Containerd镜像构建

buildkit

buildkit代码托管地址： https://github.com/moby/buildkit

简介

使用nerdctl无法直接通过containerd构建镜像，需要与buildkit组全使用以实现镜像构建。
buildkit项目是Docker公司开源出来的一个构建工具包，支持OCI标准的镜像构建。它主要包含以下部分:

• 服务端buildkitd，当前支持runc和containerd作为worker，默认是runc
• 客户端buildctl，负责解析Dockerfile，并向服务端buildkitd发出构建请求

buildkit是典型的C/S架构，client和server可以不在一台服务器上。而nerdctl在构建镜像方面也可以作为buildkitd的客户端。

安装

• 获取buildkit安装包并解压至/usr/local/目录：

wget https://breezey-public.oss-cn-zhangjiakou.aliyuncs.com/softwares/linux/kubernetes/buildkit-v0.9.0.linux-amd64.tar.gz
tar xf buildkit-v0.9.0.linux-amd64.tar.gz -C /usr/local/

• 配置buildkit的启动文件，可以从这里下载： https://github.com/moby/buildkit/tree/master/examples/systemd
  • buildkit需要配置两个文件
    • /etc/systemd/system/buildkit.socket
    • vim /etc/systemd/system/buildkit.service

# 配置buildkit.socker文件  
vim /etc/systemd/system/buildkit.socket
# 输入以下内容
[Unit]
Description=BuildKit
Documentation=https://github.com/moby/buildkit
[Socket]
ListenStream=%t/buildkit/buildkitd.sock
SocketMode=0660
[Install]
WantedBy=sockets.target
# 编辑buildkit.service 文件
vim /etc/systemd/system/buildkit.service
# 输入以下内容
[Unit]
Description=BuildKit
Requires=buildkit.socket
After=buildkit.socket
Documentation=https://github.com/moby/buildkit
[Service]
# Replace runc builds with containerd builds  
ExecStart=/usr/local/bin/buildkitd --addr fd://
[Install]
WantedBy=multi-user.target

• 启动buildkit:

systemctl daemon-reload
systemctl enable buildkit --now	

构建示例

构建一个nginx镜像

下面是一个简单的dockerfile示例：

# 添加引用的基础镜像
FROM centos:7
# 添加注解
LABEL Author natasha<natasha@example.com> \
      Time 20210911 \
      function  nginx-demo
# 镜像构建
ADD repos.tar.gz /etc/yum.repos.d/
#COPY repos.tar.gz /etc/yum.repos.d/
#ADD CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo
#ADD epel.repo /etc/yum.repos.d/epe l.repo
RUN yum install -y nginx && \
    rm -rf /usr/share/nginx/html/* && \
    echo "hello world" > /usr/share/nginx/html/index.html
# 容器启动时执行的操作
CMD ["nginx","-g", "daemon off;"]

• Dockerfile文件如下

FROM centos:7.6
RUN yum -y install wget
RUN wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
RUN wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
RUN yum -y install nginx
RUN rm -f /usr/share/nginx/html/index.html
RUN echo "hello word" > /usr/share/nginx/html/index.html
CMD ["nginx","-g","daemon off;"]

• docker基于分层思想，最多能128层，因此需要尽可能的避免分层，上述文件可优化如下

FROM centos:7.6
RUN yum -y install wget &&
wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo &&
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo &&
yum -y install nginx &&
rm -f /usr/share/nginx/html/index.html &&
echo “hello word” > /usr/share/nginx/html/index.html
CMD [“nginx”,"-g",“daemon off;”]

• 执行构建：

nerdctl build -t nginx:custom .

多阶段构建

下面是一个简单的golang的web应用示例：

package main
import (
  "io"
  "log"
  "net/http"
)
func main() {
  handler := func(w http.ResponseWriter, req *http.Request) {
    io.WriteString(w, "Hello, world!\n")
  }
  http.HandleFunc("/hello", handler)
  err := http.ListenAndServe(":8080", nil)
  if err != nil {
    log.Fatal(err)
  }
}

多阶段构建的dockerfile示例：

FROM golang:1.16.4-alpine3.13 as builder
WORKDIR /go/src/hello
COPY main.go .
ENV GO111MODULE=off
RUN go build .
FROM hub.example.com/ops/centos:7
WORKDIR /app/
COPY --from=0 /go/src/hello/hello .
CMD ["./hello"]
EXPOSE 8080

执行构建：

nerdctl build -t go-web-hello .