SlideShare a Scribd company logo

DCSF19 Dockerfile Best Practices

Docker, Inc.
Docker, Inc.

This document discusses best practices for improving Dockerfiles. It provides examples of optimizing Dockerfiles to reduce image size, build time, and improve maintainability. Specific techniques covered include using multi-stage builds, caching dependencies, copying specific files rather than entire contexts, and leveraging official images when possible. New Dockerfile features like context mounts and secrets are also briefly introduced.

Technology
1 of 69
Downloaded 257 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
Tibor Vass Docker, Inc. Dockerfile Best Practices Sebastiaan van Stijn Docker, Inc. @tiborvass @thaJeztah
Dockerfile Blueprint to build Docker images Popular: 1+ million Dockerfiles on GitHub
Concurrency, lazy context upload, better caching, new Dockerfile features, ... BuildKit: builder v2 Windows supportcoming soon
Use latest Docker, enable BuildKit today! Docker client: export DOCKER_BUILDKIT=1 Or, Docker daemon config: { "features": {"buildkit": true} }
https://docs.docker.com/engine/reference/builder/
Improving Dockerfiles
- (Incremental) build time - Image size - Maintainability - Security - Consistency/Repeatability Areas of improvements
-rw-r--r-- 1 656 Dec 4 12:20 Dockerfile drwxr-xr-x 2 6.1M Dec 4 09:44 docs/ -rw-r--r-- 1 1.7K Dec 3 09:48 pom.xml -rw-r--r-- 1 1.0K Dec 4 10:12 README.md drwxr-xr-x 4 44K Dec 3 09:48 src/ drwxr-xr-x 2 17M Dec 4 09:50 target/ Basic Java Spring Hello world web app Example project
FROM debian COPY . /app RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh emacs CMD ["java", "-jar", "/app/target/app.jar"] Let’s improve this Dockerfile
Let’s improve this Dockerfile FROM debian COPY . /app RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh emacs vim CMD ["java", "-jar", "/app/target/app.jar"]
Make build cache your friend Incremental build time
Order matters for caching FROM debian COPY . /app RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY . /app CMD ["java", "-jar", "/app/target/app.jar"] Order from least to most frequently changing content.
More specific COPY to limit cache busts FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY . /app COPY target/app.jar /app CMD ["java", "-jar", "/app/target/app.jar"] Only copy what's needed. Avoid "COPY ." if possible
Line buddies: apt-get update & install FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim RUN apt-get update && apt-get -y install openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"] Prevents using an outdated package cache
Reduce image size Faster deploys, smaller attack surface
Remove unnecessary dependencies FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
Remove package manager cache FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk && rm -rf /var/lib/apt/lists/* COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
Remove package manager cache FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk && rm -rf /var/lib/apt/lists/* COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
Maintainability
Use official images where possible - Reduce time spent on maintenance (frequently updated with fixes) - Reduce size (shared layers between images) - Pre-configured for container use - Built by smart people
Use official images when possible FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk && rm -rf /var/lib/apt/lists/* FROM openjdk COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
Use more specific tags FROM openjdk:latest FROM openjdk:8 COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"] The "latest" tag is a rolling tag. Be specific, to prevent unexpected changes in your base image.
Pick your variant Read the image's documentation on Docker Hub https://hub.docker.com/_/openjdk
Look for minimal flavors REPOSITORY TAG SIZE openjdk 8 624MB openjdk 8-jre 443MB openjdk 8-jre-slim 204MB openjdk 8-jre-alpine 83MB Just using a different base image reduced the image size by 540 MB
The Dockerfile as blueprint, source code the source of truth Reproducibility
Build from source in a consistent environment Make the Dockerfile your blueprint: - It describes the build environment - Correct versions of build tools installed - Prevent inconsistencies between environments - There may be system dependencies - The "source of truth" is the source code, not the build artifact
Build from source in a consistent environment FROM openjdk:8-jre-alpine FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY app.jar /app COPY pom.xml . COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"] Build from source in a consistent environment
FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"] Fetch dependencies in a separate step
Identify build dependencies FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"] FROM openjdk:8-jre-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] Multi-stage builds to remove build deps
FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package FROM openjdk:8-jre-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] Multi-stage builds to remove build deps
Not just for reducing image size Multi-stage Dockerfiles
- Moby: 16 stages https://github.com/moby/moby/blob/master/Dockerfile - BuildKit: 44 stages https://github.com/moby/buildkit/blob/master/hack/d ockerfiles/test.buildkit.Dockerfile Projects with many stages
- Separate build from runtime environment (shrinking image size) - Slight variations on images (DRY) - Build/dev/test/lint/... specific environments - Delinearizing your dependencies (concurrency) - Platform-specific stages Multi-stage use cases
FROM image_or_stage AS stage_name … $ docker build --target stage_name Building specific stages with --target
FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-jessie AS release-jessie COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM openjdk:8-jre-alpine AS release-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] $ docker build --target release-jessie . Different image flavors
FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-jessie AS release-jessie COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM openjdk:8-jre-alpine AS release-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] $ docker build --target release-jessie . Different image flavors
FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-jessie AS release-jessie COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM openjdk:8-jre-alpine AS release-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] $ docker build --target release-jessie . Different image flavors
ARG flavor=alpine FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-$flavor AS release COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] $ docker build --target release --build-arg flavor=jessie . Different image flavors (DRY / global ARG)
Examples of possible stage layout: - builder: all build dependencies - build (or binary): builder + built artifacts - cross: same as build but for multiple platforms - dev: build(er) + dev/debug tools - lint: minimal lint dependencies - test: all test dependencies + build artifacts to be tested - release: final minimal image with build artifacts Various environments: build, dev, test, lint, ...
FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-alpine AS lint RUN wget https://github.com/checkstyle/checkstyle/releases/download/checkstyle-8.15/checkstyle-8.15-all.jar COPY checks.xml . COPY src /src RUN java -jar checkstyle-8.15-all.jar -c checks.xml /src Various environments: build, dev, test, lint, ...
FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-alpine AS release COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM builder AS dev RUN apk add --no-cache strace vim tcpdump ENTRYPOINT ["ash"] Various environments: build, dev, test, lint, ...
FROM maven:3.6-jdk-8-alpine AS builder ... RUN mvn -e -B package -DskipTests FROM builder AS unit-test RUN mvn -e -B test FROM release AS integration-test RUN apk add --no-cache curl RUN ./test/run.sh Various environments: build, dev, test, lint, ...
DCSF19 Dockerfile Best Practices
DCSF19 Dockerfile Best Practices
- all stages are executed in sequence - without BuildKit, unneeded stages are unnecessarily executed but discarded From linear Dockerfile stages ...
… to multi-stage graphs with BuildKit - BuildKit traverses from bottom (stage name from --target ) to top
… to multi-stage graphs with BuildKit - BuildKit traverses from bottom (stage name from --target ) to top - Unneeded stages are not even considered
FROM maven:3.6-jdk-8-alpine AS builder ... FROM tiborvass/whalesay AS assets RUN whalesay "Hello DockerCon!" > /out/assets.html FROM openjdk:8-jre-alpine AS release COPY --from=builder /app/app.jar / COPY --from=assets /out /assets CMD ["java", "-jar", "/app.jar"] Multi-stage: build concurrently
FROM maven:3.6-jdk-8-alpine AS builder-base … FROM gcc:8-alpine AS builder-someClib … RUN git clone … ./configure --prefix=/out && make && make install FROM g++:8-alpine AS builder-someCPPlib … RUN git clone … cmake … FROM builder-base AS builder COPY --from=builder-someClib /out / COPY --from=builder-someCPPlib /out / … Multi-stage: build concurrently Concurrency pattern: multiple COPY --from ... COPY --from ...
Benchmarks Based on github.com/moby/moby Dockerfile, master branch. Smaller is better. Time for full build from empty state 2.0x faster
Benchmarks Based on github.com/moby/moby Dockerfile, master branch. Smaller is better. Repeated build with matching cache 7.2x faster
Benchmarks Based on github.com/moby/moby Dockerfile, master branch. Smaller is better. Repeated build with new source code 2.5x faster
New Dockerfile features
Enabling new features Experimental as in, not in mainline Dockerfile syntax. The 1.0-experimental image will not break in the future. # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY . /app RUN mvn -e -B package FROM openjdk:8-jre-alpine COPY --from=builder /app/app.jar / CMD ["java", "-jar", "/app.jar"]
For more details: docs/experimental-syntaxes.md https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/experimental.md
Context mounts (v18.09+ w/ BuildKit) # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY . /app RUN --mount=target=. mvn -e -B package -DoutputDirectory=/ FROM openjdk:8-jre-alpine COPY --from=builder /app/app.jar / CMD ["java", "-jar", "/app.jar"]
Context mounts (v18.09+ w/ BuildKit) # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app RUN --mount=target=. mvn -e -B package -DoutputDirectory=/ FROM openjdk:8-jre-alpine COPY --from=builder /app.jar / CMD ["java", "-jar", "/app.jar"]
Cache dependencies (before BuildKit) FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
Application cache (v18.09+ w/ BuildKit) # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app RUN --mount=target=. --mount=type=cache,target=/root/.m2 && mvn package -DoutputDirectory=/ FROM openjdk:8-jre-alpine COPY --from=builder /app.jar / CMD ["java", "/app.jar"] apt: /var/lib/apt/lists go: ~/.cache/go-build go-modules: $GOPATH/pkg/mod npm: ~/.npm pip: ~/.cache/pip
FROM baseimage RUN ... ENV AWS_ACCESS_KEY_ID=... ENV AWS_SECRET_ACCESS_KEY=... RUN ./fetch-assets-from-s3.sh RUN ./build-scripts.sh Secrets (DON’T DO THIS)
FROM baseimage RUN ... ARG AWS_ACCESS_KEY_ID ARG AWS_SECRET_ACCESS_KEY RUN ./fetch-assets-from-s3.sh RUN ./build-scripts.sh $ docker build --build-arg AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID … . Secrets (DON’T DO THIS EITHER) docker history
# syntax=docker/dockerfile:1-experimental FROM baseimage RUN ... RUN --mount=type=secret,id=aws,target=/root/.aws/credentials ,required ./fetch-assets-from-s3.sh RUN ./build-scripts.sh $ docker build --secret id=aws,src=~/.aws/credentials . Secrets (DO THIS, v18.09+ w/ BuildKit)
FROM baseimage COPY ./keys/private.pem /root/.ssh/private.pem ARG REPO_REF=19ba7bcd9976ef8a9bd086187df19ba7bcd997f2 RUN git clone git@github.com:org/repo /work && cd /work && git checkout -b $REPO_REF Private git repos (DON’T DO THIS)
FROM alpine RUN apk add --no-cache openssh-client RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan github.com >> ~/.ssh/known_hosts ARG REPO_REF=19ba7bcd9976ef8a9bd086187df19ba7bcd997f2 RUN --mount=type=ssh,required git clone git@github.com:org/repo /work && cd /work && git checkout -b $REPO_REF $ eval $(ssh-agent) $ ssh-add ~/.ssh/id_rsa $ docker build --ssh=default . Private git repos (DO THIS, v18.09+ w/ BuildKit)
We went from: - inconsistent build/dev/test environments - bloated image - slow build and incremental build times (cache busts) - building insecurely To: - consistent build/dev/test environments - minimal image - very fast build and incremental build times - building more securely Improvements recap
Read more on blog posts https://medium.com/@tonistiigi/advanced-mult i-stage-build-patterns-6f741b852fae https://medium.com/@tonistiigi/build-secrets-and-s sh-forwarding-in-docker-18-09-ae8161d066
• Multi-stage, multi-stage, multi-stage • DOCKER_BUILDKIT=1 OSS Summit: Advanced BuildKit sessions on Thursday, May 2 at 12:30pm in room 2020 Thank you! Follow us @tiborvass @thaJeztah

More Related Content

What's hot (20)

PDF
Introduction to Docker Compose
Ajeet Singh Raina
 
PPTX
Introduction to docker
Frederik Mogensen
 
PDF
Dockerイメージの理解とコンテナのライフサイクル
Masahito Zembutsu
 
PDF
Docker Introduction
Peng Xiao
 
PDF
Introduction to gradle
NexThoughts Technologies
 
PDF
Intro To Docker
Jessica Lucci
 
PDF
Dockerを支える技術
Etsuji Nakai
 
PPTX
Introduction to Docker
Pubudu Jayawardana
 
PDF
Dockerセキュリティ: 今すぐ役に立つテクニックから，次世代技術まで
Akihiro Suda
 
PDF
”30分”ぐらいでわかる「Kubernetes」について
Yuya Ohara
 
PDF
Introduction to Docker
Aditya Konarde
 
PDF
Docker入門-基礎編 いまから始めるDocker管理【2nd Edition】
Masahito Zembutsu
 
PPTX
Introduction to helm
Jeeva Chelladhurai
 
PDF
Introduction to Docker storage, volume and image
ejlp12
 
PPT
Docker introduction
Phuc Nguyen
 
PPTX
Gitlab CI/CD
JEMLI Fathi
 
PPTX
Introduction to Docker - 2017
Docker, Inc.
 
PDF
A GitOps Kubernetes Native CICD Solution with Argo Events, Workflows, and CD
Julian Mazzitelli
 
PPTX
Kubernetes PPT.pptx
ssuser0cc9131
 
PPTX
Git
Shinu Suresh
 
Introduction to Docker Compose
Ajeet Singh Raina
 
Introduction to docker
Frederik Mogensen
 
Dockerイメージの理解とコンテナのライフサイクル
Masahito Zembutsu
 
Docker Introduction
Peng Xiao
 
Introduction to gradle
NexThoughts Technologies
 
Intro To Docker
Jessica Lucci
 
Dockerを支える技術
Etsuji Nakai
 
Introduction to Docker
Pubudu Jayawardana
 
Dockerセキュリティ: 今すぐ役に立つテクニックから，次世代技術まで
Akihiro Suda
 
”30分”ぐらいでわかる「Kubernetes」について
Yuya Ohara
 
Introduction to Docker
Aditya Konarde
 
Docker入門-基礎編 いまから始めるDocker管理【2nd Edition】
Masahito Zembutsu
 
Introduction to helm
Jeeva Chelladhurai
 
Introduction to Docker storage, volume and image
ejlp12
 
Docker introduction
Phuc Nguyen
 
Gitlab CI/CD
JEMLI Fathi
 
Introduction to Docker - 2017
Docker, Inc.
 
A GitOps Kubernetes Native CICD Solution with Argo Events, Workflows, and CD
Julian Mazzitelli
 
Kubernetes PPT.pptx
ssuser0cc9131
 
Git
Shinu Suresh
 

Similar to DCSF19 Dockerfile Best Practices (20)

PDF
DockerCon EU 2018 - Dockerfile Best Practices
Tibor Vass
 
PDF
DCEU 18: Dockerfile Best Practices
Docker, Inc.
 
PDF
Docker Best Practices Workshop
Ahmed AbouZaid
 
PDF
Be a better developer with Docker (revision 3)
Nicola Paolucci
 
PDF
Docker for Devs - John Zaccone, IBM
Docker, Inc.
 
PPTX
Docker for Development
allingeek
 
PDF
Webinar: Creating an Effective Docker Build Pipeline for Java Apps
Codefresh
 
PPTX
Michal Kordas "Docker: Good, Bad or Both"
LogeekNightUkraine
 
PPTX
Effective images remix
🎥 Brent Langston
 
PDF
IBM Index 2018 Conference Workshop: Modernizing Traditional Java App's with D...
Eric Smalling
 
PDF
Best Practices for Developing & Deploying Java Applications with Docker
Eric Smalling
 
PDF
Java in a world of containers
Docker, Inc.
 
PDF
Java in a World of Containers - DockerCon 2018
Arun Gupta
 
PDF
Lecture eight to be introduced in class.
nigamsajal14
 
PDF
docker.pdf
EishaTirRaazia1
 
PPTX
Cloud native buildpacks_collabnix
Suman Chakraborty
 
PDF
Building distribution packages with Docker
Bruno Cornec
 
PPTX
Dockerizing mule soft esb
sivachandra mandalapu
 
PDF
Dockerfile best practices
Bhushan Lodha
 
ODP
Dockerfiles & Best Practices
Avash Mulmi
 
DockerCon EU 2018 - Dockerfile Best Practices
Tibor Vass
 
DCEU 18: Dockerfile Best Practices
Docker, Inc.
 
Docker Best Practices Workshop
Ahmed AbouZaid
 
Be a better developer with Docker (revision 3)
Nicola Paolucci
 
Docker for Devs - John Zaccone, IBM
Docker, Inc.
 
Docker for Development
allingeek
 
Webinar: Creating an Effective Docker Build Pipeline for Java Apps
Codefresh
 
Michal Kordas "Docker: Good, Bad or Both"
LogeekNightUkraine
 
Effective images remix
🎥 Brent Langston
 
IBM Index 2018 Conference Workshop: Modernizing Traditional Java App's with D...
Eric Smalling
 
Best Practices for Developing & Deploying Java Applications with Docker
Eric Smalling
 
Java in a world of containers
Docker, Inc.
 
Java in a World of Containers - DockerCon 2018
Arun Gupta
 
Lecture eight to be introduced in class.
nigamsajal14
 
docker.pdf
EishaTirRaazia1
 
Cloud native buildpacks_collabnix
Suman Chakraborty
 
Building distribution packages with Docker
Bruno Cornec
 
Dockerizing mule soft esb
sivachandra mandalapu
 
Dockerfile best practices
Bhushan Lodha
 
Dockerfiles & Best Practices
Avash Mulmi
 
Ad

More from Docker, Inc. (20)

PDF
Containerize Your Game Server for the Best Multiplayer Experience
Docker, Inc.
 
PDF
How to Improve Your Image Builds Using Advance Docker Build
Docker, Inc.
 
PDF
Build & Deploy Multi-Container Applications to AWS
Docker, Inc.
 
PDF
Securing Your Containerized Applications with NGINX
Docker, Inc.
 
PDF
How To Build and Run Node Apps with Docker and Compose
Docker, Inc.
 
PDF
Hands-on Helm
Docker, Inc.
 
PDF
Distributed Deep Learning with Docker at Salesforce
Docker, Inc.
 
PDF
The First 10M Pulls: Building The Official Curl Image for Docker Hub
Docker, Inc.
 
PDF
Monitoring in a Microservices World
Docker, Inc.
 
PDF
COVID-19 in Italy: How Docker is Helping the Biggest Italian IT Company Conti...
Docker, Inc.
 
PDF
Predicting Space Weather with Docker
Docker, Inc.
 
PDF
Become a Docker Power User With Microsoft Visual Studio Code
Docker, Inc.
 
PDF
How to Use Mirroring and Caching to Optimize your Container Registry
Docker, Inc.
 
PDF
Monolithic to Microservices + Docker = SDLC on Steroids!
Docker, Inc.
 
PDF
Kubernetes at Datadog Scale
Docker, Inc.
 
PDF
Labels, Labels, Labels
Docker, Inc.
 
PDF
Using Docker Hub at Scale to Support Micro Focus' Delivery and Deployment Model
Docker, Inc.
 
PDF
Build & Deploy Multi-Container Applications to AWS
Docker, Inc.
 
PDF
From Fortran on the Desktop to Kubernetes in the Cloud: A Windows Migration S...
Docker, Inc.
 
PDF
Developing with Docker for the Arm Architecture
Docker, Inc.
 
Containerize Your Game Server for the Best Multiplayer Experience
Docker, Inc.
 
How to Improve Your Image Builds Using Advance Docker Build
Docker, Inc.
 
Build & Deploy Multi-Container Applications to AWS
Docker, Inc.
 
Securing Your Containerized Applications with NGINX
Docker, Inc.
 
How To Build and Run Node Apps with Docker and Compose
Docker, Inc.
 
Hands-on Helm
Docker, Inc.
 
Distributed Deep Learning with Docker at Salesforce
Docker, Inc.
 
The First 10M Pulls: Building The Official Curl Image for Docker Hub
Docker, Inc.
 
Monitoring in a Microservices World
Docker, Inc.
 
COVID-19 in Italy: How Docker is Helping the Biggest Italian IT Company Conti...
Docker, Inc.
 
Predicting Space Weather with Docker
Docker, Inc.
 
Become a Docker Power User With Microsoft Visual Studio Code
Docker, Inc.
 
How to Use Mirroring and Caching to Optimize your Container Registry
Docker, Inc.
 
Monolithic to Microservices + Docker = SDLC on Steroids!
Docker, Inc.
 
Kubernetes at Datadog Scale
Docker, Inc.
 
Labels, Labels, Labels
Docker, Inc.
 
Using Docker Hub at Scale to Support Micro Focus' Delivery and Deployment Model
Docker, Inc.
 
Build & Deploy Multi-Container Applications to AWS
Docker, Inc.
 
From Fortran on the Desktop to Kubernetes in the Cloud: A Windows Migration S...
Docker, Inc.
 
Developing with Docker for the Arm Architecture
Docker, Inc.
 
Ad

Recently uploaded (20)

PPTX
Top Managed Service Providers in Los Angeles
Captain IT
 
PDF
SWEBOK Guide and Software Services Engineering Education
Hironori Washizaki
 
PPTX
MSP360 Backup Scheduling and Retention Best Practices.pptx
MSP360
 
PDF
Impact of IEEE Computer Society in Advancing Emerging Technologies including ...
Hironori Washizaki
 
PDF
Building Real-Time Digital Twins with IBM Maximo & ArcGIS Indoors
Safe Software
 
PDF
CloudStack GPU Integration - Rohit Yadav
ShapeBlue
 
PDF
Français Patch Tuesday - Juillet
Ivanti
 
PDF
Meetup Kickoff & Welcome - Rohit Yadav, CSIUG Chairman
ShapeBlue
 
PPTX
WooCommerce Workshop: Bring Your Laptop
Laura Hartwig
 
PDF
Persuasive AI: risks and opportunities in the age of digital debate
Speck&Tech
 
PDF
CIFDAQ Token Spotlight for 9th July 2025
CIFDAQ
 
PDF
How Startups Are Growing Faster with App Developers in Australia.pdf
India App Developer
 
PDF
Why Orbit Edge Tech is a Top Next JS Development Company in 2025
mahendraalaska08
 
PDF
Predicting the unpredictable: re-engineering recommendation algorithms for fr...
Speck&Tech
 
PDF
SFWelly Summer 25 Release Highlights July 2025
Anna Loughnan Colquhoun
 
PDF
TrustArc Webinar - Data Privacy Trends 2025: Mid-Year Insights & Program Stra...
TrustArc
 
PDF
NewMind AI Journal - Weekly Chronicles - July'25 Week II
NewMind AI
 
PDF
Blockchain Transactions Explained For Everyone
CIFDAQ
 
PDF
Apache CloudStack 201: Let's Design & Build an IaaS Cloud
ShapeBlue
 
PDF
The Builder’s Playbook - 2025 State of AI Report.pdf
jeroen339954
 
Top Managed Service Providers in Los Angeles
Captain IT
 
SWEBOK Guide and Software Services Engineering Education
Hironori Washizaki
 
MSP360 Backup Scheduling and Retention Best Practices.pptx
MSP360
 
Impact of IEEE Computer Society in Advancing Emerging Technologies including ...
Hironori Washizaki
 
Building Real-Time Digital Twins with IBM Maximo & ArcGIS Indoors
Safe Software
 
CloudStack GPU Integration - Rohit Yadav
ShapeBlue
 
Français Patch Tuesday - Juillet
Ivanti
 
Meetup Kickoff & Welcome - Rohit Yadav, CSIUG Chairman
ShapeBlue
 
WooCommerce Workshop: Bring Your Laptop
Laura Hartwig
 
Persuasive AI: risks and opportunities in the age of digital debate
Speck&Tech
 
CIFDAQ Token Spotlight for 9th July 2025
CIFDAQ
 
How Startups Are Growing Faster with App Developers in Australia.pdf
India App Developer
 
Why Orbit Edge Tech is a Top Next JS Development Company in 2025
mahendraalaska08
 
Predicting the unpredictable: re-engineering recommendation algorithms for fr...
Speck&Tech
 
SFWelly Summer 25 Release Highlights July 2025
Anna Loughnan Colquhoun
 
TrustArc Webinar - Data Privacy Trends 2025: Mid-Year Insights & Program Stra...
TrustArc
 
NewMind AI Journal - Weekly Chronicles - July'25 Week II
NewMind AI
 
Blockchain Transactions Explained For Everyone
CIFDAQ
 
Apache CloudStack 201: Let's Design & Build an IaaS Cloud
ShapeBlue
 
The Builder’s Playbook - 2025 State of AI Report.pdf
jeroen339954
 

DCSF19 Dockerfile Best Practices

  • 1. Tibor Vass Docker, Inc. Dockerfile Best Practices Sebastiaan van Stijn Docker, Inc. @tiborvass @thaJeztah
  • 2. Dockerfile Blueprint to build Docker images Popular: 1+ million Dockerfiles on GitHub
  • 3. Concurrency, lazy context upload, better caching, new Dockerfile features, ... BuildKit: builder v2 Windows supportcoming soon
  • 4. Use latest Docker, enable BuildKit today! Docker client: export DOCKER_BUILDKIT=1 Or, Docker daemon config: { "features": {"buildkit": true} }
  • 7. - (Incremental) build time - Image size - Maintainability - Security - Consistency/Repeatability Areas of improvements
  • 8. -rw-r--r-- 1 656 Dec 4 12:20 Dockerfile drwxr-xr-x 2 6.1M Dec 4 09:44 docs/ -rw-r--r-- 1 1.7K Dec 3 09:48 pom.xml -rw-r--r-- 1 1.0K Dec 4 10:12 README.md drwxr-xr-x 4 44K Dec 3 09:48 src/ drwxr-xr-x 2 17M Dec 4 09:50 target/ Basic Java Spring Hello world web app Example project
  • 9. FROM debian COPY . /app RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh emacs CMD ["java", "-jar", "/app/target/app.jar"] Let’s improve this Dockerfile
  • 10. Let’s improve this Dockerfile FROM debian COPY . /app RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh emacs vim CMD ["java", "-jar", "/app/target/app.jar"]
  • 11. Make build cache your friend Incremental build time
  • 12. Order matters for caching FROM debian COPY . /app RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY . /app CMD ["java", "-jar", "/app/target/app.jar"] Order from least to most frequently changing content.
  • 13. More specific COPY to limit cache busts FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim COPY . /app COPY target/app.jar /app CMD ["java", "-jar", "/app/target/app.jar"] Only copy what's needed. Avoid "COPY ." if possible
  • 14. Line buddies: apt-get update & install FROM debian RUN apt-get update RUN apt-get -y install openjdk-8-jdk ssh vim RUN apt-get update && apt-get -y install openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"] Prevents using an outdated package cache
  • 15. Reduce image size Faster deploys, smaller attack surface
  • 16. Remove unnecessary dependencies FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk ssh vim COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
  • 17. Remove package manager cache FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk && rm -rf /var/lib/apt/lists/* COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
  • 18. Remove package manager cache FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk && rm -rf /var/lib/apt/lists/* COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
  • 20. Use official images where possible - Reduce time spent on maintenance (frequently updated with fixes) - Reduce size (shared layers between images) - Pre-configured for container use - Built by smart people
  • 21. Use official images when possible FROM debian RUN apt-get update && apt-get -y install --no-install-recommends openjdk-8-jdk && rm -rf /var/lib/apt/lists/* FROM openjdk COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"]
  • 22. Use more specific tags FROM openjdk:latest FROM openjdk:8 COPY target/app.jar /app CMD ["java", "-jar", "/app/app.jar"] The "latest" tag is a rolling tag. Be specific, to prevent unexpected changes in your base image.
  • 23. Pick your variant Read the image's documentation on Docker Hub https://hub.docker.com/_/openjdk
  • 24. Look for minimal flavors REPOSITORY TAG SIZE openjdk 8 624MB openjdk 8-jre 443MB openjdk 8-jre-slim 204MB openjdk 8-jre-alpine 83MB Just using a different base image reduced the image size by 540 MB
  • 25. The Dockerfile as blueprint, source code the source of truth Reproducibility
  • 26. Build from source in a consistent environment Make the Dockerfile your blueprint: - It describes the build environment - Correct versions of build tools installed - Prevent inconsistencies between environments - There may be system dependencies - The "source of truth" is the source code, not the build artifact
  • 27. Build from source in a consistent environment FROM openjdk:8-jre-alpine FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY app.jar /app COPY pom.xml . COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
  • 28. FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"] Build from source in a consistent environment
  • 29. FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"] Fetch dependencies in a separate step
  • 30. Identify build dependencies FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
  • 31. FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"] FROM openjdk:8-jre-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] Multi-stage builds to remove build deps
  • 32. FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package FROM openjdk:8-jre-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] Multi-stage builds to remove build deps
  • 33. Not just for reducing image size Multi-stage Dockerfiles
  • 34. - Moby: 16 stages https://github.com/moby/moby/blob/master/Dockerfile - BuildKit: 44 stages https://github.com/moby/buildkit/blob/master/hack/d ockerfiles/test.buildkit.Dockerfile Projects with many stages
  • 35. - Separate build from runtime environment (shrinking image size) - Slight variations on images (DRY) - Build/dev/test/lint/... specific environments - Delinearizing your dependencies (concurrency) - Platform-specific stages Multi-stage use cases
  • 36. FROM image_or_stage AS stage_name … $ docker build --target stage_name Building specific stages with --target
  • 37. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-jessie AS release-jessie COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM openjdk:8-jre-alpine AS release-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] $ docker build --target release-jessie . Different image flavors
  • 38. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-jessie AS release-jessie COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM openjdk:8-jre-alpine AS release-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] $ docker build --target release-jessie . Different image flavors
  • 39. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-jessie AS release-jessie COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM openjdk:8-jre-alpine AS release-alpine COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] $ docker build --target release-jessie . Different image flavors
  • 40. ARG flavor=alpine FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-$flavor AS release COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] $ docker build --target release --build-arg flavor=jessie . Different image flavors (DRY / global ARG)
  • 41. Examples of possible stage layout: - builder: all build dependencies - build (or binary): builder + built artifacts - cross: same as build but for multiple platforms - dev: build(er) + dev/debug tools - lint: minimal lint dependencies - test: all test dependencies + build artifacts to be tested - release: final minimal image with build artifacts Various environments: build, dev, test, lint, ...
  • 42. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-alpine AS lint RUN wget https://github.com/checkstyle/checkstyle/releases/download/checkstyle-8.15/checkstyle-8.15-all.jar COPY checks.xml . COPY src /src RUN java -jar checkstyle-8.15-all.jar -c checks.xml /src Various environments: build, dev, test, lint, ...
  • 43. FROM maven:3.6-jdk-8-alpine AS builder ... FROM openjdk:8-jre-alpine AS release COPY --from=builder /app/target/app.jar / CMD ["java", "-jar", "/app.jar"] FROM builder AS dev RUN apk add --no-cache strace vim tcpdump ENTRYPOINT ["ash"] Various environments: build, dev, test, lint, ...
  • 44. FROM maven:3.6-jdk-8-alpine AS builder ... RUN mvn -e -B package -DskipTests FROM builder AS unit-test RUN mvn -e -B test FROM release AS integration-test RUN apk add --no-cache curl RUN ./test/run.sh Various environments: build, dev, test, lint, ...
  • 47. - all stages are executed in sequence - without BuildKit, unneeded stages are unnecessarily executed but discarded From linear Dockerfile stages ...
  • 48. … to multi-stage graphs with BuildKit - BuildKit traverses from bottom (stage name from --target ) to top
  • 49. … to multi-stage graphs with BuildKit - BuildKit traverses from bottom (stage name from --target ) to top - Unneeded stages are not even considered
  • 50. FROM maven:3.6-jdk-8-alpine AS builder ... FROM tiborvass/whalesay AS assets RUN whalesay "Hello DockerCon!" > /out/assets.html FROM openjdk:8-jre-alpine AS release COPY --from=builder /app/app.jar / COPY --from=assets /out /assets CMD ["java", "-jar", "/app.jar"] Multi-stage: build concurrently
  • 51. FROM maven:3.6-jdk-8-alpine AS builder-base … FROM gcc:8-alpine AS builder-someClib … RUN git clone … ./configure --prefix=/out && make && make install FROM g++:8-alpine AS builder-someCPPlib … RUN git clone … cmake … FROM builder-base AS builder COPY --from=builder-someClib /out / COPY --from=builder-someCPPlib /out / … Multi-stage: build concurrently Concurrency pattern: multiple COPY --from ... COPY --from ...
  • 52. Benchmarks Based on github.com/moby/moby Dockerfile, master branch. Smaller is better. Time for full build from empty state 2.0x faster
  • 53. Benchmarks Based on github.com/moby/moby Dockerfile, master branch. Smaller is better. Repeated build with matching cache 7.2x faster
  • 54. Benchmarks Based on github.com/moby/moby Dockerfile, master branch. Smaller is better. Repeated build with new source code 2.5x faster
  • 56. Enabling new features Experimental as in, not in mainline Dockerfile syntax. The 1.0-experimental image will not break in the future. # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY . /app RUN mvn -e -B package FROM openjdk:8-jre-alpine COPY --from=builder /app/app.jar / CMD ["java", "-jar", "/app.jar"]
  • 57. For more details: docs/experimental-syntaxes.md https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/experimental.md
  • 58. Context mounts (v18.09+ w/ BuildKit) # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app COPY . /app RUN --mount=target=. mvn -e -B package -DoutputDirectory=/ FROM openjdk:8-jre-alpine COPY --from=builder /app/app.jar / CMD ["java", "-jar", "/app.jar"]
  • 59. Context mounts (v18.09+ w/ BuildKit) # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app RUN --mount=target=. mvn -e -B package -DoutputDirectory=/ FROM openjdk:8-jre-alpine COPY --from=builder /app.jar / CMD ["java", "-jar", "/app.jar"]
  • 60. Cache dependencies (before BuildKit) FROM maven:3.6-jdk-8-alpine WORKDIR /app COPY pom.xml . RUN mvn -e -B dependency:resolve COPY src ./src RUN mvn -e -B package CMD ["java", "-jar", "/app/app.jar"]
  • 61. Application cache (v18.09+ w/ BuildKit) # syntax=docker/dockerfile:1.0-experimental FROM maven:3.6-jdk-8-alpine AS builder WORKDIR /app RUN --mount=target=. --mount=type=cache,target=/root/.m2 && mvn package -DoutputDirectory=/ FROM openjdk:8-jre-alpine COPY --from=builder /app.jar / CMD ["java", "/app.jar"] apt: /var/lib/apt/lists go: ~/.cache/go-build go-modules: $GOPATH/pkg/mod npm: ~/.npm pip: ~/.cache/pip
  • 62. FROM baseimage RUN ... ENV AWS_ACCESS_KEY_ID=... ENV AWS_SECRET_ACCESS_KEY=... RUN ./fetch-assets-from-s3.sh RUN ./build-scripts.sh Secrets (DON’T DO THIS)
  • 63. FROM baseimage RUN ... ARG AWS_ACCESS_KEY_ID ARG AWS_SECRET_ACCESS_KEY RUN ./fetch-assets-from-s3.sh RUN ./build-scripts.sh $ docker build --build-arg AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID … . Secrets (DON’T DO THIS EITHER) docker history
  • 64. # syntax=docker/dockerfile:1-experimental FROM baseimage RUN ... RUN --mount=type=secret,id=aws,target=/root/.aws/credentials ,required ./fetch-assets-from-s3.sh RUN ./build-scripts.sh $ docker build --secret id=aws,src=~/.aws/credentials . Secrets (DO THIS, v18.09+ w/ BuildKit)
  • 65. FROM baseimage COPY ./keys/private.pem /root/.ssh/private.pem ARG REPO_REF=19ba7bcd9976ef8a9bd086187df19ba7bcd997f2 RUN git clone [email protected]:org/repo /work && cd /work && git checkout -b $REPO_REF Private git repos (DON’T DO THIS)
  • 66. FROM alpine RUN apk add --no-cache openssh-client RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan github.com >> ~/.ssh/known_hosts ARG REPO_REF=19ba7bcd9976ef8a9bd086187df19ba7bcd997f2 RUN --mount=type=ssh,required git clone [email protected]:org/repo /work && cd /work && git checkout -b $REPO_REF $ eval $(ssh-agent) $ ssh-add ~/.ssh/id_rsa $ docker build --ssh=default . Private git repos (DO THIS, v18.09+ w/ BuildKit)
  • 67. We went from: - inconsistent build/dev/test environments - bloated image - slow build and incremental build times (cache busts) - building insecurely To: - consistent build/dev/test environments - minimal image - very fast build and incremental build times - building more securely Improvements recap
  • 68. Read more on blog posts https://medium.com/@tonistiigi/advanced-mult i-stage-build-patterns-6f741b852fae https://medium.com/@tonistiigi/build-secrets-and-s sh-forwarding-in-docker-18-09-ae8161d066
  • 69. • Multi-stage, multi-stage, multi-stage • DOCKER_BUILDKIT=1 OSS Summit: Advanced BuildKit sessions on Thursday, May 2 at 12:30pm in room 2020 Thank you! Follow us @tiborvass @thaJeztah