Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Ultimate Docker Cheat Sheet

devopscycle.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: The Ultimate Docker Cheat Sheet

#21

Post by nikeee »

I'm wondering why it's not more common to indent the stages in a multi-stage build. For me, it's a no-brainer to see at a glance

1. how many stages there are

2. how long they are

3. the dependencies

Taking the example from the article:

  FROM node:18-alpine as builder
      WORKDIR /app
      COPY ./package* .
      RUN npm ci
      COPY . .
      RUN npm run build:client

  FROM nginxinc/nginx-unprivileged:1.24 as serve
      COPY --from=builder /app/dist /var/www
      COPY --from=builder /app/.nginx/nginx.conf /etc/nginx/conf.d/default.conf
      EXPOSE 80
      CMD ["nginx", "-g", "daemon off;"]
IMHO it's just so more legible. Without this, it feels like writing C without indentation. Unfortunately the Jetbrains IDEs fail to properly apply syntax highlighting.

Re: The Ultimate Docker Cheat Sheet

#22

Post by ljm »

nikeee wrote: post #21

I'm wondering why it's not more common to indent the stages in a multi-stage build. For me, it's a no-brainer to see at a glance 1. how many stages there are 2. how long they are 3. the dependencies Taking the example from the article: FROM node:18-alpine as builder WORKDIR /app COPY ./package* . RUN npm ci COPY . . RUN npm run build:client FROM nginxinc/nginx-unprivileged:1.24 as serve COPY --from=builder /app/dist…

I've never really had the chance to try it, but buildah seems like a decent enough choice to build images using basic shell tooling. At least then you don't need to muck around with build-args or other limitations of the dockerfile DSL.

Re: The Ultimate Docker Cheat Sheet

#23

Post by pella »

MrLA wrote: post #8
pella wrote: post #7

Please add - Security warnings: like: Note that ports which are not bound to the host (i.e., -p 5432:5432 instead of -p 127.0.0.1:5432:5432) will be accessible from the outside. This also applies if you configured UFW to block this specific port, as Docker manages its own iptables rules. https://docs.docker.com/network/packet-filtering-firewalls/ - using trivy scanner: "trivy image --ignore-unfixed ... " ------------…

Author here. This is actually a good point, we will add this in the near future. Thanks for your input.

Sometimes, following a security vulnerability, users end up in intense discussions with the maintainers of Docker images. It's challenging to navigate such situations effectively. The apparent simplicity of Docker images can be deceptive and pose risks. It's important to exercise caution to avoid potential problems.

See:

"Docker Hub image for version 12.4 contains a cryptominer [Confirmed!]"

https://github.com/docker-library/postgres/issues/770

Re: The Ultimate Docker Cheat Sheet

#25

Post by m463 »

funaculi wrote: post #10

One thing missing I use often, is to run a throw-away image with custom entrypoint, for looking around and investigating: `docker run --entrypoint /bin/sh -it --rm the-image` IIRC

I do things like this all the time:

  docker run -it --rm ubuntu:22.04
I assume that the default command for this image is /bin/sh

Do you do it this way to override the image's entrypoint unconditionally?

Re: The Ultimate Docker Cheat Sheet

#27

Post by flumpcakes »

pella wrote: post #23
MrLA wrote: post #8

Earlier quoted context omitted.

Author here. This is actually a good point, we will add this in the near future. Thanks for your input.

Sometimes, following a security vulnerability, users end up in intense discussions with the maintainers of Docker images. It's challenging to navigate such situations effectively. The apparent simplicity of Docker images can be deceptive and pose risks. It's important to exercise caution to avoid potential problems. See: "Docker Hub image for version 12.4 contains a cryptominer [Confirmed!]" https://github.com/docker…

I would have thought people would have investigated more than just jumping to opening issues. There is obviously a skill issue here.
Post reply on HN