容器化与 Docker 工作流

# ========== 阶段一：编译构建 ========== FROM golang:1.22-alpine AS builder # 设置工作目录和构建参数 WORKDIR /app ARG APP_VERSION=1.0.0 ARG BUILD_TIME # 依赖缓存层（利用 Docker 层缓存加速） COPY go.mod go.sum ./ RUN go mod download # 复制源代码并编译 COPY . . RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="\ -X main.Version=${APP_VERSION} \ -X main.BuildTime=${BUILD_TIME} \ -w -s" \ -o /app/server ./cmd/server # ========== 阶段二：安全扫描（可选）========== FROM aquasec/trivy:latest AS trivy COPY --from=builder /app/server /server RUN trivy filesystem --severity HIGH,CRITICAL --exit-code 1 /server # ========== 阶段三：运行镜像 ========== FROM alpine:3.20 AS runtime # 安装运行时依赖（最小化） RUN apk add --no-cache ca-certificates tzdata && \ adduser -D -u 1001 appuser # 从构建阶段复制编译产物 COPY --from=builder /app/server /usr/local/bin/server COPY --chown=appuser:appuser configs/ /etc/app/configs/ # 安全配置：非 root 用户运行 USER appuser WORKDIR /home/appuser # 健康检查 HEALTHCHECK --interval=30s --timeout=3s --retries=3 \ CMD wget -qO- http://localhost:8080/health || exit 1 EXPOSE 8080 ENTRYPOINT ["server"]

# ❌ 不良实践：每次构建都会重新下载依赖 FROM node:20-alpine WORKDIR /app COPY . . RUN npm install RUN npm run build # ✅ 最佳实践：按变更频率分层，利用 Docker 层缓存 FROM node:20-alpine AS builder WORKDIR /app # 第1层：系统依赖（极少变更） RUN apk add --no-cache python3 make g++ # 第2层：package.json 和 lock 文件（相对少变更） COPY package.json package-lock.json ./ RUN npm ci --only=production # 第3层：源代码（最频繁变更） COPY . . RUN npm run build # 第4层：运行时镜像 FROM node:20-alpine AS runtime WORKDIR /app COPY --from=builder /app/dist ./dist COPY --from=builder /app/node_modules ./node_modules EXPOSE 3000 CMD ["node", "dist/index.js"]

# 版本控制相关 .git/ .gitignore # 开发环境 node_modules/ vendor/ .env .env.local *.log .cache/ # IDE 配置 .idea/ .vscode/ *.swp *.swo # 构建产物 dist/ build/ *.tar.gz Dockerfile docker-compose*.yml # 测试和文档 test/ tests/ __pycache__/ *.pyc coverage/ docs/ *.md # CI/CD .gitlab-ci.yml .github/

#!/bin/bash # build-and-scan.sh -- 构建并扫描 Docker 镜像 set -euo pipefail IMAGE_NAME="${1:-myapp}" IMAGE_TAG="${2:-latest}" SEVERITY="${3:-HIGH,CRITICAL}" echo ">>> 步骤1: 构建 Docker 镜像" docker build \ --build-arg BUILD_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \ --build-arg APP_VERSION=$(git describe --tags --always) \ -t "${IMAGE_NAME}:${IMAGE_TAG}" . echo ">>> 步骤2: Trivy 安全扫描" docker run --rm \ -v /var/run/docker.sock:/var/run/docker.sock \ -v "${HOME}/trivy-cache:/root/.cache" \ aquasec/trivy:latest \ image --severity "${SEVERITY}" \ --exit-code 1 \ --no-progress \ --ignore-unfixed \ --format table \ "${IMAGE_NAME}:${IMAGE_TAG}" echo ">>> 步骤3: 扫描通过，镜像就绪" docker images "${IMAGE_NAME}:${IMAGE_TAG}"

version: "3.9" # ========== 网络隔离 ========== networks: frontend: driver: bridge ipam: config: - subnet: "172.20.0.0/24" backend: driver: bridge internal: true # 内网网络，不对外暴露 ipam: config: - subnet: "172.20.1.0/24" # ========== 持久化卷 ========== volumes: postgres_data: driver: local driver_opts: type: none device: ${PWD}/data/postgres o: bind redis_data: uploads_data: certs_data: # ========== 服务定义 ========== services: # ---- 反向代理 ---- nginx: image: nginx:1.27-alpine ports: - "80:80" - "443:443" volumes: - ./nginx/conf.d:/etc/nginx/conf.d:ro - ./nginx/ssl:/etc/nginx/ssl:ro - certs_data:/etc/letsencrypt depends_on: frontend: condition: service_started api: condition: service_healthy networks: - frontend restart: unless-stopped healthcheck: test: ["CMD", "nginx", "-t"] interval: 30s timeout: 5s retries: 3 # ---- 前端应用 ---- frontend: build: context: ./frontend dockerfile: Dockerfile target: production args: - API_BASE_URL=https://api.example.com ports: - "3000:3000" environment: - NODE_ENV=production - NEXT_PUBLIC_API_URL=/api depends_on: api: condition: service_healthy networks: - frontend restart: unless-stopped # ---- API 服务 ---- api: build: context: ./backend dockerfile: Dockerfile target: runtime expose: - "8080" environment: - DB_HOST=postgres - DB_PORT=5432 - DB_USER=${DB_USER:-app} - DB_PASSWORD=${DB_PASSWORD:?err} - DB_NAME=${DB_NAME:-myapp} - REDIS_HOST=redis - REDIS_PORT=6379 - JWT_SECRET=${JWT_SECRET:?err} - LOG_LEVEL=info volumes: - uploads_data:/data/uploads env_file: - ./backend/.env.production depends_on: postgres: condition: service_healthy redis: condition: service_started networks: - frontend - backend restart: unless-stopped deploy: replicas: 3 resources: limits: cpus: "1.0" memory: 512M reservations: cpus: "0.5" memory: 256M healthcheck: test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"] interval: 15s timeout: 5s retries: 3 start_period: 30s # ---- PostgreSQL 数据库 ---- postgres: image: postgres:16-alpine expose: - "5432" environment: POSTGRES_USER: ${DB_USER:-app} POSTGRES_PASSWORD: ${DB_PASSWORD:?err} POSTGRES_DB: ${DB_NAME:-myapp} POSTGRES_INITDB_ARGS: "--data-checksums --auth=scram-sha-256" volumes: - postgres_data:/var/lib/postgresql/data - ./db/init:/docker-entrypoint-initdb.d:ro networks: - backend restart: unless-stopped healthcheck: test: ["CMD-SHELL", "pg_isready -U app -d myapp"] interval: 10s timeout: 5s retries: 5 start_period: 10s # ---- Redis 缓存 ---- redis: image: redis:7.4-alpine expose: - "6379" command: > redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:?err} --maxmemory 256mb --maxmemory-policy allkeys-lru volumes: - redis_data:/data networks: - backend restart: unless-stopped healthcheck: test: ["CMD", "redis-cli", "--raw", "incr", "ping"] interval: 10s timeout: 3s retries: 3 # ---- 后台任务处理 ---- worker: build: context: ./backend dockerfile: Dockerfile target: runtime command: ["celery", "-A", "tasks", "worker", "--loglevel=info"] environment: - REDIS_HOST=redis - REDIS_PORT=6379 - REDIS_PASSWORD=${REDIS_PASSWORD:?err} env_file: - ./backend/.env.production depends_on: redis: condition: service_started networks: - backend restart: unless-stopped deploy: replicas: 2 resources: limits: cpus: "0.5" memory: 256M

#!/bin/bash # wait-for-it.sh -- 等待 TCP 服务就绪 set -e host="$1" port="$2" shift 2 cmd="$@" until nc -z "$host" "$port"; do echo "等待 $host:$port 就绪..." sleep 2 done echo "$host:$port 已就绪" exec $cmd

# 第1层: compose 文件中的 default 值（最低优先级） environment: - LOG_LEVEL=info - PORT=8080 # 第2层: .env 文件中的全局变量 # docker-compose.yml 同级目录下的 .env 文件自动加载 # .env 文件内容: DB_HOST=localhost DB_PORT=5432 # 第3层: env_file 指定文件 env_file: - ./backend/.env.production # 第4层: shell 环境变量 + 变量替换（最高优先级） environment: - DB_PASSWORD=${DB_PASSWORD:?err} - JWT_SECRET=${JWT_SECRET:?err} - API_KEY=${API_KEY:-default_key}

name: Docker Build & Deploy on: push: branches: [main, develop] tags: ["v*"] pull_request: branches: [main] env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} DOCKER_BUILDKIT: 1 COMPOSE_DOCKER_CLI_BUILD: 1 jobs: # ======== 步骤1: 代码检查与测试 ======== test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: 运行单元测试 run: | docker compose -f docker-compose.test.yml run --rm test - name: 上传测试覆盖率 uses: actions/upload-artifact@v4 with: name: coverage path: coverage/ # ======== 步骤2: 构建与安全扫描 ======== build-and-scan: needs: test runs-on: ubuntu-latest permissions: contents: read packages: write security-events: write steps: - uses: actions/checkout@v4 - name: 设置 Docker 元数据 id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=ref,event=branch type=sha,format=short type=raw,value=latest,enable={{is_default_branch}} - name: 登录容器仓库 uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: 设置 Docker BuildKit 缓存 uses: actions/cache@v4 with: path: /tmp/.buildx-cache key: ${{ runner.os }}-buildx-${{ github.sha }} restore-keys: | ${{ runner.os }}-buildx- - name: 构建并推送镜像 uses: docker/build-push-action@v6 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache-new build-args: | APP_VERSION=${{ github.ref_name }} BUILD_TIME=${{ github.event.repository.updated_at }} - name: Trivy 安全扫描 uses: aquasecurity/trivy-action@master with: image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} format: sarif output: trivy-results.sarif severity: HIGH,CRITICAL exit-code: 1 ignore-unfixed: true - name: 上传 Trivy 扫描结果 uses: github/codeql-action/upload-sarif@v3 with: sarif_file: trivy-results.sarif category: trivy - name: 镜像签名（cosign） uses: sigstore/cosign-installer@v3 - name: 签名镜像 run: | cosign sign --yes \ --key env://COSIGN_PRIVATE_KEY \ ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.digest.outputs.digest }} env: COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} # 缓存优化（限制缓存大小） - name: 移动缓存 run: | rm -rf /tmp/.buildx-cache mv /tmp/.buildx-cache-new /tmp/.buildx-cache # ======== 步骤3: 部署到 Kubernetes ======== deploy: needs: build-and-scan runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' steps: - uses: actions/checkout@v4 - name: 配置 kubeconfig uses: azure/k8s-set-context@v4 with: kubeconfig: ${{ secrets.KUBECONFIG }} - name: 更新 Kubernetes 部署 run: | kubectl set image deployment/myapp \ myapp=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \ -n production kubectl rollout status deployment/myapp -n production --timeout=5m

# ========== 镜像签名 ========== # 生成密钥对 cosign generate-key-pair # 签名镜像（推送前） cosign sign --key cosign.key \ ghcr.io/myorg/myapp:v1.2.3 # ========== 镜像验证 ========== # 在部署前验证签名 cosign verify --key cosign.pub \ ghcr.io/myorg/myapp:v1.2.3 # 在 Kubernetes 中强制验证签名（Kyverno 策略） # policy.yaml: apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: verify-image spec: validationFailureAction: Enforce rules: - name: verify-cosign match: any: - resources: kinds: - Pod verifyImages: - image: "ghcr.io/myorg/*" key: |- -----BEGIN PUBLIC KEY----- ... -----END PUBLIC KEY-----

apiVersion: apps/v1 kind: Deployment metadata: name: myapp namespace: production labels: app: myapp tier: backend version: v1.2.3 annotations: app.kubernetes.io/managed-by: Claude Code app.kubernetes.io/description: "微服务 API 后端" spec: replicas: 3 strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 # 允许额外创建 1 个 Pod maxUnavailable: 0 # 更新期间必须保持所有 Pod 可用 selector: matchLabels: app: myapp tier: backend template: metadata: labels: app: myapp tier: backend version: v1.2.3 spec: # 安全上下文 securityContext: runAsNonRoot: true runAsUser: 1001 fsGroup: 1001 seccompProfile: type: RuntimeDefault # 容器定义 containers: - name: myapp image: ghcr.io/myorg/myapp:v1.2.3 imagePullPolicy: IfNotPresent ports: - containerPort: 8080 protocol: TCP name: http - containerPort: 9090 protocol: TCP name: metrics # 资源限制 resources: requests: cpu: 250m memory: 256Mi limits: cpu: 1000m memory: 512Mi # 存活探针 livenessProbe: httpGet: path: /health port: http initialDelaySeconds: 30 periodSeconds: 15 timeoutSeconds: 3 failureThreshold: 3 # 就绪探针 readinessProbe: httpGet: path: /ready port: http initialDelaySeconds: 5 periodSeconds: 10 timeoutSeconds: 3 successThreshold: 1 # 启动探针（慢启动应用） startupProbe: httpGet: path: /health port: http initialDelaySeconds: 10 periodSeconds: 5 failureThreshold: 30 # 环境变量 envFrom: - configMapRef: name: myapp-config - secretRef: name: myapp-secrets # 持久化存储 volumeMounts: - name: data mountPath: /data - name: tmp mountPath: /tmp securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: ["ALL"] volumes: - name: data persistentVolumeClaim: claimName: myapp-data-pvc - name: tmp emptyDir: medium: Memory # Pod 调度策略 affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchExpressions: - key: app operator: In values: - myapp topologyKey: kubernetes.io/hostname tolerations: - key: "critical" operator: "Equal" value: "true" effect: "NoSchedule" --- apiVersion: v1 kind: Service metadata: name: myapp-service namespace: production annotations: service.beta.kubernetes.io/aws-load-balancer-type: "nlb" spec: type: ClusterIP ports: - port: 80 targetPort: 8080 protocol: TCP name: http - port: 9090 targetPort: 9090 protocol: TCP name: metrics selector: app: myapp tier: backend --- apiVersion: v1 kind: Service metadata: name: myapp-ingress namespace: production spec: type: LoadBalancer ports: - port: 443 targetPort: 8080 protocol: TCP name: https selector: app: myapp tier: backend

apiVersion: v1 kind: ConfigMap metadata: name: myapp-config namespace: production data: # 应用配置（非敏感信息） APP_ENV: "production" LOG_LEVEL: "info" LOG_FORMAT: "json" API_PORT: "8080" METRICS_PORT: "9090" DB_HOST: "postgres.production.svc.cluster.local" DB_PORT: "5432" DB_NAME: "myapp" REDIS_HOST: "redis.production.svc.cluster.local" REDIS_PORT: "6379" CORS_ORIGINS: "https://app.example.com" RATE_LIMIT: "1000" RATE_LIMIT_WINDOW: "60" # 配置文件挂载 nginx.conf: | server { listen 80; location / { proxy_pass http://localhost:8080; proxy_set_header Host $host; } } --- apiVersion: v1 kind: Secret metadata: name: myapp-secrets namespace: production type: Opaque stringData: DB_PASSWORD: "your-db-password-here" JWT_SECRET: "your-jwt-secret-here" REDIS_PASSWORD: "your-redis-password-here" API_KEY: "your-api-key-here" ENCRYPTION_KEY: "base64-encoded-32-byte-key"

apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: myapp-hpa namespace: production spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: myapp minReplicas: 3 maxReplicas: 20 behavior: # 快速扩容，慢速缩容 scaleUp: stabilizationWindowSeconds: 0 policies: - type: Percent value: 100 periodSeconds: 15 - type: Pods value: 4 periodSeconds: 15 selectPolicy: Max scaleDown: stabilizationWindowSeconds: 300 policies: - type: Percent value: 10 periodSeconds: 60 metrics: # CPU 利用率指标 - type: Resource resource: name: cpu target: type: Utilization averageUtilization: 70 # 内存利用率指标 - type: Resource resource: name: memory target: type: Utilization averageUtilization: 80 # 自定义指标：每秒请求数 - type: Pods pods: metric: name: http_requests_per_second target: type: AverageValue averageValue: 1000

apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: myapp-pdb namespace: production spec: minAvailable: 2 selector: matchLabels: app: myapp tier: backend

{ "name": "MyApp 开发环境", "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04", "features": { "ghcr.io/devcontainers/features/go:1": { "version": "1.22" }, "ghcr.io/devcontainers/features/node:1": { "version": "20" }, "ghcr.io/devcontainers/features/docker-in-docker:1": { "version": "latest", "moby": true }, "ghcr.io/devcontainers/features/kubectl-cli:1": {}, "ghcr.io/devcontainers/features/helm:1": {} }, "customizations": { "vscode": { "settings": { "go.useLanguageServer": true, "go.formatTool": "gofumpt", "go.lintTool": "golangci-lint", "editor.formatOnSave": true, "files.eol": "\n", "terminal.integrated.defaultProfile.linux": "zsh" }, "extensions": [ "golang.Go", "ms-azuretools.vscode-docker", "ms-kubernetes-tools.vscode-kubernetes-tools", "redhat.vscode-yaml", "eamodio.gitlens", "tamasfe.even-better-toml", "bierner.markdown-mermaid", "github.vscode-github-actions" ] } }, "mounts": [ "source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind" ], "forwardPorts": [3000, 8080, 5432, 6379], "portsAttributes": { "3000": { "label": "前端服务", "onAutoForward": "notify" }, "8080": { "label": "API 服务", "onAutoForward": "openBrowser" }, "5432": { "label": "PostgreSQL", "onAutoForward": "silent" } }, "postCreateCommand": "go mod download && make init-dev", "postStartCommand": "make dev-env-up", "remoteUser": "vscode", "containerEnv": { "DEV_ENV": "true", "COMPOSE_FILE": "docker-compose.dev.yml" }, "runArgs": [ "--network=host", "--memory=4g", "--memory-swap=6g" ] } # ========== 配套 Dockerfile ========== # .devcontainer/Dockerfile FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04 # 安装系统依赖 RUN apt-get update && export DEBIAN_FRONTEND=noninteractive && \ apt-get install -y --no-install-recommends \ build-essential \ curl \ git \ zsh \ fzf \ ripgrep \ jq \ yq \ htop \ httpie \ && rm -rf /var/lib/apt/lists/* # 安装 oh-my-zsh RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended # 安装 Taskfile（替代 Makefile 的现代构建工具） RUN sh -c "$(curl -sSL https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin

version: "3.9" services: # ---- API 服务（开发模式）---- api-dev: build: context: ./backend dockerfile: Dockerfile.dev args: - DEV_MODE=true ports: - "8080:8080" - "2345:2345" # Delve 调试器端口 volumes: # 源码热挂载（代码修改立即生效） - ./backend:/app:ro,delegated # 排除 node_modules（使用容器内安装的依赖） - /app/node_modules - /app/.git environment: - DEV_MODE=true - DEBUG_PORT=2345 - GODEBUG=gctrace=1 command: > air -- # Go 热重载工具 # 或使用 Delve 调试模式: # command: dlv debug --headless --listen=:2345 --api-version=2 --accept-multiclient # ---- 前端服务（开发模式）---- frontend-dev: build: context: ./frontend dockerfile: Dockerfile.dev ports: - "3000:3000" - "9229:9229" # Node.js 调试器端口 volumes: - ./frontend:/app:ro,delegated - /app/node_modules - /app/.next environment: - NODE_ENV=development - NEXT_PUBLIC_API_URL=http://localhost:8080 - WATCHPACK_POLLING=true # 文件系统轮询（解决 Docker 文件监听问题） command: npm run dev # ---- 数据库（开发优化配置）---- postgres-dev: image: postgres:16-alpine ports: - "5432:5432" environment: POSTGRES_USER: dev POSTGRES_PASSWORD: dev POSTGRES_DB: myapp_dev volumes: - postgres_dev_data:/var/lib/postgresql/data - ./db/init:/docker-entrypoint-initdb.d:ro - ./db/dev-seed:/docker-entrypoint-initdb.d/seed:ro volumes: postgres_dev_data:

{ "version": "0.2.0", "configurations": [ { "name": "Attach to Docker (Go)", "type": "go", "request": "attach", "mode": "remote", "remotePath": "/app", "port": 2345, "host": "127.0.0.1", "trace": "log", "showLog": true }, { "name": "Attach to Docker (Node)", "type": "node", "request": "attach", "port": 9229, "address": "127.0.0.1", "localRoot": "${workspaceFolder}/frontend", "remoteRoot": "/app", "skipFiles": ["/**"] } ] }

# MyApp 项目 Docker 工作流 ## 开发环境 - 使用 `docker compose -f docker-compose.dev.yml up -d` 启动开发环境 - 源码通过 Volume 挂载到容器内，支持热重载 - 使用 `./dev.sh` 脚本一键启动（包含数据库迁移和种子数据） - 调试端口映射：API (2345)、前端 (9229) ## 构建命令 - `make build` -- 使用 Docker BuildKit 构建生产镜像 - `make scan` -- 使用 Trivy 扫描镜像中的安全漏洞 - `make push` -- 推送镜像到 GHCR 仓库 - `make sign` -- 使用 cosign 签名镜像 ## 镜像标签规范 - 生产发布: v{major}.{minor}.{patch} - 开发构建: {branch}-{short-sha} - 禁止在 CI 之外手动推送 latest 标签 ## Dockerfile 要求 - 必须使用多阶段构建 - 基础镜像固定 digest（摘要） - 运行阶段禁止包含编译工具链 - 必须设置 HEALTHCHECK - 必须以非 root 用户运行 ## Kubernetes 部署 - 命名空间: production / staging - 部署文件: k8s/deployment.yaml - 配置更新: `kubectl apply -f k8s/` - 回滚命令: `kubectl rollout undo deployment/myapp -n production` ## 安全要求 - 每次构建必须通过 Trivy 扫描（HIGH/CRITICAL 级别阻断） - 生产镜像必须经过 cosign 签名 - 敏感信息通过 Secret 注入，不得硬编码 - 容器安全上下文：readOnlyRootFilesystem + 丢弃所有 Capabilities

## 工具函数（Claude Code 可调用） dev() { # 启动完整开发环境 docker compose -f docker-compose.dev.yml up -d echo "开发环境已启动" docker compose -f docker-compose.dev.yml logs -f } rebuild() { # 重新构建并启动指定服务 local service=${1:-api-dev} docker compose -f docker-compose.dev.yml build $service docker compose -f docker-compose.dev.yml up -d $service } logs() { # 查看服务日志 docker compose -f docker-compose.dev.yml logs -f ${1:-api-dev} } exec-app() { # 进入容器交互终端 docker compose -f docker-compose.dev.yml exec api-dev /bin/zsh } cleanup() { # 清理开发环境 docker compose -f docker-compose.dev.yml down -v docker system prune -f } db-migrate() { # 执行数据库迁移 docker compose -f docker-compose.dev.yml exec api-dev migrate up } db-shell() { # 进入数据库交互终端 docker compose -f docker-compose.dev.yml exec postgres-dev psql -U dev -d myapp_dev }

# =========================================== # 端到端 Docker 工作流 (Claude Code 驱动) # =========================================== # ---- 阶段 1: 本地开发 ---- # 1. 启动开发环境 docker compose -f docker-compose.dev.yml up -d # 2. 修改代码后，热重载自动生效 # （无需手动操作，容器内文件监听自动重启） # 3. 运行测试 docker compose -f docker-compose.dev.yml exec api-dev go test ./... docker compose -f docker-compose.dev.yml exec frontend-dev npm run test # ---- 阶段 2: 构建与发布 ---- # 4. 构建生产镜像 DOCKER_BUILDKIT=1 docker build -t myapp:$(git rev-parse --short HEAD) . # 5. 安全扫描 trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:$(git rev-parse --short HEAD) # 6. 打标签并推送 docker tag myapp:$(git rev-parse --short HEAD) ghcr.io/myorg/myapp:v1.2.3 docker push ghcr.io/myorg/myapp:v1.2.3 # 7. 签名 cosign sign --key cosign.key ghcr.io/myorg/myapp:v1.2.3 # ---- 阶段 3: 部署上线 ---- # 8. 更新 Kubernetes 部署 kubectl set image deployment/myapp \ myapp=ghcr.io/myorg/myapp:v1.2.3 \ -n production # 9. 监控滚动更新状态 kubectl rollout status deployment/myapp -n production --watch # 10. 验证部署 kubectl get pods -n production -l app=myapp kubectl describe deployment/myapp -n production

apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: myapp-production namespace: argocd spec: project: default source: repoURL: https://github.com/myorg/myapp-deploy.git targetBranch: main path: k8s/production kustomize: images: - ghcr.io/myorg/myapp:v1.2.3 destination: server: https://kubernetes.default.svc namespace: production syncPolicy: automated: prune: true selfHeal: true syncOptions: - CreateNamespace=true - ApplyOutOfSyncOnly=true