Docker obrazini qurish va registry'ga yuborish - CI/CD va GitHub Actions

Testlar yashil bo'ldi. Endi ilovani serverga olib borish kerak - buning eng ishonchli yo'li uni obrazga joylash. Bu bo'lim Docker darsligi ning asoslarini bilishni talab qiladi.

Mahalliy qurishdan boshlaymiz #

Oddiy Node ilovasi uchun Dockerfile:

Dockerfile

FROM node:22-alpine

WORKDIR /app

COPY package*.json ./
RUN npm ci --omit=dev

COPY . .

EXPOSE 3000
CMD ["node", "server.js"]

Qurish:

Terminal

docker build -t salom-ci:1.0.0 .

Natija

#9 [5/5] COPY . .
#9 DONE 0.1s

#10 exporting to image
#10 exporting layers 0.4s done
#10 naming to docker.io/library/salom-ci:1.0.0 done
#10 DONE 0.8s

Natijani tekshiramiz:

Terminal

docker images salom-ci --format "{{.Repository}}:{{.Tag}}  {{.Size}}"
docker run --rm -d -p 3100:3000 --name salom-sinov salom-ci:1.0.0
curl -s http://localhost:3100/

Natija

salom-ci:1.0.0  235MB
Salom, CI/CD!

Mahalliy ishlagan bu ikki buyruqni endi quvurga ko'chiramiz.

GHCR - GitHub ning registry'si #

Obrazni saqlash uchun alohida xizmatga ro'yxatdan o'tish shart emas: GitHub Container Registry (ghcr.io) repozitoriyning o'zi bilan keladi va autentifikatsiya uchun tayyor GITHUB_TOKEN ishlatiladi.

YAML

name: Obraz

on:
  push:
    branches: [main]

jobs:
  obraz:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Registry'ga kirish
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Qurish va yuborish
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ghcr.io/${{ github.repository }}:latest

packages: write - eng ko'p unutiladigan qator

Usiz quvur shunday xato beradi:

Natija

denied: installation not allowed to Create organization package

GITHUB_TOKEN ning huquqlari sukut bo'yicha cheklangan. Registry'ga yozish uchun aynan shu ruxsat kerak.

Teglash - eng muhim qaror #

latest tegi qulay, lekin u hech narsani bildirmaydi: qaysi kod ichida ekanini bilib bo'lmaydi va orqaga qaytarish imkonsiz.

Teglar bir xil obrazga turli nomlar beradi - har biri o'z vazifasi uchun

docker/metadata-action teglarni o'zi hisoblaydi:

YAML

      - name: Teglarni hisoblash
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=sha,format=short
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Qurish va yuborish
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

Teg turi	Natija	Qachon
`type=sha`	`sha-9f2c1ab`	Har doim - aniq kodga bog'lanadi
`type=ref,event=branch`	`main`	Tarmoq nomi bo'yicha
`type=semver`	`1.4.2`, `1.4`, `1`	`v1.4.2` tegi qo'yilganda
`type=raw,value=latest`	`latest`	Faqat asosiy tarmoqda

Qatlam keshi #

Har ishga tushirishda obrazni noldan qurish sekin. Buildx GitHub keshidan foydalana oladi:

YAML

      - uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

Sozlama	Ma'nosi
`cache-from: type=gha`	GitHub keshidan qatlamlarni oladi
`cache-to: ...,mode=max`	Barcha oraliq qatlamlarni saqlaydi
`mode=min` (sukut)	Faqat yakuniy qatlamlarni saqlaydi

Dockerfile tartibi keshdan ham muhimroq

Kesh faqat qatlam o'zgarmagan bo'lsa ishlaydi. Shuning uchun Dockerfile da kam o'zgaradigan narsa yuqorida turishi kerak:

Dockerfile

COPY package*.json ./      # kamdan-kam o'zgaradi
RUN npm ci --omit=dev      # kesh shu yerda saqlanadi
COPY . .                   # har kommitda o'zgaradi

Agar COPY . . yuqorida bo'lsa, har bir kichik o'zgarish bog'liqliklarni qaytadan o'rnatishga majbur qiladi - kesh butunlay foydasiz bo'lib qoladi.

To'liq quvur: test, keyin obraz #

YAML

name: Test va obraz

on:
  push:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm test

  obraz:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=sha,format=short
            type=raw,value=latest,enable={{is_default_branch}}

      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

needs: test shu yerda asosiy himoya: testlar qizil bo'lsa, obraz umuman qurilmaydi.

Ko'p platformali obraz #

Server ARM protsessorda bo'lsa (masalan, ba'zi arzon VPS lar), obraz ham ARM uchun kerak:

YAML

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}

Ko'p platforma qurishni sezilarli sekinlashtiradi

QEMU orqali ARM emulyatsiyasi bir necha barobar sekin ishlaydi. Agar ARM kerak bo'lmasa, uni yozmang.

Kerak bo'lsa, ikki yo'l bor:

Yechim	Izoh
Faqat relizda	Kundalik kommitlarda amd64, teg qo'yilganda ikkalasi
ARM runner	GitHub ning ARM runner'lari emulyatsiyasiz ishlaydi

Obrazni PR da sinash #

PR da obrazni qurish foydali - Dockerfile buzilgani darhol ko'rinadi. Lekin uni registry'ga yuborish shart emas:

YAML

  obraz-sinovi:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          load: true
          tags: sinov:${{ github.sha }}

      - name: Obraz ishga tushishini tekshirish
        run: |
          docker run --rm -d -p 3000:3000 --name sinov sinov:${{ github.sha }}
          sleep 3
          curl -sSf http://localhost:3000/ || exit 1
          docker rm -f sinov

push: false bilan obraz faqat quriladi, load: true esa uni mahalliy Docker'ga yuklaydi - shunda uni ishga tushirib sinash mumkin.

Amaliy topshiriq

Ilovangiz uchun Dockerfile yozing va uni mahalliy quring.
Obrazni ishga tushirib, curl bilan javob olganingizga ishonch hosil qiling.
Quvurga obraz qurish jobini qo'shing (hali yubormasdan).
permissions: packages: write siz yuborishga urinib, xatoni o'qing.
Ruxsatni qo'shib, obrazni GHCR ga yuboring.
Repozitoriyning Packages bo'limida obrazni toping.
docker/metadata-action bilan uchta teg hosil qiling: sha, latest, tarmoq nomi.
cache-from va cache-to qo'shib, ikkinchi qurish vaqtini solishtiring.
Dockerfile da COPY . . ni yuqoriga ko'chirib, keshning buzilishini kuzating.
PR uchun push: false bilan obrazni faqat sinaydigan job yozing.

Xulosa #

Obraz qurish quvurda testlardan keyin turadi: needs: test.
GHCR (ghcr.io) repozitoriy bilan birga keladi va GITHUB_TOKEN bilan ishlaydi.
Registry'ga yozish uchun permissions: packages: write shart.
latest tegi qaysi kod ichida ekanini bildirmaydi - serverda aniq teg ishlating.
docker/metadata-action teglarni kommit, tarmoq va versiya bo'yicha o'zi hisoblaydi.
Qatlam keshi uchun cache-from: type=gha va cache-to: type=gha,mode=max.
Dockerfile tartibi keshdan muhimroq: kam o'zgaradigan qadamlar yuqorida tursin.
Ko'p platformali qurish QEMU orqali sezilarli sekinlashadi - faqat kerak bo'lsa yoqing.
PR da obrazni push: false bilan qurib sinash mumkin - registry ifloslanmaydi.
load: true obrazni mahalliy Docker'ga yuklaydi va uni ishga tushirish imkonini beradi.

Keyingi bo'limda versiyalash va reliz chiqarishni avtomatlashtiramiz.

Mahalliy qurishdan boshlaymiz #

GHCR - GitHub ning registry'si #

Teglash - eng muhim qaror #

Qatlam keshi #

To'liq quvur: test, keyin obraz #

Ko'p platformali obraz #

Obrazni PR da sinash #

Xulosa #

Xatolik topdingizmi?