无法直接build立openjdk：8-jdk图像
我正在慢慢地通过你的Docker镜像的控制权进行控制http://engineering.riotgames.com/news/taking-control-your-docker-image 。 本教程有点旧，所以对最终文件的外观有一些明确的改变。 打了几面墙后，我决定按照教程的相反顺序工作。 我成功地将官方jenkinsci图像折叠到我的个人Dockerfile中，从FROM：openjdk：8-dk开始。 但是当我尝试在openjdk：8-dk文件中放入我的个人映像时，我收到以下错误消息
E：找不到'openjdk-8-jdk'版本'8u102-b14.1-1〜bpo8 + 1'错误：服务'jenkinsmaster'无法build立：命令'/ bin / sh -c set -x && apt-get update && apt-get install -y openjdk-8-jdk =“$ JAVA_DEBIAN_VERSION”ca-certificates-java =“$ CA_CERTIFICATES_JAVA_VERSION”&& rm -rf / var / lib / apt / lists / * && [“$ JAVA_HOME “=”$（docker-java-home）“]'返回一个非零的代码：100 Cosettes-MacBook-Pro：docker-test Cosette $
即使当我放弃并直接复制并粘贴openjdk：8-jdk Dockerfile到我自己的时候，我也收到了这个错误。 我的最终目标是把我的个人Dockerfile放到从debian-jessie开始的地步。 任何帮助，将不胜感激。
我的Dockerfile：
FROM buildpack-deps:jessie-scm # A few problems with compiling Java from source: # 1. Oracle. Licensing prevents us from redistributing the official JDK. # 2. Compiling OpenJDK also requires the JDK to be installed, and it gets # really hairy. RUN apt-get update && apt-get install -y --no-install-recommends \ bzip2 \ unzip \ xz-utils \ && rm -rf /var/lib/apt/lists/* RUN echo 'deb http://deb.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list # Default to UTF-8 file.encoding ENV LANG C.UTF-8 # add a simple script that can auto-detect the appropriate JAVA_HOME value # based on whether the JDK or only the JRE is installed RUN { \ echo '#!/bin/sh'; \ echo 'set -e'; \ echo; \ echo 'dirname "$(dirname "$(readlink -f "$(which javac || which java)")")"'; \ } > /usr/local/bin/docker-java-home \ && chmod +x /usr/local/bin/docker-java-home ENV JAVA_HOME /usr/lib/jvm/java-8-openjdk-amd64 ENV JAVA_VERSION 8u102 ENV JAVA_DEBIAN_VERSION 8u102-b14.1-1~bpo8+1 # see https://bugs.debian.org/775775 # and https://github.com/docker-library/java/issues/19#issuecomment-70546872 ENV CA_CERTIFICATES_JAVA_VERSION 20140324 RUN set -x \ && apt-get update \ && apt-get install -y \ openjdk-8-jdk="$JAVA_DEBIAN_VERSION" \ ca-certificates-java="$CA_CERTIFICATES_JAVA_VERSION" \ && rm -rf /var/lib/apt/lists/* \ && [ "$JAVA_HOME" = "$(docker-java-home)" ] # see CA_CERTIFICATES_JAVA_VERSION notes above RUN /var/lib/dpkg/info/ca-certificates-java.postinst configure # Jenkins Specifics # install Tini ENV TINI_VERSION 0.9.0 ENV TINI_SHA fa23d1e20732501c3bb8eeeca423c89ac80ed452 # Use tini as subreaper in Docker container to adopt zombie processes RUN curl -fsSL https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static -o /bin/tini && chmod +x /bin/tini \ && echo "$TINI_SHA /bin/tini" | sha1sum -c - # Set Jenkins Environmental Variables ENV JENKINS_HOME /var/jenkins_home ENV JENKINS_SLAVE_AGENT_PORT 50000 # jenkins version being bundled in this docker image ARG JENKINS_VERSION ENV JENKINS_VERSION ${JENKINS_VERSION:-2.19.1} # jenkins.war checksum, download will be validated using it ARG JENKINS_SHA=dc28b91e553c1cd42cc30bd75d0f651671e6de0b ENV JENKINS_UC https://updates.jenkins.io ENV COPY_REFERENCE_FILE_LOG $JENKINS_HOME/copy_reference_file.log ENV JAVA_OPTS="-Xmx8192m" ENV JENKINS_OPTS="--handlerCountMax=300 --logfile=/var/log/jenkins/jenkins.log --webroot=/var/cache/jenkins/war" # Can be used to customize where jenkins.war get downloaded from ARG JENKINS_URL=http://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war ARG user=jenkins ARG group=jenkins ARG uid=1000 ARG gid=1000 # Jenkins is run with user `jenkins`, uid = 1000. If you bind mount a volume from the host or a data # container, ensure you use the same uid. RUN groupadd -g ${gid} ${group} \ && useradd -d "$JENKINS_HOME" -u ${uid} -g ${gid} -m -s /bin/bash ${user} # Jenkins home directory is a volume, so configuration and build history # can be persisted and survive image upgrades VOLUME /var/jenkins_home # `/usr/share/jenkins/ref/` contains all reference configuration we want # to set on a fresh new installation. Use it to bundle additional plugins # or config file with your custom jenkins Docker image. RUN mkdir -p /usr/share/jenkins/ref/init.groovy.d # Install Jenkins. Could use ADD but this one does not check Last-Modified header neither does it # allow to control checksum. see https://github.com/docker/docker/issues/8331 RUN curl -fsSL ${JENKINS_URL} -o /usr/share/jenkins/jenkins.war \ && echo "${JENKINS_SHA} /usr/share/jenkins/jenkins.war" | sha1sum -c - # Prep Jenkins Directories USER root RUN chown -R ${user} "$JENKINS_HOME" /usr/share/jenkins/ref RUN mkdir /var/log/jenkins RUN mkdir /var/cache/jenkins RUN chown -R ${group}:${user} /var/log/jenkins RUN chown -R ${group}:${user} /var/cache/jenkins # Expose ports for web (8080) & node (50000) agents EXPOSE 8080 EXPOSE 50000 # Copy in local config filesfiles COPY init.groovy /usr/share/jenkins/ref/init.groovy.d/tcp-slave-agent-port.groovy COPY jenkins-support /usr/local/bin/jenkins-support COPY jenkins.sh /usr/local/bin/jenkins.sh # NOTE : Just set pluginID to download latest version of plugin. # NOTE : All plugins need to be listed as there is no transitive dependency resolution. # from a derived Dockerfile, can use `RUN plugins.sh active.txt` to setup # /usr/share/jenkins/ref/plugins from a support bundle COPY plugins.sh /usr/local/bin/plugins.sh RUN chmod +x /usr/local/bin/plugins.sh RUN chmod +x /usr/local/bin/jenkins.sh # Switch to the jenkins user USER ${user} # Tini as the entry point to manage zombie processes ENTRYPOINT ["/bin/tini", "--", "/usr/local/bin/jenkins.sh"] 试试8u111-b14-2~bpo8+1
以下是发生的事情：当您构builddocker文件时，docker会尝试执行dockerfile中的所有行。 其中之一是这个apt命令： apt-get install -y openjdk-8-jdk="$JAVA_DEBIAN_VERSION" 。 这个命令说：“安装OpenJDK版本$ JAVA_DEBIAN_VERSION，完全没有别的。” 这个版本已经不在Debian仓库中了，所以它不能被apt-get安装！ 我相信这种情况发生在官方镜像中的所有软件包中：如果发布新版本的软件包，旧版本将不再被安装。
如果你想访问旧的Debian软件包，你可以使用像http://snapshot.debian.org/ 。 较旧的OpenJDK包有已知的安全漏洞 。 我build议使用最新版本。
您可以通过在apt-get命令中省略显式版本来使用最新版本。 另一方面，这样会使图像的可重复性降低：今天build立图像可能会帮助你，明天build立图像可能会使你变得更好。
至于为什么指令在另一个Dockerfile中工作，我认为原因是在构build其他Dockerfile的时候，程序包是可用的。 所以docker工人可以apt-get install它。 然后，Docker构build了包含（旧的）OpenJDK的图像。 这个图像是一个二进制文件，所以你可以安装它，或者在没有任何问题的情况下在FROM使用它。 但是你不能复制这个图像：如果你想自己尝试build立相同的图像，你会遇到同样的错误。
这也提出了一个关于安全更新的问题：由于docker镜像是有效的静态二进制文件（一次构build，捆绑在所有依赖项中），所以一旦构build，它们就不会获得安全更新。 您需要跟踪影响您的泊坞窗图像的任何安全更新并重build任何受影响的泊坞窗图像。