Docker 为所谓的缓存摘要下载更新的图像

Question

我的 Dockerfile有这第一步:

FROM python:3.6.10@sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11

目标是 to "lock" or "pin" the version of the image .

一会儿， docker build正确使用缓存版本:

Step 1/2 : FROM python:3.6.10@sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11
 ---> 114ae8bdb954

但过了一段时间，它决定“下载更新的图像”:

Step 1/2 : FROM python:3.6.10@sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11
sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11: Pulling from library/python
7e2b2a5af8f6: Pulling fs layer
09b6f03ffac4: Pulling fs layer
dc3f0c679f0f: Pulling fs layer
fd4b47407fc3: Pulling fs layer
bb7b28578995: Pulling fs layer
6ebea4a9a306: Pulling fs layer
22a2327cd1ca: Pulling fs layer
bfbf91c84bbe: Pulling fs layer
f6b29b259c5c: Pulling fs layer
09b6f03ffac4: Verifying Checksum
09b6f03ffac4: Download complete
dc3f0c679f0f: Download complete
7e2b2a5af8f6: Verifying Checksum
7e2b2a5af8f6: Download complete
6ebea4a9a306: Verifying Checksum
6ebea4a9a306: Download complete
fd4b47407fc3: Verifying Checksum
fd4b47407fc3: Download complete
bfbf91c84bbe: Verifying Checksum
bfbf91c84bbe: Download complete
f6b29b259c5c: Verifying Checksum
f6b29b259c5c: Download complete
22a2327cd1ca: Verifying Checksum
22a2327cd1ca: Download complete
bb7b28578995: Verifying Checksum
bb7b28578995: Download complete
7e2b2a5af8f6: Pull complete
09b6f03ffac4: Pull complete
dc3f0c679f0f: Pull complete
fd4b47407fc3: Pull complete
bb7b28578995: Pull complete
6ebea4a9a306: Pull complete
22a2327cd1ca: Pull complete
bfbf91c84bbe: Pull complete
f6b29b259c5c: Pull complete
Digest: sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11
Status: Downloaded newer image for python@sha256:6cd232ed00e729b4d4d3aa57c1764dddfab70f616042b7f36536e2c3d70c4c11
 ---> 114ae8bdb954

即使这一步的最终哈希是相同的:

 ---> 114ae8bdb954

据我了解，摘要( sha256:... )是不可变的。
那么它们到底是可变的吗？
还是缓存的版本以某种方式被删除了？
发生了什么事，我该如何解决？

Answer 1

鉴于并非每次运行都会发生这种情况，并且如果您在本地进行测试也可能不会发生，那么问题似乎与您的 Dockerfile 或 FROM 行无关。 Docker 不会自动清理缓存，因此您需要调查哪些外部进程正在删除缓存。由于您使用 kubernetes 插件在 Jenkins 中运行构建，因此问题似乎来自该插件在超时后清理构建代理。从文档中可以看到various settings to tune this builder :

• podRetention Controls the behavior of keeping slave pods. Can be 'never()', 'onFailure()', 'always()', or 'default()' - if empty will default to deleting the pod after activeDeadlineSeconds has passed.
• activeDeadlineSeconds If podRetention is set to 'never()' or 'onFailure()', pod is deleted after this deadline is passed.
• idleMinutes Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it.

解决临时构建代理的一种方法是使用 --cache-from docker build 中的选项命令。使用经典构建(vs buildkit)，您需要首先在本地拉取这个镜像。该图像将来自以前的构建，您可以将多个图像用于缓存，这对于多阶段构建特别有用，因为您需要为每个阶段提取缓存。此标志告诉 docker 信任从注册表中提取的镜像，因为通常只信任本地构建的镜像(有人可能会注入(inject)恶意镜像，该镜像声称已在流行镜像中运行了步骤，但在该层的 tar 中包含恶意软件) .