I-BuildKit: I-Docker Efihliwe Gem Engakha Cishe Noma Yini
Amazwana
Mewayz Team
Editorial Team
BuildKit: Itshe Elifihliwe Le-Docker Elingakha Cishe Noma Yini
Onjiniyela abaningi bayayazi i-Docker njengesikhathi sokusebenza sesiqukathi esiguqule ukuthi isofthiwe ithunyelwa kanjani. Bambalwa kakhulu abaziyo ngenjini eduma buthule ngaphansi kwayo yonke i-Docker eyakhiwe yesimanje - i-BuildKit, isistimu yokwakha yesizukulwane esilandelayo ebithunyelwa nge-Docker kusukela enguqulweni engu-18.09 futhi yaba ingemuva elizenzakalelayo ku-Docker 23.0. Ngenkathi onjiniyela bephikisana ngokungapheli mayelana nokucushwa kwe-Kubernetes kanye namaphethini we-microservice, i-BuildKit ibilokhu iguqukela ekubeni enye yezinhlelo zokwakha ezinamandla kakhulu, eziguquguqukayo ku-ecosystem ye-DevOps. Uma ubuyiphatha njengokwakhiwa kwedokha okusheshayo, ushiya ikhono elikhulu etafuleni. Izinkampani ezisebenzisa amapayipi e-CI/CD aphezulu zinciphise izikhathi zokwakha ngo-50–70% ngokuqonda ukuthi i-BuildKit inikeza ini ngempela - futhi leso kuyisiqalo nje.
Yini eyenza i-BuildKit Ihluke Kakhulu Kumakhi Akudala
Injini yokuqala ye-Docker yokwakha isebenzise imiyalelo ye-Dockerfile ngokulandelana, isendlalelo esisodwa ngesikhathi, ngaphandle kokwazi ukuthi imuphi umsebenzi ongenzeka ngokuphephile ngokuhambisana. I-BuildKit ithatha indawo yaleyo modeli yokusayinda eqondile ngegrafu ye-acyclic eqondisiwe (DAG) — igrafu yokuncika eqonda ukuthi yiziphi izinyathelo zokwakha ezincike kwenye neziphi ezingathembeki. Izigaba ezizimele zisetshenziswa kanyekanye, izigaba ezingasetshenziswanga zeqiwa ngokuphelele, futhi isakhiwo sonke siba incazelo echazayo yalokho okufunayo kunokuba ukulandelana okubalulekile kwezinyathelo okufanele uzisho ngendlela efanele.
Lokhu kushintshwa kwezakhiwo kunemiphumela ephathekayo ehamba ngale kwesivinini. Lapho i-Dockerfile enezigaba eziningi ihlanganisa kanambambili ye-Go esigabeni esisodwa, ilanda okuncikile kwe-Node.js kwesinye, futhi ihlanganisa isithombe sokukhiqiza kwesesithathu, i-BuildKit ingasebenzisa izigaba ezimbili zokuqala ngesikhathi esisodwa. Isakhiwo esithathe imizuzu emine kumgijimi onamandla we-CI manje siqeda ngaphansi kwamasekhondi angamashumi ayisishiyagalolunye. I-Stripe, Shopify, kanye nenqwaba yamanye amaqembu onjiniyela bezinga eliphezulu abhale izinzuzo ezifanayo ekubukeni kwawo kabusha kwamathuluzi kwangaphakathi. Imodeli ye-DAG iphinde isho ukuthi i-BuildKit ingakhiqiza imethadatha yokwakha enembe kakhulu - isisekelo sezici ezifana nobufakazi be-provenance kanye nokukhiqizwa kwe-software bill of materials (i-SBOM) ebaluleke kakhulu ekuvikelekeni kwe-supply chain.
Kuphinde kube nokuguquguquka komqondo kokuthi ukungavumelekile kwenqolobane kusebenza kanjani. Umakhi wakudala wenze ukuba zonke izendlalelo zingavumelekile ngaphansi kwanoma yimuphi umyalo oshintshile. I-BuildKit ilandelela ama-hashes okuqukethwe kokokufaka ngakunye, ngakho ukushintsha amazwana ku-Dockerfile akuchithi inqolobane emele imizuzu engamashumi amathathu yokuhlanganisa. Uma inqolobane yakho yokwakha ingumehluko phakathi kwemizuzu emihlanu kanye nemizuzu engamashumi amane yempendulo yethimba lakho lonjiniyela, lokhu kunemba kubaluleke kakhulu kunalokho obekungase kubonakale ekuqaleni.
Ukwakhiwa Kwezingxenyekazi Eziningi: Umyalo Owodwa, Yonke Isakhiwo Sezakhiwo
Ifulegi le---platform le-BuildKit kanye nokuhlanganiswa kwe-QEMU kuguqula lokho okwake kwaba yinkinga yokuxhumanisa amasistimu amaningi kube umyalo owodwa. Isebenzisa i-docker buildx build --platform linux/amd64,linux/arm64,linux/arm/v7 . ikhiqiza izithombe ezintathu ezilungele ukukhiqizwa ngokuhambisana kusuka kusicelo esisodwa sokwakha. Leli khono selibaluleke kakhulu njengoba imboni ishintshela ku-ARM - Izimo ze-AWS Graviton3 zihlala ziletha ukusebenza kwentengo okungcono okungu-40% emithwalweni yomsebenzi njengokuphakelwa kwewebhu nokucutshungulwa kwedatha, futhi i-Apple Silicon yenze i-ARM yaba umshini wokuthuthukisa ozenzakalelayo wezigidi zonjiniyela.
Ngaphambi kokuthi usekelo lwezingxenyekazi eziningi lwe-BuildKit luvuthwe, ukugcinwa kwamapayipi okwakha ahlukene ezakhiwo ezahlukene kwakuyisikhungo sezindleko zangempela. Amaqembu kungenzeka agcine ama-Dockerfiles amaningi, asebenzisa amapayipi e-CI ahlukene kubagijimi abaklanywe ngendlela ehlukile, noma avele athumela izithombe ze-x86 yonke indawo futhi akhokha inhlawulo yokusebenza engqalasizinda ye-ARM. Nge-BuildKit, uchaza isakhiwo sakho kanye futhi uvumele isistimu ukuthi iphathe ukuhlanganiswa okuqondene nesakhiwo esithile ngokusobala. Amaphrojekthi okugqwala adinga ukuhlanganiswa okuphambene, Amaphrojekthi we-Go anokuncika kwe-CGO, amaphakheji e-Python anezandiso ze-C — I-BuildKit iphatha isendlalelo sokulingisa ngaphandle kokudinga ukuthi uqonde imininingwane yenkundla ngayinye eqondiwe.
Inani lebhizinisi elisebenzayo lapha liyalinganiseka. Ithimba elisebenzisa iziqukathi ezingu-200 ezimweni ze-AWS Graviton ngo-$0.04 ngehora le-vCPU ngalinye uma liqhathaniswa nesibonelo esilinganayo se-x86 ngo-$0.056 ngehora le-vCPU yonga cishe u-$11,520 ngonyaka ngama-vCPU angu-100 - ngokusuka ekukhetheni izakhiwo ezifanele. Ukwenza lokho kukhetha kufinyeleleke ngaphandle komzamo wokuphinda ubunjiniyela kuwuhlobo ncamashi lokuthuthukisa ingqalasizinda oluzikhokhela lona ngokushesha.
Ukuphatha Okuyimfihlo Ngaphandle Kokuvuza Kuzendlalelo Zesithombe
Esinye sezici ze-BuildKit ezingaziswa kakhulu izimfihlo zayo ze-API. Umakhi we-Docker wakudala wayengenayo indlela ehlanzekile yokudlulisa imininingwane esakhiweni ngaphandle kwalezo ziqinisekiso okungenzeka zigcine kusendlalelo sesithombe. Onjiniyela basebenze eduze nalokhu ngokwakhiwa kwezigaba eziningi, ARG imiyalelo, noku-oda ngokucophelela — kodwa ubungozi bokubhaka ukhiye we-API ngephutha noma ukhiye we-SSH oyimfihlo esithombeni esithunyelwe buhlale buphezulu ngendlela engathandeki. Izikena zokuphepha ngokuvamile zithola izifakazelo ezinekhodi eqinile ezithombeni zesiqukathi ezishicilelwe kumarejistri asesidlangalaleni, futhi okuningi kwalokho ukuputshuza kulandelela ngokuqondile ekuphathweni okuyimfihlo okuxakile phakathi nokwakhiwa.
Ifulegi le---secret le-BuildKit lifaka idatha ebucayi endaweni yokwakha njengendlela yesistimu yefayela yesikhashana ekhona kuphela ubude besikhathi somyalelo othize we-RUN oyidingayo futhi engalokothi ithinte noma yisiphi isendlalelo sesithombe. Umyalelo we-Dockerfile ofana ne-RUN --mount=type=secret,id=npmrc cat /run/secrets/npmrc > ~/.npmrc && npm install unikeza inqubo yokwakha ukufinyelela kuzifakazelo eziyimfihlo ze-npm ngaphandle kwalezo zimpawu ezize zivele esithombeni sokugcina nanoma yisiphi isendlalelo esimaphakathi. Iphethini efanayo isebenzela izifakazelo ze-PyPI, izilungiselelo ze-Maven, okhiye be-SSH bamakhosombe ayimfihlo e-Git, nanoma yiziphi ezinye izinto ezibucayi ezidingwa inqubo yakho yokwakha.
Emaqenjini akha isofthiwe ethinta izimboni ezilawulwayo — izinkundla zokunakekelwa kwezempilo, imikhiqizo ye-fintech, isofthiwe ye-HR — umehluko phakathi kokuthi "imininingwane ingase ibe sesithombeni" kanye "nobufakazi ngokusobala abunakukwazi ukuba sesithombeni" umehluko phakathi kokuphasa ukuhlolwa kwezokuphepha nokuchitha amasonto amathathu kulungiswa okutholiwe. Amapulatifomu afana ne-Mewayz, esebenza ngamandla ebhizinisini labasebenzisi abangaphezu kuka-138,000 kuzo zonke izimboni ezifana neholo, i-HR, nama-invoyisi, ancike ngqo kulolu hlobo lokuma okuvikelekayo okungenzeka ekwakheni nasekuphakeleni kwawo ukuze kugcinwe ukwethenjwa yilawo makhasimende adlulisela kudatha yawo ebucayi yezezimali neyezisebenzi.
Ukuthunyelwa Kwenqolobane: Ukwenza Amapayipi E-CI Ashesha Ngempela
Amapayipi e-CI kulapho ukusebenza kwesakhiwo kubaluleke kakhulu nalapho umuzwa wokwakha we-Docker ozenzakalelayo ube buhlungu kakhulu ngokomlando. Abagijimi abasha be-CI ngokuvamile baqala ngezinqolobane ezingenalutho, okusho ukuthi wonke amapayipi agijima ahlanganisa yonke into kusukela ekuqaleni. Ngesevisi ye-Java enamakhulu okuncika kwe-Maven, iphrojekthi ye-Rust, noma uhlelo lwe-Python olunezandiso ezisindayo zomdabu, lokhu kusho izikhathi zokwakha zikalwa emashumini emizuzu kunemizuzwana. Izindleko zebhizinisi ze-CI ehamba kancane zinkulu kakhulu - imvamisa yokusetshenziswa encishisiwe, izihibe ezinde zempendulo, nonjiniyela bahlezi bengenzi lutho belinde amapayipi ukuthi aqedwe ngaphambi kokuthi ahlangane futhi aqhubeke.
Isici sokuthekelisa senqolobane ye-BuildKit sixazulula lokhu nge-manifest yenqolobane ethekelisayo. Isebenzisa i---cache-to type=registry,ref=myregistry/myapp:cache kanye --cache-from type=registry,ref=myregistry/myapp:cache, i-BuildKit iphusha isifinyezo senqolobane enemininingwane kurejista ngemva kokwakhiwa ngakunye nokudonsa kwayo. Inqolobane inekheli lokuqukethwe, ngakho-ke izendlalelo ezishintshwe ngempela kuphela ezilandwa kabusha. Amaqembu asebenzisa le phethini ku-GitHub Actions, GitLab CI, kanye ne-CircleCI avamise ukusika izikhathi zamapayipi ukusuka emaminithini ayishumi nanhlanu ukuya ngaphansi kwezintathu ekugijimeni okulandelayo. Amadokhumenti e-GitHub ku-Advanced Docker build workflows incoma kakhulu le phethini ngenxa yalesi sizathu.
Isakhiwo esishesha kakhulu yileso okungasadingeki usiqalise futhi.Isistimu yenqolobane ye-BuildKit enezingqimba, enekheli lokuqukethwe ayisheshi nje ukwakha - yenza wonke umqondo "wokwakha" uhlakaniphe, iguqule ukuhlanganisa okuphindaphindiwe kube umehluko okhulayo walokho kanye okushintshile.
Ukuthunyelwa kwenqolobane nakho kuhlanganisa ngokuhlanzekile nokugeleza komsebenzi okusekelwe egatsheni. Ungakwazi ukumisa ipayipi lakho le-CI ukuthi lihlehle lisuka kunqolobane eqondene negatsha liye enqolobaneni yegatsha elikhulu lapho ingekho inqolobane yegatsha ekhona, okusho ukuthi amagatsha amasha azuza ngokushesha kunqolobane efudumele eqoqwe umugqa wakho wokuthuthukisa oyinhloko. Onjiniyela bathola impendulo esheshayo ekuzibophezeleni kwabo kokuqala egatsheni elisha kunokulinda inhlawulo yokungaqali.
💡 DID YOU KNOW?
Mewayz replaces 8+ business tools in one platform
CRM · Invoicing · HR · Projects · Booking · eCommerce · POS · Analytics. Free forever plan available.
Start Free →Ama-BuildKit Frontend: Ukwakha Ngale Kwe-Dockerfiles
Mhlawumbe ikhono elaziwa kancane le-BuildKit ukuthi i-Dockerfiles iyifomethi yokufaka eyodwa engaba khona — akuyona yodwa. I-BuildKit inokwakheka kwe-frontend exhunywayo evumela ngokuphelele izilimi nezincazelo zokwakha ngokwezifiso. Indawo engaphambili icaciswa # syntax= isiyalelo phezulu kwefayela lakho lokwakha, esitshela i-BuildKit ukuthi idonse isithombe esingaphambili futhi isisebenzise ukuze ihlaziye futhi isebenzise lonke ifayela.
Lesi sakhiwo sinike amandla amaphrojekthi ambalwa aphoqayo. Ukuhlanganiswa kwe-Buildpacks kuvumela i-BuildKit ukuthi yakhe izithombe zesiqukathi kusuka kukhodi yomthombo wohlelo lokusebenza ngaphandle kwanoma iyiphi i-Dockerfile nhlobo - ithola ulimi, ikhethe izithombe eziyisisekelo ezifanele, futhi ihlanganise ngokuzenzakalelayo isiqukathi esilungele ukukhiqizwa. I-HPC kanye nemiphakathi yamakhompuyutha yesayensi isebenzise ama-frontend ngokwezifiso ukuchaza ukwakha ngezilimi eziqondene nesizinda ezihlanganisa izethulo zangaphakathi ze-LLB (I-Low-Level Build) ye-BuildKit. Ukuhlolwa kwe-docker/dockerfile:labs kwe-syntax frontend enezici ezifana nosekelo lwe-heredoc, --network ukulawula ngomyalelo ngamunye, kanye namacebiso athuthukisiwe enqolobane ngaphambi kokuba afike ku-syntax ye-Dockerfile ezinzile.
Ikhono lokuchaza indawo yakho engaphambili liphinde lisho ukuthi izinhlangano ezinezidingo ezingajwayelekile zokwakha akumele zikhethe phakathi kokuthi "faka uphondo lwezicathulo yonke into ku-Dockerfile syntax" kanye "nokushiya ngokuphelele iziqukathi." I-firmware ye-FPGA yeqembu, izithombe zesistimu eshumekiwe, noma iziqukathi zemodeli ye-ML ezikhethekile zingachaza ukwakheka kwazo ngokwemibandela enengqondo ngesizinda sazo kuyilapho zisakhiqiza izithombe zesiqukathi esivumelana ne-OCI ezisetshenziswa noma kuphi lapho iziqukathi zisebenza khona. Lokhu kwandiswa kuyinzuzo yangempela yezakhiwo ngaphezu kwamasistimu okwakha aphatha ifomethi yawo yokufaka njengelungisiwe.
I-Provenance kanye ne-SBOM: Ukwakhela Umhlaba We-Post-SolarWinds
Ukuvikeleka kochungechunge lokuhlinzekwa kwesofthiwe kusuke ekukhathazekeni okusengqondweni kwaya ekubalulekeni ezingeni lebhodi ngemva kokuphulwa kwe-SolarWinds ngo-2020 kanye nokuba sengozini kwe-Log4Shell ngo-2021. I-Executive Order 14028 kahulumeni wase-US mayelana ne-cybersecurity, eyakhishwa ngo-May 2021, i-software egunyazwe umthethosivivinywa womsebenzi wosonkontileka bombuso. Ubufakazi bendawo ye-BuildKit nezici zokukhiqiza ze-SBOM ziyimpendulo eqondile kulo mkhakha wokulawula nokuvikela.
Ngamafulegi --provenance=true kanye --sbom=true, i-BuildKit ikhiqiza ubufakazi obusayiniwe ngendlela efihlekile obuchaza ngqo lokho okuye esithombeni sesitsha - yiziphi izithombe eziyisisekelo ezisetshenzisiwe, imiphi imiyalelo ye-Dockerfile ekhishiwe, yimaphi amafayela omthombo abekhona, nokuthi yikuphi ukuncika kwangaphandle okulandiwe. Lezi ziqinisekiso zilandela uhlaka lwe-SLSA (Supply-chain Levels for Software Artifacts) kanye nefomethi yobufakazi be-in-toto, okubenza baqinisekiseke ngomshini izinjini zenqubomgomo ezifana ne-Sigstore's Cosign kanye ne-OPA (Open Policy Agent).
Ukugeleza komsebenzi okusebenzayo lokhu okuvumelayo kubukeka kanje:
- Unjiniyela uphusha ikhodi; Ipayipi le-CI livula ukwakhiwa kwe-BuildKit okuvulwe amandla.
- I-BuildKit ikhiqiza i-SBOM esayiniwe efaka kuhlu zonke izingxenye nezinguqulo zazo.
- I-SBOM ishicilelwe kusiqukathi esiseduzane ne-manifest yesithombe.
- Izilawuli zokungena ku-Kubernetes cluster ziqinisekisa ukusebenza ngaphambi kokuvumela ukusetshenziswa.
- Izikena zobungozi zibuza i-SBOM ukuthi ibone izithombe ezithintekayo uma kudalulwa ama-CVE amasha.
Amaqembu asebenzisa lo mzila ogcwele angaphendula ekudalulweni kokuba sengozini ngamahora kunezinsuku, ngoba anemephu enembile, efundeka ngomshini yazo zonke izingxenye kuso sonke isiqukathi esisebenzayo. Emabhizinisini afana ne-Mewayz ahlanganisa ngokujulile ekugelezeni komsebenzi wamakhasimende - ukusebenzisa imali ekhokhelwayo, ukuphatha idatha yemikhumbi, ukucubungula ama-invoyisi - ikhono lokubonisa uchungechunge oluqinile, olucwaningayo lokuhlinzekwa kwempahla luya ngokuya luyimfuneko yezingxoxo zokuthengisa zebhizinisi, hhayi nje ukuba nobumnandi.
Ukuqalisa: Kusuka Kwakhiwe Okuzenzakalelayo Kuya Kumapayipi Athuthukile
I-BuildKit isivele isebenza endaweni yakho ye-Docker uma usebenzisa inguqulo yakamuva - i-Docker 23.0 futhi kamuva ivule amandla ngokuzenzakalelayo. Isinyathelo sokuqala esisebenzayo samaqembu amaningi ukunika amandla i-plugin ye-Docker Buildx, edalula isici esigcwele se-BuildKit esisethwe nge-docker buildx subcommand. Ukusebenzisa i-docker buildx create --use kumisa isibonelo somakhi we-BuildKit esinamandla amakhulu kunomshayeli ozenzakalelayo. Ukusuka lapho, ukwamukelwa okwandayo kwezici ezithuthukisiwe kunengqondo kunokuzama ukusebenzisa yonke into ngesikhathi esisodwa.
Indlela yokutholwa ephusile yeqembu okwamanje elenza izicelo eziyisisekelo
Isifundo esijulile se-BuildKit simayelana nokwakha ngamabomu. Kungakhathaliseki ukuthi uthumela isiqukathi se-microservice, isiphetho se-inference yokufunda komshini, noma inkundla eyinkimbinkimbi efana ne-Mewayz's suite yamamojula ebhizinisi angu-207, inqubo yokwakha ayiyona into esemthethweni oyijahayo lapho usendleleni eya ekusetshenzisweni - i-artifact yobunjiniyela ebonisa ikhwalithi, ukuma kwezokuphepha, kanye nokuvuthwa kokusebenza kwakho konke okuthunyelwayo. I-BuildKit ikunikeza amathuluzi okwenza leyo artifact ibe yinhle kakhulu. Umbuzo wukuthi uyazinika yini isikhathi sokuzisebenzisa.
Imibuzo Evame Ukubuzwa
Iyini i-BuildKit futhi ihluke kanjani kusistimu yokwakha ye-Docker yakudala?
I-BuildKit iyinjini yokwakha yesizukulwane esilandelayo se-Docker, eyethulwe ku-Docker 18.09 futhi yenza okuzenzakalelayo ku-Docker 23.0. Ngokungafani nomakhi wakudala, i-BuildKit isekela ukwenziwa kwesendlalelo esihambisanayo, amasu okulondoloza isikhashana athuthukisiwe, ukukhweza izimfihlo, nokwakhiwa kwenkundla. Iphatha inqubo yokwakha njengegrafu ye-acyclic eqondisiwe (DAG), evumela ukulungiswa kokuxhomekeka okuhlakaniphile kanye nezikhathi zokwakha ezishesha kakhulu zama-Dockerfiles ayinkimbinkimbi, anezigaba eziningi.
Ingabe ngidinga ukufaka noma yini eyengeziwe ukuze ngiqale ukusebenzisa i-BuildKit nge-Docker?
Akukho ukufakwa okwengeziwe okudingekayo uma usebenzisa i-Docker 23.0 noma kamuva — I-BuildKit inikwe amandla ngokuzenzakalela. Ezinguqulweni ezindala, ungakwazi ukuzisebenzisa ngokusetha ukwahluka kwemvelo DOCKER_BUILDKIT=1 ngaphambi kokusebenzisa imiyalo yakho yokwakha. Ezimweni ezithuthukisiwe zokusetshenziswa ezifana nezinqolobane zokwakha kude noma ukwakhiwa kwezingxenyekazi eziningi, ungase ufune ukulungiselela isenzakalo somakhi we-Buildx ozinikele usebenzisa docker buildx create.
Ingabe i-BuildKit ingasetshenziselwa ukwakha ama-artifact angaphezu kwezithombe zesiqukathi esijwayelekile?
Yebo, futhi leli ngelinye lamakhono e-BuildKit angaziswa kakhulu. Isebenzisa ama-frontend angokwezifiso kanye nefulegi --output, i-BuildKit ingakhiqiza okuhamba ngakubili okungaphekiwe, ama-tarball, amawebhusayithi amile, namanye ama-artifact wamafayela artifact — hhayi nje izithombe ze-OCI. Lokhu kuyenza injini yokwakha enenhloso evamile elingana ngokwemvelo kuma-polyglot monorepos namapayipi ayinkimbinkimbi e-CI lapho amaqembu ahlukene edinga amafomethi ahlukene okukhiphayo avela ochungechungeni lwamathuluzi oluhlanganisiwe.
Ingena kanjani i-BuildKit kunkundla ebanzi ye-DevOps eduze kwamathuluzi afana ne-Mewayz?
I-BuildKit iphethe isendlalelo sokwakha sezinga eliphansi, kodwa amathimba okuthuthukiswa kwesimanje nawo adinga ukuphatha ukugeleza komsebenzi webhizinisi, ukulethwa kwamakhasimende, nezinqubo zokusebenza. Izinkundla ezifana Mewayz — i-OS yebhizinisi enamamojuli angu-207 eqala ku-$19/mo — ihambisana namathuluzi engqalasizinda ngokumboza uhlangothi lokusebenza lwebhizinisi lesofthiwe. Ukumatanisa amapayipi okwakha aphumelelayo anikwa amandla yi-BuildKit enenkundla yakho konke okukodwa njenge-Mewayz kunikeza amaqembu isitaki esiphelele kusukela ku-artifact yekhodi kuya ekulethweni kwamakhasimende.
We use cookies to improve your experience and analyze site traffic. Cookie Policy