CI/CD 集成

约 509 字大约 2 分钟

布欧-Lewyon

2026-05-15

将 Docker 镜像构建和推送集成到 CI/CD 流水线中，每次代码提交自动构建并部署。

GitHub Actions

# .github/workflows/docker-build.yml
name: Build and Push Docker Image

on:
  push:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Log in to Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and Push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

GitLab CI

# .gitlab-ci.yml
stages:
  - build
  - deploy

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: ""

services:
  - docker:dind

build:
  stage: build
  image: docker:latest
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA $CI_REGISTRY_IMAGE:latest
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
    - docker push $CI_REGISTRY_IMAGE:latest
  only:
    - main

多架构构建

# GitHub Actions 多架构构建
- name: Set up QEMU
  uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
  uses: docker/setup-buildx-action@v3

- name: Build multi-arch
  uses: docker/build-push-action@v5
  with:
    platforms: linux/amd64,linux/arm64
    push: true
    tags: myapp:latest

安全扫描集成

# GitHub Actions 扫描
- name: Scan image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myapp:latest'
    severity: 'CRITICAL,HIGH'
    format: 'sarif'
    output: 'trivy-results.sarif'

- name: Upload results
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: 'trivy-results.sarif'

自动部署

# CI/CD 构建后自动部署到服务器
- name: Deploy to server
  uses: appleboy/ssh-action@v1
  with:
    host: ${{ secrets.DEPLOY_HOST }}
    username: ${{ secrets.DEPLOY_USER }}
    key: ${{ secrets.DEPLOY_KEY }}
    script: |
      cd /opt/app
      docker compose pull
      docker compose up -d --force-recreate

Docker Hub 自动构建

Docker Hub 支持连接 GitHub/GitLab 仓库，每次推送自动构建：

# Docker Hub 上的自动构建配置
# 1. 连接 GitHub 仓库
# 2. 设置构建规则（分支/标签）
# 3. 可选：BuildHook 触发外部 Webhook

小结

CI/CD 流水线标准化镜像构建流程：代码 push → 自动构建 → 镜像扫描 → 推送 Registry → 部署。
GitHub Actions 和 GitLab CI 都原生支持 Docker 构建，推荐使用 docker/build-push-action。
多架构构建（linux/amd64 + linux/arm64）通过 QEMU + Buildx 实现。
镜像安全扫描（Trivy）集成到流水线，阻止高危 CVE 进入生产。
构建时使用 cache 加速（type=gha 或 type=registry）。

上一节：私有 Registry 下一节：Docker Swarm 简介