Dockerイメージのサイズを減らす — レイヤーの真実、multi-stage build、ベースイメージの実コスト

docker history myapp:latest

IMAGE          CREATED         CREATED BY                                       SIZE
a3f91c2e77b1   3 minutes ago   CMD ["node" "dist/server.js"]                    0B
<missing>      3 minutes ago   RUN /bin/sh -c npm run build # buildkit          48.2MB
<missing>      3 minutes ago   RUN /bin/sh -c npm install # buildkit            901MB
<missing>      4 minutes ago   COPY . . # buildkit                              286MB
<missing>      4 minutes ago   RUN /bin/sh -c apt-get update && apt-get inst…   412MB
<missing>      2 weeks ago     /bin/sh -c #(nop)  CMD ["node"]                  0B
<missing>      2 weeks ago     /bin/sh -c #(nop) COPY file:4d192565a7220e13…    388B
<missing>      2 weeks ago     /bin/sh -c set -ex && for key in 4ED778F539E…    5.3MB
<missing>      2 weeks ago     /bin/sh -c #(nop)  ENV NODE_VERSION=22.14.0      0B
<missing>      2 weeks ago     /bin/sh -c #(nop) ADD file:07cf5b0f8bd1d5d5…     74.8MB

dive myapp:latest --ci --lowestEfficiency=0.95

  Analyzing image
  efficiency: 71.8443 %
  wastedBytes: 407583744 bytes (408 MB)
  userWastedPercent: 21.4127 %

Filename                                        Total Space
/root/.npm/_cacache                                  214 MB
/var/lib/apt/lists                                    48 MB
/app/.git                                             61 MB
/usr/share/doc                                        23 MB
/tmp/build-deps                                       62 MB

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y build-essential
RUN make -C /src all
RUN apt-get purge -y build-essential && apt-get autoremove -y
RUN rm -rf /var/lib/apt/lists/*

docker build -t bad-cleanup . && docker history bad-cleanup --format '{{.Size}}\t{{.CreatedBy}}'

0B      RUN /bin/sh -c rm -rf /var/lib/apt/lists/* # buildkit
2.1MB   RUN /bin/sh -c apt-get purge -y build-essential && apt-get autoremove -y # buildkit
18.4MB  RUN /bin/sh -c make -C /src all # buildkit
396MB   RUN /bin/sh -c apt-get update && apt-get install -y build-essential # buildkit
74.8MB  /bin/sh -c #(nop) ADD file:...

FROM debian:bookworm-slim

RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential \
 && make -C /src all \
 && apt-get purge -y --auto-remove build-essential \
 && rm -rf /var/lib/apt/lists/*

# Debian / Ubuntu
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl \
 && rm -rf /var/lib/apt/lists/*

# Alpine
RUN apk add --no-cache ca-certificates curl

# Python
RUN pip install --no-cache-dir -r requirements.txt

# Node
RUN npm ci --omit=dev && npm cache clean --force

# アンチパターン: マルチステージを使いながら丸ごとコピー
FROM node:22 AS builder
WORKDIR /app
COPY . .
RUN npm install && npm run build

FROM node:22-slim
WORKDIR /app
COPY --from=builder /app /app
CMD ["node", "dist/server.js"]

# syntax=docker/dockerfile:1.7
FROM node:22-bookworm-slim AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci

FROM node:22-bookworm-slim AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build

FROM node:22-bookworm-slim AS prod-deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev && npm cache clean --force

FROM gcr.io/distroless/nodejs22-debian12:nonroot
WORKDIR /app
COPY --from=prod-deps /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
COPY package.json ./
USER nonroot
CMD ["dist/server.js"]

FROM golang:1.23-bookworm AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/api ./cmd/api

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /out/api /api
USER nonroot
ENTRYPOINT ["/api"]

docker images --format '{{.Repository}}:{{.Tag}}\t{{.Size}}' | head -3

api:distroless      14.8MB
api:naive-golang    1.24GB
node-app:optimized  198MB

FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
COPY --from=builder /out/api /api
ENTRYPOINT ["/api"]

# python:3.12-slim
$ time pip install pandas==2.2.3
Downloading pandas-2.2.3-cp312-cp312-manylinux_2_17_x86_64.whl (12.7 MB)
Successfully installed pandas-2.2.3
real    0m9.412s

# python:3.12-alpine
$ time pip install pandas==2.2.3
Downloading pandas-2.2.3.tar.gz (4.4 MB)
  Building wheel for pandas (pyproject.toml) ... done
Successfully installed pandas-2.2.3
real    11m38.204s

kubectl debug -it api-7d9f8c6b4-x2ktl \
  --image=busybox:1.36 --target=api --share-processes

docker build -t myapp .

[+] Building 41.6s (12/12) FINISHED
 => [internal] load build context                                        18.3s
 => => transferring context: 612.44MB                                    18.1s

.git
.gitignore
node_modules
dist
coverage
**/*.log
.env
.env.*
Dockerfile
docker-compose*.yml
README.md

[+] Building 21.9s (12/12) FINISHED
 => [internal] load build context                                         0.4s
 => => transferring context: 3.71MB                                       0.3s

docker pull registry.example.com/api:v312

v312: Pulling from api
9c704ecd0c69: Already exists
2f8a1e3b7d44: Already exists
b17d2a9e4c31: Already exists
7e2c9f04a8b6: Pull complete
d3a91b2e5f77: Pull complete
Digest: sha256:4f9a...
Status: Downloaded newer image for registry.example.com/api:v312

FROM python:3.12-slim

# 1. ほとんど変わらない: システムパッケージ
RUN apt-get update \
 && apt-get install -y --no-install-recommends libpq5 \
 && rm -rf /var/lib/apt/lists/*

# 2. たまに変わる: 依存関係のリスト
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# 3. コミットのたびに変わる: ソース
COPY src/ ./src/

CMD ["python", "-m", "src.main"]

# 圧縮サイズはマニフェストで確認
crane manifest registry.example.com/api:v312 \
  | jq '[.layers[].size] | add / 1048576 | round'

71

# コールドキャッシュでのpull時間を計測
docker image rm registry.example.com/api:v312 >/dev/null
time docker pull registry.example.com/api:v312

real    0m6.284s