Docker CI/CD — 持续集成与持续部署
Guidance for integrating Docker into automated build, test, and deployment pipelines.
When to Use
ALWAYS use this skill when the user mentions:
- "docker CI", "docker CD", "CI/CD pipeline"
- "GitHub Actions docker", "Jenkins docker"
- "buildx", "multi-platform build", "多平台构建"
- "Docker Build Cloud"
- "镜像构建流水线"
GitHub Actions
Build & Push Pipeline
name: Build and Push
on:
push:
tags: ['v*']
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Build and push
uses: docker/build-push-action@v6
with:
push: true
tags: user/app:${{ github.ref_name }},user/app:latest
cache-from: type=gha
cache-to: type=gha,mode=max
Multi-Platform Build
- name: Build and push multi-platform
uses: docker/build-push-action@v6
with:
platforms: linux/amd64,linux/arm64
push: true
tags: user/app:latest
Jenkins Pipeline
pipeline {
agent any
environment {
DOCKER_IMAGE = 'myapp'
DOCKER_TAG = "${env.BUILD_NUMBER}"
}
stages {
stage('Build') {
steps {
sh "docker build -t ${DOCKER_IMAGE}:${DOCKER_TAG} ."
}
}
stage('Test') {
steps {
sh "docker run --rm ${DOCKER_IMAGE}:${DOCKER_TAG} npm test"
}
}
stage('Push') {
steps {
withDockerRegistry([credentialsId: 'docker-hub']) {
sh "docker push ${DOCKER_IMAGE}:${DOCKER_TAG}"
}
}
}
}
}
Layer Caching in CI
# Pull previous image for layer cache
docker pull $IMAGE:latest || true
docker build \
--cache-from $IMAGE:latest \
--build-arg BUILDKIT_INLINE_CACHE=1 \
-t $IMAGE:$TAG .
Workflow — 推荐 CI/CD 流程
Step 1: 配置 CI 环境: docker/login-action + docker/setup-buildx-action
Step 2: 构建镜像: docker/build-push-action + registry 缓存加速
Step 3: 安全扫描: docker/scout-action 扫描 CVE + 策略门禁
Step 4: 推送仓库: 多标签（semver + sha + latest）推送到 ghcr.io/Docker Hub
Step 5: 部署: ArgoCD/Flux 监听仓库变更自动部署
Gotchas — Common Pitfalls
- CI cache miss: Without
--cache-from, every CI build starts from scratch. → Recovery: docker pull myapp:latest || true before build; use --cache-from type=gha in GitHub Actions.
- Build secrets in CI logs: Never
echo or print secrets. Use buildx --secret or CI secrets masking. → Recovery: docker buildx build --secret id=npmrc,src=$HOME/.npmrc; check CI secrets are masked in logs.
- Disk space in CI: Multi-stage builds can consume CI disk. → Recovery:
docker system prune -af between builds; monitor with docker system df.
- Multi-platform emulation slow: QEMU emulation for ARM on AMD is slow (~10x). → Recovery: Use native ARM runners (e.g., GitHub Actions ARM64 runners) or Docker Build Cloud for multi-platform.
Boundary — 能力边界（适用与不适用场景）
| 分类 | 场景 | 说明 |
|------|------|------|
| ✅ 能做 | GitHub Actions Docker 集成 | docker/build-push-action + QEMU + multi-arch |
| ✅ 能做 | Jenkins Pipeline Docker | Docker agent + build/push/scan |
| ✅ 能做 | 多平台 CI 构建 | buildx + QEMU + 多架构 manifest |
| ⚠️ 需条件 | Docker Build Cloud 加速 | 需付费订阅 |
| ⚠️ 需条件 | 非 GitHub/Jenkins CI | 参考通用模式适配 |
| ❌ 超范围 | Dockerfile 编写 | 使用 docker-dockerfile |
| ❌ 超范围 | K8s CD（ArgoCD/Flux） | K8s 部署技能 |
| ❌ 超范围 | CI 平台搭建（Jenkins 安装） | DevOps 基础设施 |
When NOT to Use
| ❌ Skip | ✅ Use Instead |
|---------|---------------|
| Writing Dockerfile | docker-build |
| Security scanning | docker-security / docker-scout |
| Production deployment | docker-production |
| Registry management | docker-hub |
Security & Stability
- Never hardcode registry credentials in CI configs. Use CI secrets manager (GitHub Secrets, Jenkins Credentials).
- Use OIDC (OpenID Connect) for cloud registry auth instead of long-lived credentials.
- Scan images with Docker Scout before pushing to production registry.
- Tag images with SHA digest for audit trails:
image:sha-${GITHUB_SHA::7}.
- Rotate registry tokens regularly. Never use personal access tokens for CI.
📚 官方文档参考
| 文档 | 地址 |
|------|------|
| Docker Build CI | https://docs.docker.com/build/ci/ |
| Docker Build Cloud | https://docs.docker.com/build-cloud/ |
| GitHub Actions Docker | https://docs.docker.com/build/ci/github-actions/ |
| Docker Scout CI | https://docs.docker.com/scout/policy/ci/ |
| Buildx CI 集成 | https://docs.docker.com/build/ci/github-actions/build-push-action/ |
🧭 Docker Skills Journey
📍 You are here: docker-cicd — CI/CD 自动化
← Previous: docker-build | → Next: docker-production
FAQ
Q1: 如何快速上手此技能？
A: 参考上方的快速开始章节，按步骤操作即可。
Q2: 遇到版本不兼容问题怎么办？
A: 检查依赖版本，使用 lock 文件锁定，参考常见陷阱章节。
Q3: 如何在生产环境使用？
A: 参考最佳实践章节，确保配置正确，做好监控和日志。
Q4: 性能如何优化？
A: 参考性能优化相关文档，使用缓存、索引等手段。
Q5: 如何贡献或反馈问题？
A: 在 GitHub 仓库提交 Issue 或 Pull Request。
Q6: 是否支持中文？
A: 支持中文文档和中文注释，详见国内适配章节。