装必要工具
RUN apk add --no-cache git

WORKDIR /app

# 只复制依赖文件
COPY go.mod go.sum ./

# 下载并验证依赖
RUN go mod download && go mod verify

# 第二阶段：应用构建
FROM dependencies AS builder

# 复制源代码
COPY . .

# 构建优化
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
    -ldflags='-w -s -extldflags "-static"' \
    -a -installsuffix cgo \
    -o main .

# 第三阶段：运行时环境
FROM scratch AS runtime

# 复制时区信息
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo

# 复制 CA 证书
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

# 复制应用程序
COPY --from=builder /app/main /main

# 暴露端口
EXPOSE 8080

# 运行应用
ENTRYPOINT ["/main"]

# 基础依赖阶段
FROM golang:1.19-alpine AS base
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .

# 并行构建 API 服务
FROM base AS api-builder
RUN CGO_ENABLED=0 go build -o api ./cmd/api

# 并行构建 Worker 服务
FROM base AS worker-builder
RUN CGO_ENABLED=0 go build -o worker ./cmd/worker

# 并行构建 CLI 工具
FROM base AS cli-builder
RUN CGO_ENABLED=0 go build -o cli ./cmd/cli

# API 服务运行时
FROM alpine:latest AS api-runtime
RUN apk --no-cache add ca-certificates
COPY --from=api-builder /app/api /usr/local/bin/
EXPOSE 8080
CMD ["api"]

# Worker 服务运行时
FROM alpine:latest AS worker-runtime
RUN apk --no-cache add ca-certificates
COPY --from=worker-builder /app/worker /usr/local/bin/
CMD ["worker"]

# CLI 工具运行时
FROM alpine:latest AS cli-runtime
RUN apk --no-cache add ca-certificates
COPY --from=cli-builder /app/cli /usr/local/bin/
ENTRYPOINT ["cli"]

FROM golang:1.19-alpine AS builder

WORKDIR /app

# 优化：先复制依赖文件，利用 Docker 层缓存
COPY go.mod go.sum ./

# 这一层只有在依赖变化时才会重新构建
RUN go mod download

# 复制源代码（代码变更不会影响依赖层）
COPY . .

# 构建应用
RUN CGO_ENABLED=0 go build -o main .

FROM scratch
COPY --from=builder /app/main /main
ENTRYPOINT ["/main"]

# syntax=docker/dockerfile:1.4
FROM golang:1.19-alpine AS builder

WORKDIR /app

COPY go.mod go.sum ./

# 使用缓存挂载优化依赖下载
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download

COPY . .

# 使用缓存挂载优化构建过程
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 go build -o main .

FROM scratch
COPY --from=builder /app/main /main
ENTRYPOINT ["/main"]

FROM golang:1.19-alpine AS builder

# 定义构建参数
ARG VERSION=dev
ARG BUILD_TIME
ARG GIT_COMMIT

WORKDIR /app

COPY go.mod go.sum ./
RUN go mod download

COPY . .

# 在构建时注入版本信息
RUN CGO_ENABLED=0 go build \
    -ldflags="-X main.Version=${VERSION} -X main.BuildTime=${BUILD_TIME} -X main.GitCommit=${GIT_COMMIT}" \
    -o main .

FROM scratch
COPY --from=builder /app/main /main
ENTRYPOINT ["/main"]

# 选择 1：Alpine Linux（平衡大小和功能）
FROM golang:1.19-alpine AS builder
# ... 构建过程 ...
FROM alpine:latest
RUN apk --no-cache add ca-certificates
COPY --from=builder /app/main .
CMD ["./main"]

# 选择 2：Distroless（Google 维护的最小镜像）
FROM golang:1.19 AS builder
# ... 构建过程 ...
FROM gcr.io/distroless/static:nonroot
COPY --from=builder /app/main .
EXPOSE 8080
ENTRYPOINT ["./main"]

# 选择 3：Scratch（最小化，但调试困难）
FROM golang:1.19-alpine AS builder
# ... 构建过程 ...
FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /app/main .
ENTRYPOINT ["./main"]

FROM golang:1.19-alpine AS builder

WORKDIR /app

COPY go.mod go.sum ./
RUN go mod download

COPY . .

# 静态链接构建，减少运行时依赖
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
    -ldflags='-w -s -extldflags "-static"' \
    -a -installsuffix cgo \
    -tags netgo \
    -o main .

# 使用 scratch 作为最小运行时
FROM scratch

# 只复制必要的文件
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /app/main /main

EXPOSE 8080
ENTRYPOINT ["/main"]

# 完整的 Web 应用多阶段构建示例
FROM node:16-alpine AS frontend-builder

WORKDIR /app/frontend

# 构建前端资源
COPY frontend/package*.json ./
RUN npm ci --only=production

COPY frontend/ ./
RUN npm run build

# Go 后端构建
FROM golang:1.19-alpine AS backend-builder

WORKDIR /app

# 安装构建依赖
RUN apk add --no-cache git

# 下载 Go 依赖
COPY go.mod go.sum ./
RUN go mod download

# 复制后端代码
COPY . .

# 从前端构建阶段复制静态资源
COPY --from=frontend-builder /app/frontend/dist ./static

# 构建后端应用
RUN CGO_ENABLED=0 go build -o main .

# 最终运行时镜像
FROM alpine:latest

RUN apk --no-cache add ca-certificates

WORKDIR /app

# 复制应用程序和静态资源
COPY --from=backend-builder /app/main .
COPY --from=backend-builder /app/static ./static

EXPOSE 8080
CMD ["./main"]

# 微服务项目的多阶段构建
FROM golang:1.19-alpine AS base

WORKDIR /app

# 安装依赖
RUN apk add --no-cache git ca-certificates

# 下载模块依赖
COPY go.mod go.sum ./
RUN go mod download

# 复制共享代码
COPY internal/ ./internal/
COPY pkg/ ./pkg/

# 用户服务构建
FROM base AS user-service-builder
COPY cmd/user-service/ ./cmd/user-service/
RUN CGO_ENABLED=0 go build -o user-service ./cmd/user-service

# 订单服务构建
FROM base AS order-service-builder
COPY cmd/order-service/ ./cmd/order-service/
RUN CGO_ENABLED=0 go build -o order-service ./cmd/order-service

# 支付服务构建
FROM base AS payment-service-builder
COPY cmd/payment-service/ ./cmd/payment-service/
RUN CGO_ENABLED=0 go build -o payment-service ./cmd/payment-service

# 用户服务运行时
FROM alpine:latest AS user-service
RUN apk --no-cache add ca-certificates
COPY --from=user-service-builder /app/user-service /usr/local/bin/
EXPOSE 8080
CMD ["user-service"]

# 订单服务运行时
FROM alpine:latest AS order-service
RUN apk --no-cache add ca-certificates
COPY --from=order-service-builder /app/order-service /usr/local/bin/
EXPOSE 8081
CMD ["order-service"]

# 支付服务运行时
FROM alpine:latest AS payment-service
RUN apk --no-cache add ca-certificates
COPY --from=payment-service-builder /app/payment-service /usr/local/bin/
EXPOSE 8082
CMD ["payment-service"]

#!/bin/bash
# multi-build.sh

set -e

# 构建参数
VERSION=${1:-dev}
BUILD_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
GIT_COMMIT=$(git rev-parse --short HEAD)

echo "Building multi-stage application..."
echo "Version: $VERSION"
echo "Build Time: $BUILD_TIME"
echo "Git Commit: $GIT_COMMIT"

# 启用 BuildKit
export DOCKER_BUILDKIT=1

# 构建不同的服务
services=("user-service" "order-service" "payment-service")

for service in "${services[@]}"; do
    echo "Building $service..."

    docker build \
        --target "$service" \
        --build-arg VERSION="$VERSION" \
        --build-arg BUILD_TIME="$BUILD_TIME" \
        --build-arg GIT_COMMIT="$GIT_COMMIT" \
        -t "myapp-$service:$VERSION" \
        -t "myapp-$service:latest" \
        .

    echo "$service build completed!"
done

echo "All services built successfully!"

# docker-compose.build.yml
version: "3.8"

services:
  user-service:
    build:
      context: .
      target: user-service
      args:
        VERSION: ${VERSION:-dev}
        BUILD_TIME: ${BUILD_TIME}
        GIT_COMMIT: ${GIT_COMMIT}
    image: myapp-user-service:${VERSION:-dev}

  order-service:
    build:
      context: .
      target: order-service
      args:
        VERSION: ${VERSION:-dev}
        BUILD_TIME: ${BUILD_TIME}
        GIT_COMMIT: ${GIT_COMMIT}
    image: myapp-order-service:${VERSION:-dev}

  payment-service:
    build:
      context: .
      target: payment-service
      args:
        VERSION: ${VERSION:-dev}
        BUILD_TIME: ${BUILD_TIME}
        GIT_COMMIT: ${GIT_COMMIT}
    image: myapp-payment-service:${VERSION:-dev}

# 调试技巧：创建调试阶段
FROM golang:1.19-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN go build -o main .

# 调试阶段 - 包含调试工具
FROM alpine:latest AS debug
RUN apk --no-cache add ca-certificates curl vim strace
COPY --from=builder /app/main .
EXPOSE 8080
CMD ["./main"]

# 生产阶段 - 最小化
FROM scratch AS production
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /app/main .
EXPOSE 8080
ENTRYPOINT ["/main"]

# 检查特定构建阶段
docker build --target builder -t debug-builder .

# 运行构建阶段进行调试
docker run -it debug-builder /bin/sh

# 检查中间层大小
docker history myapp:latest

# 分析镜像层
docker image inspect myapp:latest

# 使用并行构建和缓存优化
FROM golang:1.19-alpine AS base
WORKDIR /app
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod go mod download

# 并行构建多个二进制文件
FROM base AS build-api
COPY cmd/api/ ./cmd/api/
COPY internal/ ./internal/
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    go build -o api ./cmd/api

FROM base AS build-worker
COPY cmd/worker/ ./cmd/worker/
COPY internal/ ./internal/
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    go build -o worker ./cmd/worker

# 最终镜像
FROM alpine:latest
RUN apk --no-cache add ca-certificates
COPY --from=build-api /app/api /usr/local/bin/
COPY --from=build-worker /app/worker /usr/local/bin/

# 分析镜像大小
docker images | grep myapp

# 使用 dive 工具分析镜像层
dive myapp:latest

# 比较不同构建策略的镜像大小
docker build -t myapp:single-stage -f Dockerfile.single .
docker build -t myapp:multi-stage -f Dockerfile.multi .
docker images | grep myapp