Build and move container images

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

المهارات في هذا الفصل

صور الحاويات — 4

Docker — build and run images

docker builds images from a Dockerfile and runs containers; docker compose runs a small stack.

Used for: local development, CI builds, simple servers.

$docker build -t ghcr.io/acme/shop:1.4.0 .
$docker run --rm -p 8080:8080 ghcr.io/acme/shop:1.4.0
$docker compose up -d && docker compose logs -f
$docker push ghcr.io/acme/shop:1.4.0

Good practice:

Multi-stage builds; small base images; a non-root USER.
Tag with the version or commit (:1.4.0, :a1b2c3d), not only latest.
.dockerignore keeps .git and secrets out of the build.

4.2

Podman — Docker without a daemon

podman runs containers rootless and without a background daemon; the commands are the same as docker.

Used for: RHEL servers, rootless containers, systemd services from containers.

$podman run -d --name web -p 8080:8080 ghcr.io/acme/shop:1.4.0
$podman ps
$podman generate systemd --new --name web > ~/.config/systemd/user/web.service
$systemctl --user enable --now web

4.3

Buildah — build images in CI safely

buildah builds images without a daemon and without root — no privileged docker-in-docker.

$buildah build -t shop:1.4.0 .
$buildah build --isolation chroot -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA .
$buildah push shop:1.4.0 docker://ghcr.io/acme/shop:1.4.0

4.4

Skopeo — copy and inspect images

skopeo reads and copies images between registries without pulling them.

$skopeo inspect docker://ghcr.io/acme/shop:1.4.0
$skopeo copy docker://ghcr.io/acme/shop:1.4.0 docker://registry.internal/shop:1.4.0
$skopeo list-tags docker://ghcr.io/acme/shop

Good practice:

Promote the same image (same digest) from staging to production with skopeo copy; do not rebuild.

4.5

Make images small and fast

Small images pull faster, start faster and have fewer things to patch.

Order the Dockerfile from rarely to often changed: base, packages, dependencies, then code.
Copy the lock file first and install dependencies before COPY . . — the layer cache does the rest.
Multi-stage: compile in a big image, copy only the result into distroless, alpine or ubi-minimal.
One process per container; logs to stdout.
Rebuild often to get base image fixes.

تذكّر

An image name with a digest (shop@sha256:…) points to exactly one image forever; a tag can move.

كل الأوامر في هذا الفصل