我已经创建了以下Dockerfile:
FROM ubuntu:20.04 as install
RUN apt update &&
apt -y install iputils-ping
FROM gcr.io/distroless/base-debian11
COPY --from=install /usr/bin/ping ./ping
COPY --from=install /lib/x86_64-linux-gnu/libcap.so.2 /lib/x86_64-linux-gnu/libcap.so.2
COPY --from=install /lib/x86_64-linux-gnu/libidn2.so.0 /lib/x86_64-linux-gnu/libidn2.so.0
COPY --from=install /lib/x86_64-linux-gnu/libc.so.6 /lib/x86_64-linux-gnu/libc.so.6
COPY --from=install /lib/x86_64-linux-gnu/libunistring.so.2 /lib/x86_64-linux-gnu/libunistring.so.2
COPY --from=install /usr/lib/x86_64-linux-gnu/libgcrypt.so.20 /usr/lib/x86_64-linux-gnu/libgcrypt.so.20
COPY --from=install /usr/lib/x86_64-linux-gnu/libgpg-error.so.0 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0
ENTRYPOINT ["./ping"]
但我不明白为什么它不起作用。我想可能是容器在进程完成之前就停止了。
$ docker run --rm distroless-ping 127.0.0.1
$ # no output from the run
至少,如果我不带参数运行它,我会得到输出:
$ docker run --rm distroless-ping
./ping: usage error: Destination address required
有什么问题吗?我试过使用Docker的CMD
而不是ENTRYPOINT
,但我也遇到了同样的问题。
我不知道gcr.io/distroless/base-debian11
是什么,确切地说,但它看起来好像包含一个不兼容的运行时加载器。如果我们从Ubuntu镜像中复制动态加载器…
COPY --from=install /lib64/ld-linux-x86-64.so.2 /lib64/ld-linux-x86-64.so.2
…然后它似乎像预期的那样工作:
$ docker run -it --rm pingtest 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.104 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.020 ms
^C
--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.020/0.062/0.104/0.042 ms
这使得最终的Dockerfile
看起来像:
FROM ubuntu:20.04 as install
RUN apt update &&
apt -y install iputils-ping
FROM gcr.io/distroless/base-debian11
COPY --from=install /usr/bin/ping ./ping
COPY --from=install /lib/x86_64-linux-gnu/libcap.so.2 /lib/x86_64-linux-gnu/libcap.so.2
COPY --from=install /lib/x86_64-linux-gnu/libidn2.so.0 /lib/x86_64-linux-gnu/libidn2.so.0
COPY --from=install /lib/x86_64-linux-gnu/libc.so.6 /lib/x86_64-linux-gnu/libc.so.6
COPY --from=install /lib/x86_64-linux-gnu/libunistring.so.2 /lib/x86_64-linux-gnu/libunistring.so.2
COPY --from=install /usr/lib/x86_64-linux-gnu/libgcrypt.so.20 /usr/lib/x86_64-linux-gnu/libgcrypt.so.20
COPY --from=install /usr/lib/x86_64-linux-gnu/libgpg-error.so.0 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0
COPY --from=install /lib64/ld-linux-x86-64.so.2 /lib64/ld-linux-x86-64.so.2
ENTRYPOINT ["./ping"]
请注意,使用一个额外的库,您可以从scratch
而不是gcr.io/distroless/base-debian11
构建最终图像:
FROM ubuntu:20.04 as install
RUN apt update &&
apt -y install iputils-ping
FROM scratch
COPY --from=install /usr/bin/ping ./ping
COPY --from=install /lib/x86_64-linux-gnu/libcap.so.2 /lib/x86_64-linux-gnu/libcap.so.2
COPY --from=install /lib/x86_64-linux-gnu/libidn2.so.0 /lib/x86_64-linux-gnu/libidn2.so.0
COPY --from=install /lib/x86_64-linux-gnu/libc.so.6 /lib/x86_64-linux-gnu/libc.so.6
COPY --from=install /lib/x86_64-linux-gnu/libunistring.so.2 /lib/x86_64-linux-gnu/libunistring.so.2
COPY --from=install /lib/x86_64-linux-gnu/libgcrypt.so.20 /lib/x86_64-linux-gnu/libgcrypt.so.20
COPY --from=install /lib/x86_64-linux-gnu/libgpg-error.so.0 /lib/x86_64-linux-gnu/libgpg-error.so.0
COPY --from=install /lib/x86_64-linux-gnu/libresolv.so.2 /lib/x86_64-linux-gnu/libresolv.so.2
COPY --from=install /lib64/ld-linux-x86-64.so.2 /lib64/ld-linux-x86-64.so.2
ENTRYPOINT ["./ping"]