Registry — Docker Hub, GHCR ga image yuklash, teglash

~12 daq · Docker · Production

Muammodan boshlaylik

Image kompyuteringizda yasaldi. Endi u serverga kerak. Variantlar:

  • Serverda git pull va docker build — serverda build vositalari, manba kod va har bir deploy da bir necha daqiqa build
  • docker save → fayl → scp → docker load — har safar yuzlab MB, versiyalar tartibsiz

To'g'ri yo'l — registry: image lar uchun "GitHub". Bir marta push qilasiz — istalgan server pull qiladi. Xuddi kod uchun Git kabi.

Registry lar

Registry Manzil Bepul
Docker Hub docker.io (standart) 1 ta yopiq repo, ommaviylari cheksiz; pull chegarasi
GitHub Container Registry ghcr.io Ommaviylari bepul; yopiqlari — GitHub tarifi bo'yicha
GitLab Registry registry.gitlab.com Ha, loyiha bilan
AWS ECR, Google Artifact Registry, Azure ACR Bulut Pullik, bulut bilan integratsiya
O'z registry ingiz registry:2 image, Harbor O'zingiz boshqarasiz

GitHub da kodingiz bo'lsa — GHCR eng qulay: CI/CD bilan to'g'ridan-to'g'ri ishlaydi (41-dars).

Image nomi tuzilishi

ghcr.io/firdavsdev07/dokon-api:1.4.2
└──┬──┘ └─────┬─────┘ └───┬───┘ └─┬─┘
registry    egasi       repo     teg
  • Registry yozilmasa — docker.io (Docker Hub)
  • nginx = docker.io/library/nginx:latest (rasmiy image lar — library/)
  • Teg yozilmasa — latest

Push: Docker Hub

docker login                                   # foydalanuvchi + access token
docker build -t otabek/dokon-api:1.0.0 .
docker push otabek/dokon-api:1.0.0

Mavjud image ga yangi nom berish:

docker tag dokon-api:latest otabek/dokon-api:1.0.0
docker push otabek/dokon-api:1.0.0

docker tag — nusxa emas, xuddi shu image ga yana bir nom (qatlamlar umumiy).

[!WARNING] docker login da parol emas, access token ishlating (Docker Hub → Account Settings → Personal access tokens). Token ni cheklash va bekor qilish mumkin; parolni — yo'q.

Push: GHCR

# GitHub → Settings → Developer settings → Personal access tokens
# ruxsat: write:packages
echo $GHCR_TOKEN | docker login ghcr.io -u firdavsdev07 --password-stdin

docker build -t ghcr.io/firdavsdev07/dokon-api:1.0.0 .
docker push ghcr.io/firdavsdev07/dokon-api:1.0.0

--password-stdin — token buyruqlar tarixida (history) qolmasligi uchun.

Image ni repo bilan bog'lash (GitHub sahifasida ko'rinsin):

LABEL org.opencontainers.image.source="https://github.com/firdavsdev07/dokon"

Teglash strategiyasi

latest muammosi

image: otabek/dokon-api:latest

Bugun latest = 1.4. Ertaga kimdir push qildi — latest = 1.5. Server qayta ishga tushdi — boshqa versiya, hech kim bilmaydi. Orqaga qaytish? Qaysi versiyaga — noma'lum.

[!WARNING] latest — "eng yangi" degani emas, shunchaki standart teg nomi. Production da latest ga tayanmang.

Yaxshi amaliyot: bir nechta teg

VERSION=1.4.2
SHA=$(git rev-parse --short HEAD)

docker build \
  -t ghcr.io/firdavsdev07/dokon-api:$VERSION \
  -t ghcr.io/firdavsdev07/dokon-api:1.4 \
  -t ghcr.io/firdavsdev07/dokon-api:sha-$SHA \
  -t ghcr.io/firdavsdev07/dokon-api:latest \
  .
docker push --all-tags ghcr.io/firdavsdev07/dokon-api
Teg Ma'nosi Kim uchun
1.4.2 Aniq versiya, o'zgarmaydi Production
1.4 1.4.x ning eng yangisi Avtomatik patch yangilanishlari
sha-a3f9c2b Aniq commit Debug, staging
latest Oxirgi build Sinash

Production da — aniq versiya yoki sha-. Orqaga qaytish — tegni o'zgartirish.

Digest — mutlaqo aniq

Teg ni qayta yozish mumkin. Digest — image mazmunining hash i, o'zgarmaydi:

docker images --digests
docker pull nginx@sha256:a484819eb60211f5299034ac80f6a681b06f89e65866ce91f356ed7c72af059c

Eng yuqori xavfsizlik talablarida (va 39-darsdagi supply chain hujumlariga qarshi) image lar digest bo'yicha qotiriladi.

Ko'p arxitektura (multi-platform)

Mac M1/M2/M3 — arm64. Server — ko'pincha amd64. Mac da yasalgan image serverda:

exec /usr/local/bin/docker-entrypoint.sh: exec format error

Yechim — buildx bilan bir vaqtda ikki platforma uchun:

docker buildx create --use
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t ghcr.io/firdavsdev07/dokon-api:1.4.2 \
  --push .

Registry da bitta teg ostida ikkala variant; har bir server o'ziga mosini oladi. Rasmiy image lar (node, nginx) aynan shunday.

Pull va eskilarni tozalash

# Serverda (yopiq registry uchun avval login)
docker pull ghcr.io/firdavsdev07/dokon-api:1.4.2

# Eski image lar diskni to'ldiradi
docker image prune -a --filter "until=168h"   # 7 kundan eski, ishlatilmayotgan

Registry ning o'zida ham eski teglar to'planadi — GHCR va Docker Hub da saqlash qoidalari (retention policy) yoki CI da tozalash.

O'z registry ingiz

docker run -d -p 5000:5000 --name registry \
  -v registry-data:/var/lib/registry \
  registry:2

docker tag dokon-api localhost:5000/dokon-api:1.0
docker push localhost:5000/dokon-api:1.0

Lokal sinov uchun yaxshi. Production da — HTTPS, autentifikatsiya va tozalash kerak; buning uchun Harbor kabi to'liq yechimlar.

Nima uchun shunday?

Nima uchun serverda build qilish o'rniga registry orqali o'tish kerak?

Chunki "bir marta build — hamma joyda ishga tushir". Registry dagi 1.4.2 image — CI da sinovdan o'tgan aynan o'sha baytlar. Serverda qayta build qilsangiz — boshqa vaqtda, boshqa bog'liqlik versiyalari bilan, ehtimol boshqa natija: sinovdan o'tgan narsa emas, boshqa narsa ishga tushadi. Bundan tashqari, serverga build vositalari va manba kod kerak emas, deploy esa build vaqtisiz — faqat pull (o'zgargan qatlamlar). Va har bir versiya saqlanadi — orqaga qaytish bir soniyalik ish.

Xulosa

Eslab qoling:

  • Registry — image lar ombori: Docker Hub, GHCR, bulut, o'zingizniki
  • Nom: registry/egasi/repo:teg; standart — docker.io, latest
  • docker login — access token, --password-stdin
  • docker tag — yangi nom; docker push / docker pull
  • Production da latest emas — aniq versiya yoki sha-...; digest — eng aniq
  • Mac (arm64) → server (amd64): docker buildx build --platform linux/amd64,linux/arm64
  • Bir marta build — hamma joyda shu image

Keyingi dars

39-dars: Xavfsizlik — root siz, secrets, image skanerlash