在Google Cloud Build上使用Docker Buildkit

ibrsph3r  于 2024-01-06  发布在  Docker
关注(0)|答案(3)|浏览(180)

我尝试在Google Cloud Build上使用BuildKit和Docker，这样我最终可以使用--secret标志。我使用Build Enhancements for Docker作为参考。
它在我的笔记本电脑上工作时，我使用以下命令：DOCKER_BUILDKIT=1 docker build -t hello-world:latest .
当我在Cloud Build上运行它时，我得到错误“docker.io/docker/dockerfile:experimental not found”。
你知道如何在Cloud Build中使用它吗？
下面是设置（注意：我还没有使用--secret标志）：
Dockerfile：

  1. #syntax=docker/dockerfile:experimental
  3. FROM node:10.15.3-alpine
  5. RUN mkdir -p /usr/src/app && \
  6.     apk add --no-cache tini
  8. WORKDIR /usr/src/app
  10. COPY package*.json ./
  12. RUN npm install --production
  14. COPY . .
  16. RUN chown -R node:node .
  18. USER node
  20. EXPOSE 8080
  22. ENTRYPOINT ["/sbin/tini", "--"]
  24. CMD [ "node", "index.js" ]

字符串
cloudbuild.yaml:

  1. steps:
  3.   - id: 'Build'
  4.     name: 'gcr.io/cloud-builders/docker'
  5.     args: [
  6.       'build',
  7.       '-t', 'gcr.io/$PROJECT_ID/hello-world:latest',
  8.       '.'
  9.     ]
  10.     env:
  11.       - "DOCKER_BUILDKIT=1"

型
云构建日志：

  1. starting build "xxxx"
  3. FETCHSOURCE
  4. Fetching storage object: gs://xxxxx
  5. Copying gs://xxxxx...
  6. / [0 files][ 0.0 B/ 15.3 KiB] 
  7. / [1 files][ 15.3 KiB/ 15.3 KiB] 
  8. Operation completed over 1 objects/15.3 KiB. 
  9. BUILD
  10. Already have image (with digest): gcr.io/cloud-builders/docker
  12. #2 [internal] load .dockerignore
  13. #2 digest: sha256:3ce0de94c925587ad30afb764af9bef89edeb62eb891b99694aedb086ee53f50
  14. #2 name: "[internal] load .dockerignore"
  15. #2 started: 2019-07-24 03:21:49.153855989 +0000 UTC
  16. #2 completed: 2019-07-24 03:21:49.195969197 +0000 UTC
  17. #2 duration: 42.113208ms
  18. #2 transferring context: 230B done
  20. #1 [internal] load build definition from Dockerfile
  21. #1 digest: sha256:82b0dcd17330313705522448d60a78d4565304d55c86f55b903b18877d612601
  22. #1 name: "[internal] load build definition from Dockerfile"
  23. #1 started: 2019-07-24 03:21:49.150042849 +0000 UTC
  24. #1 completed: 2019-07-24 03:21:49.189628322 +0000 UTC
  25. #1 duration: 39.585473ms
  26. #1 transferring dockerfile: 445B done
  28. #3 resolve image config for docker.io/docker/dockerfile:experimental
  29. #3 digest: sha256:401713457b113a88eb75a6554117f00c1e53f1a15beec44e932157069ae9a9a3
  30. #3 name: "resolve image config for docker.io/docker/dockerfile:experimental"
  31. #3 started: 2019-07-24 03:21:49.210803849 +0000 UTC
  32. #3 completed: 2019-07-24 03:21:49.361743084 +0000 UTC
  33. #3 duration: 150.939235ms
  34. #3 error: "docker.io/docker/dockerfile:experimental not found"
  36. docker.io/docker/dockerfile:experimental not found
  37. ERROR
  38. ERROR: build step 0 "gcr.io/cloud-builders/docker" failed: exit status 1

型
笔记本电脑Docker版本：

  1. Client: Docker Engine - Community
  2.  Version:           18.09.2
  3.  API version:       1.39
  4.  Go version:        go1.10.8
  5.  Git commit:        6247962
  6.  Built:             Sun Feb 10 04:12:39 2019
  7.  OS/Arch:           darwin/amd64
  8.  Experimental:      false
  10. Server: Docker Engine - Community
  11.  Engine:
  12.   Version:          18.09.2
  13.   API version:      1.39 (minimum version 1.12)
  14.   Go version:       go1.10.6
  15.   Git commit:       6247962
  16.   Built:            Sun Feb 10 04:13:06 2019
  17.   OS/Arch:          linux/amd64
  18.   Experimental:     false

型
Cloud Build Docker版本：

  1. Step #0 - "Version": Client:
  2. Step #0 - "Version": Version: 18.09.7
  3. Step #0 - "Version": API version: 1.39
  4. Step #0 - "Version": Go version: go1.10.8
  5. Step #0 - "Version": Git commit: 2d0083d
  6. Step #0 - "Version": Built: Thu Jun 27 17:56:17 2019
  7. Step #0 - "Version": OS/Arch: linux/amd64
  8. Step #0 - "Version": Experimental: false
  9. Step #0 - "Version": 
  10. Step #0 - "Version": Server: Docker Engine - Community
  11. Step #0 - "Version": Engine:
  12. Step #0 - "Version": Version: 18.09.3
  13. Step #0 - "Version": API version: 1.39 (minimum version 1.12)
  14. Step #0 - "Version": Go version: go1.10.8
  15. Step #0 - "Version": Git commit: 774a1f4
  16. Step #0 - "Version": Built: Thu Feb 28 05:59:55 2019
  17. Step #0 - "Version": OS/Arch: linux/amd64
  18. Step #0 - "Version": Experimental: false

型
更新：我注意到我使用的是#syntax=docker/dockerfile：experimental，而链接的文章有#syntax=docker/dockerfile：1.0-experimental。当我使用1.0-experimental时，我得到了同样的错误。

docker

3条答案

按热度按时间
fae0ux8s

fae0ux8s1#

当“registry-mirrors”选项与buildkit结合使用时，似乎存在一个问题，那么buildkit前端图像无法获取：
https://github.com/moby/moby/issues/39120
在构建之前提取它们似乎可以解决这个问题：

  1. - name: 'gcr.io/cloud-builders/docker'
  2.     args: ['pull', 'docker/dockerfile:experimental']
  3.   - name: 'gcr.io/cloud-builders/docker'
  4.     args: ['pull', 'docker/dockerfile:1.0-experimental']

字符串

赞(0）分享  回复(0）举报  2024-01-06
uqzxnwby

uqzxnwby2#

我也遇到过类似的问题，并设法解决了这个问题。在gcr.io/cloud-builders/docker中使用docker buildkit是不可能的，相反，你必须在docker daemon中运行一个docker，然后在docker-compose中运行另一个docker build。
具体来说，你需要一个docker-compose.yml，它具有：

  1. docker（docker daemon中的docker）
    1.构建镜像的docker构建步骤（启用buildkit）
    1.一个docker auth和push步骤，授权docker推送到gcr（你需要创建creds.json w/ service role w/ gcs权限，详见底部）
    为了验证并推送到gcr，需要使用creds.json进行docker登录。查看详情：https://cloud.google.com/container-registry/docs/advanced-authentication
  1. # deploy/app/docker-compose.yml
  2. version: '3.7'
  3. services:
  4.   docker:
  5.     image: "docker:18.09.9-dind"
  6.     privileged: true
  7.     volumes:
  8.       - docker-certs-client:/certs/client
  9.       - docker-certs-ca:/certs/ca
  10.     expose:
  11.       - 2376
  12.     environment:
  13.       - DOCKER_TLS_CERTDIR=/certs
  14.     networks:
  15.       - docker-in-docker-network
  16.   docker-build:
  17.     image: docker:18.09.9
  18.     working_dir: /project
  19.     command: build -t 'gcr.io/$PROJECT_ID/<image>:<tag>'
  20.     privileged: true
  21.     depends_on: 
  22.       - docker
  23.     volumes:
  24.       - docker-certs-client:/certs/client:ro
  25.       - ../../:/project
  26.     environment:
  27.       - DOCKER_TLS_CERTDIR=/certs
  28.       - DOCKER_BUILDKIT=1
  29.     networks:
  30.       - docker-in-docker-network
  31.   docker-push:
  32.     image: docker:18.09.9
  33.     working_dir: /project
  34.     entrypoint: /bin/sh -c
  35.     command: 
  36.       - |
  37.         cat creds.json | docker login -u _json_key --password-stdin https://gcr.io
  38.         docker push 'gcr.io/$PROJECT_ID/<image>:<tag>'
  39.     privileged: true
  40.     depends_on: 
  41.       - docker
  42.     volumes:
  43.       - docker-certs-client:/certs/client:ro
  44.       - ../../:/project
  45.     environment:
  46.       - DOCKER_CERT_PATH=/certs/client
  47.       - DOCKER_HOST=tcp://docker:2376
  48.       - DOCKER_TLS_VERIFY=1
  49.     networks:
  50.       - docker-in-docker-network
  51. volumes:
  52.   docker-certs-ca:
  53.   docker-certs-client:
  54. networks:
  55.   docker-in-docker-network:

字符串
在cloud-build.yaml中：
1.你需要先解密creds.json（必须先创建并加密）--详情：https://cloud.google.com/docs/authentication/getting-started（push步骤将使用该密钥授权docker登录到gcr）。
1.在daemon模式下从docker-compose运行一个docker daemon（这样它就不会阻止构建和推送步骤）
1.运行构建步骤docker-compose
1.在docker-compose中运行auth和push步骤。

  1. # cloud-build.yaml
  2. steps:
  3.   # decrypt gcloud json secret
  4.   - name: gcr.io/cloud-builders/gcloud
  5.     args:
  6.     - kms
  7.     - decrypt
  8.     - --ciphertext-file=deploy/app/creds.json.enc
  9.     - --plaintext-file=creds.json
  10.     - --location=global
  11.     - --keyring=<...>
  12.     - --key=<...>
  13.   # run docker daemon
  14.   - name: 'docker/compose:1.24.1'
  15.     args: ['-f', 'deploy/app/docker-in-docker-compose.yml', 'up', '-d', 'docker']
  16.     env:
  17.       - 'PROJECT_ID=$PROJECT_ID'
  18.   # build image
  19.   - name: 'docker/compose:1.24.1'
  20.     args: ['-f', 'deploy/app/docker-in-docker-compose.yml', 'up', 'docker-build']
  21.     env:
  22.       - 'PROJECT_ID=$PROJECT_ID'
  23.   # docker auth and push to gcr
  24.   - name: 'docker/compose:1.24.1'
  25.     args: ['-f', 'deploy/app/docker-in-docker-compose.yml', 'up', 'docker-push']
  26.     env:
  27.       - 'PROJECT_ID=$PROJECT_ID'
  28. timeout: 600s

型

展开查看全部
赞(0）分享  回复(0）举报  2024-01-06
3b6akqbq

3b6akqbq3#

我找到了解决办法：
1.您需要在您的Dokecker文件之前添加从# syntax=docker/dockerfile:1.4信息：https://www.docker.com/blog/image-rebase-and-improved-remote-cache-support-in-new-buildkit/
1.在步骤构建中添加env: 'DOCKER_BUILDKIT=1'
例如：

  1. - name: 'gcr.io/cloud-builders/docker'
  2.   args: ['build', '-t', 'gcr.io/prj-123-23231,'.']
  3.   dir:  ubuntu
  4.   env: 'DOCKER_BUILDKIT=1'

字符串

赞(0）分享  回复(0）举报  2024-01-06
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com