dockerfile

Name: dockerfile
Author: chaterm

51installs12forks

How to install dockerfile?

chaterm/terminal-skills/dockerfile

$npx -y skills add chaterm/terminal-skills --skill dockerfile

Installs into the current project.

Summary

Dockerfile 编写最佳实践

Files · 1

View on GitHub

SKILL.md

1	# Dockerfile 编写
2
3	## 概述
4	Dockerfile 最佳实践、安全扫描等技能。
5
6	## 指令详解
7
8	### FROM
9	```dockerfile
10	# 基础镜像
11	FROM ubuntu:22.04
12	FROM node:18-alpine
13	FROM python:3.11-slim
14
15	# 多阶段构建
16	FROM node:18 AS builder
17	FROM nginx:alpine AS production
18
19	# 使用 ARG 动态指定
20	ARG BASE_IMAGE=node:18-alpine
21	FROM ${BASE_IMAGE}
22	```
23
24	### WORKDIR
25	```dockerfile
26	# 设置工作目录（推荐使用绝对路径）
27	WORKDIR /app
28	WORKDIR /home/node/app
29
30	# 多次使用会切换目录
31	WORKDIR /app
32	WORKDIR src
33	# 当前目录: /app/src
34	```
35
36	### COPY 与 ADD
37	```dockerfile
38	# COPY（推荐）
39	COPY package.json ./
40	COPY src/ ./src/
41	COPY --chown=node:node . .
42
43	# 多文件复制
44	COPY package.json package-lock.json ./
45
46	# ADD（支持 URL 和解压）
47	ADD https://example.com/file.tar.gz /app/
48	ADD archive.tar.gz /app/ # 自动解压
49
50	# 推荐：优先使用 COPY，除非需要 ADD 的特殊功能
51	```
52
53	### RUN
54	```dockerfile
55	# Shell 形式
56	RUN apt-get update && apt-get install -y curl
57
58	# Exec 形式
59	RUN ["apt-get", "update"]
60
61	# 最佳实践：合并命令减少层数
62	RUN apt-get update && \
63	apt-get install -y --no-install-recommends \
64	curl \
65	wget \
66	git && \
67	rm -rf /var/lib/apt/lists/*
68	```
69
70	### CMD 与 ENTRYPOINT
71	```dockerfile
72	# CMD - 默认命令（可被覆盖）
73	CMD ["node", "app.js"]
74	CMD ["npm", "start"]
75
76	# ENTRYPOINT - 入口点（不易被覆盖）
77	ENTRYPOINT ["docker-entrypoint.sh"]
78	CMD ["postgres"]
79
80	# 组合使用
81	ENTRYPOINT ["python"]
82	CMD ["app.py"]
83	# 运行: python app.py
84	# docker run myimage other.py -> python other.py
85	```
86
87	### ENV 与 ARG
88	```dockerfile
89	# ENV - 运行时环境变量
90	ENV NODE_ENV=production
91	ENV PORT=3000 HOST=0.0.0.0
92
93	# ARG - 构建时参数
94	ARG VERSION=1.0
95	ARG BUILD_DATE
96
97	# ARG 转 ENV
98	ARG APP_VERSION
99	ENV APP_VERSION=${APP_VERSION}
100
101	# 使用构建参数
102	# docker build --build-arg VERSION=2.0 .
103	```
104
105	### EXPOSE
106	```dockerfile
107	# 声明端口（文档作用）
108	EXPOSE 80
109	EXPOSE 443
110	EXPOSE 3000/tcp
111	EXPOSE 5000/udp
112	```
113
114	### VOLUME
115	```dockerfile
116	# 声明挂载点
117	VOLUME /data
118	VOLUME ["/data", "/logs"]
119	```
120
121	### USER
122	```dockerfile
123	# 切换用户
124	RUN addgroup -S appgroup && adduser -S appuser -G appgroup
125	USER appuser
126
127	# 或使用 UID
128	USER 1000:1000
129	```
130
131	### HEALTHCHECK
132	```dockerfile
133	# 健康检查
134	HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
135	CMD curl -f http://localhost/ \|\| exit 1
136
137	# 禁用健康检查
138	HEALTHCHECK NONE
139	```
140
141	## 最佳实践模板
142
143	### Node.js 应用
144	```dockerfile
145	FROM node:18-alpine
146
147	# 创建非 root 用户
148	RUN addgroup -S appgroup && adduser -S appuser -G appgroup
149
150	WORKDIR /app
151
152	# 先复制依赖文件
153	COPY package*.json ./
154
155	# 安装依赖
156	RUN npm ci --only=production && npm cache clean --force
157
158	# 复制源代码
159	COPY --chown=appuser:appgroup . .
160
161	# 切换用户
162	USER appuser
163
164	EXPOSE 3000
165
166	HEALTHCHECK --interval=30s --timeout=3s \
167	CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health \|\| exit 1
168
169	CMD ["node", "app.js"]
170	```
171
172	### Python 应用
173	```dockerfile
174	FROM python:3.11-slim
175
176	ENV PYTHONDONTWRITEBYTECODE=1
177	ENV PYTHONUNBUFFERED=1
178
179	WORKDIR /app
180
181	# 安装依赖
182	COPY requirements.txt .
183	RUN pip install --no-cache-dir -r requirements.txt
184
185	# 创建非 root 用户
186	RUN useradd -m -r appuser && chown appuser:appuser /app
187	USER appuser
188
189	COPY --chown=appuser:appuser . .
190
191	EXPOSE 8000
192
193	CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"]
194	```
195
196	### Go 应用
197	```dockerfile
198	# 构建阶段
199	FROM golang:1.21-alpine AS builder
200
201	WORKDIR /app
202
203	COPY go.mod go.sum ./
204	RUN go mod download
205
206	COPY . .
207	RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o main .
208
209	# 生产阶段
210	FROM scratch
211
212	COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
213	COPY --from=builder /app/main /main
214
215	EXPOSE 8080
216
217	ENTRYPOINT ["/main"]
218	```
219
220	### Java 应用
221	```dockerfile
222	# 构建阶段
223	FROM maven:3.9-eclipse-temurin-17 AS builder
224
225	WORKDIR /app
226	COPY pom.xml .
227	RUN mvn dependency:go-offline
228
229	COPY src ./src
230	RUN mvn package -DskipTests
231
232	# 生产阶段
233	FROM eclipse-temurin:17-jre-alpine
234
235	RUN addgroup -S appgroup && adduser -S appuser -G appgroup
236	USER appuser
237
238	WORKDIR /app
239	COPY --from=builder /app/target/*.jar app.jar
240
241	EXPOSE 8080
242
243	ENTRYPOINT ["java", "-jar", "app.jar"]
244	```
245
246	## .dockerignore
247
248	```dockerignore
249	# Git
250	.git
251	.gitignore
252
253	# Node
254	node_modules
255	npm-debug.log
256
257	# Python
258	__pycache__
259	*.pyc
260	.venv
261	venv
262
263	# IDE
264	.idea
265	.vscode
266	*.swp
267
268	# Docker
269	Dockerfile*
270	docker-compose*
271	.dockerignore
272
273	# 文档
274	*.md
275	LICENSE
276
277	# 测试
278	test
279	tests
280	coverage
281
282	# 其他
283	.env
284	.env.*
285	*.log
286	tmp
287	```
288
289	## 安全检查
290
291	### 镜像扫描
292	```bash
293	# Docker Scout
294	docker scout cves myimage:tag
295	docker scout recommendations myimage:tag
296
297	# Trivy
298	trivy image myimage:tag
299
300	# Snyk
301	snyk container test myimage:tag
302	```
303
304	### Dockerfile 检查
305	```bash
306	# Hadolint
307	docker run --rm -i hadolint/hadolint < Dockerfile
308
309	# Dockle
310	dockle myimage:tag
311	```
312
313	## 常见场景
314
315	### 场景 1：入口脚本
316	```dockerfile
317	COPY docker-entrypoint.sh /usr/local/bin/
318	RUN chmod +x /usr/local/bin/docker-entrypoint.sh
319	ENTRYPOINT ["docker-entrypoint.sh"]
320	CMD ["app"]
321	```
322
323	```bash
324	#!/bin/bash
325	set -e
326
327	# 初始化逻辑
328	if [ "$1" = 'app' ]; then
329	# 等待依赖服务
330	until nc -z db 5432; do
331	echo "Waiting for database..."
332	sleep 1
333	done
334	fi
335
336	exec "$@"
337	```
338
339	### 场景 2：多架构构建
340	```bash
341	# 创建 builder
342	docker buildx create --name mybuilder --use
343
344	# 多架构构建并推送
345	docker buildx build --platform linux/amd64,linux/arm64 \
346	-t myrepo/myimage:tag --push .
347	```

People who liked this also viewed

6 picks

Type

microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026476k1.3k
azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026472k1.3k
azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026471k1.3k
azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026471k1.3k
azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026470k1.3k
azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026424k1.3k

dockerfile

51installs12forks

View on GitHub

How to install dockerfile?

chaterm/terminal-skills/dockerfile

$npx -y skills add chaterm/terminal-skills --skill dockerfile

Installs into the current project.

Summary

Dockerfile 编写最佳实践

Files · 1

View on GitHub

SKILL.md

1	# Dockerfile 编写
2
3	## 概述
4	Dockerfile 最佳实践、安全扫描等技能。
5
6	## 指令详解
7
8	### FROM
9	```dockerfile
10	# 基础镜像
11	FROM ubuntu:22.04
12	FROM node:18-alpine
13	FROM python:3.11-slim
14
15	# 多阶段构建
16	FROM node:18 AS builder
17	FROM nginx:alpine AS production
18
19	# 使用 ARG 动态指定
20	ARG BASE_IMAGE=node:18-alpine
21	FROM ${BASE_IMAGE}
22	```
23
24	### WORKDIR
25	```dockerfile
26	# 设置工作目录（推荐使用绝对路径）
27	WORKDIR /app
28	WORKDIR /home/node/app
29
30	# 多次使用会切换目录
31	WORKDIR /app
32	WORKDIR src
33	# 当前目录: /app/src
34	```
35
36	### COPY 与 ADD
37	```dockerfile
38	# COPY（推荐）
39	COPY package.json ./
40	COPY src/ ./src/
41	COPY --chown=node:node . .
42
43	# 多文件复制
44	COPY package.json package-lock.json ./
45
46	# ADD（支持 URL 和解压）
47	ADD https://example.com/file.tar.gz /app/
48	ADD archive.tar.gz /app/ # 自动解压
49
50	# 推荐：优先使用 COPY，除非需要 ADD 的特殊功能
51	```
52
53	### RUN
54	```dockerfile
55	# Shell 形式
56	RUN apt-get update && apt-get install -y curl
57
58	# Exec 形式
59	RUN ["apt-get", "update"]
60
61	# 最佳实践：合并命令减少层数
62	RUN apt-get update && \
63	apt-get install -y --no-install-recommends \
64	curl \
65	wget \
66	git && \
67	rm -rf /var/lib/apt/lists/*
68	```
69
70	### CMD 与 ENTRYPOINT
71	```dockerfile
72	# CMD - 默认命令（可被覆盖）
73	CMD ["node", "app.js"]
74	CMD ["npm", "start"]
75
76	# ENTRYPOINT - 入口点（不易被覆盖）
77	ENTRYPOINT ["docker-entrypoint.sh"]
78	CMD ["postgres"]
79
80	# 组合使用
81	ENTRYPOINT ["python"]
82	CMD ["app.py"]
83	# 运行: python app.py
84	# docker run myimage other.py -> python other.py
85	```
86
87	### ENV 与 ARG
88	```dockerfile
89	# ENV - 运行时环境变量
90	ENV NODE_ENV=production
91	ENV PORT=3000 HOST=0.0.0.0
92
93	# ARG - 构建时参数
94	ARG VERSION=1.0
95	ARG BUILD_DATE
96
97	# ARG 转 ENV
98	ARG APP_VERSION
99	ENV APP_VERSION=${APP_VERSION}
100
101	# 使用构建参数
102	# docker build --build-arg VERSION=2.0 .
103	```
104
105	### EXPOSE
106	```dockerfile
107	# 声明端口（文档作用）
108	EXPOSE 80
109	EXPOSE 443
110	EXPOSE 3000/tcp
111	EXPOSE 5000/udp
112	```
113
114	### VOLUME
115	```dockerfile
116	# 声明挂载点
117	VOLUME /data
118	VOLUME ["/data", "/logs"]
119	```
120
121	### USER
122	```dockerfile
123	# 切换用户
124	RUN addgroup -S appgroup && adduser -S appuser -G appgroup
125	USER appuser
126
127	# 或使用 UID
128	USER 1000:1000
129	```
130
131	### HEALTHCHECK
132	```dockerfile
133	# 健康检查
134	HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
135	CMD curl -f http://localhost/ \|\| exit 1
136
137	# 禁用健康检查
138	HEALTHCHECK NONE
139	```
140
141	## 最佳实践模板
142
143	### Node.js 应用
144	```dockerfile
145	FROM node:18-alpine
146
147	# 创建非 root 用户
148	RUN addgroup -S appgroup && adduser -S appuser -G appgroup
149
150	WORKDIR /app
151
152	# 先复制依赖文件
153	COPY package*.json ./
154
155	# 安装依赖
156	RUN npm ci --only=production && npm cache clean --force
157
158	# 复制源代码
159	COPY --chown=appuser:appgroup . .
160
161	# 切换用户
162	USER appuser
163
164	EXPOSE 3000
165
166	HEALTHCHECK --interval=30s --timeout=3s \
167	CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health \|\| exit 1
168
169	CMD ["node", "app.js"]
170	```
171
172	### Python 应用
173	```dockerfile
174	FROM python:3.11-slim
175
176	ENV PYTHONDONTWRITEBYTECODE=1
177	ENV PYTHONUNBUFFERED=1
178
179	WORKDIR /app
180
181	# 安装依赖
182	COPY requirements.txt .
183	RUN pip install --no-cache-dir -r requirements.txt
184
185	# 创建非 root 用户
186	RUN useradd -m -r appuser && chown appuser:appuser /app
187	USER appuser
188
189	COPY --chown=appuser:appuser . .
190
191	EXPOSE 8000
192
193	CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"]
194	```
195
196	### Go 应用
197	```dockerfile
198	# 构建阶段
199	FROM golang:1.21-alpine AS builder
200
201	WORKDIR /app
202
203	COPY go.mod go.sum ./
204	RUN go mod download
205
206	COPY . .
207	RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o main .
208
209	# 生产阶段
210	FROM scratch
211
212	COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
213	COPY --from=builder /app/main /main
214
215	EXPOSE 8080
216
217	ENTRYPOINT ["/main"]
218	```
219
220	### Java 应用
221	```dockerfile
222	# 构建阶段
223	FROM maven:3.9-eclipse-temurin-17 AS builder
224
225	WORKDIR /app
226	COPY pom.xml .
227	RUN mvn dependency:go-offline
228
229	COPY src ./src
230	RUN mvn package -DskipTests
231
232	# 生产阶段
233	FROM eclipse-temurin:17-jre-alpine
234
235	RUN addgroup -S appgroup && adduser -S appuser -G appgroup
236	USER appuser
237
238	WORKDIR /app
239	COPY --from=builder /app/target/*.jar app.jar
240
241	EXPOSE 8080
242
243	ENTRYPOINT ["java", "-jar", "app.jar"]
244	```
245
246	## .dockerignore
247
248	```dockerignore
249	# Git
250	.git
251	.gitignore
252
253	# Node
254	node_modules
255	npm-debug.log
256
257	# Python
258	__pycache__
259	*.pyc
260	.venv
261	venv
262
263	# IDE
264	.idea
265	.vscode
266	*.swp
267
268	# Docker
269	Dockerfile*
270	docker-compose*
271	.dockerignore
272
273	# 文档
274	*.md
275	LICENSE
276
277	# 测试
278	test
279	tests
280	coverage
281
282	# 其他
283	.env
284	.env.*
285	*.log
286	tmp
287	```
288
289	## 安全检查
290
291	### 镜像扫描
292	```bash
293	# Docker Scout
294	docker scout cves myimage:tag
295	docker scout recommendations myimage:tag
296
297	# Trivy
298	trivy image myimage:tag
299
300	# Snyk
301	snyk container test myimage:tag
302	```
303
304	### Dockerfile 检查
305	```bash
306	# Hadolint
307	docker run --rm -i hadolint/hadolint < Dockerfile
308
309	# Dockle
310	dockle myimage:tag
311	```
312
313	## 常见场景
314
315	### 场景 1：入口脚本
316	```dockerfile
317	COPY docker-entrypoint.sh /usr/local/bin/
318	RUN chmod +x /usr/local/bin/docker-entrypoint.sh
319	ENTRYPOINT ["docker-entrypoint.sh"]
320	CMD ["app"]
321	```
322
323	```bash
324	#!/bin/bash
325	set -e
326
327	# 初始化逻辑
328	if [ "$1" = 'app' ]; then
329	# 等待依赖服务
330	until nc -z db 5432; do
331	echo "Waiting for database..."
332	sleep 1
333	done
334	fi
335
336	exec "$@"
337	```
338
339	### 场景 2：多架构构建
340	```bash
341	# 创建 builder
342	docker buildx create --name mybuilder --use
343
344	# 多架构构建并推送
345	docker buildx build --platform linux/amd64,linux/arm64 \
346	-t myrepo/myimage:tag --push .
347	```

People who liked this also viewed

6 picks

Type