🐳 容器化：Docker / Compose / Kubernetes

为什么需要容器

容器解决的核心问题：环境一致性。开发、测试、生产环境完全相同，消除了"在我电脑上能跑"的困境。

Docker 深入

Docker 是容器的事实标准。从 2013 年发布至今，几乎改变了软件交付方式。

来源：github.com/moby/moby（Docker Engine 开源上游，2026-05）。Docker Engine 从 v29 起模块路径迁移至 github.com/moby/moby/v2。

Docker 核心概念

# 查看本地镜像
docker images

# 拉取镜像
docker pull node:22-alpine

# 构建镜像
docker build -t myapp:latest .

# 运行容器
docker run -d -p 3000:3000 --name app myapp:latest

# 查看运行中容器
docker ps

# 进入容器
docker exec -it app sh

# 创建自定义网络
docker network create mynet

# 容器加入网络
docker run --network mynet --name api myapi
docker run --network mynet --name db postgres

# api 容器内可通过 db:5432 访问数据库

# 创建数据卷
docker volume create pgdata

# 挂载到容器
docker run -v pgdata:/var/lib/postgresql/data postgres

# 绑定挂载（开发用）
docker run -v ./src:/app/src myapp

Dockerfile 最佳实践

1. Next.js SaaS 的生产级 Dockerfile

# ---- 多阶段构建 ----

# Stage 1: 依赖安装
FROM node:22-alpine AS deps
RUN corepack enable pnpm
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile --prod=false

# Stage 2: 构建
FROM node:22-alpine AS builder
RUN corepack enable pnpm
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
ENV NEXT_TELEMETRY_DISABLED=1
RUN pnpm build

# Stage 3: 生产运行
FROM node:22-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1

RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs

COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static

USER nextjs
EXPOSE 3000
ENV PORT=3000
ENV HOSTNAME="0.0.0.0"

CMD ["node", "server.js"]

2. FastAPI 后端 Dockerfile

FROM python:3.12-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

FROM python:3.12-slim
WORKDIR /app
COPY --from=builder /root/.local /root/.local
COPY . .
ENV PATH=/root/.local/bin:$PATH
EXPOSE 8000
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

Dockerfile 优化技巧

# Dockerfile 中使用缓存挂载
RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
    pnpm install --frozen-lockfile

# 多平台构建缓存
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    apt-get update && apt-get install -y ...

Docker Compose：多容器编排

Docker Compose 用一个 YAML 文件定义和运行多容器应用。开发环境利器。

来源：github.com/docker/compose（2026-05）。Compose v5 基于 Go 重写，v1 (Python) 已停止维护。

SaaS 全栈开发环境示例

# compose.yaml
services:
  # Next.js 前端
  web:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "3000:3000"
    environment:
      - DATABASE_URL=postgresql://postgres:postgres@db:5432/myapp
      - REDIS_URL=redis://redis:6379
      - NEXTAUTH_SECRET=dev-secret
    volumes:
      - ./src:/app/src        # 热重载
      - ./public:/app/public
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    command: pnpm dev

  # PostgreSQL
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: myapp
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5

  # Redis
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redisdata:/data

  # MinIO (S3 兼容存储)
  minio:
    image: minio/minio
    ports:
      - "9000:9000"
      - "9001:9001"  # 管理面板
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    volumes:
      - miniodata:/data
    command: server /data --console-address ":9001"

  # Meilisearch (搜索)
  search:
    image: getmeili/meilisearch:v1.8
    ports:
      - "7700:7700"
    environment:
      MEILI_MASTER_KEY: dev-master-key
    volumes:
      - searchdata:/meili_data

volumes:
  pgdata:
  redisdata:
  miniodata:
  searchdata:

Compose 常用命令

多平台构建

当你的用户使用 ARM（M1/M2 Mac、ARM 服务器）和 x86 时，需要构建多平台镜像。

来源：Docker Docs - Multi-platform builds（docs.docker.com，2026-05）。Docker Engine 29+ 默认使用 containerd image store，原生支持多平台。

# 创建多平台 builder
docker buildx create --name multiplatform --use

# 同时构建 amd64 和 arm64 并推送
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t ghcr.io/myapp:latest \
  --push .

# 使用交叉编译（推荐，比 QEMU 快）
# Dockerfile 中：
FROM --platform=$BUILDPLATFORM node:22-alpine AS builder
ARG TARGETPLATFORM
ARG TARGETARCH
RUN echo "Building for $TARGETARCH"
# 用交叉编译工具链代替 QEMU 模拟

Kubernetes：生产级容器编排

Kubernetes (K8s) 是 Google 基于 Borg 系统经验开源的容器编排平台，由 CNCF 托管。当你的 SaaS 需要高可用、自动扩缩、滚动部署时，K8s 是终极选择。

来源：github.com/kubernetes/kubernetes（2026-05）、kubernetes.io（2026-05）

K8s 架构总览

核心资源对象

apiVersion: v1
kind: Pod
metadata:
  name: api
spec:
  containers:
    - name: api
      image: myapp:latest
      ports:
        - containerPort: 3000
      resources:
        requests:
          memory: "256Mi"
          cpu: "250m"
        limits:
          memory: "512Mi"
          cpu: "500m"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
        - name: api
          image: myapp:latest
          ports:
            - containerPort: 3000
          readinessProbe:
            httpGet:
              path: /health
              port: 3000

apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  selector:
    app: api
  ports:
    - port: 80
      targetPort: 3000
  type: ClusterIP

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
spec:
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api
                port:
                  number: 80

K8s 自动扩缩 (HPA)

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

托管 K8s 对比

除非你有专职运维团队，否则<强>强烈推荐托管 K8s——云厂商负责控制面维护、升级、安全补丁。

来源：各云厂商官方定价页（2026-05），价格可能随时调整

Docker 替代方案

# Buildah 构建
buildah bud -t myapp:latest .

# Skopeo 复制镜像
skopeo copy docker://docker.io/library/nginx:alpine \
  docker://ghcr.io/myorg/nginx:alpine

容器化开发环境

Dev Containers (VS Code)

// .devcontainer/devcontainer.json
{
  "name": "SaaS Dev",
  "dockerComposeFile": ["../compose.yaml"],
  "service": "web",
  "workspaceFolder": "/app",
  "features": {
    "ghcr.io/devcontainers/features/node:1": { "version": "22" },
    "ghcr.io/devcontainers/features/github-cli:1": {}
  },
  "postCreateCommand": "pnpm install",
  "forwardPorts": [3000, 5432, 6379],
  "customizations": {
    "vscode": {
      "extensions": [
        "dbaeumer.vscode-eslint",
        "bradlc.vscode-tailwindcss",
        "prisma.prisma"
      ]
    }
  }
}

其他开发环境方案

容器安全

# K8s SecurityContext 示例
securityContext:
  runAsNonRoot: true
  runAsUser: 1001
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]

选型决策树

🔗 相关内容