Docker BuildKit Secrets 与缓存挂载实践

Dockerfile 示例

# syntax=docker/dockerfile:1.5
FROM node:18-alpine AS build
WORKDIR /app
COPY package*.json ./
# 使用缓存挂载与构建时密钥
RUN --mount=type=cache,target=/root/.npm \
    --mount=type=secret,id=npm_token \
    npm ci
COPY . .
RUN npm run build

FROM node:18-alpine AS runtime
WORKDIR /app
COPY --from=build /app/dist ./dist
CMD ["node", "dist/server.js"]

构建命令

DOCKER_BUILDKIT=1 docker build \
  --secret id=npm_token,env=NPM_TOKEN \
  -t app:buildkit .

要点

• `# syntax=docker/dockerfile:1.5` 启用新前端特性
• `--mount=type=secret` 仅在构建阶段可见，避免进入镜像
• `--mount=type=cache` 复用依赖缓存，显著加速构建

总结

BuildKit 的密钥与缓存挂载提高安全与效率，适合含私有依赖与重度构建的项目。