Dockerfile 進階多階段建構

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Stage 1: 建構
FROM eclipse-temurin:21-jdk AS builder
WORKDIR /app
COPY . .
RUN ./mvnw package -q -DskipTests

# Stage 2: 執行（只複製 jar，不含 JDK 與 source code）
FROM eclipse-temurin:21-jre-jammy
COPY --from=builder /app/target/app.jar /app.jar
ENTRYPOINT ["java", "-jar", "/app.jar"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

FROM eclipse-temurin:21-jdk AS builder
WORKDIR /app
COPY pom.xml mvnw ./
COPY .mvn .mvn
# 先只複製 pom.xml，cache mount 讓 ~/.m2 跨 build 保留
RUN --mount=type=cache,target=/root/.m2 \
    ./mvnw dependency:go-offline -q

COPY src ./src
RUN --mount=type=cache,target=/root/.m2 \
    ./mvnw package -q -DskipTests

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

FROM node:20-alpine AS builder
WORKDIR /app
COPY package.json pnpm-lock.yaml ./

# npm cache
RUN --mount=type=cache,target=/root/.npm \
    npm ci --prefer-offline

# pnpm cache
RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
    pnpm install --frozen-lockfile

COPY . .
RUN pnpm build

1
2
3
4
5

RUN --mount=type=cache,target=/root/.gradle \
    ./gradlew dependencies --no-daemon -q

RUN --mount=type=cache,target=/root/.gradle \
    ./gradlew bootJar --no-daemon -q

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 錯誤：機密殘留在 layer history
RUN echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc \
    && npm install \
    && rm ~/.npmrc
# docker history 或 docker save 仍可找到 .npmrc

# 正確：secret 只在 build 期間存在，不進 image
RUN --mount=type=secret,id=npmtoken \
    NPM_TOKEN=$(cat /run/secrets/npmtoken) \
    npm config set //registry.npmjs.org/:_authToken "${NPM_TOKEN}" \
    && npm install

1
2
3
4

# 建構時傳入 secret
docker build --secret id=npmtoken,src=./npm-token.txt -t my-app .
# 或從環境變數
docker build --secret id=npmtoken,env=NPM_TOKEN -t my-app .

1
2
3

RUN --mount=type=secret,id=maven-settings,dst=/root/.m2/settings.xml \
    --mount=type=cache,target=/root/.m2/repository \
    ./mvnw package -q -DskipTests

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

FROM eclipse-temurin:21-jdk AS builder
WORKDIR /app
COPY . .
RUN --mount=type=cache,target=/root/.m2 \
    ./mvnw package -q -DskipTests

# 無 shell，無套件管理器
FROM gcr.io/distroless/java21-debian12
COPY --from=builder /app/target/app.jar /app.jar
# ENTRYPOINT 必須用 exec form（JSON array），不能用 shell form
ENTRYPOINT ["java", "-jar", "/app.jar"]

1
2
3

# 用 debug variant（含 busybox shell）
docker run --rm gcr.io/distroless/java21-debian12:debug sh
# 或在建構時加入 debug stage

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

FROM eclipse-temurin:21-jdk AS jlink-builder
# 先分析 jar 需要哪些模組
RUN java -jar /opt/java/openjdk/lib/ct.sym 2>/dev/null; \
    jdeps --ignore-missing-deps \
          --print-module-deps \
          --multi-release 21 \
          app.jar > /tmp/modules.txt || true

# 建構自訂 JRE（已知模組清單）
RUN jlink \
    --add-modules java.base,java.logging,java.net.http,java.sql,java.management,jdk.crypto.ec \
    --output /jre-custom \
    --strip-debug \
    --no-header-files \
    --no-man-pages \
    --compress=2

# 最終 image：基於 slim debian，只含自訂 JRE
FROM debian:12-slim
COPY --from=jlink-builder /jre-custom /opt/jre
COPY --from=builder /app/target/app.jar /app.jar
ENV PATH="/opt/jre/bin:$PATH"
ENTRYPOINT ["java", "-jar", "/app.jar"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# ARG：只在 build 階段存在，不進入最終 image
ARG APP_VERSION=1.0.0
ARG BUILD_DATE

# ENV：在 image 和 container 執行時都存在
ENV JAVA_OPTS="-Xmx512m -Xms256m"
ENV APP_HOME=/app

# 使用 ARG
RUN echo "Building version: ${APP_VERSION}"

# ARG 可以傳給 ENV（讓 build-time 值進入 runtime）
ARG GIT_COMMIT
ENV GIT_COMMIT_SHA=${GIT_COMMIT}

1
2

# 傳入 ARG
docker build --build-arg APP_VERSION=2.0.1 --build-arg GIT_COMMIT=$(git rev-parse HEAD) -t my-app .

1
2
3
4

# ARG 值可在 docker history 看到
docker history my-app
# IMAGE          CREATED BY
# ...            /bin/sh -c #(nop) ARG APP_VERSION=2.0.1  ← 可見

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# Stage 1: 下載依賴（利用 cache layer）
FROM eclipse-temurin:21-jdk-alpine AS deps
WORKDIR /app
COPY pom.xml mvnw ./
COPY .mvn .mvn
RUN --mount=type=cache,target=/root/.m2 \
    ./mvnw dependency:go-offline -q

# Stage 2: 建構
FROM deps AS builder
COPY src ./src
RUN --mount=type=cache,target=/root/.m2 \
    ./mvnw package -q -DskipTests
# Spring Boot Layered Jar
RUN java -Djarmode=tools -jar target/app.jar extract --layers --destination target/extracted

# Stage 3: 執行（distroless）
FROM gcr.io/distroless/java21-debian12 AS runtime
ARG APP_VERSION=unknown
ARG GIT_COMMIT=unknown
LABEL org.opencontainers.image.version="${APP_VERSION}"
LABEL org.opencontainers.image.revision="${GIT_COMMIT}"

WORKDIR /app
# Layered jar：dependencies 變動較少，先 COPY 利用 Docker cache
COPY --from=builder /app/target/extracted/dependencies/ ./
COPY --from=builder /app/target/extracted/spring-boot-loader/ ./
COPY --from=builder /app/target/extracted/snapshot-dependencies/ ./
COPY --from=builder /app/target/extracted/application/ ./

EXPOSE 8080
ENTRYPOINT ["java", "org.springframework.boot.loader.launch.JarLauncher"]