背景信息

使用企業(yè)版構(gòu)建服務(wù)，容器鏡像服務(wù)可以在鏡像構(gòu)建前自動(dòng)對(duì)構(gòu)建的Dockerfile進(jìn)行優(yōu)化推薦。優(yōu)化推薦功能會(huì)根據(jù)語法規(guī)則以及最優(yōu)實(shí)踐規(guī)則進(jìn)行分析，最后輸出分析結(jié)果。關(guān)于語法規(guī)則的更多內(nèi)容，請(qǐng)參見官方語法規(guī)則。

分析結(jié)果分為Error和Warning兩種等級(jí)：

• Error：Dockerfile中存在語法錯(cuò)誤或容器鏡像服務(wù)不支持的構(gòu)建參數(shù)，此類問題將導(dǎo)致鏡像構(gòu)建出錯(cuò)，需要進(jìn)行改正。

• Warning：Dockerfile中存在潛在問題，可能導(dǎo)致構(gòu)建產(chǎn)生非預(yù)期的結(jié)果或者鏡像存在冗余數(shù)據(jù)。

分析結(jié)果格式

語法檢測結(jié)果

[Error] <Error message> at line <line number>: <Specific instruction content>
[Warning] <Warning message> at line <line number>: <Specific instruction content>
[Error] [Rule <Rule id>] <Error message> at line <line number>: <Specific instruction content>
[Warning] [Rule <Rule id>] <Warning message> at line <line number>: <Specific instruction content>

示例1

存在語法錯(cuò)誤的Dockerfile。

# FROM指令使用了不支持的架構(gòu)的基礎(chǔ)鏡像，并且沒有指定多階段構(gòu)建的名稱
FROM --platform=windows alpine as
# RUN指令使用了不支持的運(yùn)行參數(shù)
RUN --security=insecure cat /proc/self/status | grep CapEff
# ADD指令缺少目的路徑
ADD https://mirrors.edge.kernel.org/pub/linux/kernel/Historic/linux-0.01.tar.gz
# COPY指令不支持拷貝遠(yuǎn)程文件
COPY https://mirrors.edge.kernel.org/pub/linux/kernel/Historic/linux-0.01.tar.gz linux-0.01.tag.gz
# COPY/ADD拷貝的源文件路徑在構(gòu)建路徑下不存在
COPY  <不存在的路徑> /somedir/
# 錯(cuò)誤的指令名稱
CPY /foo /bar

語法檢測結(jié)果輸出。

[parse stage begin.]
[Error] Unsupported target architecture at line 2: windows.
[Error] Lack of stage name at line 2.
[Error] Unsupported security mode at line 4: insecure.
[Error] Lack of dest at line 6.
[Error] COPY does not support remote links. Please use the ADD instruction at line 8: https://mirrors.edge.kernel.org/pub/linux/kernel/Historic/linux-0.01.tar.gz.
[Error] Source path is not exist at line 10: <不存在的路徑>.
[Error] Unknown instruction at line 12: CPY.
[Warning] No tag specified at line 2: from ["--platform=windows"] "alpine" "as".
[parse successfully, takes 0s.]

示例2

違背了最優(yōu)實(shí)踐規(guī)則的Dockerfile。

# 未指定鏡像版本
FROM alpine AS a
# 安裝軟件包后未清除緩存
RUN apk add gcc
# 未指定鏡像版本，使用了已有的階段名
from ubuntu as a
# 安裝軟件包后未清除緩存，未使用--no-install-recommends避免下載不必要的軟件包
RUN apt-get install -y gcc

語法檢測結(jié)果輸出。

[parse stage begin.]
[Warning] [Rule1003]When installing software with apt-get, it is recommended to include the --no-install-recommends parameter at line 8: RUN apt-get install -y gcc .
[Warning] No tag specified at line 2: FROM alpine AS a .
[Warning] No tag specified at line 6: from ubuntu as a .
[Warning] [Rule1001]Using a base image with a specific tag instead of the latest image.
[Error] Duplicate stage names with line 2: a at line 6: from ubuntu as a .
[Error] [Rule1014]Do not use duplicate stage names.
[parse successfully, takes 0s.]

檢測規(guī)則

最優(yōu)實(shí)踐規(guī)則

FROM alpine:3.17 as complie
COPY <source code> code/
RUN make
FROM alpine:3.17
COPY --from=compile /code/bin bin/