Docker Cicd

Docker CI/CD — 持续集成与持续部署

Guidance for integrating Docker into automated build, test, and deployment pipelines.

When to Use

ALWAYS use this skill when the user mentions:

• "docker CI", "docker CD", "CI/CD pipeline"
• "GitHub Actions docker", "Jenkins docker"
• "buildx", "multi-platform build", "多平台构建"
• "Docker Build Cloud"
• "镜像构建流水线"

GitHub Actions

Build & Push Pipeline

name: Build and Push
on:
  push:
    tags: ['v*']

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          push: true
          tags: user/app:${{ github.ref_name }},user/app:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

Multi-Platform Build

- name: Build and push multi-platform
  uses: docker/build-push-action@v6
  with:
    platforms: linux/amd64,linux/arm64
    push: true
    tags: user/app:latest

Jenkins Pipeline

pipeline {
    agent any
    environment {
        DOCKER_IMAGE = 'myapp'
        DOCKER_TAG = "${env.BUILD_NUMBER}"
    }
    stages {
        stage('Build') {
            steps {
                sh "docker build -t ${DOCKER_IMAGE}:${DOCKER_TAG} ."
            }
        }
        stage('Test') {
            steps {
                sh "docker run --rm ${DOCKER_IMAGE}:${DOCKER_TAG} npm test"
            }
        }
        stage('Push') {
            steps {
                withDockerRegistry([credentialsId: 'docker-hub']) {
                    sh "docker push ${DOCKER_IMAGE}:${DOCKER_TAG}"
                }
            }
        }
    }
}

Layer Caching in CI

# Pull previous image for layer cache
docker pull $IMAGE:latest || true
docker build \
  --cache-from $IMAGE:latest \
  --build-arg BUILDKIT_INLINE_CACHE=1 \
  -t $IMAGE:$TAG .

Workflow — 推荐 CI/CD 流程

Step 1: 配置 CI 环境: docker/login-action + docker/setup-buildx-action Step 2: 构建镜像: docker/build-push-action + registry 缓存加速 Step 3: 安全扫描: docker/scout-action 扫描 CVE + 策略门禁 Step 4: 推送仓库: 多标签（semver + sha + latest）推送到 ghcr.io/Docker Hub Step 5: 部署: ArgoCD/Flux 监听仓库变更自动部署

Gotchas — Common Pitfalls

• CI cache miss: Without --cache-from, every CI build starts from scratch. → Recovery: docker pull myapp:latest || true before build; use --cache-from type=gha in GitHub Actions.
• Build secrets in CI logs: Never echo or print secrets. Use buildx --secret or CI secrets masking. → Recovery: docker buildx build --secret id=npmrc,src=$HOME/.npmrc; check CI secrets are masked in logs.
• Disk space in CI: Multi-stage builds can consume CI disk. → Recovery: docker system prune -af between builds; monitor with docker system df.
• Multi-platform emulation slow: QEMU emulation for ARM on AMD is slow (~10x). → Recovery: Use native ARM runners (e.g., GitHub Actions ARM64 runners) or Docker Build Cloud for multi-platform.

Boundary — 能力边界（适用与不适用场景）

When NOT to Use

Security & Stability

• Never hardcode registry credentials in CI configs. Use CI secrets manager (GitHub Secrets, Jenkins Credentials).
• Use OIDC (OpenID Connect) for cloud registry auth instead of long-lived credentials.
• Scan images with Docker Scout before pushing to production registry.
• Tag images with SHA digest for audit trails: image:sha-${GITHUB_SHA::7}.
• Rotate registry tokens regularly. Never use personal access tokens for CI.

📚 官方文档参考

🧭 Docker Skills Journey

📍 You are here: `docker-cicd` — CI/CD 自动化

← Previous: docker-build | → Next: docker-production

FAQ

Q1: 如何快速上手此技能？ A: 参考上方的快速开始章节，按步骤操作即可。

Q2: 遇到版本不兼容问题怎么办？ A: 检查依赖版本，使用 lock 文件锁定，参考常见陷阱章节。

Q3: 如何在生产环境使用？ A: 参考最佳实践章节，确保配置正确，做好监控和日志。

Q4: 性能如何优化？ A: 参考性能优化相关文档，使用缓存、索引等手段。

Q5: 如何贡献或反馈问题？ A: 在 GitHub 仓库提交 Issue 或 Pull Request。

Q6: 是否支持中文？ A: 支持中文文档和中文注释，详见国内适配章节。

GitHub Actions — Build, Scan, Push

name: Build and Deploy
on:
  push:
    branches: [main]
    tags: ['v*']

env:
  IMAGE_NAME: myapp

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Registry
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=tag
            type=sha,prefix=

      - name: Build and Push
        uses: docker/build-push-action@v6
        with:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

Jenkins Pipeline with Docker

pipeline {
    agent any
    environment {
        REGISTRY = 'docker.io/myorg'
        IMAGE_NAME = 'myapp'
    }
    stages {
        stage('Checkout') {
            steps { checkout scm }
        }
        stage('Build') {
            steps {
                script {
                    docker.build("${IMAGE_NAME}:${BUILD_NUMBER}")
                }
            }
        }
        stage('Test') {
            steps {
                script {
                    docker.image("${IMAGE_NAME}:${BUILD_NUMBER}").inside {
                        sh 'npm test'
                    }
                }
            }
        }
        stage('Push') {
            steps {
                script {
                    docker.withRegistry("https://${REGISTRY}", 'docker-hub-cred') {
                        docker.image("${IMAGE_NAME}:${BUILD_NUMBER}").push()
                        docker.image("${IMAGE_NAME}:${BUILD_NUMBER}").push('latest')
                    }
                }
            }
        }
    }
    post {
        always { cleanWs() }
    }
}

CI 多架构构建：GitHub Actions + buildx + QEMU

.github/workflows/multi-arch.yml

name: Multi-Arch Build and Push

on:
  push:
    tags: ['v*']

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64,arm,s390x

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            image=moby/buildkit:latest

      - name: Login to Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=sha,format=short

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Verify manifest
        run: |
          docker buildx imagetools inspect \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}

仅构建不推送（PR 验证）

- name: Build (PR check)
  uses: docker/build-push-action@v6
  with:
    context: .
    platforms: linux/amd64,linux/arm64
    push: false
    cache-from: type=gha

Buildx Multi-Platform Build

# Create builder with multi-platform support
docker buildx create --name multiarch --use
docker buildx inspect --bootstrap

# Build for multiple platforms
docker buildx build   --platform linux/amd64,linux/arm64   -t myapp:latest   --push .

# Check platform support
docker buildx imagetools inspect myapp:latest

# GitHub Actions example: add platforms to build-push-action
# platforms: linux/amd64,linux/arm64

Docker Build Cloud CI 集成

概述

将构建卸载到云端 BuildKit 集群，CI Runner 仅发送构建上下文。

前置步骤

# 登录 Docker（需付费订阅）
docker login

# 创建 Cloud Builder
docker buildx create \
  --name cloud-builder \
  --driver cloud \
  --use

# 验证
docker buildx ls

GitHub Actions 集成

- name: Set up Docker Buildx with Cloud
  uses: docker/setup-buildx-action@v3
  with:
    driver: cloud
    endpoint: myorg/cloud-builder     # Build Cloud endpoint

- name: Build and push
  uses: docker/build-push-action@v6
  with:
    platforms: linux/amd64,linux/arm64
    push: true
    tags: myorg/myapp:latest
    cache-from: type=registry,ref=myorg/myapp:buildcache
    cache-to: type=registry,ref=myorg/myapp:buildcache,mode=max

Jenkins Pipeline

pipeline {
    agent any
    environment {
        DOCKER_BUILDKIT = '1'
    }
    stages {
        stage('Build') {
            steps {
                sh '''
                    docker buildx build \
                        --builder cloud-builder \
                        --platform linux/amd64,linux/arm64 \
                        --tag myorg/myapp:${BUILD_NUMBER} \
                        --push .
                '''
            }
        }
    }
}

共享缓存

团队内所有成员共享 Build Cloud 缓存，无需额外配置：

开发者 A 构建 → 缓存写入 Cloud
开发者 B 构建 → 命中 A 的缓存（层 hash 匹配）
CI 构建 → 命中团队缓存

与本地构建对比