python - 密码学 Python Docker 多阶段构建

Question

我有一个在 docker 容器中运行的 Python 项目，我正在尝试转换为多阶段 docker 构建过程。我的项目依赖于cryptography包裹。我的 Dockerfile 包含:

# Base                                                                          
FROM python:3.6 AS base                                                         

RUN pip install cryptography                                                    

# Production                                                                    
FROM python:3.6-alpine                                                          

COPY --from=base /root/.cache /root/.cache                                      

RUN pip install cryptography \                                                  
        && rm -rf /root/.cache                                                  

CMD python

我尝试使用以下方式构建:

docker build -t my-python-app .

此过程适用于我测试过的许多其他 Python 要求，例如 pycrypto 和 psutil，但针对 cryptography 抛出以下错误>:

Step 5/6 : RUN pip install cryptography         && rm -rf /root/.cache
 ---> Running in ebc15bd61d43
Collecting cryptography
  Downloading cryptography-2.1.4.tar.gz (441kB)
Collecting idna>=2.1 (from cryptography)
  Using cached idna-2.6-py2.py3-none-any.whl
Collecting asn1crypto>=0.21.0 (from cryptography)
  Using cached asn1crypto-0.24.0-py2.py3-none-any.whl
Collecting six>=1.4.1 (from cryptography)
  Using cached six-1.11.0-py2.py3-none-any.whl
Collecting cffi>=1.7 (from cryptography)
  Downloading cffi-1.11.5.tar.gz (438kB)
    Complete output from command python setup.py egg_info:

        No working compiler found, or bogus compiler options passed to
        the compiler from Python's standard "distutils" module.  See
        the error messages above.  Likely, the problem is not related
        to CFFI but generic to the setup.py of any Python package that
        tries to compile C code.  (Hints: on OS/X 10.8, for errors about
        -mno-fused-madd see http://stackoverflow.com/questions/22313407/
        Otherwise, see https://wiki.python.org/moin/CompLangPython or
        the IRC channel #python on irc.freenode.net.)

    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-uyh9_v63/cffi/

显然我希望不必在我的生产镜像上安装任何编译器。我是否需要复制 /root/.cache 以外的其他目录？

Answer 1

Alpine没有manylinux的wheel，所以需要自己编译。下面是从安装文档中粘贴的。在同一命令中安装和删除构建依赖项，仅将包保存到 docker 镜像层。

If you are on Alpine or just want to compile it yourself then cryptography requires a compiler, headers for Python (if you’re not using pypy), and headers for the OpenSSL and libffi libraries available on your system.

Alpine Replace python3-dev with python-dev if you’re using Python 2.

$ sudo apk add gcc musl-dev python3-dev libffi-dev openssl-dev

If you get an error with openssl-dev you may have to use libressl-dev.

Docs can be found here