我应该使用 Dockerfiles 还是图像提交?

我对这两个选择有点困惑。他们似乎有血缘关系。然而,它们并不是真正兼容的。

例如,使用 Dockerfiles 似乎意味着您不应该真正地提交图像,因为您应该真正地在 git 中跟踪 Dockerfile 并对其进行更改。那么对于什么是权威就没有歧义了。

然而,图像提交看起来真的很不错。它非常棒,您可以直接修改容器并标记更改以创建另一个映像。我知道您甚至可以从映像提交历史中获得类似于文件系统的东西。太棒了。但是你不应该使用 Dockerfiles。否则,如果您提交了一个映像,就必须返回到 Dockerfile 并进行一些更改,以表示所做的操作。

所以我很纠结。我喜欢图像提交的想法: 您不必在 Dockerfile 中表示您的图像状态——您可以直接跟踪它。但是我对于放弃某种清单文件的想法感到不安,这种文件可以让您快速地了解图像中的内容。在同一个软件包中看到两个似乎不兼容的特性也是令人不安的。

有人有什么想法吗?使用图像提交被认为是不好的做法吗?或者我应该放弃我的附件,从我的木偶时代的清单文件?我该怎么办?

更新 :

对于那些认为这是一个基于观点的问题的人,我不太确定。它有一些主观的特性,但我认为它主要是一个客观的问题。此外,我相信关于这个话题的好的讨论将是有益的。

最后,我希望阅读本文的读者能够更好地理解 Dockerfiles 和图像提交是如何相互关联的。

更新-2017/7/18 :

我最近发现了图像提交的合法用途。我们刚刚在公司建立了一个 CI 管道,在管道的一个阶段,我们的应用程序测试在一个容器内运行。我们需要在测试运行程序进程生成覆盖率结果(在容器的文件系统中)并且容器已经停止运行之后,从退出的容器中检索覆盖率结果。我们通过提交已停止的容器来创建一个新的映像,然后运行显示覆盖率文件并将其转储到 stdout 的命令,从而使用 image 提交来完成此操作。所以有这个很方便。除了这种非常特殊的情况,我们还使用 Dockerfiles 来定义环境。

11993 次浏览

Dockerfiles are a tool that is used to create images.

The result of running docker build . is an image with a commit so it's not possible to use a Dockerfile with out creating a commit. The question is should you update the image by hand each time anything changes and thus doom yourself to the curse of the golden image?

The curse of the golden image is a terrible curse cast upon people who must continue living with a buggy security hole ridden base image to run their software on because the person who created it was long ago devoured by the ancient ones (or moved on to a new job) and nobody knows where they got the version of imagemagic that went into that image. and is the only thing that will link against the c++ module that was provided by that consultant the boss's son hired three years ago, and anyway it doesn't matter because even if you figured out where imagemagic came from the version of libstdc++ used by the JNI calls in the support tool that intern with the long hair created only exists in an unsupported version of ubuntu anyway.

Knowing both solutions advantages and inconvenient is a good start. Because a mix of the two is probably a valid way to go.

Con: avoid the golden image dead end:

Using only commits is bad if you lose track of how to rebuild your image. You don't want to be in the state that you can't rebuild the image. This final state is here called the golden image as the image will be your only reference, starting point and ending point at each stage. If you loose it, you'll be in a lot of trouble since you can't rebuild it. The fatal dead end is that one day you'll need to rebuild a new one (because all system lib are obsolete for instance), and you'll have no idea what to install... ending in big loss of time.

As a side note, it's probable that using commits over commits would be nicer if the history log would be easily usable (consult diffs, and repeat them on other images) as it is in git: you'll notice that git don't have this dilemma.

Pro: slick upgrades to distribute

In the other hand, layering commits has some considerable advantage in term of distributed upgrades and thus in bandwidth and deploy time. If you start to handle docker images as a baker is handling pancakes (which is precisely what docker permits), or want to deploy tests version instantly, you'll be happier to send just a small update in the form of a small commit rather a whole new image. Especially when having continuous integration for your customers where bug fixes should be deployed soon and often.

Try to get the best of two worlds:

In these type of scenario, you'll probably want to tag major version of your images and they should come from Dockerfiles. And you can provide continuous integration versions thanks to commits based on the tagged version. This mitigates advantages and inconvenients of Dockerfiles and layering commits scenario. Here, the key point is that you never stop keeping track of your images by limiting the number of commits you'll allow to do on them.

So I guess it depends on your scenario, and you probably shouldn't try to find a single rule. However, there might be some real dead-ends you should really avoid (as ending up with a "golden image" scenario) whatever the solution.