Docker 从入门到常用

# CMD 示例：默认执行 node app.js，可覆盖
CMD ["node", "app.js"]
# docker run my-image node server.js  → 覆盖

# ENTRYPOINT 示例：固定为 ping
ENTRYPOINT ["ping"]
CMD ["localhost"]
# docker run my-image  → ping localhost
# docker run my-image google.com  → ping google.com

# 第一阶段：构建
FROM golang:1.21 AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o server

# 第二阶段：运行（极小的 scratch 镜像）
FROM scratch
WORKDIR /
COPY --from=builder /app/server /server
EXPOSE 8080
CMD ["/server"]

# ===== 生产环境 =====
FROM node:20-alpine AS production

# 安全：使用非 root 用户
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app

# 先复制依赖文件（利用 Docker 缓存层）
COPY package.json pnpm-lock.yaml ./
RUN npm config set registry https://registry.npmmirror.com && \
    npm install --production

# 再复制源码
COPY . .

USER appuser
EXPOSE 3000
CMD ["node", "app.js"]

# docker-compose.yml
version: '3.8'

services:
  web:
    build: .
    ports:
      - "3000:3000"
    depends_on:
      - db
    environment:
      - DB_HOST=db
      - DB_PORT=5432

  db:
    image: postgres:16-alpine
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: myapp
      POSTGRES_PASSWORD: secret

volumes:
  pgdata:

# docker-compose.dev.yml
version: '3.8'

services:
  web:
    build:
      context: .
      target: development
    volumes:
      - .:/app                    # 源码热重载
      - /app/node_modules         # 屏蔽宿主机 node_modules
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
      - DEBUG=app:*               # 开启调试日志

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"               # 暴露端口，方便 Redis 客户端连接

  db:
    image: postgres:16-alpine
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: dev
      POSTGRES_PASSWORD: dev
      POSTGRES_DB: myapp_dev
    ports:
      - "5432:5432"               # 暴露端口，方便 GUI 工具连接

volumes:
  pgdata:

# docker-compose.prod.yml
version: '3.8'

services:
  web:
    image: myapp:latest
    restart: unless-stopped
    environment:
      - NODE_ENV=production
      - DB_HOST=db
      - REDIS_HOST=redis
    # 不暴露端口，通过 Nginx 反向代理
    networks:
      - backend

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data
    # 不暴露端口，仅内部通信
    networks:
      - backend

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${DB_USER}        # 从 .env 读取
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ${DB_NAME}
    # 不暴露端口
    networks:
      - backend

  nginx:
    image: nginx:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certs:/etc/nginx/certs:ro
    depends_on:
      - web
    networks:
      - backend

volumes:
  pgdata:
  redis_data:

networks:
  backend:

# docker-compose.test.yml
version: '3.8'

services:
  web:
    build:
      context: .
      target: test
    environment:
      - NODE_ENV=test
      - CI=true
    depends_on:
      - db
      - redis
    command: npm run test:e2e

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: test
      POSTGRES_PASSWORD: test
      POSTGRES_DB: test_db
    tmpfs:
      - /var/lib/postgresql/data    # 临时文件系统，测试结束即销毁

  redis:
    image: redis:7-alpine

services:
  db:
    image: postgres:16-alpine
    volumes:
      # 命名 volume（推荐）
      - pgdata:/var/lib/postgresql/data
      # bind mount（开发用）
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql

volumes:
  pgdata:        # 声明命名 volume

services:
  web:
    build: .
    networks:
      - frontend
      - backend
  api:
    image: my-api
    networks:
      - backend
  db:
    image: postgres
    networks:
      - backend
    # 不加入 frontend，更安全

networks:
  frontend:
  backend:

# ❌ 不推荐
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get clean

# ✅ 推荐：合并在一个 RUN 中
RUN apt-get update && \
    apt-get install -y curl && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# .github/workflows/docker-deploy.yml
name: Docker Build and Deploy

on:
  push:
    branches: [ main ]

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v4
        with:
          context: .
          push: true
          tags: user/myapp:latest
          cache-from: type=registry,ref=user/myapp:buildcache
          cache-to: type=registry,ref=user/myapp:buildcache,mode=max

      - name: Deploy to VPS
        uses: appleboy/ssh-action@master
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd /srv/myapp
            docker-compose pull
            docker-compose up -d --remove-orphans
            docker image prune -f