"Docker BuildKit Secrets 与缓存挂载实践"

Docker BuildKit Secrets 与缓存挂载实践Dockerfile 示例# syntax=docker/dockerfile:1.5 FROM node:18-alpine AS build WORKDIR /app COPY package*.json ./ # 使用缓存挂载与构建时密钥 RUN --mount=type=cache,target=/root/.npm \ --mount=type=secret,id=npm_token \ npm ci COPY . . RUN npm run build FROM node:18-alpine AS runtime WORKDIR /app COPY --from=build /app/dist ./dist CMD ["node", "dist/server.js"] 构建命令DOCKER_BUILDKIT=1 docker build \ --secret id=npm_token,env=NPM_TOKEN \ -t app:buildkit . 要点`# syntax=docker/dockerfile:1.5` 启用新前端特性`--mount=type=secret` 仅在构建阶段可见，避免进入镜像`--mount=type=cache` 复用依赖缓存，显著加速构建总结BuildKit 的密钥与缓存挂载提高安全与效率，适合含私有依赖与重度构建的项目。