3 ms·
Something really useful I recently discovered is multi-stage Dockerfiles. Using FROM and then COPY --from to copy from a previous stage to prevent unwanted inte
by dkarp 6y ago
Something really useful I recently discovered is multi-stage Dockerfiles. Using FROM and then COPY --from to copy from a previous stage to prevent unwanted intermediate build steps that might expose secrets or just bloat your images.
Two ways this was useful for us. Firstly, we needed a private key in the image to pull some private git repos. By doing this in a previous stage, they're not included in the final image layers. Secondly, we have a python backend and small react app served from the same image. By splitting their build steps into a backend and frontend stage, changes to frontend code don't break caching for the later backend steps or vice versa. E.g.
FROM python:3.8.3-slim-buster AS frontend
# Do frontend build steps
FROM python:3.8.3-slim-buster AS backend
# Do backend build steps
FROM python:3.8.3-slim-buster AS final
COPY --from=frontend /app /app/frontend
COPY --from=backend /app /app/backend
- junon 6y agoThis is how C/C++ services are done in production, too. You have a build step that does `apk add --update alpine-sdk git cmake` etc., builds the service, and then you start again fresh with a FROM (new stage) and `COPY --from` over the build artifacts. Reading this thread I'm surprised this isn't common knowledge by now given how it's so incredibly paramount to efficient production releases.
- dkarp 6y agoIt may well be common knowledge now. I discovered it when writing our Dockerfiles earlier this year and before that hadn't seen it. It looks like multi-stage builds were added to the best practices in 2018 [https://github.com/docker/docker.github.io/blob/master/develop/develop-images/multistage-build.md https://github.com/docker/docker.github.io/blob/master/devel...] which is probably why I missed it before
- nullsense 6y agoDocker has official support for secrets using Buildkit.
- dkarp 6y agoThis looks like exactly what I need. Even supports forwarding ssh agent. Thanks!