高效Docker镜像构建与部署实战指南

# 构建阶段
FROM golang:1.20-alpine AS builder
WORKDIR /app
# 安装依赖并缓存
COPY go.mod go.sum ./
RUN go mod download
COPY src/ ./src/
RUN CGO_ENABLED=0 GOOS=linux go build -o my-service ./src

# 运行阶段
FROM alpine:3.18 AS runner
# 添加CA证书
RUN apk add --no-cache ca-certificates
WORKDIR /app
# 拷贝可执行文件
COPY --from=builder /app/my-service ./
# 声明端口
EXPOSE 8080
# 启动命令
ENTRYPOINT ["./my-service"]

stages:
  - build
  - scan
  - push
  - deploy

variables:
  IMAGE_NAME: registry.example.com/my-service
  DOCKER_DRIVER: overlay2
  DOCKER_BUILDKIT: 1

before_script:
  - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY

build_image:
  stage: build
  script:
    - docker buildx create --use --name buildx_builder
    - docker buildx build \
        --platform linux/amd64 \
        --cache-from "type=registry,ref=$IMAGE_NAME:cache" \
        --cache-to "type=registry,ref=$IMAGE_NAME:cache,mode=max" \
        -t $IMAGE_NAME:$CI_COMMIT_SHORT_SHA . \
        --push
  only:
    - main

security_scan:
  image: aquasec/trivy:0.34.0
  stage: scan
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE_NAME:$CI_COMMIT_SHORT_SHA
  allow_failure: true

deploy_image:
  stage: deploy
  script:
    - echo "部署到生产集群或通过Argo CD触发应用更新"
  only:
    - main

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-service
  template:
    metadata:
      labels:
        app: my-service
    spec:
      containers:
      - name: my-service
        image: registry.example.com/my-service:{{ .Values.image.tag }}
        ports:
        - containerPort: 8080
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"