[{"data":1,"prerenderedAt":329},["ShallowReactive",2],{"site-data":3,"article-121":143,"article-show-hot-121":170,"article-show-new-121":260},{"settings":4,"categorys":35,"tree":97,"models":118,"search_model_select":128,"nav_list":130},{"changefreq":5,"changyan_app_id":6,"changyan_app_key":6,"copy":7,"description":8,"editor":9,"file":6,"guest_feedback":10,"head_html":6,"icp":11,"index_banner":12,"index_banner_bg":13,"is_excel":14,"is_watermark":10,"keywords":15,"links":16,"logo":17,"lzcms_banner":6,"lzcms_banner_link":18,"member_register_enabled":14,"qq_app_id":6,"qq_app_key":6,"qr_code":6,"search_model":19,"site_closedreason":6,"site_idea":6,"site_idea1":20,"site_idea2":21,"site_idea3":22,"site_name":23,"site_statistice":6,"site_status":14,"site_url":18,"sitemap_model":19,"stationmaster_motto":24,"stationmaster_name":25,"stationmaster_occupation":26,"stationmaster_qq":27,"stationmaster_qqnet":28,"stationmaster_qqnet_code":29,"threshold":14,"title_add":30,"watermark":6,"watermark_alpha":31,"watermark_height":32,"watermark_locate":33,"watermark_width":34},"weekly","","版权所有 © \u003Ca class=\"site_url\" href=\"https://zhl123.com\">2026 zhl123.com\u003C/a>","linux、Python、mysql、docker、k8s技术交流","layedit","0","粤ICP备15054664号-1","/uploads/images/20181109/7a86191de8b8bb60e9c6b54d8b27c5cc.jpg","#xe604","1","linux、Python、mysql、docker、k8s","{\"1\":{\"id\":\"1\",\"link_url\":\"https://linux.org\",\"logo\":\"\",\"name\":\"linux\",\"sort\":\"0\",\"status\":\"1\"}}","/uploads/images/20181109/e7305012448aed257176dd591846f50a.png","https://zhl123.com","2","学无止境\n学习，探索，研究，从不了解到了解，从无知到掌握，到灵活运用，在不断的学习中加深认识。由浅入深，由表及里。","业精于勤\n“业精于勤荒于嬉”，精深的业技靠的是勤学、刻苦努力，靠的是争分夺秒的勤学苦练才会有精深的技术。得在认真，失在随便。","工匠精神\n精益求精，注重细节，追求完美和极致，不惜花费时间精力，孜孜不倦，反复改进产品，把99%提高到99.99%。","linux","业精于勤、学无止境、工匠精神","廖地金","高级Linux运维工程师","1256636645","592958303","\u003Ca target=\"_blank\" href=\"//shang.qq.com/wpa/qunwpa?idkey=09be7d1a682073783fd636102e666393169b8a8aac8f3393da1de57bcaa821a0\">\u003Cimg border=\"0\" src=\"//pub.idqqimg.com/wpa/images/group.png\" alt=\"Linux技术\" title=\"Linux技术\">\u003C/a>"," | Python | mysql | docker | k8s 技术交流","100","300","9","500",{"0":36,"17":51,"18":60,"19":63,"20":67,"21":71,"22":76,"25":80,"26":83,"27":89,"29":94},{"children":37},{"0":38,"25":43,"26":48},[39,40,41,42],25,21,22,26,[44,45,46,47],17,18,19,20,[49,50],27,29,{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},"index",1,"list","article",2,"文章模型","show","/article/lists?category_id=17",{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},"python","/article/lists?category_id=18",{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},"容器技术",3,"/article/lists?category_id=19",{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},"负载均衡",4,"/article/lists?category_id=20",{"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},"分享无价",0,5,"/article/lists?category_id=21",{"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},"随笔",6,"/article/lists?category_id=22",{"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},"学无止境","/article/lists?category_id=25",{"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},"picture","图集模型","关于",8,"/picture/lists?category_id=26",{"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},"page","单页模型","关于博主","/page/27",{"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},"留言","/feedback",[98,108,110,112],{"children":99,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[100,102,104,106],{"children":101,"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},[],{"children":103,"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},[],{"children":105,"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},[],{"children":107,"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},[],{"children":109,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":111,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":113,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[114,116],{"children":115,"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},[],{"children":117,"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},[],{"1":119,"2":120,"3":121,"4":122,"5":125},{"id":53,"index_template":52,"list_template":54,"name":91,"show_template":58,"status":73,"tablename":90},{"id":56,"index_template":52,"list_template":54,"name":57,"show_template":58,"status":73,"tablename":55},{"id":65,"index_template":52,"list_template":54,"name":85,"show_template":58,"status":73,"tablename":84},{"id":69,"index_template":52,"list_template":54,"name":123,"show_template":58,"status":73,"tablename":124},"链接模型","link",{"id":74,"index_template":52,"list_template":54,"name":126,"show_template":58,"status":73,"tablename":127},"下载模型","download",[129],{"id":56,"name":57,"tablename":55},[131,137,139,141],{"children":132,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[133,134,135,136],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"children":138,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":140,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":142,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[],{"article":144,"breadcrumb":154,"category":158,"next":159,"prev":161,"second_categorys":164,"seo":169},{"id":145,"category_id":46,"title":146,"keywords":6,"description":147,"image_url":6,"content":148,"content_md":149,"url":150,"hits":151,"is_recommend":73,"is_top":73,"create_time":152,"update_time":153},121,"Docker 镜像优化与安全扫描：将镜像体积压缩 70%","1. 适用场景 & 前置条件项目要求适用场景容器化应用镜像体积过大（> 500MB），构建时间长（> 10分钟），存在安全漏洞（CVE高危）OSRHEL/CentOS 7.9+ 或 Ubuntu 20.04+内核Linux Kernel 3.10+软件版本Docker 20.10+ 或 Podman 3.0+，Trivy 0.40+（安全扫描工具）资源规格2C4G（最小）/ 4C8G（推荐），磁盘 50GB+（存储镜像与缓存）网络可访问 Docker Hub/阿里云镜像仓库（","\u003Ch3 class=\"js_darkmode__bg__23\" style=\"text-align: justify;\">\u003Cspan>架构与数据流说明\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__84\" style=\"text-align: justify;\">\u003Cspan>Docker 镜像分层架构：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__24 js_darkmode__85\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">镜像 = 基础镜像层 + 依赖层 + 应用层 + 配置层\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">每个 Dockerfile 指令（RUN/COPY/ADD）创建新层（Layer）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">层累加形成最终镜像（Union File System，联合文件系统）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">容器运行时在镜像顶部添加可写层（Container Layer）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__86\" style=\"text-align: justify;\">\u003Cspan>镜像体积构成：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__25 js_darkmode__87\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">总体积 = 基础镜像（如 Ubuntu:22.04 = 77MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">       + 系统依赖（apt install = 100-500MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">       + 应用依赖（Python packages = 50-200MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">       + 应用代码（10-50MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">       + 缓存与临时文件（50-200MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__88\" style=\"text-align: justify;\">\u003Cspan>优化策略：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__89\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. \u003C/span>\u003Cspan>替换基础镜像\u003C/span>\u003Cspan leaf=\"\">：Ubuntu（77MB）→ Alpine（5MB）→ Distroless（< 2MB）→ Scratch（0MB，仅静态二进制）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. \u003C/span>\u003Cspan>多阶段构建\u003C/span>\u003Cspan leaf=\"\">：构建阶段（完整工具链）→ 运行时阶段（仅复制二进制与依赖）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. \u003C/span>\u003Cspan>层合并\u003C/span>\u003Cspan leaf=\"\">：多个 RUN 指令合并为一个（减少层数，清理临时文件）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">4. \u003C/span>\u003Cspan>依赖精简\u003C/span>\u003Cspan leaf=\"\">：仅安装运行时必需依赖，移除构建工具\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cp class=\"js_darkmode__90\" style=\"text-align: justify;\">\u003Cspan>安全扫描流程：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__26 js_darkmode__91\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">构建镜像 → Trivy 扫描 → 发现漏洞（CVE列表）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">分析漏洞来源（基础镜像 / 依赖包 / 应用代码）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">修复措施：升级基础镜像 / 更新依赖 / 打补丁\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    ↓\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">重新构建 → 再次扫描 → 确认修复\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__27 js_darkmode__92\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__28\" style=\"text-align: justify;\">\u003Cspan>Step 1: 评估当前镜像（基线测量）\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__93\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 获取优化前的镜像大小、层数、漏洞数量作为对比基线\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__29\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>1.1 检查镜像大小与层数\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__30 js_darkmode__94\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 查看镜像列表与大小\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># REPOSITORY          TAG       IMAGE ID       CREATED         SIZE\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0      a1b2c3d4e5f6   2 hours ago     1.2GB  # ⚠️ 过大\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 查看镜像构建历史（每层大小）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker \u003C/span>\u003Cspan leaf=\"\">history\u003C/span>\u003Cspan leaf=\"\"> my-python-app:v1.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># IMAGE          CREATED       CREATED BY                                      SIZE      COMMENT\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># a1b2c3d4e5f6   2 hours ago   /bin/sh -c pip install -r requirements.txt      350MB     # ⚠️ 依赖层过大\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># b2c3d4e5f6a7   3 hours ago   /bin/sh -c apt-get install -y build-essential   250MB     # ⚠️ 构建工具未清理\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># c3d4e5f6a7b8   1 day ago     /bin/sh -c #(nop) FROM ubuntu:22.04              77MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 统计总层数\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker \u003C/span>\u003Cspan leaf=\"\">history\u003C/span>\u003Cspan leaf=\"\"> my-python-app:v1.0 --no-trunc | \u003C/span>\u003Cspan leaf=\"\">wc\u003C/span>\u003Cspan leaf=\"\"> -l\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：25 层（正常应 < 15 层）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__31\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>1.2 安装并运行 Trivy 安全扫描\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__95\" style=\"text-align: justify;\">\u003Cspan>安装 Trivy（Ubuntu/Debian）：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__32 js_darkmode__96\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 方法1：使用官方脚本\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 方法2：使用 apt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> apt-get install wget apt-transport-https gnupg lsb-release\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | \u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> apt-key add -\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">echo\u003C/span>\u003Cspan leaf=\"\">\"deb https://aquasecurity.github.io/trivy-repo/deb \u003C/span>\u003Cspan leaf=\"\">$(lsb_release -sc)\u003C/span>\u003Cspan leaf=\"\"> main\"\u003C/span>\u003Cspan leaf=\"\"> | \u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\">tee\u003C/span>\u003Cspan leaf=\"\"> -a /etc/apt/sources.list.d/trivy.list\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> apt-get update && \u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> apt-get install trivy\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__97\" style=\"text-align: justify;\">\u003Cspan>安装 Trivy（RHEL/CentOS）：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__33 js_darkmode__98\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 使用 rpm\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">rpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.48.3/trivy_0.48.3_Linux-64bit.rpm\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 或使用二进制文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">wget https://github.com/aquasecurity/trivy/releases/download/v0.48.3/trivy_0.48.3_Linux-64bit.tar.gz\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">tar -zxvf trivy_0.48.3_Linux-64bit.tar.gz\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\">mv\u003C/span>\u003Cspan leaf=\"\"> trivy /usr/local/bin/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__99\" style=\"text-align: justify;\">\u003Cspan>扫描镜像漏洞：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__34 js_darkmode__100\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 扫描镜像并输出报告\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image my-python-app:v1.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出（截取）：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0 (ubuntu 22.04)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">#\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Total: 342 (UNKNOWN: 0, LOW: 150, MEDIUM: 120, HIGH: 50, CRITICAL: 22)  # ⚠️ 22个严重漏洞！\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">#\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | libc6        | CVE-2023-4911    | CRITICAL | 2.35-0ubuntu3.1   | 2.35-0ubuntu3.4 |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | openssl      | CVE-2023-5678    | HIGH     | 3.0.2-0ubuntu1.10 | 3.0.2-0ubuntu1.12 |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | python3.10   | CVE-2023-9999    | HIGH     | 3.10.12-1         | 3.10.12-2 |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 仅显示高危及以上漏洞\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 导出 JSON 格式报告（用于 CI/CD）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --format json --output report.json my-python-app:v1.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__101\" style=\"text-align: justify;\">\u003Cspan>执行前验证：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__35 js_darkmode__102\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 确认 Docker 已安装\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker --version\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：Docker version 24.0.7\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 确认镜像存在\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images | grep my-python-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__103\" style=\"text-align: justify;\">\u003Cspan>执行后验证：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__36 js_darkmode__104\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 确认 Trivy 安装成功\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy --version\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：Version: 0.48.3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 检查扫描报告文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">ls\u003C/span>\u003Cspan leaf=\"\"> -lh report.json\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__37 js_darkmode__105\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__38\" style=\"text-align: justify;\">\u003Cspan>Step 2: 优化 Dockerfile - 切换基础镜像\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__106\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 将基础镜像从 Ubuntu 替换为 Alpine Linux，减少 70-90% 体积\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__39\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>2.1 原 Dockerfile（未优化）\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__40 js_darkmode__107\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 原 Dockerfile（Python 应用示例）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> ubuntu:\u003C/span>\u003Cspan leaf=\"\">22.04\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装系统依赖\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update && apt-get install -y \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    python3 \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    python3-pip \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    build-essential \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libpq-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    curl \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    vim\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装 Python 依赖\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> requirements.txt /app/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">WORKDIR\u003C/span>\u003Cspan leaf=\"\"> /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> pip3 install -r requirements.txt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 复制应用代码\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> . /app/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 暴露端口\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">EXPOSE\u003C/span>\u003Cspan leaf=\"\">8000\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 启动命令\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">CMD\u003C/span>\u003Cspan leaf=\"\"> [\u003C/span>\u003Cspan leaf=\"\">\"python3\"\u003C/span>\u003Cspan leaf=\"\">, \u003C/span>\u003Cspan leaf=\"\">\"app.py\"\u003C/span>\u003Cspan leaf=\"\">]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 问题分析：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 1. 基础镜像过大（Ubuntu 77MB）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 2. 安装了不必要的工具（vim/curl）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 3. 未清理 apt 缓存\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 4. 未使用多阶段构建\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 5. 以 root 用户运行（安全风险）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__108\" style=\"text-align: justify;\">\u003Cspan>构建并测量：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__41 js_darkmode__109\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker build -t my-python-app:v1.0-ubuntu .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images my-python-app:v1.0-ubuntu\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：SIZE = 1.2GB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__42\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>2.2 优化版 Dockerfile（Alpine 基础镜像）\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__43 js_darkmode__110\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 优化 Dockerfile（Alpine Linux）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 设置工作目录\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">WORKDIR\u003C/span>\u003Cspan leaf=\"\"> /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装运行时依赖（仅必需的库）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk add --no-cache \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libpq \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && \u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> -rf /var/cache/apk/*  \u003C/span>\u003Cspan leaf=\"\"># 清理apk缓存\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装 Python 依赖（使用虚拟环境）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> requirements.txt .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk add --no-cache --virtual .build-deps \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gcc \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    musl-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    postgresql-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && pip install --no-cache-dir -r requirements.txt \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && apk del .build-deps  \u003C/span>\u003Cspan leaf=\"\"># 删除构建依赖\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 复制应用代码\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> --\u003C/span>\u003Cspan leaf=\"\">chown\u003C/span>\u003Cspan leaf=\"\">=appuser:appuser . .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 创建非 root 用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> addgroup -S appuser && adduser -S appuser -G appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 切换到非 root 用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">USER\u003C/span>\u003Cspan leaf=\"\"> appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 暴露端口\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">EXPOSE\u003C/span>\u003Cspan leaf=\"\">8000\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 健康检查\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">HEALTHCHECK\u003C/span>\u003Cspan leaf=\"\"> --interval=30s --\u003C/span>\u003Cspan leaf=\"\">timeout\u003C/span>\u003Cspan leaf=\"\">=3s \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    CMD wget --quiet --tries=1 --spider http://localhost:8000/health || \u003C/span>\u003Cspan leaf=\"\">exit\u003C/span>\u003Cspan leaf=\"\"> 1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 启动命令\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">CMD\u003C/span>\u003Cspan leaf=\"\"> [\u003C/span>\u003Cspan leaf=\"\">\"python\"\u003C/span>\u003Cspan leaf=\"\">, \u003C/span>\u003Cspan leaf=\"\">\"app.py\"\u003C/span>\u003Cspan leaf=\"\">]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__111\" style=\"text-align: justify;\">\u003Cspan>关键优化点解释：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__112\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. \u003C/span>\u003Cspan>python:3.11-alpine3.18\u003C/span>\u003Cspan leaf=\"\">：官方 Alpine 基础镜像（约 50MB，比 Ubuntu 小 35%）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. \u003C/span>\u003Cspan>apk add --no-cache\u003C/span>\u003Cspan leaf=\"\">：不保留 apk 索引缓存（减少 5-10MB）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. \u003C/span>\u003Cspan>–virtual .build-deps\u003C/span>\u003Cspan leaf=\"\">：构建依赖打包为虚拟包，安装后可整体删除\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">4. \u003C/span>\u003Cspan>–no-cache-dir\u003C/span>\u003Cspan leaf=\"\">：pip 不缓存下载的包（减少 50-100MB）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">5. \u003C/span>\u003Cspan>USER appuser\u003C/span>\u003Cspan leaf=\"\">：非 root 用户运行（安全加固）\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cp class=\"js_darkmode__113\" style=\"text-align: justify;\">\u003Cspan>构建并对比：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__44 js_darkmode__114\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker build -t my-python-app:v1.0-alpine .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images | grep my-python-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-ubuntu   1.2GB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-alpine   350MB  # 减少 70.8%\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__45 js_darkmode__115\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__46\" style=\"text-align: justify;\">\u003Cspan>Step 3: 优化 Dockerfile - 多阶段构建\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__116\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 将构建环境与运行时环境分离，进一步减少 50-70% 体积\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__47\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>3.1 多阶段构建 Dockerfile（最终优化版）\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__48 js_darkmode__117\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># ============ 阶段1：构建阶段 ============\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\"> AS builder\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">WORKDIR\u003C/span>\u003Cspan leaf=\"\"> /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装构建依赖\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk add --no-cache \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    gcc \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    musl-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    postgresql-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libffi-dev\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 安装 Python 依赖到虚拟环境\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> requirements.txt .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> python -m venv /opt/venv && \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    /opt/venv/bin/pip install --no-cache-dir -r requirements.txt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># ============ 阶段2：运行时阶段 ============\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">WORKDIR\u003C/span>\u003Cspan leaf=\"\"> /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 仅安装运行时库（无需编译工具）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk add --no-cache \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libpq \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libffi \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && \u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> -rf /var/cache/apk/*\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 从构建阶段复制虚拟环境\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> --from=builder /opt/venv /opt/venv\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 复制应用代码\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> --\u003C/span>\u003Cspan leaf=\"\">chown\u003C/span>\u003Cspan leaf=\"\">=appuser:appuser . .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 创建非 root 用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> addgroup -S appuser && adduser -S appuser -G appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 设置环境变量（使用虚拟环境）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">ENV\u003C/span>\u003Cspan leaf=\"\"> PATH=\u003C/span>\u003Cspan leaf=\"\">\"/opt/venv/bin:$PATH\"\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">USER\u003C/span>\u003Cspan leaf=\"\"> appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">EXPOSE\u003C/span>\u003Cspan leaf=\"\">8000\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">HEALTHCHECK\u003C/span>\u003Cspan leaf=\"\"> --interval=30s --\u003C/span>\u003Cspan leaf=\"\">timeout\u003C/span>\u003Cspan leaf=\"\">=3s \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    CMD wget --quiet --tries=1 --spider http://localhost:8000/health || \u003C/span>\u003Cspan leaf=\"\">exit\u003C/span>\u003Cspan leaf=\"\"> 1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">CMD\u003C/span>\u003Cspan leaf=\"\"> [\u003C/span>\u003Cspan leaf=\"\">\"python\"\u003C/span>\u003Cspan leaf=\"\">, \u003C/span>\u003Cspan leaf=\"\">\"app.py\"\u003C/span>\u003Cspan leaf=\"\">]\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__118\" style=\"text-align: justify;\">\u003Cspan>多阶段构建优势：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__119\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>阶段1（builder）\u003C/span>\u003Cspan leaf=\"\">：包含完整编译工具链（gcc/make），用于编译 C 扩展依赖\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>阶段2（运行时）\u003C/span>\u003Cspan leaf=\"\">：仅复制编译好的二进制与依赖，不包含编译工具\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>体积减少\u003C/span>\u003Cspan leaf=\"\">：编译工具约占 150-200MB，通过多阶段构建完全删除\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cp class=\"js_darkmode__120\" style=\"text-align: justify;\">\u003Cspan>构建并对比：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__49 js_darkmode__121\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker build -t my-python-app:v1.0-multistage .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker images | grep my-python-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-ubuntu      1.2GB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-alpine      350MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app:v1.0-multistage  120MB  # 减少 90%！\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__122\" style=\"text-align: justify;\">\u003Cspan>验证功能完整性：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__50 js_darkmode__123\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 启动容器\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker run -d -p 8000:8000 --name test-app my-python-app:v1.0-multistage\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 测试应用\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">curl http://localhost:8000/health\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：{\"status\": \"healthy\"}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 检查容器日志\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker logs test-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 清理测试容器\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker stop test-app && docker \u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> test-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__51 js_darkmode__124\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__52\" style=\"text-align: justify;\">\u003Cspan>Step 4: 层合并与缓存清理\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__125\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 减少镜像层数，清理构建缓存与临时文件\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__53\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>4.1 合并 RUN 指令\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__126\" style=\"text-align: justify;\">\u003Cspan>未优化（多层）：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__54 js_darkmode__127\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get install -y python3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get install -y python3-pip\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get install -y libpq-dev\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get clean\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 问题：每个 RUN 创建一层，即使最后 clean 也不会减少前面层的体积\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__128\" style=\"text-align: justify;\">\u003Cspan>优化后（单层）：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__55 js_darkmode__129\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update && apt-get install -y \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    python3 \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    python3-pip \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    libpq-dev \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && apt-get clean \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && \u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> -rf /var/lib/apt/lists/*  \u003C/span>\u003Cspan leaf=\"\"># 删除 apt 缓存\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 优势：一层完成，临时文件在同一层内删除，不占用最终镜像体积\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__56\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>4.2 使用 .dockerignore 文件\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__130\" style=\"text-align: justify;\">\u003Cspan>创建 .dockerignore：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__57 js_darkmode__131\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># .dockerignore（排除无关文件）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 版本控制\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.git\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.gitignore\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.github\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 开发文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">*.md\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">*.\u003C/span>\u003Cspan leaf=\"\">log\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">*.pyc\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">__pycache__/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.pytest_cache/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.vscode/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.idea/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 测试文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">tests/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">test_*.py\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 构建产物\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">build/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">dist/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">*.egg-info/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 环境文件\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.\u003C/span>\u003Cspan leaf=\"\">env\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.env.local\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">venv/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">env\u003C/span>\u003Cspan leaf=\"\">/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 文档\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docs/\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">README.md\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">LICENSE\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># CI/CD\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">.gitlab-ci.yml\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">Jenkinsfile\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__132\" style=\"text-align: justify;\">\u003Cspan>效果验证：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__58 js_darkmode__133\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 对比 COPY 指令复制的文件大小\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 未使用 .dockerignore：COPY . . 复制 50MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 使用后：COPY . . 复制 15MB（减少 70%）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__59\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>4.3 启用 Docker BuildKit\u003C/span>\u003C/h4>\u003Cp class=\"js_darkmode__134\" style=\"text-align: justify;\">\u003Cspan>启用方法：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__60 js_darkmode__135\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 方法1：环境变量\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">export\u003C/span>\u003Cspan leaf=\"\"> DOCKER_BUILDKIT=1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker build -t my-app:v2.0 .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 方法2：守护进程配置（持久化）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># /etc/docker/daemon.json\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">{\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\"features\"\u003C/span>\u003Cspan leaf=\"\">: {\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\"buildkit\"\u003C/span>\u003Cspan leaf=\"\">: \u003C/span>\u003Cspan leaf=\"\">true\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">  }\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">}\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 重启 Docker\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">sudo\u003C/span>\u003Cspan leaf=\"\"> systemctl restart docker\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__136\" style=\"text-align: justify;\">\u003Cspan>BuildKit 优势：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__137\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 并行构建多个层（性能提升 2-5 倍）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 自动跳过未使用的阶段（多阶段构建优化）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• 更好的缓存机制（修改代码不重新下载依赖）\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cp class=\"js_darkmode__138\" style=\"text-align: justify;\">\u003Cspan>验证 BuildKit 启用：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__61 js_darkmode__139\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker build -t test-buildkit .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出包含 [buildkit] 标识\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># [buildkit] [1/5] FROM docker.io/library/python:3.11-alpine3.18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__62 js_darkmode__140\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__63\" style=\"text-align: justify;\">\u003Cspan>Step 5: 安全扫描与漏洞修复\u003C/span>\u003C/h3>\u003Cp class=\"js_darkmode__141\" style=\"text-align: justify;\">\u003Cspan>目标：\u003C/span>\u003Cspan leaf=\"\"> 扫描优化后的镜像，修复高危漏洞至零\u003C/span>\u003C/p>\u003Ch4 class=\"js_darkmode__bg__64\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>5.1 扫描优化后的镜像\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__65 js_darkmode__142\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 扫描多阶段构建的镜像\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0-multistage\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Total: 12 (HIGH: 8, CRITICAL: 4)  # 仍有漏洞（来自基础镜像或依赖）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">#\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | libcrypto3   | CVE-2023-5678    | CRITICAL | 3.0.10-r0         | 3.0.12-r0     |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | python3.11   | CVE-2023-9999    | HIGH     | 3.11.6-r0         | 3.11.7-r1     |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># +--------------+------------------+----------+-------------------+---------------+\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__66\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>5.2 修复漏洞 - 升级基础镜像\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__67 js_darkmode__143\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 原基础镜像（存在漏洞）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 修复方法1：升级到最新版本\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">19\u003C/span>\u003Cspan leaf=\"\"># 更新的基础镜像通常包含安全补丁\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 修复方法2：在 Dockerfile 中手动升级受影响的包\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">FROM\u003C/span>\u003Cspan leaf=\"\"> python:\u003C/span>\u003Cspan leaf=\"\">3.11\u003C/span>\u003Cspan leaf=\"\">-alpine3.\u003C/span>\u003Cspan leaf=\"\">18\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apk upgrade --no-cache libcrypto3 libssl3\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__68\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>5.3 修复漏洞 - 更新 Python 依赖\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__69 js_darkmode__144\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 检查 Python 依赖的漏洞\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">pip install safety\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">safety check --file requirements.txt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 示例输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | package     | installed | affected     | source                                    |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># | requests    | 2.28.0    | <2.31.0      | https://pyup.io/vulnerabilities/CVE-2023-32681/ |\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 修复：更新 requirements.txt\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 原：requests==2.28.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 新：requests==2.31.0\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__70\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>5.4 再次扫描验证\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__71 js_darkmode__145\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 重新构建镜像\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker build -t my-python-app:v1.0-secure .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 再次扫描\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># Total: 0 (HIGH: 0, CRITICAL: 0)  # ✅ 无高危漏洞\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__72 js_darkmode__146\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__73\" style=\"text-align: justify;\">\u003Cspan>Step 6: 安全加固措施\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__74\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>6.1 非 root 用户运行\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__75 js_darkmode__147\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 创建专用用户（UID/GID 固定，便于权限管理）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> addgroup -g 1001 -S appuser && \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    adduser -u 1001 -S appuser -G appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 设置文件所有者\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">COPY\u003C/span>\u003Cspan leaf=\"\"> --\u003C/span>\u003Cspan leaf=\"\">chown\u003C/span>\u003Cspan leaf=\"\">=appuser:appuser . /app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 切换用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">USER\u003C/span>\u003Cspan leaf=\"\"> appuser\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__148\" style=\"text-align: justify;\">\u003Cspan>验证：\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__76 js_darkmode__149\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 检查容器内运行用户\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker run --\u003C/span>\u003Cspan leaf=\"\">rm\u003C/span>\u003Cspan leaf=\"\"> my-python-app:v1.0-secure \u003C/span>\u003Cspan leaf=\"\">id\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 预期输出：uid=1001(appuser) gid=1001(appuser)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__77\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>6.2 移除 SUID 二进制文件\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__78 js_darkmode__150\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 移除可能被利用的 SUID 文件（如 su/sudo）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> find / -perm /6000 -\u003C/span>\u003Cspan leaf=\"\">type\u003C/span>\u003Cspan leaf=\"\"> f -\u003C/span>\u003Cspan leaf=\"\">exec\u003C/span>\u003Cspan leaf=\"\">chmod\u003C/span>\u003Cspan leaf=\"\"> a-s {} \\; || \u003C/span>\u003Cspan leaf=\"\">true\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__79\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>6.3 只读根文件系统\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__80 js_darkmode__151\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 运行容器时启用只读根文件系统\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker run --read-only --tmpfs /tmp my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__81\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>6.4 镜像签名（Docker Content Trust）\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__82 js_darkmode__152\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 启用 Content Trust\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">export\u003C/span>\u003Cspan leaf=\"\"> DOCKER_CONTENT_TRUST=1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 推送镜像（会自动签名）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker push myregistry.com/my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 拉取镜像时自动验证签名\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">docker pull myregistry.com/my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__bg__83 js_darkmode__153\" style=\"text-align: justify;\">\u003Ch3 class=\"js_darkmode__bg__84\" style=\"text-align: justify;\">\u003Cspan>Step 7: 最终对比与验证\u003C/span>\u003C/h3>\u003Ch4 class=\"js_darkmode__bg__85\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>7.1 体积对比\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__86 js_darkmode__154\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\">docker images | grep my-python-app\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># REPOSITORY          TAG              SIZE\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0-ubuntu      1.2GB   # 原始版本\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0-alpine      350MB   # Alpine 基础镜像\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0-multistage  120MB   # 多阶段构建\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># my-python-app       v1.0-secure      115MB   # 最终优化版（体积减少 90.4%！）\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__87\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>7.2 安全对比\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__88 js_darkmode__155\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 扫描对比\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0-ubuntu\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：Total: 72 (HIGH: 50, CRITICAL: 22)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">trivy image --severity HIGH,CRITICAL my-python-app:v1.0-secure\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 输出：Total: 0 (HIGH: 0, CRITICAL: 0)  # ✅ 零高危漏洞\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch4 class=\"js_darkmode__bg__89\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">◆ \u003C/span>\u003Cspan>7.3 构建时间对比\u003C/span>\u003C/h4>\u003Cpre class=\"js_darkmode__bg__90 js_darkmode__156\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 未启用 BuildKit\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">time\u003C/span>\u003Cspan leaf=\"\"> docker build -t test-nobuildkit .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># real    8m32s\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 启用 BuildKit\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">export\u003C/span>\u003Cspan leaf=\"\"> DOCKER_BUILDKIT=1\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">time\u003C/span>\u003Cspan leaf=\"\"> docker build -t test-buildkit .\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># real    2m15s  # 提升 73.6%\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp style=\"text-align: left;\">\u003Cspan leaf=\"\"> \u003C/span>\u003C/p>\u003Cp style=\"text-align: left;\">\u003Cspan leaf=\"\">\u003Cb>最小必要原理\u003C/b>\u003C/span>\u003C/p>\u003Cp class=\"js_darkmode__158\" style=\"text-align: justify;\">\u003Cspan>Docker 镜像分层机制：\u003C/span>\u003C/p>\u003Cp class=\"js_darkmode__159\" style=\"text-align: justify;\">\u003Cspan leaf=\"\">Docker 使用 \u003C/span>\u003Cspan>联合文件系统（Union File System）\u003C/span>\u003Cspan leaf=\"\"> 实现镜像分层：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__160\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">1. 每个 Dockerfile 指令（FROM/RUN/COPY/ADD）创建一个只读层\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">2. 层之间通过 Copy-on-Write（COW）机制堆叠\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">3. 容器运行时在最顶层添加可写层（Container Layer）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">4. 所有层的累加 = 最终镜像体积\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cp class=\"js_darkmode__161\" style=\"text-align: justify;\">\u003Cspan>为什么删除文件不减少镜像体积？\u003C/span>\u003C/p>\u003Cpre class=\"js_darkmode__bg__93 js_darkmode__162\" style=\"text-align: justify;\">\u003Ccode>\u003Cspan leaf=\"\"># 错误示例\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update && apt-get install -y build-essential  \u003C/span>\u003Cspan leaf=\"\"># Layer 1: +200MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get clean  \u003C/span>\u003Cspan leaf=\"\"># Layer 2: 删除缓存，但 Layer 1 的 200MB 仍存在！\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 最终镜像 = Layer 1 (200MB) + Layer 2 (0MB) = 200MB\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 正确示例\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">RUN\u003C/span>\u003Cspan leaf=\"\"> apt-get update && apt-get install -y build-essential \\\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\">    && apt-get clean  \u003C/span>\u003Cspan leaf=\"\"># 在同一层完成安装与清理\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003Cspan leaf=\"\"># 最终镜像 = Layer 1 (150MB，已清理缓存)\u003C/span>\u003Cspan leaf=\"\">\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Cp class=\"js_darkmode__163\" style=\"text-align: justify;\">\u003Cspan>多阶段构建原理：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__164\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>阶段1（builder）\u003C/span>\u003Cspan leaf=\"\">：包含完整工具链，生成二进制或编译依赖\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>阶段2（运行时）\u003C/span>\u003Cspan leaf=\"\">：使用 \u003C/span>\u003Ccode>\u003Cspan leaf=\"\">COPY --from=builder\u003C/span>\u003C/code>\u003Cspan leaf=\"\"> 仅复制必要文件\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>丢弃的内容\u003C/span>\u003Cspan leaf=\"\">：阶段1的所有中间层（编译工具、临时文件）不会进入最终镜像\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Cp class=\"js_darkmode__165\" style=\"text-align: justify;\">\u003Cspan>Alpine vs Ubuntu 体积差异：\u003C/span>\u003C/p>\u003Cp>\u003Ccode>\u003Cspan leaf=\"\">\u003C/span>\u003C/code>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__166\" style=\"text-align: justify;\">\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>Ubuntu\u003C/span>\u003Cspan leaf=\"\">：基于 glibc，包含完整 GNU 工具链（bash/coreutils），适合通用场景\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection>\u003Cspan leaf=\"\">• \u003C/span>\u003Cspan>Alpine\u003C/span>\u003Cspan leaf=\"\">：基于 musl libc + BusyBox，极致精简，但可能遇到兼容性问题（如某些 Python C 扩展）\u003C/span>\u003C/section>\u003C/li>\u003C/ul>","### 架构与数据流说明\n\nDocker 镜像分层架构：\n\n```\n镜像 = 基础镜像层 + 依赖层 + 应用层 + 配置层    ↓每个 Dockerfile 指令（RUN/COPY/ADD）创建新层（Layer）    ↓层累加形成最终镜像（Union File System，联合文件系统）    ↓容器运行时在镜像顶部添加可写层（Container Layer）\n```\n\n镜像体积构成：\n\n```\n总体积 = 基础镜像（如 Ubuntu:22.04 = 77MB）       + 系统依赖（apt install = 100-500MB）       + 应用依赖（Python packages = 50-200MB）       + 应用代码（10-50MB）       + 缓存与临时文件（50-200MB）\n```\n\n优化策略：\n\n1. 1. 替换基础镜像：Ubuntu（77MB）→ Alpine（5MB）→ Distroless（\u003C 2MB）→ Scratch（0MB，仅静态二进制）\n2. 2. 多阶段构建：构建阶段（完整工具链）→ 运行时阶段（仅复制二进制与依赖）\n3. 3. 层合并：多个 RUN 指令合并为一个（减少层数，清理临时文件）\n4. 4. 依赖精简：仅安装运行时必需依赖，移除构建工具\n\n安全扫描流程：\n\n```\n构建镜像 → Trivy 扫描 → 发现漏洞（CVE列表）    ↓分析漏洞来源（基础镜像 / 依赖包 / 应用代码）    ↓修复措施：升级基础镜像 / 更新依赖 / 打补丁    ↓重新构建 → 再次扫描 → 确认修复\n```\n\n---\n\n### Step 1: 评估当前镜像（基线测量）\n\n目标：\n\n 获取优化前的镜像大小、层数、漏洞数量作为对比基线\n\n#### ◆ 1.1 检查镜像大小与层数\n\n```\n# 查看镜像列表与大小docker images# 示例输出：# REPOSITORY          TAG       IMAGE ID       CREATED         SIZE# my-python-app       v1.0      a1b2c3d4e5f6   2 hours ago     1.2GB  # ⚠️ 过大# 查看镜像构建历史（每层大小）docker history my-python-app:v1.0# 示例输出：# IMAGE          CREATED       CREATED BY                                      SIZE      COMMENT# a1b2c3d4e5f6   2 hours ago   /bin/sh -c pip install -r requirements.txt      350MB     # ⚠️ 依赖层过大# b2c3d4e5f6a7   3 hours ago   /bin/sh -c apt-get install -y build-essential   250MB     # ⚠️ 构建工具未清理# c3d4e5f6a7b8   1 day ago     /bin/sh -c #(nop) FROM ubuntu:22.04              77MB# 统计总层数docker history my-python-app:v1.0 --no-trunc | wc -l# 预期输出：25 层（正常应 \u003C 15 层）\n```\n\n#### ◆ 1.2 安装并运行 Trivy 安全扫描\n\n安装 Trivy（Ubuntu/Debian）：\n\n```\n# 方法1：使用官方脚本curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin# 方法2：使用 aptsudo apt-get install wget apt-transport-https gnupg lsb-releasewget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -echo\"deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main\" | sudotee -a /etc/apt/sources.list.d/trivy.listsudo apt-get update && sudo apt-get install trivy\n```\n\n安装 Trivy（RHEL/CentOS）：\n\n```\n# 使用 rpmrpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.48.3/trivy_0.48.3_Linux-64bit.rpm# 或使用二进制文件wget https://github.com/aquasecurity/trivy/releases/download/v0.48.3/trivy_0.48.3_Linux-64bit.tar.gztar -zxvf trivy_0.48.3_Linux-64bit.tar.gzsudomv trivy /usr/local/bin/\n```\n\n扫描镜像漏洞：\n\n```\n# 扫描镜像并输出报告trivy image my-python-app:v1.0# 示例输出（截取）：# my-python-app:v1.0 (ubuntu 22.04)## Total: 342 (UNKNOWN: 0, LOW: 150, MEDIUM: 120, HIGH: 50, CRITICAL: 22)  # ⚠️ 22个严重漏洞！## +--------------+------------------+----------+-------------------+---------------+# | LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |# +--------------+------------------+----------+-------------------+---------------+# | libc6        | CVE-2023-4911    | CRITICAL | 2.35-0ubuntu3.1   | 2.35-0ubuntu3.4 |# | openssl      | CVE-2023-5678    | HIGH     | 3.0.2-0ubuntu1.10 | 3.0.2-0ubuntu1.12 |# | python3.10   | CVE-2023-9999    | HIGH     | 3.10.12-1         | 3.10.12-2 |# +--------------+------------------+----------+-------------------+---------------+# 仅显示高危及以上漏洞trivy image --severity HIGH,CRITICAL my-python-app:v1.0# 导出 JSON 格式报告（用于 CI/CD）trivy image --format json --output report.json my-python-app:v1.0\n```\n\n执行前验证：\n\n```\n# 确认 Docker 已安装docker --version# 预期输出：Docker version 24.0.7# 确认镜像存在docker images | grep my-python-app\n```\n\n执行后验证：\n\n```\n# 确认 Trivy 安装成功trivy --version# 预期输出：Version: 0.48.3# 检查扫描报告文件ls -lh report.json\n```\n\n---\n\n### Step 2: 优化 Dockerfile - 切换基础镜像\n\n目标：\n\n 将基础镜像从 Ubuntu 替换为 Alpine Linux，减少 70-90% 体积\n\n#### ◆ 2.1 原 Dockerfile（未优化）\n\n```\n# 原 Dockerfile（Python 应用示例）FROM ubuntu:22.04# 安装系统依赖RUN apt-get update && apt-get install -y \\    python3 \\    python3-pip \\    build-essential \\    libpq-dev \\    curl \\    vim# 安装 Python 依赖COPY requirements.txt /app/WORKDIR /appRUN pip3 install -r requirements.txt# 复制应用代码COPY . /app/# 暴露端口EXPOSE8000# 启动命令CMD [\"python3\", \"app.py\"]# 问题分析：# 1. 基础镜像过大（Ubuntu 77MB）# 2. 安装了不必要的工具（vim/curl）# 3. 未清理 apt 缓存# 4. 未使用多阶段构建# 5. 以 root 用户运行（安全风险）\n```\n\n构建并测量：\n\n```\ndocker build -t my-python-app:v1.0-ubuntu .docker images my-python-app:v1.0-ubuntu# 输出：SIZE = 1.2GB\n```\n\n#### ◆ 2.2 优化版 Dockerfile（Alpine 基础镜像）\n\n```\n# 优化 Dockerfile（Alpine Linux）FROM python:3.11-alpine3.18# 设置工作目录WORKDIR /app# 安装运行时依赖（仅必需的库）RUN apk add --no-cache \\    libpq \\    && rm -rf /var/cache/apk/*  # 清理apk缓存# 安装 Python 依赖（使用虚拟环境）COPY requirements.txt .RUN apk add --no-cache --virtual .build-deps \\    gcc \\    musl-dev \\    postgresql-dev \\    && pip install --no-cache-dir -r requirements.txt \\    && apk del .build-deps  # 删除构建依赖# 复制应用代码COPY --chown=appuser:appuser . .# 创建非 root 用户RUN addgroup -S appuser && adduser -S appuser -G appuser# 切换到非 root 用户USER appuser# 暴露端口EXPOSE8000# 健康检查HEALTHCHECK --interval=30s --timeout=3s \\    CMD wget --quiet --tries=1 --spider http://localhost:8000/health || exit 1# 启动命令CMD [\"python\", \"app.py\"]\n```\n\n关键优化点解释：\n\n1. 1. python:3.11-alpine3.18：官方 Alpine 基础镜像（约 50MB，比 Ubuntu 小 35%）\n2. 2. apk add --no-cache：不保留 apk 索引缓存（减少 5-10MB）\n3. 3. –virtual .build-deps：构建依赖打包为虚拟包，安装后可整体删除\n4. 4. –no-cache-dir：pip 不缓存下载的包（减少 50-100MB）\n5. 5. USER appuser：非 root 用户运行（安全加固）\n\n构建并对比：\n\n```\ndocker build -t my-python-app:v1.0-alpine .docker images | grep my-python-app# 输出：# my-python-app:v1.0-ubuntu   1.2GB# my-python-app:v1.0-alpine   350MB  # 减少 70.8%\n```\n\n---\n\n### Step 3: 优化 Dockerfile - 多阶段构建\n\n目标：\n\n 将构建环境与运行时环境分离，进一步减少 50-70% 体积\n\n#### ◆ 3.1 多阶段构建 Dockerfile（最终优化版）\n\n```\n# ============ 阶段1：构建阶段 ============FROM python:3.11-alpine3.18 AS builderWORKDIR /app# 安装构建依赖RUN apk add --no-cache \\    gcc \\    musl-dev \\    postgresql-dev \\    libffi-dev# 安装 Python 依赖到虚拟环境COPY requirements.txt .RUN python -m venv /opt/venv && \\    /opt/venv/bin/pip install --no-cache-dir -r requirements.txt# ============ 阶段2：运行时阶段 ============FROM python:3.11-alpine3.18WORKDIR /app# 仅安装运行时库（无需编译工具）RUN apk add --no-cache \\    libpq \\    libffi \\    && rm -rf /var/cache/apk/*# 从构建阶段复制虚拟环境COPY --from=builder /opt/venv /opt/venv# 复制应用代码COPY --chown=appuser:appuser . .# 创建非 root 用户RUN addgroup -S appuser && adduser -S appuser -G appuser# 设置环境变量（使用虚拟环境）ENV PATH=\"/opt/venv/bin:$PATH\"USER appuserEXPOSE8000HEALTHCHECK --interval=30s --timeout=3s \\    CMD wget --quiet --tries=1 --spider http://localhost:8000/health || exit 1CMD [\"python\", \"app.py\"]\n```\n\n多阶段构建优势：\n\n- • 阶段1（builder）：包含完整编译工具链（gcc/make），用于编译 C 扩展依赖\n- • 阶段2（运行时）：仅复制编译好的二进制与依赖，不包含编译工具\n- • 体积减少：编译工具约占 150-200MB，通过多阶段构建完全删除\n\n构建并对比：\n\n```\ndocker build -t my-python-app:v1.0-multistage .docker images | grep my-python-app# 输出：# my-python-app:v1.0-ubuntu      1.2GB# my-python-app:v1.0-alpine      350MB# my-python-app:v1.0-multistage  120MB  # 减少 90%！\n```\n\n验证功能完整性：\n\n```\n# 启动容器docker run -d -p 8000:8000 --name test-app my-python-app:v1.0-multistage# 测试应用curl http://localhost:8000/health# 预期输出：{\"status\": \"healthy\"}# 检查容器日志docker logs test-app# 清理测试容器docker stop test-app && docker rm test-app\n```\n\n---\n\n### Step 4: 层合并与缓存清理\n\n目标：\n\n 减少镜像层数，清理构建缓存与临时文件\n\n#### ◆ 4.1 合并 RUN 指令\n\n未优化（多层）：\n\n```\nRUN apt-get updateRUN apt-get install -y python3RUN apt-get install -y python3-pipRUN apt-get install -y libpq-devRUN apt-get clean# 问题：每个 RUN 创建一层，即使最后 clean 也不会减少前面层的体积\n```\n\n优化后（单层）：\n\n```\nRUN apt-get update && apt-get install -y \\    python3 \\    python3-pip \\    libpq-dev \\    && apt-get clean \\    && rm -rf /var/lib/apt/lists/*  # 删除 apt 缓存# 优势：一层完成，临时文件在同一层内删除，不占用最终镜像体积\n```\n\n#### ◆ 4.2 使用 .dockerignore 文件\n\n创建 .dockerignore：\n\n```\n# .dockerignore（排除无关文件）# 版本控制.git.gitignore.github# 开发文件*.md*.log*.pyc__pycache__/.pytest_cache/.vscode/.idea/# 测试文件tests/test_*.py# 构建产物build/dist/*.egg-info/# 环境文件.env.env.localvenv/env/# 文档docs/README.mdLICENSE# CI/CD.gitlab-ci.ymlJenkinsfile\n```\n\n效果验证：\n\n```\n# 对比 COPY 指令复制的文件大小# 未使用 .dockerignore：COPY . . 复制 50MB# 使用后：COPY . . 复制 15MB（减少 70%）\n```\n\n#### ◆ 4.3 启用 Docker BuildKit\n\n启用方法：\n\n```\n# 方法1：环境变量export DOCKER_BUILDKIT=1docker build -t my-app:v2.0 .# 方法2：守护进程配置（持久化）# /etc/docker/daemon.json{\"features\": {\"buildkit\": true  }}# 重启 Dockersudo systemctl restart docker\n```\n\nBuildKit 优势：\n\n- • 并行构建多个层（性能提升 2-5 倍）\n- • 自动跳过未使用的阶段（多阶段构建优化）\n- • 更好的缓存机制（修改代码不重新下载依赖）\n\n验证 BuildKit 启用：\n\n```\ndocker build -t test-buildkit .# 输出包含 [buildkit] 标识# [buildkit] [1/5] FROM docker.io/library/python:3.11-alpine3.18\n```\n\n---\n\n### Step 5: 安全扫描与漏洞修复\n\n目标：\n\n 扫描优化后的镜像，修复高危漏洞至零\n\n#### ◆ 5.1 扫描优化后的镜像\n\n```\n# 扫描多阶段构建的镜像trivy image --severity HIGH,CRITICAL my-python-app:v1.0-multistage# 示例输出：# Total: 12 (HIGH: 8, CRITICAL: 4)  # 仍有漏洞（来自基础镜像或依赖）## +--------------+------------------+----------+-------------------+---------------+# | LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |# +--------------+------------------+----------+-------------------+---------------+# | libcrypto3   | CVE-2023-5678    | CRITICAL | 3.0.10-r0         | 3.0.12-r0     |# | python3.11   | CVE-2023-9999    | HIGH     | 3.11.6-r0         | 3.11.7-r1     |# +--------------+------------------+----------+-------------------+---------------+\n```\n\n#### ◆ 5.2 修复漏洞 - 升级基础镜像\n\n```\n# 原基础镜像（存在漏洞）FROM python:3.11-alpine3.18# 修复方法1：升级到最新版本FROM python:3.11-alpine3.19# 更新的基础镜像通常包含安全补丁# 修复方法2：在 Dockerfile 中手动升级受影响的包FROM python:3.11-alpine3.18RUN apk upgrade --no-cache libcrypto3 libssl3\n```\n\n#### ◆ 5.3 修复漏洞 - 更新 Python 依赖\n\n```\n# 检查 Python 依赖的漏洞pip install safetysafety check --file requirements.txt# 示例输出：# | package     | installed | affected     | source                                    |# | requests    | 2.28.0    |\n```\n\n#### ◆ 5.4 再次扫描验证\n\n```\n# 重新构建镜像docker build -t my-python-app:v1.0-secure .# 再次扫描trivy image --severity HIGH,CRITICAL my-python-app:v1.0-secure# 预期输出：# Total: 0 (HIGH: 0, CRITICAL: 0)  # ✅ 无高危漏洞\n```\n\n---\n\n### Step 6: 安全加固措施\n\n#### ◆ 6.1 非 root 用户运行\n\n```\n# 创建专用用户（UID/GID 固定，便于权限管理）RUN addgroup -g 1001 -S appuser && \\    adduser -u 1001 -S appuser -G appuser# 设置文件所有者COPY --chown=appuser:appuser . /app# 切换用户USER appuser\n```\n\n验证：\n\n```\n# 检查容器内运行用户docker run --rm my-python-app:v1.0-secure id# 预期输出：uid=1001(appuser) gid=1001(appuser)\n```\n\n#### ◆ 6.2 移除 SUID 二进制文件\n\n```\n# 移除可能被利用的 SUID 文件（如 su/sudo）RUN find / -perm /6000 -type f -execchmod a-s {} \\; || true\n```\n\n#### ◆ 6.3 只读根文件系统\n\n```\n# 运行容器时启用只读根文件系统docker run --read-only --tmpfs /tmp my-python-app:v1.0-secure\n```\n\n#### ◆ 6.4 镜像签名（Docker Content Trust）\n\n```\n# 启用 Content Trustexport DOCKER_CONTENT_TRUST=1# 推送镜像（会自动签名）docker push myregistry.com/my-python-app:v1.0-secure# 拉取镜像时自动验证签名docker pull myregistry.com/my-python-app:v1.0-secure\n```\n\n---\n\n### Step 7: 最终对比与验证\n\n#### ◆ 7.1 体积对比\n\n```\ndocker images | grep my-python-app# 输出：# REPOSITORY          TAG              SIZE# my-python-app       v1.0-ubuntu      1.2GB   # 原始版本# my-python-app       v1.0-alpine      350MB   # Alpine 基础镜像# my-python-app       v1.0-multistage  120MB   # 多阶段构建# my-python-app       v1.0-secure      115MB   # 最终优化版（体积减少 90.4%！）\n```\n\n#### ◆ 7.2 安全对比\n\n```\n# 扫描对比trivy image --severity HIGH,CRITICAL my-python-app:v1.0-ubuntu# 输出：Total: 72 (HIGH: 50, CRITICAL: 22)trivy image --severity HIGH,CRITICAL my-python-app:v1.0-secure# 输出：Total: 0 (HIGH: 0, CRITICAL: 0)  # ✅ 零高危漏洞\n```\n\n#### ◆ 7.3 构建时间对比\n\n```\n# 未启用 BuildKittime docker build -t test-nobuildkit .# real    8m32s# 启用 BuildKitexport DOCKER_BUILDKIT=1time docker build -t test-buildkit .# real    2m15s  # 提升 73.6%\n```\n\n \n\n**最小必要原理**\n\nDocker 镜像分层机制：\n\nDocker 使用 \n\n联合文件系统（Union File System）\n\n 实现镜像分层：\n\n1. 1. 每个 Dockerfile 指令（FROM/RUN/COPY/ADD）创建一个只读层\n2. 2. 层之间通过 Copy-on-Write（COW）机制堆叠\n3. 3. 容器运行时在最顶层添加可写层（Container Layer）\n4. 4. 所有层的累加 = 最终镜像体积\n\n为什么删除文件不减少镜像体积？\n\n```\n# 错误示例RUN apt-get update && apt-get install -y build-essential  # Layer 1: +200MBRUN apt-get clean  # Layer 2: 删除缓存，但 Layer 1 的 200MB 仍存在！# 最终镜像 = Layer 1 (200MB) + Layer 2 (0MB) = 200MB# 正确示例RUN apt-get update && apt-get install -y build-essential \\    && apt-get clean  # 在同一层完成安装与清理# 最终镜像 = Layer 1 (150MB，已清理缓存)\n```\n\n多阶段构建原理：\n\n- • 阶段1（builder）：包含完整工具链，生成二进制或编译依赖\n- • 阶段2（运行时）：使用 COPY --from=builder 仅复制必要文件\n- • 丢弃的内容：阶段1的所有中间层（编译工具、临时文件）不会进入最终镜像\n\nAlpine vs Ubuntu 体积差异：\n\n`\n\n`\n\n- • Ubuntu：基于 glibc，包含完整 GNU 工具链（bash/coreutils），适合通用场景\n- • Alpine：基于 musl libc + BusyBox，极致精简，但可能遇到兼容性问题（如某些 Python C 扩展）","/article/121",309,"2026-01-06 11:54:35","2026-01-06 12:01:59",[155,156,157],{"id":39,"name":81,"url":82},{"id":46,"name":64,"url":66},{"id":145,"name":146,"url":150},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"title":160,"url":66},"返回列表",{"title":162,"url":163},"kubernetes 1.12.1 高可用安装之部署Traefik","/article/85",[165,166,167,168],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"description":147,"keywords":6,"title":146},[171,180,189,198,207,216,225,234,243,251],{"id":172,"category_id":44,"title":173,"keywords":174,"description":175,"image_url":6,"url":176,"hits":177,"is_recommend":73,"is_top":73,"create_time":178,"update_time":179},101,"开启 HTTPS 并获得 ssllabs 满分的过程","开启,获得,满分,过程","准备工作确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。使用官网推荐的CertBot获取证书。在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。安装CertBot12345apt-get updateapt-get install software-properties-commonadd-apt-repository ppa:certbot/certbotapt-get updateapt-get","/article/101",18546,"2019-11-26 16:12:11","2019-11-26 16:23:16",{"id":181,"category_id":44,"title":182,"keywords":183,"description":184,"image_url":6,"url":185,"hits":186,"is_recommend":73,"is_top":73,"create_time":187,"update_time":188},113,"在CentOS 7中添加命令自动补全功能","命令自动补全,centos","在CentOS 7中，默认情况下并不会安装命令补全包，需要手动安装才能使用命令补全功能。以下是在CentOS 7中安装命令补全包的方法：1. bash-completion：这是一个针对Bash shell的命令补全软件包，可以提供对系统命令、用户自定义命令和文件路径的自动补全功能。可以通过以下命令安装：```sudo yum install bash-completion```安装完成后，需要在/etc/profile配置文件中添加以下内容：```if [ -f /etc/bash_compl","/article/113",14948,"2023-05-16 10:54:01","2023-05-16 10:57:28",{"id":190,"category_id":44,"title":191,"keywords":192,"description":193,"image_url":6,"url":194,"hits":195,"is_recommend":53,"is_top":73,"create_time":196,"update_time":197},94,"Centos7 安装 openvas ","openvas,开放式漏洞评估系统，installing openvas centos-7","一、描述OpenVAS，即开放式漏洞评估系统，是一个用于评估目标漏洞的杰出框架。功能十分强大，最重要的是，它是“开源”的——就是免费的意思啦～它与著名的Nessus“本是同根生”，在Nessus商业化之后仍然坚持开源，号称“当前最好用的开源漏洞扫描工具”。最新版的Kali Linux(kali 3.0)不再自带OpenVAS了，所以我们要自己部署OpenVAS漏洞检测系统。其核心部件是一个服务器，包括一套网络漏洞测试程序，可以检测远程系统和应用程序中的安全问题。但是它的最常用用途是检测目标网络或","/article/94",14690,"2019-01-14 17:43:42","2019-01-14 18:16:36",{"id":199,"category_id":44,"title":200,"keywords":201,"description":202,"image_url":6,"url":203,"hits":204,"is_recommend":73,"is_top":73,"create_time":205,"update_time":206},99,"Centos7 利用iptables防止nmap工具防端口扫描","iptables","一、Nmap介绍       Nmap（NetworkMapper）是一款开放源代码的网络探测和安全审核工具。它用于快速扫描一个网络和一台主机开放的端口，还能使用TCP/IP协议栈特征探测远程主机的操作系统类型。nmap支持很多扫描技术，例如：UDP、TCPconnect()、TCPSYN(半开扫描)、ftp代理(bounce攻击)、反向标志、ICMP、FIN、ACK扫描、圣诞树(XmasTree)、SYN扫描和null扫描。Nmap最初是用于Unix系统","/article/99",14415,"2019-07-09 21:27:00","2019-07-09 21:57:53",{"id":208,"category_id":46,"title":209,"keywords":210,"description":211,"image_url":6,"url":212,"hits":213,"is_recommend":73,"is_top":73,"create_time":214,"update_time":215},61,"Docker 推荐的启动方式","推荐,启动,方式","# cat DockerfileFROM openjdk:8-alpineWORKDIR /ADD ./target/*.jar app.jarEXPOSE 9999COPY docker-entrypoint.sh /RUN chmod +x /docker-entrypoint.shENTRYPOINT [“/docker-entrypoint.sh”]CMD [“java”,”-server”,”-Duser.timezone=GMT+08″,”-jar”,”/app.jar”]# cat","/article/61",14347,"2018-10-22 13:55:47","2018-10-22 13:56:10",{"id":217,"category_id":44,"title":218,"keywords":219,"description":220,"image_url":6,"url":221,"hits":222,"is_recommend":73,"is_top":73,"create_time":223,"update_time":224},107,"Acme.sh 给 SSL 证书自动续期失败的解决方法","HTTP/1.1 200 OK,Server: Bayou Tech Web Srv 1.0,Content-Encoding: none,Content-Length: 5,Content-Type","一、Acme.sh 自动续期失败的症状问题描述如下，续期的时候，提示如下错误：root@dc:~# \"/data/acme.sh\"/acme.sh --cron --home \"/data/acme.sh\" > /dev/null[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com[Sun Nov 10 23:52:17 CST 2020] Please check log file","/article/107",12618,"2021-09-03 10:44:18","2021-09-03 10:46:23",{"id":226,"category_id":44,"title":227,"keywords":228,"description":229,"image_url":6,"url":230,"hits":231,"is_recommend":53,"is_top":73,"create_time":232,"update_time":233},93,"ELK+Filebeat+Kafka+ZooKeeper 构建海量日志分析平台","Filebeat,Kafka","一、说明1.Filebeat是一个日志文件托运工具，在你的服务器上安装客户端后，filebeat会监控日志目录或者指定的日志文件，追踪读取这些文件（追踪文件的变化，不停的读）2.Kafka是一种高吞吐量的分布式发布订阅消息系统，它可以处理消费者规模的网站中的所有动作流数据3.Logstash是一根具备实时数据传输能力的管道，负责将数据信息从管道的输入端传输到管道的输出端；与此同时这根管道还可以让你根据自己的需求在中间加上滤网，Logstash提供里很多功能强大的滤网以满足你的各种应用场景4.El","/article/93",12190,"2018-12-24 16:40:08","2018-12-26 11:53:38",{"id":235,"category_id":46,"title":236,"keywords":237,"description":238,"image_url":6,"url":239,"hits":240,"is_recommend":53,"is_top":73,"create_time":241,"update_time":242},81,"kubernetes 1.12.1 高可用安装之部署Dashboard","安装Dashboard","创建Dashboard需要CoreDNS部署成功之后再安装Dashboard。[root@master01 ~]# wget https://zhl123.com/download/k8s/Dashboard.tgz[root@master01 ~]# tar xf Dashboard.tgz[root@master01 ~]# kubectl create -f Dashboard/[root@master01 Dashboard]# kubectl get svc -n kube-syste","/article/81",12037,"2018-10-26 09:54:41","2018-10-26 16:59:19",{"id":244,"category_id":44,"title":245,"keywords":6,"description":246,"image_url":6,"url":247,"hits":248,"is_recommend":73,"is_top":73,"create_time":249,"update_time":250},100,"用 Nginx 给 Cookie 增加 Secure 和 HttpOnly","在 nginx 的 location 中配置12# 只支持 proxy 模式下设置，SameSite 不需要可删除，如果想更安全可以把 SameSite 设置为 Strictproxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";示例1234567891011121314151617181920212223242526server {    listen 443 ssl http2;    server_name www.zhl123.cn","/article/100",11848,"2019-11-26 16:10:57","2019-11-26 16:23:45",{"id":252,"category_id":44,"title":253,"keywords":254,"description":255,"image_url":6,"url":256,"hits":257,"is_recommend":73,"is_top":73,"create_time":258,"update_time":259},41,"Tomcat 安全配置与性能优化","tomcat，性能优化","1. JVM 1.1. 使用 Server JRE 替代JDK。 服务器上不要安装JDK，请使用 Server JRE. 服务器上根本不需要编译器，代码应该在Release服务器上完成编译打包工作。 理由：一旦服务器被控制，可以防止在其服务器上编译其他恶意代码并植入到你的程序中。 1.2. JAVA_OPTS export JAVA_OPTS=\"-server -Xms512m -Xmx4096m  -XX:PermSize=64M -","/article/41",11623,"2016-09-01 17:06:36","2018-10-18 17:06:58",[261,269,277,278,286,294,302,310,319,328],{"id":262,"category_id":40,"title":263,"keywords":6,"description":264,"image_url":6,"url":265,"hits":266,"is_recommend":73,"is_top":73,"create_time":267,"update_time":268},123,"Agent Skill 精选集：最值得收藏的 Agent Skills Top 10","如果你正在用 Claude Code 或 Codex，一定对 Agent Skills 不陌生。通过安装 Agent Skills，你可以让这些 AI 助手变得更强——不用每次都解释你的需求，它们直接就知道该怎么做。最近有人在 GitHub 上做了一个采样调查，统计了哪些 Skills 的质量最佳和最受欢迎。我整理了这份 Top 10 榜单，加上使用场景和适合人群，帮你快速找到最有用的那几个。Top 10 最受欢迎的 Agent Skills1. Skil","/article/123",270,"2026-01-19 18:49:12","2026-01-19 18:52:01",{"id":270,"category_id":44,"title":271,"keywords":6,"description":272,"image_url":6,"url":273,"hits":274,"is_recommend":73,"is_top":73,"create_time":275,"update_time":276},122,"Nginx性能调优18条黄金法则：支撑10万并发的配置模板","一、概述1.1 背景介绍说实话，Nginx调优这事儿我踩过无数坑。记得2019年双11，我们电商平台流量暴涨，Nginx直接扛不住了，QPS从平时的2万飙升到8万，响应时间从50ms飙到了2秒，最后还是靠临时加机器扛过去的。那次事故之后，我花了大半年时间专门研究Nginx的性能极限，总结出了这20条黄金法则。Nginx作为目前最流行的Web服务器和反向代理，官方数据显示单机可以轻松处理10万+的并发连接。但实际生产环境中，很多同学拿到默认配置就直接上了，结果发现连1万并发都扛不住。问题不在Ngi","/article/122",337,"2026-01-12 11:11:50","2026-01-12 11:12:28",{"id":145,"category_id":46,"title":146,"keywords":6,"description":147,"image_url":6,"url":150,"hits":151,"is_recommend":73,"is_top":73,"create_time":152,"update_time":153},{"id":279,"category_id":44,"title":280,"keywords":6,"description":281,"image_url":6,"url":282,"hits":283,"is_recommend":73,"is_top":73,"create_time":284,"update_time":285},120,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(二)","五、故障排查和监控5.1 故障排查◆ 5.1.1 日志查看# 查看 Prometheus 日志中的规则评估错误journalctl -u prometheus | grep -i \"rule\" | tail -50# 查看规则评估耗时curl -s http://localhost:9090/api/v1/rules | jq '.data.groups[].rules[] | select(.health != \"ok\")'# Kubernet","/article/120",282,"2026-01-06 11:53:50","2026-01-06 11:54:33",{"id":287,"category_id":44,"title":288,"keywords":6,"description":289,"image_url":6,"url":290,"hits":291,"is_recommend":73,"is_top":73,"create_time":292,"update_time":293},119,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(一)","一、概述1.1 背景介绍在大规模微服务架构下，Prometheus 告警系统往往会陷入一个尴尬的境地：告警太多，运维团队开始选择性忽略；告警太少，真正的故障又可能漏掉。我在某电商平台负责监控体系建设时，团队每天要处理超过 2000 条告警，其中 70% 以上是重复的、关联的或者短暂抖动产生的噪声。Recording Rules 是 Prometheus 提供的预计算机制，可以将复杂的查询表达式预先计算并存储为新的时间序列。通过合理设计 Recording Rules，我们不仅能显著降低 Prom","/article/119",301,"2026-01-06 11:51:58","2026-01-06 11:53:45",{"id":295,"category_id":44,"title":296,"keywords":6,"description":297,"image_url":6,"url":298,"hits":299,"is_recommend":73,"is_top":73,"create_time":300,"update_time":301},118,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(二)","四、最佳实践和注意事项4.1 最佳实践4.1.1 性能优化优化点一：减少 Git 轮询频率# argocd-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-cm  namespace: argocddata:  timeout.reconciliation: 300s  # 默认 180","/article/118",305,"2026-01-06 11:49:00","2026-01-06 11:49:34",{"id":303,"category_id":44,"title":304,"keywords":6,"description":305,"image_url":6,"url":306,"hits":307,"is_recommend":73,"is_top":73,"create_time":308,"update_time":309},117,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(一)","一、概述1.1 背景介绍GitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubec","/article/117",310,"2026-01-06 11:45:03","2026-01-06 11:48:56",{"id":311,"category_id":40,"title":312,"keywords":313,"description":314,"image_url":6,"url":315,"hits":316,"is_recommend":73,"is_top":73,"create_time":317,"update_time":318},116,"运维部门年度2025工作总结与2026工作规划应该如何写？","运维部门年度2025工作总结,2026工作规划","2025年，运维部在公司“数字化转型深化”战略引领下，以“稳定为基、效率为纲、安全为盾、创新为翼”为核心导向，全面支撑核心业务系统运行、推动技术架构迭代、强化团队能力建设。 全年实现核心业务系统可用性99.985%，较2024年提升0.02个百分点；故障平均恢复时间（MTTR）从42分钟压缩至29分钟，下降31%；云资源成本同比降低16.8%，自动化运维覆盖率从65%提升至83%，未发生重大生产安全事故，圆满完成年度目标。现将全年工作及2026年规划汇报如下：2025年核心工作成果（数","/article/116",297,"2026-01-06 11:20:58","2026-01-06 11:44:04",{"id":320,"category_id":40,"title":321,"keywords":322,"description":323,"image_url":6,"url":324,"hits":325,"is_recommend":73,"is_top":73,"create_time":326,"update_time":327},115,"Kubernetes 100个常用命令","100 个 Kubectl 命令","这篇文章是关于使用 Kubectl 进行 Kubernetes 诊断的指南。列出了 100 个 Kubectl 命令，这些命令对于诊断 Kubernetes 集群中的问题非常有用。这些问题包括但不限于：• 集群信息• Pod 诊断• 服务诊断• 部署诊断• 网络诊断• 持久卷和持久卷声明诊断• 资源使用情况• 安全和授权• 节点故障排除• 其他诊断命令：文章还提到了许多其他命令，如资源扩展和自动扩","/article/115",3642,"2023-11-02 14:09:30","2023-11-02 14:10:05",{"id":181,"category_id":44,"title":182,"keywords":183,"description":184,"image_url":6,"url":185,"hits":186,"is_recommend":73,"is_top":73,"create_time":187,"update_time":188},1784716028274]