08 · Docker 容器化

官方文档：https://docs.docker.com/ Docker Hub：https://hub.docker.com/ 最佳实践：https://docs.docker.com/develop/develop-images/dockerfile_best-practices/

---

1. Dockerfile 最佳实践

# 多阶段构建（减小镜像体积）
# Stage 1: 构建
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production   # 只安装生产依赖
COPY . .
RUN npm run build

# Stage 2: 运行（最小化镜像）
FROM node:20-alpine AS runner
WORKDIR /app
RUN addgroup -S appgroup && adduser -S appuser -G appgroup  # 非 root 用户
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
USER appuser
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
  CMD wget -qO- http://localhost:8080/health || exit 1
CMD ["node", "dist/server.js"]

.dockerignore

node_modules
.git
*.log
.env
.env.*
coverage
.nyc_output

---

2. Docker Compose（本地开发 & 测试）

# docker-compose.yml
version: '3.9'

services:
  app:
    build: .
    ports: ["8080:8080"]
    environment:
      - NODE_ENV=production
      - DB_HOST=postgres
      - REDIS_HOST=redis
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: igaming
      POSTGRES_USER: app
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]

volumes:
  postgres_data:
  redis_data:

---

3. 常用 Docker 命令

# 构建
docker build -t igaming-app:latest .
docker build -t igaming-app:v1.2.3 --no-cache .

# 推送到 ECR
aws ecr get-login-password --region ap-southeast-1 | \
  docker login --username AWS --password-stdin $ECR_REGISTRY
docker tag igaming-app:latest $ECR_REGISTRY/igaming-app:latest
docker push $ECR_REGISTRY/igaming-app:latest

# 调试
docker exec -it <container_id> sh
docker logs <container_id> --tail 100 -f
docker stats                               # 实时资源使用
docker inspect <container_id>             # 详细信息
docker system df                          # 磁盘使用

# 清理
docker system prune -a --volumes          # 清理所有未使用资源（谨慎！）
docker image prune -f                     # 只清理悬空镜像

---

官方文档

• Docker 文档：https://docs.docker.com/
• Compose 规范：https://docs.docker.com/compose/compose-file/
• 安全最佳实践：https://docs.docker.com/engine/security/
• Harbor（私有仓库）：https://goharbor.io/docs/

---

最后更新：2025-04