Spring Boot 容器镜像分层构建
Posted isea533
tags:
篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了Spring Boot 容器镜像分层构建相关的知识,希望对你有一定的参考价值。
本文参考文档
本文使用 Maven 进行配置,Gradle 可以参考下面文档
一、场景
最常见的是容器镜像,将依赖、代码、配置分层后可以利用容器镜像层缓存机制加快构建和下载,这个场景使用分层是最优最简单的。
k8s 移除 Docker 后,文档中的 Docker 都去掉了…现在也把常说的 Docker 镜像 改成了 容器镜像
二、分层配置
如果不需要自定义分层,这一步可以跳过
在项目根目录中添加 layers.xml 配置文件,文件内容如下:
<layers xmlns="http://www.springframework.org/schema/boot/layers"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/boot/layers
https://www.springframework.org/schema/boot/layers/layers-2.6.xsd">
<application>
<into layer="spring-boot-loader">
<include>org/springframework/boot/loader/**</include>
</into>
<into layer="application"/>
</application>
<dependencies>
<into layer="application">
<includeModuleDependencies/>
</into>
<into layer="snapshot-dependencies">
<include>*:*:*SNAPSHOT</include>
</into>
<into layer="sencond-dependencies">
<include>com.example:*:*</include>
</into>
<into layer="dependencies"/>
</dependencies>
<layerOrder>
<layer>dependencies</layer>
<layer>spring-boot-loader</layer>
<layer>sencond-dependencies</layer>
<layer>snapshot-dependencies</layer>
<layer>application</layer>
</layerOrder>
</layers>
和官方示例相比这里增加了 sencond-dependencies,算是二方库依赖,如果公司有自己框架,自己平台,根据依赖的稳定性(修改频率)进行更细的分层。
依赖分层设计,可以参考 企业 Maven 依赖管理层次结构设计。
使用 IDEA,并且下载 layers-2.6.xsd 的情况下,<includeModuleDependencies/>
会报红,如下图所示:
通过查看官方文档和 spring boot 代码,发现文档、代码和 xsd 定义存在不一致的地方,提了 issues#31115 、 pr#31117 、pr#31126 ,代码已经合并, xsd经过修改,和文档保持一致。
增加上面的配置后,修改插件使用该配置:
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>$spring-boot.version</version>
<executions>
<execution>
<id>repackage</id>
<goals>
<goal>repackage</goal>
</goals>
</execution>
</executions>
<configuration>
<layers>
<enabled>true</enabled>
<configuration>$project.basedir/layers.xml</configuration>
</layers>
</configuration>
</plugin>
三、容器镜像
构建镜像有多种方式,官方文档介绍了 Dockerfile 和 Buildpacks 两种。
3.1 Dockerfile
通过 layertools
可以将 fat jar 按照分层定义中的层进行解压,命令如下:
Usage:
java -Djarmode=layertools -jar my-app.jar
Available commands:
list List layers from the jar that can be extracted
extract Extracts layers from the jar for image creation
help Help about any command
通过 java -Djarmode=layertools -jar my-app.jar extract
即可解压 jar 包到当前目录。为了方便,可以直接通过 Dockerfile 的多阶段构建进行,Dockerfile 如下:
FROM eclipse-temurin:11-jre as builder
WORKDIR application
ARG JAR_FILE=target/*.jar
COPY $JAR_FILE application.jar
RUN java -Djarmode=layertools -jar application.jar extract
FROM eclipse-temurin:11-jre
WORKDIR application
COPY --from=builder application/dependencies/ ./
COPY --from=builder application/spring-boot-loader/ ./
COPY --from=builder application/snapshot-dependencies/ ./
COPY --from=builder application/application/ ./
ENTRYPOINT ["java", "org.springframework.boot.loader.JarLauncher"]
如果有自定义分层,记得按顺序加入到 COPY 部分
一般情况下 target 下面只有一个 jar 后缀的包,此时可以直接执行下面的 Docker 命令:
docker build --tag imageName:version .
如果有多个 jar,需要通过参数指定:
docker build --build-arg JAR_FILE=path/to/myapp.jar --tag imageName:version .
构建后查看镜像信息:
IMAGE CREATED CREATED BY SIZE COMMENT
e1d22f48893d 11 seconds ago ENTRYPOINT ["java" "org.springframework.boot… 0B buildkit.dockerfile.v0
<missing> 11 seconds ago COPY application/application/ ./ # buildkit 55.1kB buildkit.dockerfile.v0
<missing> 11 seconds ago COPY application/snapshot-dependencies/ ./ #… 46.1MB buildkit.dockerfile.v0
<missing> 12 seconds ago COPY application/spring-boot-loader/ ./ # bu… 252kB buildkit.dockerfile.v0
<missing> 12 seconds ago COPY application/dependencies/ ./ # buildkit 216MB buildkit.dockerfile.v0
<missing> 10 minutes ago WORKDIR /application 0B buildkit.dockerfile.v0
<missing> 2 months ago /bin/sh -c set -eux; arch="$(dpkg --print-… 210MB
<missing> 2 months ago /bin/sh -c #(nop) ENV JAVA_VERSION=8u322 0B
<missing> 2 months ago /bin/sh -c #(nop) ENV LANG=C.UTF-8 0B
<missing> 2 months ago /bin/sh -c #(nop) ENV PATH=/usr/local/openj… 0B
<missing> 2 months ago /bin/sh -c echo '#/bin/sh'; echo 'echo "$J… 27B
<missing> 2 months ago /bin/sh -c #(nop) ENV JAVA_HOME=/usr/local/… 0B
<missing> 2 months ago /bin/sh -c set -eux; apt-get update; apt-g… 4.88MB
<missing> 2 months ago /bin/sh -c #(nop) CMD ["bash"] 0B
<missing> 2 months ago /bin/sh -c #(nop) ADD file:d48a85028743f16ed… 80.4MB
层信息:
"RootFS":
"Type": "layers",
"Layers": [
"sha256:1401df2b50d5de5a743b7bac3238ef3b7ce905ae39f54707b0ebb8eda3ab10bc",
"sha256:43015d7c36457e91ff0994082e7016335d5aa7690e8b5c799d41c2bab47f086c",
"sha256:f1bceed991c5891bd4bf3ad6e1ade5334e2c40ada40305b59fbf0a275ebbed17",
"sha256:7a49a2f5a65e2f57886dd32ffe85542283b249ccefd7a1b5379632030912d804",
"sha256:8791c93670dee0e973efce4424ea9b33caa49e7ef15c8e0bde1912b51c349524",
"sha256:94c6796cee53f42ae2478affbfc8510c97c76e65015ec46309f83265df078ef8",
"sha256:033be8a54968fe881ce71510862eacc0c3f3bdb6eb2af1a9130704bbe7442ae8",
"sha256:ab0700832472168ad4a9060b3fbedf8cc44f22ff1d074aebb67d9ee466796515",
"sha256:06a62903d01189112c0c8b6b68debaa170228e9d7cf868e1b9959001e877a4c4"
]
对代码进行简单修改后,重新构建镜像,再次查看:
IMAGE CREATED CREATED BY SIZE COMMENT
cc399ec3ba61 13 seconds ago ENTRYPOINT ["java" "org.springframework.boot… 0B buildkit.dockerfile.v0
<missing> 13 seconds ago COPY application/application/ ./ # buildkit 52.9kB buildkit.dockerfile.v0
<missing> 3 minutes ago COPY application/snapshot-dependencies/ ./ #… 46.1MB buildkit.dockerfile.v0
<missing> 3 minutes ago COPY application/spring-boot-loader/ ./ # bu… 252kB buildkit.dockerfile.v0
<missing> 3 minutes ago COPY application/dependencies/ ./ # buildkit 216MB buildkit.dockerfile.v0
<missing> 13 minutes ago WORKDIR /application 0B buildkit.dockerfile.v0
<missing> 2 months ago /bin/sh -c set -eux; arch="$(dpkg --print-… 210MB
<missing> 2 months ago /bin/sh -c #(nop) ENV JAVA_VERSION=8u322 0B
<missing> 2 months ago /bin/sh -c #(nop) ENV LANG=C.UTF-8 0B
<missing> 2 months ago /bin/sh -c #(nop) ENV PATH=/usr/local/openj… 0B
<missing> 2 months ago /bin/sh -c echo '#/bin/sh'; echo 'echo "$J… 27B
<missing> 2 months ago /bin/sh -c #(nop) ENV JAVA_HOME=/usr/local/… 0B
<missing> 2 months ago /bin/sh -c set -eux; apt-get update; apt-g… 4.88MB
<missing> 2 months ago /bin/sh -c #(nop) CMD ["bash"] 0B
<missing> 2 months ago /bin/sh -c #(nop) ADD file:d48a85028743f16ed… 80.4MB
层信息:
"RootFS":
"Type": "layers",
"Layers": [
"sha256:1401df2b50d5de5a743b7bac3238ef3b7ce905ae39f54707b0ebb8eda3ab10bc",
"sha256:43015d7c36457e91ff0994082e7016335d5aa7690e8b5c799d41c2bab47f086c",
"sha256:f1bceed991c5891bd4bf3ad6e1ade5334e2c40ada40305b59fbf0a275ebbed17",
"sha256:7a49a2f5a65e2f57886dd32ffe85542283b249ccefd7a1b5379632030912d804",
"sha256:8791c93670dee0e973efce4424ea9b33caa49e7ef15c8e0bde1912b51c349524",
"sha256:94c6796cee53f42ae2478affbfc8510c97c76e65015ec46309f83265df078ef8",
"sha256:033be8a54968fe881ce71510862eacc0c3f3bdb6eb2af1a9130704bbe7442ae8",
"sha256:ab0700832472168ad4a9060b3fbedf8cc44f22ff1d074aebb67d9ee466796515",
"sha256:4c0f187537195a34793722097d719f0c1247fec1648a6bdcf08f42556348af74"
]
和上面相比只有最上面的一层不同,通过分层尽可能利用Docker层缓存,可以减小镜像的差异,使得镜像更新时,只需要下载有差异的这一小部分。
构建镜像后,我们通过 grype 检测镜像是否存在安全漏洞:
$ grype 镜像名:版本
✔ Vulnerability DB [no update available]
✔ Loaded image
✔ Parsed image
✔ Cataloged packages [521 packages]
✔ Scanned image [136 vulnerabilities]
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
apt 2.2.4 deb CVE-2011-3374 Negligible
aviator 3.3.0 java-archive GHSA-xpv2-8ppj-79hh Critical
bsdutils 1:2.36.1-8+deb11u1 deb CVE-2022-0563 Negligible
coreutils 8.32-4+b1 deb CVE-2017-18018 Negligible
coreutils 8.32-4+b1 (won't fix) deb CVE-2016-2781 Low
e2fsprogs 1.46.2-2 (won't fix) deb CVE-2022-1304 High
gzip 1.10-4 1.10-4+deb11u1 deb CVE-2022-1271 Unknown
libapt-pkg6.0 2.2.4 deb CVE-2011-3374 Negligible
...
还可以对代码进行检查(dir:.
当前目录):
$ grype dir:.
✔ Vulnerability DB [no update available]
✔ Indexed .
✔ Cataloged packages [378 packages]
✔ Scanned image [36 vulnerabilities]
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
aviator 3.3.0 java-archive GHSA-xpv2-8ppj-79hh Critical
maven-aether-provider 3.1.1 java-archive CVE-2021-26291 Critical
maven-artifact 3.1.1 java-archive CVE-2021-26291 Critical
maven-common-artifact-filters 3.2.0 java-archive CVE-2021-26291 Critical
maven-core 3.1.1 java-archive CVE-2021-26291 Critical
maven-model 3.1.1 java-archive CVE-2021-26291 Critical
maven-model-builder 3.1.1 java-archive CVE-2021-26291 Critical
maven-repository-metadata 3.1.1 java-archive CVE-2021-26291 Critical
maven-settings 3.1.1 java-archive CVE-2021-26291 Critical
maven-settings-builder 3.1.1 java-archive CVE-2021-26291 Critical
maven-shared-utils 3.3.3 java-archive CVE-2021-26291 Critical
minio 8.3.8 java-archive CVE-2021-21390 Medium
minio 8.3.8 java-archive CVE-2020-11012 High
minio 8.3.8 java-archive CVE-2021-21287 High
3.2 Buildpacks
Spring Boot 插件集成了 Buildpacks 功能,插件配置如下:
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<executions>
<execution>
<goals>
<goal>build-image</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
执行 mvn org.springframework.boot:spring-boot-maven-plugin:build-image
即可构建镜像。
构建完镜像后,运行时可能会遇到中文乱码,可以通过下面两种方式解决:
1 运行镜像时,通过环境变量指定编码:
docker run -e JAVA_OPTS="-Dfile.encoding=UTF-8" <image_name>
2 配置 spring boot 插件,添加默认的 JVM 配置:
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>$spring-boot.version</version>
<executions>
<execution>
<goals>
<goal>build-image</goal>
</goals>
</execution>
</executions>
<configuration>
<image>
<env>
<BPE_DELIM_JAVA_TOOL_OPTIONS xml:space="preserve"> </BPE_DELIM_JAVA_TOOL_OPTIONS>
<BPE_APPEND_JAVA_TOOL_OPTIONS>-Dfile.encoding=UTF-8</BPE_APPEND_JAVA_TOOL_OPTIONS>
</env>
</image>
</configuration>
</plugin>
环境变量配置规则文档
https://github.com/paketo-buildpacks/environment-variables
上面两个ENV配置介绍如下:
- 追加分隔符使用空格
,xml配置保留空格(
xml:space="preserve"
)。- 追加JVM参数
四、Jar 包运行
除了使用镜像外,当使用 Jar 包运行时,通过 jar xf xxxx.jar
可以解压 jar 包到当前目录,解压后通过下面命令启动:
java org.springframework.boot.loader.JarLauncher
通过这种方式运行时,可以相对方便的修改配置文件,可以替换更新某些 jar 依赖,不用在对整个 fat jar 进行操作。
以上是关于Spring Boot 容器镜像分层构建的主要内容,如果未能解决你的问题,请参考以下文章