s0sta
EN NL عربي
Filters
Zo zoek je
  • Gewone woorden vinden namen, teksten en voorbeelden.
  • "twee woorden" vindt precies die zin.
  • --naam of -x vindt een optie.
  • #woord zoekt alleen in commando's.
  • @grep vindt lessen en labs die grep gebruiken.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Zet ! voor een woord om het weg te laten. OR tussen woorden betekent één ervan.
  • ↑ ↓ bewegen · Enter openen · Esc sluiten · / zoeken

Hoofdstuk 4Naam in de cursus: Container images

Build and move container images

The container image is the package that goes from CI to production. A DevOps engineer builds it small and repeatable, tags it clearly, and moves it between registries. Docker is the best known tool; the Red Hat tools Podman, Buildah and Skopeo do the same work without a daemon.

  • 5 Lessen
  • 5 Commando's

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

  • Container-images — 4

4.1

Docker — build and run images

docker builds images from a Dockerfile and runs containers; docker compose runs a small stack.

  • Used for: local development, CI builds, simple servers.
docker build -t ghcr.io/acme/shop:1.4.0 .
docker run --rm -p 8080:8080 ghcr.io/acme/shop:1.4.0
docker compose up -d && docker compose logs -f
docker push ghcr.io/acme/shop:1.4.0

Good practice:

  • Multi-stage builds; small base images; a non-root USER.
  • Tag with the version or commit (:1.4.0, :a1b2c3d), not only latest.
  • .dockerignore keeps .git and secrets out of the build.

4.2

Podman — Docker without a daemon

podman runs containers rootless and without a background daemon; the commands are the same as docker.

  • Used for: RHEL servers, rootless containers, systemd services from containers.
podman run -d --name web -p 8080:8080 ghcr.io/acme/shop:1.4.0
podman ps
podman generate systemd --new --name web > ~/.config/systemd/user/web.service
systemctl --user enable --now web

4.3

Buildah — build images in CI safely

buildah builds images without a daemon and without root — no privileged docker-in-docker.

buildah build -t shop:1.4.0 .
buildah build --isolation chroot -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA .
buildah push shop:1.4.0 docker://ghcr.io/acme/shop:1.4.0

4.4

Skopeo — copy and inspect images

skopeo reads and copies images between registries without pulling them.

skopeo inspect docker://ghcr.io/acme/shop:1.4.0
skopeo copy docker://ghcr.io/acme/shop:1.4.0 docker://registry.internal/shop:1.4.0
skopeo list-tags docker://ghcr.io/acme/shop

Good practice:

  • Promote the same image (same digest) from staging to production with skopeo copy; do not rebuild.

4.5

Make images small and fast

Small images pull faster, start faster and have fewer things to patch.

  1. Order the Dockerfile from rarely to often changed: base, packages, dependencies, then code.
  2. Copy the lock file first and install dependencies before COPY . . — the layer cache does the rest.
  3. Multi-stage: compile in a big image, copy only the result into distroless, alpine or ubi-minimal.
  4. One process per container; logs to stdout.
  5. Rebuild often to get base image fixes.

Onthoud

An image name with a digest (shop@sha256:…) points to exactly one image forever; a tag can move.

Alle commando's in dit hoofdstuk