s0sta
EN NL عربي
الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

الفصل 5الاسم في الدورة: Image best practices

Build small images with multi-stage builds

Small images start faster, download faster and have fewer vulnerabilities. A multi-stage build compiles in a big "builder" image and copies only the result into a tiny runtime image. Add a non-root user, pinned bases and labels — and the image is production-ready.

  • 5 الدروس
  • 3 الأوامر

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

5.1

Split build and runtime

Each FROM starts a new stage. COPY --from=STAGE takes only the files you need.

Dockerfile (Go app)
FROM golang:1.23 AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /out/app ./cmd/app
 
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/app /app
USER nonroot
EXPOSE 8080
ENTRYPOINT ["/app"]
docker build -t api:dev .
docker images api:dev
docker build --target build -t api:build .
Base imageSizeHas a shell / package manager
ubuntu, debian70 – 120 MBYes
*-slim30 – 80 MBYes, fewer packages
alpineabout 8 MBYes (musl libc, can differ)
UBI minimal / micro (Red Hat)30 – 100 MB / about 25 MBminimal: microdnf / micro: no
distroless2 – 20 MBNo — smallest attack surface

الأوامر في هذا الدرس

5.2

Run as a non-root user

Root in the container is root on the host if the container escapes. Use a fixed, non-root UID.

Dockerfile (user)
RUN groupadd -r app -g 1001 && useradd -r -u 1001 -g app app
USER 1001:1001
docker run --rm shop:dev id
uid=1001(app) gid=1001(app) groups=1001(app)

تذكّر

Many orchestrators (and OpenShift) run containers with a random UID. Make the app folder readable by the group 0, and do not write outside /tmp and mounted volumes.

الأوامر في هذا الدرس

5.3

Pin the base and rebuild often

Pin the base image (tag or digest) so builds are repeatable — and rebuild regularly so you get the security fixes.

Dockerfile (pinned)
FROM python:3.12.7-slim@sha256:DIGEST

في العمل

Let Dependabot or Renovate open PRs when a new base image digest appears, and rebuild every week even without code changes.

5.4

Add metadata

Standard OCI labels say where an image came from.

Dockerfile (labels)
LABEL org.opencontainers.image.source="https://github.com/s0sta/shop" \
      org.opencontainers.image.revision="${GIT_SHA}" \
      org.opencontainers.image.version="${VERSION}"

5.5

Check an image before you ship it

Look at size, layers, user and vulnerabilities.

docker image inspect shop:dev --format '{{.Config.User}} {{.Size}}'
docker history --no-trunc shop:dev | head
trivy image --severity HIGH,CRITICAL shop:dev
hadolint Dockerfile

hadolint lints Dockerfiles: missing pins, apt-get without cleanup, ADD instead of COPY, root user.

كل الأوامر في هذا الفصل