更好的支持容器环境运行

build/Dockerfile

@@ -1,49 +1,52 @@
-FROM alpine:latest
-LABEL maintainer="pader <[email protected]>"
+FROM bitnami/minideb:bookworm AS installer
+RUN install_packages wget ca-certificates
+ARG NACOS_VERSION=2.4.3
+ARG HOT_FIX_FLAG=""
 
 # 安装依赖
-RUN apk add --no-cache openjdk8-jre-base curl iputils ncurses vim libcurl bash
+RUN set -x \
+    && wget -O /var/tmp/nacos-server.tar.gz https://github.com/alibaba/nacos/releases/download/${NACOS_VERSION}${HOT_FIX_FLAG}/nacos-server-${NACOS_VERSION}.tar.gz \
+    && tar -xzvf /var/tmp/nacos-server.tar.gz -C /home \
+    && rm -rf /var/tmp/nacos-server.tar.gz /home/nacos/bin/* /home/nacos/conf/*.properties /home/nacos/conf/*.example /home/nacos/conf/nacos-mysql.sql
 
-# 设置环境变量
+FROM bitnami/java:1.8-debian-12
+
+# set env 
 ENV MODE="cluster" \
     PREFER_HOST_MODE="ip"\
     BASE_DIR="/home/nacos" \
     CLASSPATH=".:/home/nacos/conf:$CLASSPATH" \
     CLUSTER_CONF="/home/nacos/conf/cluster.conf" \
     FUNCTION_MODE="all" \
-    JAVA_HOME="/usr/lib/jvm/java-1.8-openjdk" \
     NACOS_USER="nacos" \
-    JAVA="/usr/lib/jvm/java-1.8-openjdk/bin/java" \
-    JVM_XMS="1g" \
-    JVM_XMX="1g" \
-    JVM_XMN="512m" \
-    JVM_MS="128m" \
-    JVM_MMS="320m" \
     NACOS_DEBUG="n" \
     TOMCAT_ACCESSLOG_ENABLED="false" \
-    TIME_ZONE="Asia/Shanghai"
+    TZ="Asia/Shanghai"
 
+# build target version
 ARG NACOS_VERSION=2.4.3
 ARG HOT_FIX_FLAG=""
 
 WORKDIR $BASE_DIR
 
-# 下载并安装 Nacos
-RUN set -x \
-    && curl -SL "https://github.com/alibaba/nacos/releases/download/${NACOS_VERSION}${HOT_FIX_FLAG}/nacos-server-${NACOS_VERSION}.tar.gz" -o nacos-server.tar.gz \
-    && tar -xzvf nacos-server.tar.gz -C /home \
-    && rm -rf nacos-server.tar.gz /home/nacos/bin/* /home/nacos/conf/*.properties /home/nacos/conf/*.example /home/nacos/conf/nacos-mysql.sql \
-    && ln -snf /usr/share/zoneinfo/$TIME_ZONE /etc/localtime && echo $TIME_ZONE > /etc/timezone
+# copy bin to workdir
+COPY --from=installer ["/home/nacos", "/home/nacos"]
 
 ADD bin/docker-startup.sh bin/docker-startup.sh
 ADD conf/application.properties conf/application.properties
 
+# add nonroot
+RUN useradd -r -u 1001 -g root nacos
+RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true
+
 # 设置启动日志目录
 RUN mkdir -p logs \
-	&& touch logs/start.out \
-	&& ln -sf /dev/stdout logs/start.out \
-	&& ln -sf /dev/stderr logs/start.out \
+    && touch logs/start.out \
+    && ln -sf /dev/stdout logs/start.out \
+    && ln -sf /dev/stderr logs/start.out \
+    && chown -R nacos:root /home/nacos \
     && chmod +x bin/docker-startup.sh
 
+USER 1001
 EXPOSE 8848
-ENTRYPOINT ["sh","bin/docker-startup.sh"]
+ENTRYPOINT ["sh","bin/docker-startup.sh"]

build/Dockerfile.Slim

@@ -1,29 +1,23 @@
-FROM amd64/buildpack-deps:buster-curl as installer
-
+FROM bitnami/minideb:bookworm AS installer
+RUN install_packages wget ca-certificates
 ARG NACOS_VERSION=2.4.3
 ARG HOT_FIX_FLAG=""
 
 RUN set -x \
-    && curl -SL --output /var/tmp/nacos-server.tar.gz https://github.com/alibaba/nacos/releases/download/${NACOS_VERSION}${HOT_FIX_FLAG}/nacos-server-${NACOS_VERSION}.tar.gz \
+    && wget -O /var/tmp/nacos-server.tar.gz https://github.com/alibaba/nacos/releases/download/${NACOS_VERSION}${HOT_FIX_FLAG}/nacos-server-${NACOS_VERSION}.tar.gz \
     && tar -xzvf /var/tmp/nacos-server.tar.gz -C /home \
     && rm -rf /var/tmp/nacos-server.tar.gz /home/nacos/bin/* /home/nacos/conf/*.properties /home/nacos/conf/*.example /home/nacos/conf/nacos-mysql.sql
 
-FROM adoptopenjdk/openjdk8:jre8u372-b07
+FROM bitnami/java:1.8-debian-12
 
-# set environment
+# set env
 ENV MODE="cluster" \
     PREFER_HOST_MODE="ip"\
     BASE_DIR="/home/nacos" \
     CLASSPATH=".:/home/nacos/conf:$CLASSPATH" \
     CLUSTER_CONF="/home/nacos/conf/cluster.conf" \
     FUNCTION_MODE="all" \
     NACOS_USER="nacos" \
-    JAVA="/opt/java/openjdk/bin/java" \
-    JVM_XMS="1g" \
-    JVM_XMX="1g" \
-    JVM_XMN="512m" \
-    JVM_MS="128m" \
-    JVM_MMS="320m" \
     NACOS_DEBUG="n" \
     TOMCAT_ACCESSLOG_ENABLED="false" \
     TZ="Asia/Shanghai"
@@ -36,13 +30,18 @@ COPY --from=installer ["/home/nacos", "/home/nacos"]
 ADD bin/docker-startup.sh bin/docker-startup.sh
 ADD conf/application.properties conf/application.properties
 
+# add user
+RUN useradd -r -u 1001 -g root nacos
+RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true
+
 # set startup log dir
 RUN mkdir -p logs \
     && cd logs \
     && touch start.out \
     && ln -sf /dev/stdout start.out \
-    && ln -sf /dev/stderr start.out
-RUN chmod +x bin/docker-startup.sh
+    && ln -sf /dev/stderr start.out \
+    && chown -R nacos:root /home/nacos
 
+USER 1001
 EXPOSE 8848
 ENTRYPOINT ["bin/docker-startup.sh"]

build/bin/docker-startup.sh

@@ -47,13 +47,13 @@ XX_MMS=$(join_if_exist "-XX:MaxMetaspaceSize=" ${JVM_MMS})
 
 JAVA_OPT="${JAVA_OPT} -XX:+UseConcMarkSweepGC -XX:+UseCMSCompactAtFullCollection -XX:CMSInitiatingOccupancyFraction=70 -XX:+CMSParallelRemarkEnabled -XX:SoftRefLRUPolicyMSPerMB=0 -XX:+CMSClassUnloadingEnabled -XX:SurvivorRatio=8 "
 if [[ "${MODE}" == "standalone" ]]; then
-  JAVA_OPT="${JAVA_OPT} $Xms $Xmx $Xmn"
+  JAVA_OPT="${JAVA_OPT} -server -XX:+UseContainerSupport -XX:MaxMetaspaceSize=256m -XX:InitiatingHeapOccupancyPercent=45 -XX:MaxGCPauseMillis=200 -XX:+UseG1GC -XX:NewRatio=2 -XX:MaxRAMPercentage=70.0 -Xss512k"
   JAVA_OPT="${JAVA_OPT} -Dnacos.standalone=true"
 else
   if [[ "${EMBEDDED_STORAGE}" == "embedded" ]]; then
     JAVA_OPT="${JAVA_OPT} -DembeddedStorage=true"
   fi
-  JAVA_OPT="${JAVA_OPT} -server $Xms $Xmx $Xmn $XX_MS $XX_MMS"
+  JAVA_OPT="${JAVA_OPT} -server -XX:+UseContainerSupport -XX:MaxMetaspaceSize=256m -XX:InitiatingHeapOccupancyPercent=45 -XX:MaxGCPauseMillis=200 -XX:+UseG1GC -XX:NewRatio=2 -XX:MaxRAMPercentage=70.0 -Xss512k -XX:MetaspaceSize=128m"
   if [[ "${NACOS_DEBUG}" == "y" ]]; then
     JAVA_OPT="${JAVA_OPT} -Xdebug -Xrunjdwp:transport=dt_socket,address=9555,server=y,suspend=n"
   fi