‫So first up we had Charles who posted his Docker file
‫area go
‫and let me let me pull up the green screen so we can
‫so let's look at this Docker file shall we.
‫And of course the reality is here is that once you get to real world files everything gets messier.
‫Right.
‫We all learn in courses like the ones I have and we learn from blog articles and documentation and then
‫once we get to the real world it always seems to be harder than that.
‫So I'm always trying to add more of that complexity to courses but it's a lot of work to get that in
‫the courses because you have to it's very context.
‫It's very much about your environment and your setup and your particular app.
‫So I thought last night Hey why don't we talk about this in the show tomorrow.
‫So if you really like this give this a thumbs up.
‫Tell me in chat or in the comments that you would like more of these and we'll make this a regular thing
‫we'll actually review more Docker files and compose files and pull out some of the good gems there.
‫All right.
‫So first up is Charles and it looks like he's coming from his own account he's got a P HP Apache image.
‫Based on that that name I'm going to just assume that that's what that is.
‫And it's got a date and it knows it's got a version and a date in the name there.
‫So that's pretty common as you start to get to your own custom from images you'll start to do things
‫like version them or date them or use commit ideas in them.
‫And that's a way to guarantee that you're using the exact same image right.
‫Again here you don't only use latest in any real production setup you can always use latest for playing
‫around and testing.
‫But when you go to real stuff you're always going to want to use those real versions.
‫Well that's Azure HP image Charles says.
‫OK cool.
‫And then he's got here an interesting set up that I've not seen before and I think I know why you're
‫doing it.
‫So in this run line here you're doing an app to get update and then you're saying if that doesn't you're
‫giving an OR in bash which means if this doesn't succeed do this.
‫And so you're repeating it.
‫So I'm guessing that may be either you're on a network or someplace where you potentially have a it's
‫a common issue to have to get update problems or maybe you've had some quirks in the past where it's
‫randomly failed and if you just did it a second time it would work.
‫That's what I'm guessing you're doing there.
‫And it's an effective solution to that problem if that's what it that's that's that's what it's for.
‫Otherwise I don't normally see this kind of setup this normally is not what I would see there.
‫All right.
‫Next up you export and which is just a tiny little metadata change.
‫So it's not going to take much Oh look at that Charles says at
‫yeah he says it's a as happy HP image.
‫And he spoke to mucks up Azure support and it fixes a bug.
‫So very cool
‫I'm going to change that
‫see
‫let's do this
‫changing the fonts here so it looks a little easier
‫yeah.
‫A look better.
‫Yeah.
‫All right.
‫So here's an interesting thing.
‫So you're download so you're doing some downloads and you're installing a package which is normal.
‫And you're also doing a bunch of APP get installs here.
‫So unless this is something you're testing and you're just trying to figure out how this workflow works
‫there's lots of opportunity for for optimization especially when it comes to size.
‫And you also have a situation here we can get yourself in a little bit of trouble.
‫So notice up here that we have a separate run line that's doing the app to get update.
‫So you don't have that line down here where you're doing all the install.
‫So you've broken these all these steps out.
‫Now if you start going and look at it official images you will notice that they never do this.
‫They always put it all in one huge run line and there's a couple of reasons for that.
‫The biggest reason here is cash busting.
‫So when you think about when you build an image there's a cash behind it.
‫Now if you're using something like Jenkins or a CCD runner and you have disabled caching where it's
‫always going to build every time from scratch without without caching then this may not be that issue
‫that kind of issue but it will certainly be an issue if you build locally or you build on any system
‫more than once.
‫And this is what's going to happen the the run line.
‫Let's say it's there.
‫OK.
‫And it never changes.
‫Right.
‫So the first time you build this image everything's fine.
‫Let's say you build three days later.
‫It's not going to cache this line because this line didn't change remember and on the on the standard
‫docker build command cache busting is when you've changed a line.
‫And when you change that line everything in that line is rerun and every line after it.
‫And what happens here is if you have this run line up here and it never changes but then you add let's
‫say another package down here in the run line or maybe you change the versions and you hard code your
‫versions which you should also be doing you should hard code the versions of all these tools and maybe
‫not zip and unzip and curl.
‫But if your security team is strict they will expect you to have reliable versions and that's another
‫thing you would want to do here.
‫But let's get back to this point.
‫So if you're going to do these installs and you change a tool and add it here.
‫Think about that and get update that had to get update downloads a cache of all of the metadata about
‫all these packages and then you're going to install these packages later and if the second line here
‫gets busted by changing it's going to rerun.
‫But it's going to be running based on that old cache of your app to get update.
‫So you over time will start to experience problems because your packages will always be installing those
‫old versions a much better way to do this is to take all your app to get stuff right.
‫And that's not necessarily related to downloading this package here.
‫This is a custom package.
‫We'll talk about that a minute.
‫But when it comes to these lines right here this line is going to have no effect on size because this
‫line has to run in the same line as this one or it's not going to work.
‫Now this is all maybe not true.
‫If you have another Okay so you're not doing multi-stage.
‫One way to get away with the size problem is do you do multi-state but you're not doing what the state
‫and that's OK.
‫You don't have to do a multi-stage
‫so let's see
‫so what's gonna happen here is that you would recommend taking these right here taking all this right
‫here bumping it all up to this line.
‫I would take this export line and put it above so I would I would just put it up here so that way it's
‫set.
‫And it never needs to change.
‫And you don't have to worry about it in the middle of all you're out to get stuff right.
‫And in general it's good that you're having all your at get stuff near the top because you want those
‫dependencies which usually take a long time to install you want them to be high up as possible so you
‫don't have to rerun them very often.
‫But I'm what I'm going to recommend that you take all this stuff right here
‫and put it up here now you can do this next because this is a manual package download and install.
‫So when you do this
‫there's a couple of things you can do.
‫One is this.
‫This line right here is going to be a layer and that layer is always going to include the db file even
‫if you don't need it.
‫So when you clean up later it's not cleaning up these previous layers.
‫That's one of the problems here is that it's a file that's downloaded into a layer and then you go to
‫the next line which is a or the next Docker command I should say the next Docker command will be a new
‫layer.
‫Think of that as a separate it's up once you stopped a line or a docker command.
‫You can not change that you can't go back in time and change that.
‫So the next line or command and docker file will just add stuff to it.
‫Now if it deletes files it's just going to delete them in that layer.
‫It essentially put some metadata that says hey that file should no longer exist or look like it exists
‫but those files are still going to exist and those read only layers because every layer above it is
‫now read only and that's the way that these layers guarantee that they're identical to what you expect.
‫So no layer can go back in time.
‫So that's what you need to do is go check out some of the docker default images and so let's do this
‫actually go look at one of mine because it'll be a little more
‫it might be a little easier to understand.
‫So
‫yeah I'm not sure.
‫OK.
‫So Docker file yes there's an AP Kay but you'll notice here how it's all in one line that's kind of
‫a bad example but let's do a hub and let's go look at Ghost.
‫So
‫look at this Debian Docker file.
‫All right here we go.
‫So you'll notice that in this situation it's downloading some stuff it's dealing with that stuff and
‫then it's getting rid of that stuff all in one run line.
‫So that way those files never stick around.
‫Once that layer is sealed and marked read only.
‫And that's pretty key to keeping your images small.
‫I bet once you make this stuff of efficient and combine this stuff together that you'll you'll be saving
‫hundreds of megs and your image size.
‫All right and the other thing here on this one is I would also add that to one single line and another
‫thing I would do there is you maybe don't need w get you maybe can do an ad an ad will automatically
‫download a file from the Internet.
‫And if you're very curious about the difference in copy and ad really nowadays our standard is copy
‫is really only for copying files out of the repo that you're in right.
‫So just copy files and ad does the same thing but we tend to only want to use ad when we're either downloading
‫something from the Internet or whatever we're copying and we want it to unzip or UN tar and that that's
‫really going to reason to use ad.
‫But the nice benefit of using ad there is you wouldn't need to do w w get you could use basically doctors
‫internals we'll go get that file and download it the negative of that though is that when you do that
‫line and then you go to the next line.
‫That package will still exist.
‫So even though ads really cool there in your case because you're downloading a package that you're good
‫they're going to install and then you don't need that package in that anymore.
‫I would maybe just put all three of those lines into one line that way at the very end you can actually
‫delete that dot D.B. file and save additional space in your final event.
‫So you would do all of that in one run.
‫All right.
‫That helps.
‫So looks like you're copying in some other files great that you're using copy not add.
‫You're also doing some makers and copying and certificates.
‫That's exactly how I would do it.
‫You might to make this more optimized you might put
‫all of these into a single run command usually because the basically it's a little bit faster to build
‫it will give you maybe a second faster in your bill because every single one these lines it has to stop
‫the container or create a new container mount the rest of the image and run that command then save that
‫to a new container image and then start a new container.
‫Right.
‫So it's got to do a lot more work than just run three quick commands.
‫So I might just have those in one.
‫There's no safe space savings or anything there but it's just a matter of three commands really would
‫turn into one long shell command their and yeah all right yeah.
‫We've got the gates.
‫I would probably do the same thing make those one just for efficiency by the way.
‫So right here you're copying in two different copy lines you can make that one line.
‫You could actually say copy and then the path to the CRT and then the path to that got to that key.
‫Kay Kay you why and have those two files and then put in the path to the SSL directory.
‫So as long as they're both going to the same directory you can have multiple files in the single copy
‫line that'll help you make it a little easier.
‫Fewer lines it tends to be better as long as they're not too complicated.
‫Yeah.
‫You've got some standard Apache stuff there on configurations you might also.
‫I don't know how much.
‫Yeah.
‫These are these are actually these are good.
‫I think those are good
‫yeah do it some more copying of config files in some of these you also might consider that these are
‫standard config files but if you need to overwrite these and you're using an orchestrator whether using
‫Cuban or swarm realize that you can use that config or in communities called config map you can use
‫the config feature and swarm to mount these files in at runtime so that way you're not hard coding any
‫configurations.
‫Ideally you're not hard coding SSL is into your image either really if you're you have custom SSL as
‫you want to store that in your orchestrator or in Docker and mount those and when you run because ideally
‫there shouldn't be anything secret in an image when you save it.
‫So hopefully you're going to be doing that same thing here as you could combine these two into one line
‫you could combine some of these into one line you could probably you know if this is all the x small
‫files that directory you could copy the directory asterisk dot X amount and then you could copy all
‫four into there it's pros and cons to that because then if an X extra excel file shows up it might accidentally
‫get copied in but it just depends on how verbose you want to be and how whether you want literal line
‫for lines kind of stuff versus keeping the darker file small and simple.
‫All right.
‫And then you got another copy run your change in the working directory and then you've got your entry
‫point.
‫Now typically so you don't have a CRM D.
‫So my guess is you are using the CRM D from this root image and that's totally fine.
‫There's nothing real wrong with that.
‫One of the challenges I have with that though is that people who are using my images if I have a team
‫of people they won't know how to go get to see them D.
‫So I tend to just repeat the CMT even though it's unnecessary down here at the bottom because they're
‫gonna get this and sort of a repo and they're gonna look at it and if they're not super savvy on Docker
‫they're not going to realize Oh I need to go find that Docker file for the.
‫From that it's coming from or use the history and go back and look at the history and time to find that
‫CMT.
‫So you could even maybe throw it into just a comment to help people that are maybe looking at this Docker
‫file but I tend to find that because the entry point in the CMT are just so important to what does this
‫Docker image do that I tend to add those n even though it might be repetitive to a previous image.
‫Again all that's just metadata so it doesn't really add any real time or bloat to your build rather
‫than the other file changes and the run commands you do.
‫But other than that it looks like a great nice quality production Docker file that you have spent a
‫lot of time on but I think definitely overall you could combine a lot of those and get stuff to save
‫a lot of space in your image and a lot of bloat and also avoid the update issue of having an old update
‫that basically an old app to get cash when you try to install new stuff.
‫I would recommend you version these and you can basically inside this install command you can specify
‫the version of each maybe some of these tools it doesn't really matter but when you start getting down
‫to libraries that you need for.
‫For Apache for your actual app these are just so more utilities for managing it not really stuff that
‫you would use on a production running app.
‫Right.
‫But this live Apache down here I would definitely version that I have been bit by this bug and HP because
‫a mongo D.B. driver and HP changed versions inside of my image and it broke it had a bug and it broke
‫my production apps because I didn't pin it in the docker file and I basically went to production I just
‫one day I rebuilt the image it went it worked fine on my machine because my machine had a different
‫version because there is no it says there's no versions there you're basically getting whatever the
‫newest version is when you built the image so it's kind of a random hope that you get a good version
‫that works.
‫So you definitely get a pin that one I personally would pin them all and just update on once a month
‫or something or whatever your security team requires.
‫But that's a great Docker file.
‫Thank you so much.
‫Of course there's always room for improvement and I'm glad you showed up to help with that.