Docker BuildKit Secrets 与缓存挂载实践

Docker BuildKit Secrets 与缓存挂载实践Dockerfile 示例# syntax=docker/dockerfile:1.5

FROM node:18-alpine AS build

WORKDIR /app

COPY package*.json ./

RUN --mount=type=cache,target=/root/.npm \

--mount=type=secret,id=npm_token \

npm ci

COPY . .

RUN npm run build

FROM node:18-alpine AS runtime

WORKDIR /app

COPY --from=build /app/dist ./dist

CMD ["node", "dist/server.js"]

构建命令DOCKER_BUILDKIT=1 docker build \

--secret id=npm_token,env=NPM_TOKEN \

-t app:buildkit .

要点# syntax=docker/dockerfile:1.5 启用新前端特性--mount=type=secret 仅在构建阶段可见，避免进入镜像--mount=type=cache 复用依赖缓存，显著加速构建总结BuildKit 的密钥与缓存挂载提高安全与效率，适合含私有依赖与重度构建的项目。