mirror of
https://github.com/yeasy/docker_practice.git
synced 2026-08-10 08:27:25 +00:00
yeasy
0cfd55af7b
Follow-ups to the 9 secret-hardening commits (each verified against docs.docker.com / vendor docs; one outright new bug found and fixed): - 11.6:eb5e4397changed settings.py to a hard os.environ lookup but the web service never receives POSTGRES_PASSWORD (only db does; DATABASE_URL is set but never read) -> step-6 'docker compose up' crashed with KeyError. Pass the var to web; harden the leftover literal password in the 配置详解 snippet that contradicted the new guidance two lines down; blank line after the inserted sentence (bold heading merged into the paragraph); dev/prod table no longer claims dev uses 明文 passwords - 11.8: FAQ still told readers to check passwords in .env after the same file banned passwords in .env -> point at secrets/db_password.txt; backup sidecar env vars updated to tiredofit/db-backup 4.x interface (DB01_* + DB01_PASS_FILE + DB01_BACKUP_INTERVAL - the unprefixed DB_* names are ignored by current :latest; verified against upstream README) - demo/wordpress: compose now references secrets files that ship nowhere -> add README with the creation commands from 11.8; demo/django: align with the hardened 11.6 (env-injected password, passed to web too) - 04_image multistage demos: go build without go.mod fails on module-mode Go (reproduced by reviewer on go1.26) -> add 'go mod init helloworld' matching the 7.17 doc pattern in all three Dockerfiles - 21.7: init script reworked init-db.sql -> init-db.sh per the official image's env-reading .sh hook - removes the baked 'secure_password' AND the CREATE DATABASE myappdb collision with POSTGRES_DB that aborted first-boot init (ON_ERROR_STOP); compose passes APP_DB_PASSWORD; microservices init.sql mount annotated schema-only (POSTGRES_USER: appuser would collide with CREATE USER); Dockerfile-redis healthcheck now authenticates via REDISCLI_AUTH read from redis.conf (plain redis-cli ping gets NOAUTH against requirepass - same class as the compose siblingeb5e4397already fixed); dev-container dev/dev creds annotated local-only - 19.3: Grafana admin password 'admin' sat directly under the newly added security warning -> env-injected like the rest of the stack
第四章 使用镜像
在之前的介绍中，我们知道镜像是 Docker 的三大组件之一。
Docker 运行容器前需要本地存在对应的镜像，如果本地不存在该镜像，Docker 会从镜像仓库下载该镜像。
本章内容
本章将介绍更多关于镜像的内容，包括：
版本提示：镜像存储后端的变迁
在 Docker Engine v29 及后续版本中，Docker 在全新安装场景默认启用 containerd image store（替代传统 classic store 路径）。这一底层架构级别的变迁，意味着 Docker 解锁了对 OCI Image Index 和 Attestations（例如原生的 provenance 来源证明与 SBOM 软件物料清单）的全量本地支持。 读者在执行类似
docker buildx build --provenance=mode=min --sbom=true甚至使用后续审查工具（如docker buildx imagetools inspect）时，其元数据能够与镜像数据一并完好地管理于本地存储系统中，为供应链安全验证补齐了最后一块拼图。