optimizing docker images
TRANSCRIPT
bdehamer | CenturyLinkLabs
@bdehamer | @centurylinklabs
Optimizing Docker Images
Brian DeHamer - CenturyLink Labs
Overview
• Images & Layers • Minimizing Image Size • Leveraging the Image Cache • Dockerfile Tips • Other Tools
Images & Layers
Interactive Image Creation
• Workflow for creating images by-hand
• docker run -it someimage
• Add/update/delete files • docker commit
• docker rm
*
Dockerfile• Automate image creation with docker build
• Place instructions for building image in Dockerfile • Commands: FROM, COPY, RUN, etc…
• Uses the same run/commit/rm sequence as the interactive approach
• More repeatable/shareable than the interactive approach
*
Image Layers• Each Dockerfile instruction generates a new layer
FROM busybox:latest
MAINTAINER brian
RUN touch foo
CMD ["/bin/sh"]
8c2e06607696
5bd9073989ff
0437ee5cf42c
350e4f999b25
Image Layers
• An image is a hierarchical list of layers • Each layer has a reference to its parent • Overall image size is the sum of the sizes of the
individual layers
• Each additional instruction you add to your Dockerfile will only ever increase the size of your image
*
Inspecting Layers• View hierarchy of all local layers
• docker images --tree
• View hierarchy of image layers w/ command • docker history <TAG>
• View all metadata for a specific layer • docker inspect <TAG>
• View layer directly on disk • /var/lib/docker/aufs*
* varies by platform
!"cf2616975b4a Virtual Size: 0 B !"6ce2e90b0bc7 Virtual Size: 2.433 MB !"8c2e06607696 Virtual Size: 2.433 MB Tags: busybox:latest !"d6057c416142 Virtual Size: 2.433 MB !"70714dda0cf8 Virtual Size: 2.448 MB Tags: foo:latest
$ docker run -it d6057c416142 /bin/sh
Images vs. Layers• An image is just a tagged hierarchy of layers • Every layer in an image is runnable • Helpful when trying to debug Dockerfiles
Minimizing Image Size
$ docker imagesREPOSITORY TAG IMAGE ID VIRTUAL SIZEaa latest 5927ecad7beb 90.22 MBbb latest 4f02d7398349 100.7 MBcc latest f466548ecd34 95.47 MBdebian wheezy 1265e16d0c28 84.98 MB
Virtual Image Size
• ~370MB in images? • Virtual size can be misleading, especially if images
have layers in common
$ docker images --tree!"511136ea3c5a Virtual Size: 0 B !"4f903438061c Virtual Size: 84.98 MB !"1265e16d0c28 Virtual Size: 84.98 MB Tags: debian:wheezy !"f5f93a9eb89b Virtual Size: 84.98 MB #"245d46749e30 Virtual Size: 90.22 MB $ !"5927ecad7beb Virtual Size: 90.22 MB Tags: aa:latest #"c4a4ebecb14b Virtual Size: 100.7 MB $ !"4f02d7398349 Virtual Size: 100.7 MB Tags: bb:latest !"13f53a3a9cb5 Virtual Size: 95.47 MB !"f466548ecd34 Virtual Size: 95.47 MB Tags: cc:latest
Reuse Your Base Image
• Shared layers are re-used across images • ~115 MB in images!
Base Images
Image Name Sizefedora:21 241 MB
ubuntu:trusty 188 MBdebian:wheezy 85 MBalpine:3.1 5 MB
busybox:latest 2 MBscratch 0 B
Language Images
Image Name Sizeruby:2.2 775 MB
python:3.4 754 MBperl:5.20 724 MBnode:0.12 706 MBjava:7-jdk 586 MBgolang:1.4 514 MB
Command Chaining• Beware of creating unnecessary layers with your
Dockerfile commands
FROM debian:wheezyWORKDIR /tmpRUN wget -nv http://foo.com/someutil-v1.0.tar.gzRUN tar -xvf someutil-v1.0.tar.gzRUN mv /tmp/someutil-v1.0/someutil /usr/bin/someutilRUN rm -rf /tmp/someutility-v1.0RUN rm /tmp/someutility-v1.0.tar.gz
Command Chaining• Chaining commands allows you to clean-up before
the layer is committed
FROM debian:wheezyWORKDIR /tmpRUN wget -nv http://foo.com/someutil-v1.0.tar.gz && \ tar -xvf someutil-v1.0.tar.gz && \ mv /tmp/someutil-v1.0/someutil /usr/bin/someutil && \ rm -rf /tmp/someutility-v1.0 && \ rm /tmp/someutility-v1.0.tar.gz
Clean-up After Yourself• Try to remove any intermediate/temporary files that
you don't need in your final image
FROM debian:wheezyRUN apt-get update && \ apt-get install -y curl wget git && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
Flattening Images• Can sometimes reduce size by combining layers • docker export <id> | docker import -
• Lots of other tools and Docker proposals for combining image layers
• https://github.com/dqminh/docker-flatten • https://gist.github.com/vieux/6156567 • https://github.com/docker/docker/issues/6906
• Not really recommended
Pack Only What You Need
• Start with FROM scratch and package only the bins/libs you need for your app
• Use cde to profile your app and identify dependencies • Statically-linked binaries w/ no dependencies (C, Go, etc…)
• centurylink/golang-builder: helps compile statically-linked Go apps and package in minimal Docker containers
• centurylink/ca-certs: base image that is just scratch plus the standard root CA certificates (257 KB)
Leveraging the Image Cache
Image Cache• All built or pulled layers are saved in the local image
cache • Docker won’t rebuild an unchanged layer (unless you
force it to) • Significant increase in build speed when iterating on
Dockerfile • Cache is invalidated for a layer if either the Dockerfile
instruction or the parent layer is changed*
Build Context
• The final argument to docker build is typically the build context
• Allows you to inject local files into your image using the COPY instruction
• Changes to copied files will also invalidate image cache
• Dockerfile must be located within the build context
*
Top-to-Bottom
• Place the instructions least likely to change at the top of your Dockerfile
• Make changes/additions at the bottom • Place instructions you use across all of your images
(MAINTAINER) at the top so they can be re-used across all images
.dockerignore• Place .dockerignore in the root of build context with
list of file/directory patterns to be excluded from build context
• Very much like .gitignore • Helpful when copying the entire build context and
want to selectively ignore files
FROM busybox:latestCOPY . /somedir/
*
Beware of Idempotent Operations• Instructions that may return different results
depending on when they are executed • apt-get update, git clone, go get, etc…
• Cached layer may not contain what you expect • Can use --no-cache flag with docker build to
ignore cache • Use strategic command chaining to bust cache
• Updating branch name does NOT invalidate cache
Bust Cache with Chained Commands
WORKDIR /tmpRUN git clone https://github.com/bdehamer/sample.gitRUN git checkout v1.0
WORKDIR /tmpRUN git clone https://github.com/bdehamer/sample.git && \ git checkout v1.0
• Updating branch invalidates cache
Dockerfile Tips
ADD vs. COPY
• ADD & COPY instructions both add files/directories to the container
• ADD can also handle URLs as a source and will automatically extract archives
• COPY added in Docker 1.0 and only copies files/dirs
• Use COPY unless there is a specific feature of ADD you absolutely need
Repeatable Image Builds• Ideally, anyone should be able to build your
Dockerfile at any time and get the same result • Vague dependencies can result in unpredictable
builds
RUN apt-get update && apt-get install -y hello
RUN apt-get update && apt-get install -y hello=2.8-4
vs
Shell Variables• Each Dockerfile instruction is executed in a new
container with a new shell • Don’t tryRUN export FOO=BARRUN cd /tmpRUN su - someuser
• Instead useENV FOO=BAR or RUN FOO=BAR /some/command/that/needs_fooWORKDIR /tmpUSER someuser
Other Tools / Resources
centurylink/dockerfile-from-image• Reverse-engineers a Dockerfile from a Docker image • Can't recreate ADD or COPY commands exactly
$ docker run --rm \ -v /var/run/docker.sock:/var/run/docker.sock \ centurylink/dockerfile-from-image dice
FROM debian:wheezyMAINTAINER [email protected] apt-get updateRUN apt-get install -y rolldiceCMD ["/usr/games/rolldice" "6"]
centurylink/image-graph• See relationships between layers in your local image
cache
imagelayers.io• Visualize images on the Docker Hub • See layers shared between different images • See the instruction for each layer • Get information about image size • Coming soon! Available now!
Additional Reading• CenturyLink Labs Blog
• http://centurylinklabs.com • Best Practices for Writing Dockerfiles
• https://docs.docker.com/articles/dockerfile_best-practices • Squashing Docker Images - Jason Wilder
• http://jasonwilder.com/blog/2014/08/19/squashing-docker-images/ • Create the Smallest Possible Docker Container - Adriaan de Jonge
• http://blog.xebia.com/2014/07/04/create-the-smallest-possible-docker-container/
bdehamer | CenturyLinkLabs
@bdehamer | @centurylinklabs
Thanks!
Brian DeHamer - CenturyLink Labs