在Dockerfile中校验和下载的典型方法？

Question

我正在创建一个Dockerfile,可以从源代码下载,构建和安装node.js. 我想在构建之前对下载进行校验和,如果校验和失败则停止或退出Dockerfile:

# officially supported ubuntu
FROM ubuntu:12.04

# SETUP
RUN cd /tmp
RUN apt-get update -y
RUN apt-get install wget build-essential automake -y
RUN wget http://nodejs.org/dist/latest/node-v0.10.26.tar.gz
RUN wget http://nodejs.org/dist/latest/SHASUMS256.txt

# RUN checksum: exit on fail, continue on success
??? how ???

# INSTALL
RUN tar -xvf node-v0.10.26.tar.gz && cd node-v0.10.26
RUN ./configure && make && make install

# CLEANUP
apt-get autoremove --purge wget build-essential automake -y

Docker社区是否采用了"最佳实践"方式来实现这一目标？

Answer 1

如果任何RUN命令返回非零代码,则构建将失败.

FROM fedora
RUN false

在上面的Dockerfile中,我只是通过运行进行快速测试false.false是一个linux实用程序,它只设置一个非零返回代码,方便测试.正如您所看到的,当我构建Dockerfile时,它会抱怨并失败.

$ docker build .
Uploading context 12.29 kB
Uploading context
Step 0 : FROM fedora
 ---> 58394af37342
Step 1 : RUN false
 ---> Running in a5b9a4b37e25
2014/04/22 09:41:19 The command [/bin/sh -c false] returned a non-zero code: 1

因此,只需要在图像中显示文件和校验和(您看起来通过它wget),就可以测试它.下面是一个快速而又脏的版本,我在其中生成一个文件并在验证之前计算其校验和.在你的例子中,你显然不会这样做,我只是为了向你展示它是如何工作的.

FROM fedora

# Create the text file
RUN echo ThisIsATest > echo.txt

# Calculate the checksum
RUN sha1sum echo.txt > sha1sums.txt

# Validate the checksum (this should pass)
RUN sha1sum -c sha1sums.txt

# Alter the text
RUN echo ThisShouldFail > echo.txt

# Validate the checksum (this should now fail)
RUN sha1sum -c sha1sums.txt

如果我们运行这个......

$ docker build -no-cache .
Warning: '-no-cache' is deprecated, it will be removed soon. See usage.
Uploading context  12.8 kB
Uploading context
Step 0 : FROM fedora
 ---> 58394af37342
Step 1 : RUN echo ThisIsATest > echo.txt
 ---> Running in cd158d4e6d91
 ---> 4088b1b4945f
Step 2 : RUN sha1sum echo.txt > sha1sums.txt
 ---> Running in 5d028d901d94
 ---> c97b1d31a720
Step 3 : RUN sha1sum -c sha1sums.txt
 ---> Running in 44d119897164
echo.txt: OK
 ---> ca01d590cadd
Step 4 : RUN echo ThisShouldFail > echo.txt
 ---> Running in 87b575ac4052
 ---> 36bb5d8cf6d1
Step 5 : RUN sha1sum -c sha1sums.txt
 ---> Running in e20b7ac0c924
echo.txt: FAILED
WARNING: 1 computed checksum did NOT match
2014/04/22 10:29:07 The command [/bin/sh -c sha1sum -c sha1sums.txt] returned a non-zero code: 1

Answer 2

1- 下载您的文件并将其放在需要的地方，然后运行：

sha256sum /path/to/file

输出：

255d...334  /path/to/file

2- 复制输出并将其放入您的 Dockerfile 中，如下所示：（注意括号之间的空格）

RUN [ "255d...334  /path/to/file" = "$(sha256sum /usr/local/bin/confd)" ]

正如@Todd 提到的，如果命令响应非零，则构建将失败。您也可以使用 sha1sum 或 sha512sum。

Answer 3

我已将校验和设置为变量

ARG CHECKSUMKUBECTL="51f5679a0cb11a65f25c3479bbfdfd21c4d0acd8814d3cbaf5aaeea7682178a3820c3555b17ea6ee24470ac67ebfd0f78cc98513e5b526436494350be64bda69"

以下代码在它们不匹配时抛出退出代码，如果匹配则抛出“Ok”。

RUN echo "${CHECKSUMKUBECTL}  $BIN_DIR/kubectl" | sha512sum --check