Docker BuildKit Secrets 与缓存挂载实践

# Docker BuildKit Secrets 与缓存挂载实践 ## Dockerfile 示例 ```dockerfile # syntax=docker/dockerfile:1.5 FROM node:18-alpine AS build WORKDIR /app COPY package*.json ./ # 使用缓存挂载与构建时密钥 RUN --mount=type=cache,target=/root/.npm \ --mount=type=secret,id=npm_token \ npm ci COPY . . RUN npm run build FROM node:18-alpine AS runtime WORKDIR /app COPY --from=build /app/dist ./dist CMD ["node", "dist/server.js"] ``` ## 构建命令 ```bash DOCKER_BUILDKIT=1 docker build \ --secret id=npm_token,env=NPM_TOKEN \ -t app:buildkit . ``` ## 要点 - `# syntax=docker/dockerfile:1.5` 启用新前端特性 - `--mount=type=secret` 仅在构建阶段可见，避免进入镜像 - `--mount=type=cache` 复用依赖缓存，显著加速构建 ## 总结 BuildKit 的密钥与缓存挂载提高安全与效率，适合含私有依赖与重度构建的项目。