背景
在docker项目开发过程中,通常会涉及多架构容器镜像问题。正常情况下可以通过docker参数--platform=linux/xxx
指定拉取镜像的架构。在之前的文章中提到,本地搭建docker hub 并使用docker push
命令将镜像推送到hub中。后续实验中发现在使用--platform
参数拉取本地hub镜像时未实现架构区分的功能,通过查询资料发现需要通过manifest
进行多架构镜像管理。
下面介绍一下当时采用的一种方式,希望看到文章的各位多提建议。
docker manifest 使用
manifest简介
docker manifest
命令使用子命令来管理镜像和多架构镜像(manifest lists)。
docker manifest
命令本身不执行任何操作。为了对 manifest 或 manifest list 进行操作,必须使用其中一个子命令。 该命令还可以为用户查看普通镜像提供额外的信息,比如构建映像的操作系统和架构。
具体子命令信息可在命令行通过docker manifest --help
查看。
前提
1、本地环境中docker需要登录到远程仓库。具体登录命令参照docker login
2、需要将多架构的镜像区分不同的tag上传到远程hub中,具体tag方式参照docker tag,上传方式见docker push。
create
介绍
docker manifest create
创建一个多架构镜像(manifest lists),并 push 到镜像仓库。
要创建多架构镜像,首先要在本地创建 manifest lists,指定您希望包含在清单列表中的组成映像。请注意,这是推送到镜像仓库的,所以如果您想推送到镜像仓库不是官方默认 hub.docker.com,您需要指定您的多架构镜像的镜像仓库地址或IP和端口。这类似于标记镜像并将其推送到外部镜像仓库。
使用介绍
$ docker manifest create --help
Usage: docker manifest create MANIFEST_LIST MANIFEST [MANIFEST...]
Create a local manifest list for annotating and pushing to a registry
EXPERIMENTAL:
docker manifest create is an experimental feature.
Experimental features provide early access to product functionality. These
features may change between releases without warning, or can be removed from a
future release. Learn more about experimental features in our documentation:
https://docs.docker.com/go/experimental/
Options:
-a, --amend Amend an existing manifest list
--insecure Allow communication with an insecure registry
命令示例
$ docker manifest create register-mirror-ip:port/library/rockylinux:8.6.20227707 register-mirror-ip:port/library/rockylinux:8.6.20227707-amd register-mirror-ip:port/library/rockylinux:8.6.20227707-arm --insecure
Created manifest list register-mirror-ip:port/library/rockylinux:8.6.20227707
--insecure
参数:允许使用不安全的(非合法证书的 https)镜像仓库
问题记录
1、创建过程中出现manifest unknown
$ docker manifest create rockylinux:8.6.20227707 register-mirror-ip:port/library/rockylinux:8.6.20227707-arm register-mirror-ip:port/library/rockylinux:8.6.20227707-amd
Error: error setting up to read manifest and configuration from "register-mirror-ip:port/library/rockylinux:8.6.20227707": reading manifest rockylinux:8.6.20227707-arm in register-mirror-ip:port/library/rockylinux:8.6.20227707: manifest unknown: manifest unknown
问题产生原因可能是因为远程仓库中不存在对应tag的镜像,通过上传之后可以正常进行创建。
2、创建过程中出现no such manifest: xxxxx
$ docker manifest create rockylinux:8.6.20227707 register-mirror-ip:port/library/rockylinux:8.6.20227707-arm register-mirror-ip:port/library/rockylinux:8.6.20227707-amd
no such manifest: register-mirror-ip:port/library/rockylinux:8.6.20227707-arm
问题原因可能是远程hub地址采用的是http协议,而本地docker使用的是https,通过添加--insecure
参数可以解决此问题。
inspect
介绍
查看普通镜像或多架构镜像的详细信息。
使用介绍
# docker manifest inspect --help
Usage: docker manifest inspect [OPTIONS] [MANIFEST_LIST] MANIFEST
Display an image manifest, or manifest list
EXPERIMENTAL:
docker manifest inspect is an experimental feature.
Experimental features provide early access to product functionality. These
features may change between releases without warning, or can be removed from a
future release. Learn more about experimental features in our documentation:
https://docs.docker.com/go/experimental/
Options:
--insecure Allow communication with an insecure registry
-v, --verbose Output additional info including layers and platform
命令示例
$ docker manifest inspect rockylinux:8.6.20227707
{
"schemaVersion": 2,
"mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
"manifests": [
{
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
"size": 529,
"digest": "sha256:dead07b4d8ed7e29e98de0f4504d87e8880d4347859d839686a31da35a3b532f",
"platform": {
"architecture": "amd64",
"os": "linux"
}
},
{
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
"size": 530,
"digest": "sha256:73f11afcbb50d8bc70eab9f0850b3fa30e61a419bc48cf426e63527d14a8373b",
"platform": {
"architecture": "arm64",
"os": "linux",
"variant": "v8"
}
}
]
}
push
介绍
推送一个多架构镜像(manifest lists)到镜像仓库。
使用介绍
$ docker manifest push --help
Usage: docker manifest push [OPTIONS] MANIFEST_LIST
Push a manifest list to a repository
EXPERIMENTAL:
docker manifest push is an experimental feature.
Experimental features provide early access to product functionality. These
features may change between releases without warning, or can be removed from a
future release. Learn more about experimental features in our documentation:
https://docs.docker.com/go/experimental/
Options:
--insecure Allow push to an insecure registry
-p, --purge Remove the local manifest list after push
命令示例
$ docker manifest push rockylinux:8.6.20227707 --insecure
sha256:de5d160af1aaa1caf83f60098ac1b73a168e096575688446eb39739ab7b0a3d6