Dunia D2: Resepi

Pilih image asas

Anda akan belajar: bagaimana asas alpine, slim, distroless dan hardened ubah saiz dan keselamatan.

Teks BM belum disemak oleh penutur asli.

Disemak dengan Docker Engine 29 pada 31 Okt 2026

Masalahnya

~/diary $ docker build -t diary:debian .[+] Building 0.1s (7/7) FINISHED                                  docker:default => [internal] load build definition from Dockerfile                        0.0s => => transferring dockerfile: 111B                                        0.0s => [internal] load metadata for docker.io/library/nginx:latest             0.0s => [internal] load .dockerignore                                           0.0s => => transferring context: 2B                                             0.0s => [1/2] FROM docker.io/library/nginx:latest@sha256:5ab5b0b01097420873a3f  0.0s => => resolve docker.io/library/nginx:latest@sha256:5ab5b0b01097420873a3f  0.0s => [internal] load build context                                           0.0s => => transferring context: 154B                                           0.0s => [2/2] COPY index.html /usr/share/nginx/html/                            0.0s => exporting to image                                                      0.1s => => exporting layers                                                     0.0s => => exporting manifest sha256:1822000cfb064931374547d3acfd3d2db20f443b8  0.0s => => exporting config sha256:ae4578166d01a725060bb2956f4b1eb8bb2e0d4a2c1  0.0s => => exporting attestation manifest sha256:263a71b840128e95ff9dc22892f06  0.0s => => exporting manifest list sha256:39454aebe9fe6344eac20daa9de63e3e4645  0.0s => => naming to docker.io/library/diary:debian                             0.0s => => unpacking to docker.io/library/diary:debian                          0.0s~/diary $ docker build --build-arg BASE=nginx:1.30-alpine -t diary:alpine .[+] Building 0.1s (7/7) FINISHED                                  docker:default => [internal] load build definition from Dockerfile                        0.0s => => transferring dockerfile: 111B                                        0.0s => [internal] load metadata for docker.io/library/nginx:1.30-alpine        0.0s => [internal] load .dockerignore                                           0.0s => => transferring context: 2B                                             0.0s => [1/2] FROM docker.io/library/nginx:1.30-alpine@sha256:0e52bd054126cdc0  0.0s => => resolve docker.io/library/nginx:1.30-alpine@sha256:0e52bd054126cdc0  0.0s => [internal] load build context                                           0.0s => => transferring context: 154B                                           0.0s => [2/2] COPY index.html /usr/share/nginx/html/                            0.0s => exporting to image                                                      0.1s => => exporting layers                                                     0.0s => => exporting manifest sha256:507252b8915bf4cf4381c15ebf1e7c4a8e4006782  0.0s => => exporting config sha256:d2cfb7e3f8ad6df59596091ba88392820504d809f2d  0.0s => => exporting attestation manifest sha256:27c17ccb04c15651c1207850939a0  0.0s => => exporting manifest list sha256:15f15d8b01bb011e218e5d2ba55eaf961778  0.0s => => naming to docker.io/library/diary:alpine                             0.0s => => unpacking to docker.io/library/diary:alpine                          0.0s~/diary $ docker images diary                                           i Info →   U  In UseIMAGE          ID             DISK USAGE   CONTENT SIZE   EXTRAdiary:alpine   15f15d8b01bb       92.6MB         26.1MB        diary:debian   39454aebe9fe        241MB         63.9MB

Laman diari yang sama dibina dua kali: atas nginx:latest (Debian) dan atas nginx:1.30-alpine. docker images tunjuk yang Debian lebih dua kali ganda besar. Transkrip Docker: $ docker build -t diary:debian . [+] Building 0.1s (7/7) FINISHED docker:default => [internal] load build definition from Dockerfile 0.0s => => transferring dockerfile: 111B 0.0s => [internal] load metadata for docker.io/library/nginx:latest 0.0s => [internal] load .dockerignore 0.0s => => transferring context: 2B 0.0s => [1/2] FROM docker.io/library/nginx:latest@sha256:5ab5b0b01097420873a3f 0.0s => => resolve docker.io/library/nginx:latest@sha256:5ab5b0b01097420873a3f 0.0s => [internal] load build context 0.0s => => transferring context: 154B 0.0s => [2/2] COPY index.html /usr/share/nginx/html/ 0.0s => exporting to image 0.1s => => exporting layers 0.0s => => exporting manifest sha256:1822000cfb064931374547d3acfd3d2db20f443b8 0.0s => => exporting config sha256:ae4578166d01a725060bb2956f4b1eb8bb2e0d4a2c1 0.0s => => exporting attestation manifest sha256:263a71b840128e95ff9dc22892f06 0.0s => => exporting manifest list sha256:39454aebe9fe6344eac20daa9de63e3e4645 0.0s => => naming to docker.io/library/diary:debian 0.0s => => unpacking to docker.io/library/diary:debian 0.0s $ docker build --build-arg BASE=nginx:1.30-alpine -t diary:alpine . [+] Building 0.1s (7/7) FINISHED docker:default => [internal] load build definition from Dockerfile 0.0s => => transferring dockerfile: 111B 0.0s => [internal] load metadata for docker.io/library/nginx:1.30-alpine 0.0s => [internal] load .dockerignore 0.0s => => transferring context: 2B 0.0s => [1/2] FROM docker.io/library/nginx:1.30-alpine@sha256:0e52bd054126cdc0 0.0s => => resolve docker.io/library/nginx:1.30-alpine@sha256:0e52bd054126cdc0 0.0s => [internal] load build context 0.0s => => transferring context: 154B 0.0s => [2/2] COPY index.html /usr/share/nginx/html/ 0.0s => exporting to image 0.1s => => exporting layers 0.0s => => exporting manifest sha256:507252b8915bf4cf4381c15ebf1e7c4a8e4006782 0.0s => => exporting config sha256:d2cfb7e3f8ad6df59596091ba88392820504d809f2d 0.0s => => exporting attestation manifest sha256:27c17ccb04c15651c1207850939a0 0.0s => => exporting manifest list sha256:15f15d8b01bb011e218e5d2ba55eaf961778 0.0s => => naming to docker.io/library/diary:alpine 0.0s => => unpacking to docker.io/library/diary:alpine 0.0s $ docker images diary i Info → U In Use IMAGE ID DISK USAGE CONTENT SIZE EXTRA diary:alpine 15f15d8b01bb 92.6MB 26.1MB diary:debian 39454aebe9fe 241MB 63.9MB

Laptop anda`~/diary`

Tiada tingkap terbuka

Bekas (container)

Belum ada container

Pek beku (image)

nginx:1.30-alpine8 layer · 93.5MB
nginx:latest7 layer · 243MB

Laman sama, resepi sama, dua asas. Satu pek lebih dua kali ganda besar. Asas mana yang anda nak hantar?

Tengok

Ketik setiap titik pada garis masa.

ialah baris FROM: pek yang anda mula guna. Ketik setiap satu, dari yang paling besar ke paling kecil.

Cuba

Kecilkan pek makanan API bawah 200MB. Tukar asas dan cuba peringkat build.

Kecilkan pek makanan bawah 200MB. Setiap butang ialah helah sebenar.

Saiz image 1.36GB

Sasaran: 200MBMula: 1.36GB

Base image

Helah resepi

Dockerfile

FROM node:24
WORKDIR /app
COPY . .
RUN npm ci
RUN npm run build
CMD ["node", "dist/server.js"]

Teka

Anda hantar atas . Kemudian anda taip docker exec -it api sh untuk tengok-tengok. Apa jadi?

Semak

bash

docker run --rm gcr.io/distroless/static-debian13:nonroot sh

docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: exec: "sh": executable file not found in $PATH

Run 'docker run --help' for more information

Ralat sebenar: executable file not found in $PATH. Maksudnya: tiada sh dalam pek ini. Memang itu tujuannya.

Semak

Asas mana yang sesuai?

Seret kad ke dalam kotak. Atau ketik kad, kemudian ketik kotak.

Anda berjaya!

Kini anda boleh pilih asas ikut saiz, alat dan keselamatan.

Nak tahu lebih (pilihan)

Docker Hardened Images ada di dhi.io. Log masuk dengan akaun Docker percuma anda, kemudian pull, contohnya dhi.io/python:3.13. Ia datang dengan SBOM dan provenance yang ditandatangani (Dunia D5). Asas distroless dan hardened sesuai dengan peringkat build.

Misi sebenar

Pull dua asas yang anda guna.
docker pull node:24-alpine
Bandingkan saiznya.
docker images
Cuba projek anda atas asas yang lebih kecil. Masih jalan?

0 daripada 3 langkah siap · Tanda anda disimpan.

Pilih image asas

Laptop anda~/diary

Bekas (container)

Pek beku (image)

Laptop anda`~/diary`