自动化构建推送

CI/CD 流水线自动构建镜像是容器化部署的核心，下面介绍集成方法。

Jenkins 集成

Pipeline 配置

pipeline {
    agent any
    environment {
        REGISTRY = 'registry.example.com'
        IMAGE_NAME = 'my-app'
    }
    stages {
        stage('Build') {
            steps {
                sh 'docker build -t ${REGISTRY}/${IMAGE_NAME}:${BUILD_NUMBER} .'
            }
        }
        stage('Push') {
            steps {
                withCredentials([usernamePassword(credentialsId: 'docker-registry', usernameVariable: 'DOCKER_USER', passwordVariable: 'DOCKER_PASS')]) {
                    sh 'echo ${DOCKER_PASS} | docker login ${REGISTRY} -u ${DOCKER_USER} --password-stdin'
                    sh "docker push ${REGISTRY}/${IMAGE_NAME}:${BUILD_NUMBER}"
                }
            }
        }
    }
}

GitLab CI 集成

.gitlab-ci.yml

stages:
  - build
  - push

variables:
  REGISTRY: registry.gitlab.com
  IMAGE_NAME: $CI_PROJECT_PATH

build:
  stage: build
  script:
    - docker build -t ${REGISTRY}/${IMAGE_NAME}:${CI_COMMIT_SHA} .

push:
  stage: push
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker push ${REGISTRY}/${IMAGE_NAME}:${CI_COMMIT_SHA}
    - docker push ${REGISTRY}/${IMAGE_NAME}:latest
  only:
    - main

GitHub Actions

workflow.yml

name: Docker Build and Push

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v4
        with:
          push: true
          tags: |
            ${{ secrets.DOCKER_USERNAME }}/my-app:${{ github.sha }}
            ${{ secrets.DOCKER_USERNAME }}/my-app:latest            

标签策略

# Git SHA
docker tag my-app registry.com/my-app:abc123

# Git 标签
docker tag my-app registry.com/my-app:v1.0.0

# 分支名
docker tag my-app registry.com/my-app:feature-auth

# 时间戳
docker tag my-app registry.com/my-app:20240101-120000

最佳实践

• 使用 --password-stdin 传递密码，避免命令行暴露
• 镜像标签使用 Git SHA 或语义版本
• 构建缓存加速 CI/CD 流水线
• 多阶段构建减小推送体积
• 推送后触发部署（CD）阶段

要点总结

• Jenkins Pipeline 使用 docker build/push 步骤，凭证管理认证
• GitLab CI 通过 .gitlab-ci.yml 定义构建推送流程
• GitHub Actions 使用 docker/build-push-action 集成
• 镜像标签使用 Git SHA、版本号或分支名
• CI/CD 使用 secrets 存储认证，不要硬编码密码