
关于
构建生产级容器部署,涵盖 Docker 多阶段构建、Kubernetes 清单、Helm Charts 和安全最佳实践。
name: container-orchestration description: "Docker 和 Kubernetes 模式。触发条件:Dockerfile、docker-compose、kubernetes、k8s、helm、pod、deployment、service、ingress、container、image。" license: MIT compatibility: "Docker 20+, Kubernetes 1.25+, Helm 3+" allowed-tools: "Read Write Bash" metadata: author: claude-mods
容器编排
用于容器化应用的 Docker 和 Kubernetes 模式。
Dockerfile 最佳实践
# Use specific version, not :latest
FROM python:3.11-slim AS builder
# Set working directory
WORKDIR /app
# Copy dependency files first (better caching)
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
# Copy application code
COPY src/ ./src/
# Production stage (multi-stage build)
FROM python:3.11-slim
WORKDIR /app
# Create non-root user
RUN useradd --create-home appuser
USER appuser
# Copy from builder
COPY --from=builder /app /app
# Set environment
ENV PYTHONUNBUFFERED=1
# Health check
HEALTHCHECK --interval=30s --timeout=3s \
CMD curl -f http://localhost:8000/health || exit 1
EXPOSE 8000
CMD ["python", "-m", "uvicorn", "src.main:app", "--host", "0.0.0.0"]
Dockerfile 规则
应该做的:
- 使用特定的基础镜像版本
- 使用多阶段构建
- 以非 root 用户运行
- 按变更频率排列命令
- 使用 .dockerignore
- 添加健康检查
不应该做的:
- 使用 :latest 标签
- 以 root 运行
- 复制不必要的文件
- 在镜像中存储密钥
- 在生产环境安装开发依赖
Docker Compose
# docker-compose.yml
version: "3.9"
services:
app:
build:
context: .
dockerfile: Dockerfile
ports:
- "8000:8000"
environment:
- DATABASE_URL=postgres://user:pass@db:5432/app
depends_on:
db:
condition: service_healthy
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
interval: 30s
timeout: 10s
retries: 3
db:
image: postgres:15-alpine
volumes:
- postgres_data:/var/lib/postgresql/data
environment:
POSTGRES_USER: user
POSTGRES_PASSWORD: pass
POSTGRES_DB: app
healthcheck:
test: ["CMD-SHELL", "pg_isready -U user -d app"]
interval: 10s
timeout: 5s
retries: 5
volumes:
postgres_data:
Kubernetes 基础
Deployment(部署)
apiVersion: apps/v1
kind: Deployment
metadata:
name: app
labels:
app: myapp
spec:
replicas: 3
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- name: app
image: myapp:1.0.0
ports:
- containerPort: 8000
resources:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "256Mi"
cpu: "500m"
livenessProbe:
httpGet:
path: /health
port: 8000
initialDelaySeconds: 10
periodSeconds: 30
readinessProbe:
httpGet:
path: /ready
port: 8000
initialDelaySeconds: 5
periodSeconds: 10
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: app-secrets
key: database-url
Service(服务)
apiVersion: v1
kind: Service
metadata:
name: app-service
spec:
selector:
app: myapp
ports:
- port: 80
targetPort: 8000
type: ClusterIP
Ingress(入口)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: app-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
ingressClassName: nginx
rules:
- host: app.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: app-service
port:
number: 80
kubectl 快速参考
| 命令 | 说明 |
|---------|-------------|
| kubectl get pods | 列出 Pod |
| kubectl logs <pod> | 查看日志 |
| kubectl exec -it <pod> -- sh | 进入 Pod Shell |
| kubectl apply -f manifest.yaml | 应用配置 |
| kubectl rollout restart deployment/app | 重启部署 |
| kubectl rollout status deployment/app | 检查滚动更新状态 |
| kubectl describe pod <pod> | 调试 Pod |
| kubectl port-forward svc/app 8080:80 | 本地端口转发 |
附加资源
./references/dockerfile-patterns.md- 高级 Dockerfile 技巧./references/k8s-manifests.md- 完整 Kubernetes 清单示例./references/helm-patterns.md- Helm Chart 结构和值
脚本
./scripts/build-push.sh- 构建并推送 Docker 镜像
资产
./assets/Dockerfile.template- 生产环境 Dockerfile 模板./assets/docker-compose.template.yml- Compose 入门模板
兼容工具
Claude CodeCursorGitHub Copilot
标签
运维部署

