So first up we had Charles who posted his Docker file 1
area go 2
and let me let me pull up the green screen so we can 3
so let's look at this Docker file shall we. 4
And of course the reality is here is that once you get to real world files everything gets messier. 5
Right. 6
We all learn in courses like the ones I have and we learn from blog articles and documentation and then 7
once we get to the real world it always seems to be harder than that. 8
So I'm always trying to add more of that complexity to courses but it's a lot of work to get that in 9
the courses because you have to it's very context. 10
It's very much about your environment and your setup and your particular app. 11
So I thought last night Hey why don't we talk about this in the show tomorrow. 12
So if you really like this give this a thumbs up. 13
Tell me in chat or in the comments that you would like more of these and we'll make this a regular thing 14
we'll actually review more Docker files and compose files and pull out some of the good gems there. 15
All right. 16
So first up is Charles and it looks like he's coming from his own account he's got a P HP Apache image. 17
Based on that that name I'm going to just assume that that's what that is. 18
And it's got a date and it knows it's got a version and a date in the name there. 19
So that's pretty common as you start to get to your own custom from images you'll start to do things 20
like version them or date them or use commit ideas in them. 21
And that's a way to guarantee that you're using the exact same image right. 22
Again here you don't only use latest in any real production setup you can always use latest for playing 23
around and testing. 24
But when you go to real stuff you're always going to want to use those real versions. 25
Well that's Azure HP image Charles says. 26
OK cool. 27
And then he's got here an interesting set up that I've not seen before and I think I know why you're 28
doing it. 29
So in this run line here you're doing an app to get update and then you're saying if that doesn't you're 30
giving an OR in bash which means if this doesn't succeed do this. 31
And so you're repeating it. 32
So I'm guessing that may be either you're on a network or someplace where you potentially have a it's 33
a common issue to have to get update problems or maybe you've had some quirks in the past where it's 34
randomly failed and if you just did it a second time it would work. 35
That's what I'm guessing you're doing there. 36
And it's an effective solution to that problem if that's what it that's that's that's what it's for. 37
Otherwise I don't normally see this kind of setup this normally is not what I would see there. 38
All right. 39
Next up you export and which is just a tiny little metadata change. 40
So it's not going to take much Oh look at that Charles says at 41
yeah he says it's a as happy HP image. 42
And he spoke to mucks up Azure support and it fixes a bug. 43
So very cool 44
I'm going to change that 45
see 46
let's do this 47
changing the fonts here so it looks a little easier 48
yeah. 49
A look better. 50
Yeah. 51
All right. 52
So here's an interesting thing. 53
So you're download so you're doing some downloads and you're installing a package which is normal. 54
And you're also doing a bunch of APP get installs here. 55
So unless this is something you're testing and you're just trying to figure out how this workflow works 56
there's lots of opportunity for for optimization especially when it comes to size. 57
And you also have a situation here we can get yourself in a little bit of trouble. 58
So notice up here that we have a separate run line that's doing the app to get update. 59
So you don't have that line down here where you're doing all the install. 60
So you've broken these all these steps out. 61
Now if you start going and look at it official images you will notice that they never do this. 62
They always put it all in one huge run line and there's a couple of reasons for that. 63
The biggest reason here is cash busting. 64
So when you think about when you build an image there's a cash behind it. 65
Now if you're using something like Jenkins or a CCD runner and you have disabled caching where it's 66
always going to build every time from scratch without without caching then this may not be that issue 67
that kind of issue but it will certainly be an issue if you build locally or you build on any system 68
more than once. 69
And this is what's going to happen the the run line. 70
Let's say it's there. 71
OK. 72
And it never changes. 73
Right. 74
So the first time you build this image everything's fine. 75
Let's say you build three days later. 76
It's not going to cache this line because this line didn't change remember and on the on the standard 77
docker build command cache busting is when you've changed a line. 78
And when you change that line everything in that line is rerun and every line after it. 79
And what happens here is if you have this run line up here and it never changes but then you add let's 80
say another package down here in the run line or maybe you change the versions and you hard code your 81
versions which you should also be doing you should hard code the versions of all these tools and maybe 82
not zip and unzip and curl. 83
But if your security team is strict they will expect you to have reliable versions and that's another 84
thing you would want to do here. 85
But let's get back to this point. 86
So if you're going to do these installs and you change a tool and add it here. 87
Think about that and get update that had to get update downloads a cache of all of the metadata about 88
all these packages and then you're going to install these packages later and if the second line here 89
gets busted by changing it's going to rerun. 90
But it's going to be running based on that old cache of your app to get update. 91
So you over time will start to experience problems because your packages will always be installing those 92
old versions a much better way to do this is to take all your app to get stuff right. 93
And that's not necessarily related to downloading this package here. 94
This is a custom package. 95
We'll talk about that a minute. 96
But when it comes to these lines right here this line is going to have no effect on size because this 97
line has to run in the same line as this one or it's not going to work. 98
Now this is all maybe not true. 99
If you have another Okay so you're not doing multi-stage. 100
One way to get away with the size problem is do you do multi-state but you're not doing what the state 101
and that's OK. 102
You don't have to do a multi-stage 103
so let's see 104
so what's gonna happen here is that you would recommend taking these right here taking all this right 105
here bumping it all up to this line. 106
I would take this export line and put it above so I would I would just put it up here so that way it's 107
set. 108
And it never needs to change. 109
And you don't have to worry about it in the middle of all you're out to get stuff right. 110
And in general it's good that you're having all your at get stuff near the top because you want those 111
dependencies which usually take a long time to install you want them to be high up as possible so you 112
don't have to rerun them very often. 113
But I'm what I'm going to recommend that you take all this stuff right here 114
and put it up here now you can do this next because this is a manual package download and install. 115
So when you do this 116
there's a couple of things you can do. 117
One is this. 118
This line right here is going to be a layer and that layer is always going to include the db file even 119
if you don't need it. 120
So when you clean up later it's not cleaning up these previous layers. 121
That's one of the problems here is that it's a file that's downloaded into a layer and then you go to 122
the next line which is a or the next Docker command I should say the next Docker command will be a new 123
layer. 124
Think of that as a separate it's up once you stopped a line or a docker command. 125
You can not change that you can't go back in time and change that. 126
So the next line or command and docker file will just add stuff to it. 127
Now if it deletes files it's just going to delete them in that layer. 128
It essentially put some metadata that says hey that file should no longer exist or look like it exists 129
but those files are still going to exist and those read only layers because every layer above it is 130
now read only and that's the way that these layers guarantee that they're identical to what you expect. 131
So no layer can go back in time. 132
So that's what you need to do is go check out some of the docker default images and so let's do this 133
actually go look at one of mine because it'll be a little more 134
it might be a little easier to understand. 135
So 136
yeah I'm not sure. 137
OK. 138
So Docker file yes there's an AP Kay but you'll notice here how it's all in one line that's kind of 139
a bad example but let's do a hub and let's go look at Ghost. 140
So 141
look at this Debian Docker file. 142
All right here we go. 143
So you'll notice that in this situation it's downloading some stuff it's dealing with that stuff and 144
then it's getting rid of that stuff all in one run line. 145
So that way those files never stick around. 146
Once that layer is sealed and marked read only. 147
And that's pretty key to keeping your images small. 148
I bet once you make this stuff of efficient and combine this stuff together that you'll you'll be saving 149
hundreds of megs and your image size. 150
All right and the other thing here on this one is I would also add that to one single line and another 151
thing I would do there is you maybe don't need w get you maybe can do an ad an ad will automatically 152
download a file from the Internet. 153
And if you're very curious about the difference in copy and ad really nowadays our standard is copy 154
is really only for copying files out of the repo that you're in right. 155
So just copy files and ad does the same thing but we tend to only want to use ad when we're either downloading 156
something from the Internet or whatever we're copying and we want it to unzip or UN tar and that that's 157
really going to reason to use ad. 158
But the nice benefit of using ad there is you wouldn't need to do w w get you could use basically doctors 159
internals we'll go get that file and download it the negative of that though is that when you do that 160
line and then you go to the next line. 161
That package will still exist. 162
So even though ads really cool there in your case because you're downloading a package that you're good 163
they're going to install and then you don't need that package in that anymore. 164
I would maybe just put all three of those lines into one line that way at the very end you can actually 165
delete that dot D.B. file and save additional space in your final event. 166
So you would do all of that in one run. 167
All right. 168
That helps. 169
So looks like you're copying in some other files great that you're using copy not add. 170
You're also doing some makers and copying and certificates. 171
That's exactly how I would do it. 172
You might to make this more optimized you might put 173
all of these into a single run command usually because the basically it's a little bit faster to build 174
it will give you maybe a second faster in your bill because every single one these lines it has to stop 175
the container or create a new container mount the rest of the image and run that command then save that 176
to a new container image and then start a new container. 177
Right. 178
So it's got to do a lot more work than just run three quick commands. 179
So I might just have those in one. 180
There's no safe space savings or anything there but it's just a matter of three commands really would 181
turn into one long shell command their and yeah all right yeah. 182
We've got the gates. 183
I would probably do the same thing make those one just for efficiency by the way. 184
So right here you're copying in two different copy lines you can make that one line. 185
You could actually say copy and then the path to the CRT and then the path to that got to that key. 186
Kay Kay you why and have those two files and then put in the path to the SSL directory. 187
So as long as they're both going to the same directory you can have multiple files in the single copy 188
line that'll help you make it a little easier. 189
Fewer lines it tends to be better as long as they're not too complicated. 190
Yeah. 191
You've got some standard Apache stuff there on configurations you might also. 192
I don't know how much. 193
Yeah. 194
These are these are actually these are good. 195
I think those are good 196
yeah do it some more copying of config files in some of these you also might consider that these are 197
standard config files but if you need to overwrite these and you're using an orchestrator whether using 198
Cuban or swarm realize that you can use that config or in communities called config map you can use 199
the config feature and swarm to mount these files in at runtime so that way you're not hard coding any 200
configurations. 201
Ideally you're not hard coding SSL is into your image either really if you're you have custom SSL as 202
you want to store that in your orchestrator or in Docker and mount those and when you run because ideally 203
there shouldn't be anything secret in an image when you save it. 204
So hopefully you're going to be doing that same thing here as you could combine these two into one line 205
you could combine some of these into one line you could probably you know if this is all the x small 206
files that directory you could copy the directory asterisk dot X amount and then you could copy all 207
four into there it's pros and cons to that because then if an X extra excel file shows up it might accidentally 208
get copied in but it just depends on how verbose you want to be and how whether you want literal line 209
for lines kind of stuff versus keeping the darker file small and simple. 210
All right. 211
And then you got another copy run your change in the working directory and then you've got your entry 212
point. 213
Now typically so you don't have a CRM D. 214
So my guess is you are using the CRM D from this root image and that's totally fine. 215
There's nothing real wrong with that. 216
One of the challenges I have with that though is that people who are using my images if I have a team 217
of people they won't know how to go get to see them D. 218
So I tend to just repeat the CMT even though it's unnecessary down here at the bottom because they're 219
gonna get this and sort of a repo and they're gonna look at it and if they're not super savvy on Docker 220
they're not going to realize Oh I need to go find that Docker file for the. 221
From that it's coming from or use the history and go back and look at the history and time to find that 222
CMT. 223
So you could even maybe throw it into just a comment to help people that are maybe looking at this Docker 224
file but I tend to find that because the entry point in the CMT are just so important to what does this 225
Docker image do that I tend to add those n even though it might be repetitive to a previous image. 226
Again all that's just metadata so it doesn't really add any real time or bloat to your build rather 227
than the other file changes and the run commands you do. 228
But other than that it looks like a great nice quality production Docker file that you have spent a 229
lot of time on but I think definitely overall you could combine a lot of those and get stuff to save 230
a lot of space in your image and a lot of bloat and also avoid the update issue of having an old update 231
that basically an old app to get cash when you try to install new stuff. 232
I would recommend you version these and you can basically inside this install command you can specify 233
the version of each maybe some of these tools it doesn't really matter but when you start getting down 234
to libraries that you need for. 235
For Apache for your actual app these are just so more utilities for managing it not really stuff that 236
you would use on a production running app. 237
Right. 238
But this live Apache down here I would definitely version that I have been bit by this bug and HP because 239
a mongo D.B. driver and HP changed versions inside of my image and it broke it had a bug and it broke 240
my production apps because I didn't pin it in the docker file and I basically went to production I just 241
one day I rebuilt the image it went it worked fine on my machine because my machine had a different 242
version because there is no it says there's no versions there you're basically getting whatever the 243
newest version is when you built the image so it's kind of a random hope that you get a good version 244
that works. 245
So you definitely get a pin that one I personally would pin them all and just update on once a month 246
or something or whatever your security team requires. 247
But that's a great Docker file. 248
Thank you so much. 249
Of course there's always room for improvement and I'm glad you showed up to help with that.