Docker Minimus migration mus rau Docker Hardened Images

Yog tias koj lub kaw lus tseem tab tom khiav image los ntawm Minimus, cia li pib Docker Minimus migration tam sim no, tsis txhob tos kom ze rau hnub kawg. Docker tau qhia tias Minimus registry yuav tsum tso tseg kev ua haujlwm rau hnub 22 lub Kaum Hli 2026; tom qab lub sijhawm ntawd, cov image uas twb rub los lawm tseem yuav khiav tau, tabsis yuav tsis tau txais kev hloov tshiab ntxiv lawm, ua rau qhov tsis muaj kev ruaj ntseg tshiab tsis tau txais kev kho (raws li Docker).

Txoj kev hloov uas yuav cuam tshuam tsawg tshaj yog hloov mus rau Docker Hardened Images (DHI) uas sib haum, ces rov txheeb xyuas kev nkag mus, tus neeg siv uas khiav container, service ports, entrypoint, CI/CD pipeline thiab cov txiaj ntsig ntawm vulnerability scan. Rau ntau daim ntawv thov, qhov kev hloov thawj zaug tsuas yog nyob hauv kab FROMxwb, tabsis tsis tsim nyog muab xam tias yog kev hloov ncaj qha yam tsis tau tshuaj xyuas.

Vim li cas yuav tsum daws Minimus registry end of life kom ntxov?

Kev tso tseg muab image hauv registry tsis txhais hais tias cov container uas tab tom khiav yuav tsum nres tam sim ntawd. Qhov kev pheej hmoo loj dua yog qhov kev tso tawm thiab kev ruaj ntseg yuav raug cuam tshuam: cov server tshiab rub tsis tau image, pipeline tsim tsis tau release, hos cov image qub tseem yuav sau CVE ntau ntxiv raws sijhawm.

Thaum lub sijhawm hloov, Minimus tseem yuav tau txais kev hloov tshiab raws li Docker daim ntawv tshaj tawm mus txog hnub 22/10/2026. Qhov no tsim ib lub sijhawm tsim nyog rau kev txheeb xyuas, sim thiab tso tawm ua pab pawg raws li cov service, tsis yog hloov ib zaug rau tag nrho lub kaw lus.

Docker piav qhia Docker Hardened Images tias yog cov image uas me, tau ntxiv dag zog thiab raug saib xyuas txuas ntxiv. DHI muaj platform Alpine thiab Debian, nrog rau cov variant siv rau build thiab runtime. DHI Community muab cov npe image qhib siv raws li Apache 2.0 license; cov pob them nyiaj ntxiv SLA rau kev daws CVE, variant FIPS/STIG, kev kho raws xav tau thiab kev txhawb nqa lub neej ncua (raws li Docker Documentation).

Tsis tsim nyog xav tias DHI yog Minimus daim qauv luam kiag. Lub npe tag, registry path, entrypoint, default user thiab cov cuab yeej uas muaj yuav txawv. Lub hom phiaj ntawm txoj kev npaj no yog khaws cia tus cwj pwm ntawm daim ntawv thov, đồng thời txhim kho qhov muaj peev xwm txheeb xyuas qhov chaw tuaj thiab txheej txheem kho qhov tsis muaj kev ruaj ntseg.

Txheeb xyuas Docker image ua ntej hloov chaw

Thawj kauj ruam ntawm kev hloov container image yog tsim ib daim ntawv teev kom tiav, suav nrog cov image uas raug xa mus siv ncaj qha lossis tsis ncaj qha hauv Dockerfile, Docker Compose, Helm chart, Kubernetes manifest, CI/CD pipeline thiab deployment script.

Cov ntaub ntawv yuav tsum sau tseg

Lub npe image, registry, repository thiab tag lossis digest uas tab tom siv.
Cov service uas siv image: production, staging, development lossis cov cuab yeej sab hauv.
Lub platform hauv paus: Alpine, Debian, Ubuntu, Wolfi lossis image uas tau kho raws xav tau.
Architecture uas yuav tsum txhawb: linux/amd64, linux/arm64 lossis ntau architecture.
Cov lus txib RUN, apt, apk, bash, curl thiab cov cuab yeej debug uas vam khom rau.
Tus user, group, listening port, volume, environment variables thiab entrypoint uas siv tam sim no.
Tus tswv service, qib tseem ceeb, maintenance window thiab txoj kev rollback.

Koj tuaj yeem pib los ntawm kev nrhiav cov kev xa mus rau image hauv source code:

grep -RInE '(^|[[:space:]])(FROM|image:)[[:space:]]' 
  Dockerfile* docker-compose*.yml .github/ helm/ k8s/ 2>/dev/null

Tom qab ntawd, siv Docker los sau tseg qhov configuration ntawm image uas tab tom khiav:

docker ps --format '{{.Image}} {{.Names}}'
docker image ls
docker image inspect <image:tag>

Cov txiaj ntsig ntawm kev txheeb xyuas yuav tsum muab tso rau hauv ib daim tracking table uas muaj cov kem: Minimus image, DHI image uas xav siv, tag/digest, service, owner, xwm txheej kev sim, hnub tso tawm thiab txoj kev rov qab. Qhov no yog ntu tseem ceeb tshaj plaws los tiv thaiv kom tsis txhob hnov qab worker, cronjob lossis image uas tsuas raug hu hauv ib lub pipeline uas tsis tshua khiav.

Yog tias lub kaw lus tab tom khiav ntawm lub server ntiag tug lossis VPS, koj kuj yuav tsum sau tseg seb registry raug tso cai hla firewall, proxy thiab secret li cas. Saib ntxiv phau ntawv qhia xaiv VPS yog tias koj qhov chaw deploy vam khom rau ib lub server uas koj tus kheej tswj.

Txheej txheem hloov mus rau Docker Hardened Images

1. Xaiv DHI image hauv tib ecosystem

Ua ntej xaiv DHI image uas yog tib hom operating system nrog image tam sim no. Yog Minimus image yog Alpine, xaiv Alpine variant; yog yog Debian, xaiv Debian variant. Txoj kev no txo qhov pheej hmoo ntawm qhov txawv ntawm library, package manager thiab runtime tus cwj pwm.

Nkag mus rau registry ua ntej sim rub image:

docker login dhi.io
docker pull dhi.io/<repository>:<tag>

Lub npe repository thiab tag tshwj xeeb yuav tsum nrhiav hauv DHI catalog; tsis tsim nyog kwv yees raws li Minimus image lub npe. Rau cov image uas yuav tsum nruab dependency, xaiv variant uas muaj tag dev lossis sdk rau build stage; runtime image feem ntau tsis muaj package manager lossis shell (raws li DHI Migration Checklist).

2. Kho Dockerfile raws li tus qauv build thiab runtime

Piv txwv yooj yim thaum image tam sim no hloov tau ncaj qha:

# Trước
FROM minimus/base-image:1.2

# Sau, cần thay bằng repository/tag DHI đã xác minh
FROM dhi.io/<dhi-image>:<tag>

Rau daim ntawv thov uas yuav tsum compile lossis nruab package, siv multi-stage build:

FROM dhi.io/<runtime>:dev AS build
WORKDIR /src
COPY . .
RUN <lệnh cài dependency và build>

FROM dhi.io/<runtime>:latest
WORKDIR /app
COPY --from=build /src/<artifact> /app/<artifact>
USER 65532
EXPOSE 8080
ENTRYPOINT ["/&app/<artifact>"]

DHI runtime yeej khiav ua non-root raws lub neej ntawd, siv UID 65532. Yog li, txhua daim nplaub tshev uas yuav tsum sau tau yuav tsum tsim thiab teeb cai kom tsim nyog hauv build stage lossis thaum pib volume. Lub application kuj yuav tsum tsis mloog cov chaw nres nkoj muaj cai qis dua 1024; hloov mus siv chaw nres nkoj txij 1025 saud, xws li 8080.

DHI twb muaj cov TLS certificates uas yog tus qauv lawm, yog li ntau lub Dockerfile tsis tas yuav nruab ntxiv ca-certificates. Txawm li cas los, cov certificates sab hauv ntawm lub tuam txhab tseem yuav tsum ntxiv raws li tus txheej txheem cais. Runtime image kuj yuav tsis muaj shell, yog li cov lus txib rau kuaj lossis kho nrog /bin/sh yuav tsum hloov mus ua hauv build stage lossis ua los ntawm sab nraud container (raws li Docker Documentation).

Kuaj, deploy thiab rollback kom nyab xeeb

Tsis tsim nyog ntsuas migration tsuas yog saib seb image puas rub tau tiav. Ib image tshiab thiaj tsim nyog thaum application pib tau raug, tuav tau request, sau log tau li ib txwm, txuas tau rau dependency thiab ua tau raws li cov kev tswj kev ruaj ntseg uas tau teeb tseg.

Cov kev kuaj yam tsawg kawg

Kuaj build: tsim image txij thaum pib hauv ib puag ncig huv, tsis siv layer cache ntawm Minimus image.
Kuaj runtime: khiav container nrog user, volume, environment variables thiab resource limits uas zoo ib yam li hauv production.
Kuaj functionality: hu healthcheck, API tseem ceeb, background job, kev txuas rau database thiab queue system.
Kuaj kev ruaj ntseg: scan image nrog cov cuab yeej uas tab tom siv, thiab kuaj SBOM, signature, provenance thiab digest.
Kuaj deployment: sim pipeline, registry mirror, secret thiab cai pull ntawm Kubernetes lossis lub host uas yuav siv.
Kuaj rollback: khaws Minimus image digest uas twb tau kuaj lawm rau lub sijhawm hloov pauv, tab sis tsis txhob suav tias yog txoj kev ruaj ntseg mus ntev.

Deploy ua pab me me: ib puag ncig development, staging, ib service uas pheej hmoo tsawg, ces mam mus rau production tseem ceeb. Saib xyuas error rate, sijhawm pib, kev siv CPU/RAM, log thiab ceeb toom tsawg kawg ib release cycle ua ntej nthuav dav.

Yog siv Kubernetes, yuav tsum tsim lossis hloov image pull secret rau DHI registry. Docker ceeb toom tias yuav tsum muaj authentication thaum rub image los ntawm dhi.io, Docker Hub mirror lossis registry thib peb (raws li Use a Docker Hardened Image).

Hais txog kev ruaj ntseg ntawm supply chain, qhov migration no tsim nyog txuas nrog txoj cai tso cai rau image uas muaj digest xwb, kom yuav tsum scan ua ntej release thiab txwv cov registry uas raug tso cai nkag. Koj kuj saib tau tsab xov xwm hais txog kev tiv thaiv supply chain kom nthuav kev tswj txij ntawm image mus txog host.

Teeb meem uas nquag ntsib

Build ua tsis tiav vim tsis muaj shell lossis package manager: hloov cov lus txib nruab mus rau image dev/sdk thiab siv multi-stage build.
Application sau file tsis tau: kuaj daim nplaub tshev cov cai nrog UID 65532, volume thiab temporary directory.
Container pib ces tawm: piv ENTRYPOINT, CMD thiab environment variables nrog cov uas nyob hauv image qub.
Healthcheck yuam kev vim chaw nres nkoj hloov: kuaj seb application puas bind rau chaw nres nkoj txij 1025 saud thiab seb manifest puas taw rau chaw nres nkoj raug.
Pipeline rub image tsis tau: hloov secret, registry permissions, firewall allowlist thiab credential helper.
Scanner qhia tau txiaj ntsig txawv yav dhau los: txheeb xyuas seb scanner nyeem CVE, SBOM thiab VEX li cas; tsis txhob piv tsuas yog siv ib tus lej tag nrho.

Checklist ua tiav yuav tsum muaj: txhua qhov kev hais txog Minimus tau sau tseg; txhua image muaj DHI image hloov chaw; Dockerfile build tiav; functional tests dhau; tau txheeb xyuas cai non-root; registry credentials ua haujlwm; tau sau tseg digest; tau pom zoo rollback plan; thiab tom qab hnub 22/10/2026 tsis tshuav pipeline production twg uas vam khom Minimus.

Xaus: Minimus registry end of life yog ib qho kev hloov hauv infrastructure uas yuav tsum daws zoo li ib txoj haujlwm tswj hwm supply chain, tsis yog tsuas kho ib kab hauv Dockerfile. Thawj lub lim tiam, ua Docker image inventory; lub lim tiam tom ntej, sim ib service uas pheej hmoo tsawg; ces nthuav dav raws digest tom qab kuaj tiav. DHI yuav pab txo cov kev hloov pauv hauv tshuab vim tseem khaws Alpine thiab Debian ua lub hauv paus, tab sis txoj cai non-root, runtime uas txo kom tsawg thiab registry authentication tseem xav kom koj kuaj kom muaj hom phiaj.

Docker Minimus migration: Hlo mus rau Docker Hardened Images