"Docker镜像瘦身与安全加固指南"

镜像瘦身多阶段构建：在 `builder` 阶段编译，`runtime` 阶段仅拷贝产物。选择轻量基础镜像：如 `alpine` 或 `distroless`，减少体积与攻击面。清理包缓存与临时文件，避免层膨胀。安全加固最小权限：`USER 1000:1000` 运行，避免 `root`。只读文件系统与限制能力（`CAP_DROP`）。定期安全扫描（如 Trivy）与镜像签名（Cosign）。示例（Node.js）FROM node:20-alpine AS builder WORKDIR /app COPY package*.json ./ RUN npm ci COPY . . RUN npm run build FROM node:20-alpine AS runtime WORKDIR /app COPY --from=builder /app/dist ./dist COPY --from=builder /app/package*.json ./ RUN npm ci --omit=dev && adduser -D app && chown -R app:app /app USER app CMD ["node", "dist/index.js"]