無法直接構建openjdk：8-jdk圖像

Question

我正在通過Riot控制Docker映像教程http://engineering.riotgames.com/news/taking-control-your-docker-image緩慢地完成工作。本教程有點舊，所以對最終文件的外觀有一些明確的改變。打了幾面牆後，我決定按照教程的相反順序工作。我成功地將官方的jenkinsci圖像摺疊到我的個人Dockerfile中，從FROM：openjdk：8-dk開始。但是，當我嘗試在OpenJDK的摺疊：8-DK文件到我的個人形象我收到以下錯誤

E: Version '8u102-b14.1-1~bpo8+1' for 'openjdk-8-jdk' was not found ERROR: Service 'jenkinsmaster' failed to build: The command '/bin/sh -c set -x && apt-get update && apt-get install -y openjdk-8-jdk="$JAVA_DEBIAN_VERSION" ca-certificates-java="$CA_CERTIFICATES_JAVA_VERSION" && rm -rf /var/lib/apt/lists/* && [ "$JAVA_HOME" = "$(docker-java-home)" ]' returned a non-zero code: 100 Cosettes-MacBook-Pro:docker-test Cosette$

我甚至收到此錯誤，當我放棄了，直接複製並粘貼在OpenJDK：8 -jdk Dockerfile到我自己的。我的最終目標是將我的個人Docker文件放到從debian-jessie開始的位置。任何幫助，將不勝感激。

我Dockerfile：

FROM buildpack-deps:jessie-scm 

# A few problems with compiling Java from source: 
# 1. Oracle. Licensing prevents us from redistributing the official JDK. 
# 2. Compiling OpenJDK also requires the JDK to be installed, and it gets 
#  really hairy. 

RUN apt-get update && apt-get install -y --no-install-recommends \ 
     bzip2 \ 
     unzip \ 
     xz-utils \ 
    && rm -rf /var/lib/apt/lists/* 

RUN echo 'deb http://deb.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list 

# Default to UTF-8 file.encoding 
ENV LANG C.UTF-8 

# add a simple script that can auto-detect the appropriate JAVA_HOME value 
# based on whether the JDK or only the JRE is installed 
RUN { \ 
     echo '#!/bin/sh'; \ 
     echo 'set -e'; \ 
     echo; \ 
     echo 'dirname "$(dirname "$(readlink -f "$(which javac || which java)")")"'; \ 
    } > /usr/local/bin/docker-java-home \ 
    && chmod +x /usr/local/bin/docker-java-home 

ENV JAVA_HOME /usr/lib/jvm/java-8-openjdk-amd64 

ENV JAVA_VERSION 8u102 
ENV JAVA_DEBIAN_VERSION 8u102-b14.1-1~bpo8+1 

# see https://bugs.debian.org/775775 
# and https://github.com/docker-library/java/issues/19#issuecomment-70546872 
ENV CA_CERTIFICATES_JAVA_VERSION 20140324 

RUN set -x \ 
    && apt-get update \ 
    && apt-get install -y \ 
     openjdk-8-jdk="$JAVA_DEBIAN_VERSION" \ 
     ca-certificates-java="$CA_CERTIFICATES_JAVA_VERSION" \ 
    && rm -rf /var/lib/apt/lists/* \ 
    && [ "$JAVA_HOME" = "$(docker-java-home)" ] 

# see CA_CERTIFICATES_JAVA_VERSION notes above 
RUN /var/lib/dpkg/info/ca-certificates-java.postinst configure 

# Jenkins Specifics 

# install Tini 
ENV TINI_VERSION 0.9.0 
ENV TINI_SHA fa23d1e20732501c3bb8eeeca423c89ac80ed452 

# Use tini as subreaper in Docker container to adopt zombie processes 
RUN curl -fsSL https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static -o /bin/tini && chmod +x /bin/tini \ 
    && echo "$TINI_SHA /bin/tini" | sha1sum -c - 

# Set Jenkins Environmental Variables 
ENV JENKINS_HOME /var/jenkins_home 
ENV JENKINS_SLAVE_AGENT_PORT 50000 
    # jenkins version being bundled in this docker image 
ARG JENKINS_VERSION 
ENV JENKINS_VERSION ${JENKINS_VERSION:-2.19.1} 
    # jenkins.war checksum, download will be validated using it 
ARG JENKINS_SHA=dc28b91e553c1cd42cc30bd75d0f651671e6de0b 
ENV JENKINS_UC https://updates.jenkins.io 
ENV COPY_REFERENCE_FILE_LOG $JENKINS_HOME/copy_reference_file.log 
ENV JAVA_OPTS="-Xmx8192m" 
ENV JENKINS_OPTS="--handlerCountMax=300 --logfile=/var/log/jenkins/jenkins.log --webroot=/var/cache/jenkins/war" 
    # Can be used to customize where jenkins.war get downloaded from 
ARG JENKINS_URL=http://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war 
ARG user=jenkins 
ARG group=jenkins 
ARG uid=1000 
ARG gid=1000 

# Jenkins is run with user `jenkins`, uid = 1000. If you bind mount a volume from the host or a data 
# container, ensure you use the same uid. 
RUN groupadd -g ${gid} ${group} \ 
    && useradd -d "$JENKINS_HOME" -u ${uid} -g ${gid} -m -s /bin/bash ${user} 

# Jenkins home directory is a volume, so configuration and build history 
# can be persisted and survive image upgrades 
VOLUME /var/jenkins_home 

# `/usr/share/jenkins/ref/` contains all reference configuration we want 
# to set on a fresh new installation. Use it to bundle additional plugins 
# or config file with your custom jenkins Docker image. 
RUN mkdir -p /usr/share/jenkins/ref/init.groovy.d 

# Install Jenkins. Could use ADD but this one does not check Last-Modified header neither does it 
# allow to control checksum. see https://github.com/docker/docker/issues/8331 
RUN curl -fsSL ${JENKINS_URL} -o /usr/share/jenkins/jenkins.war \ 
    && echo "${JENKINS_SHA} /usr/share/jenkins/jenkins.war" | sha1sum -c - 

# Prep Jenkins Directories 
USER root 
RUN chown -R ${user} "$JENKINS_HOME" /usr/share/jenkins/ref 
RUN mkdir /var/log/jenkins 
RUN mkdir /var/cache/jenkins 
RUN chown -R ${group}:${user} /var/log/jenkins 
RUN chown -R ${group}:${user} /var/cache/jenkins 

# Expose ports for web (8080) & node (50000) agents 
EXPOSE 8080 
EXPOSE 50000 

# Copy in local config filesfiles 
COPY init.groovy /usr/share/jenkins/ref/init.groovy.d/tcp-slave-agent-port.groovy 
COPY jenkins-support /usr/local/bin/jenkins-support 
COPY jenkins.sh /usr/local/bin/jenkins.sh 
    # NOTE : Just set pluginID to download latest version of plugin. 
    # NOTE : All plugins need to be listed as there is no transitive dependency resolution. 
    # from a derived Dockerfile, can use `RUN plugins.sh active.txt` to setup 
    # /usr/share/jenkins/ref/plugins from a support bundle 
COPY plugins.sh /usr/local/bin/plugins.sh 
RUN chmod +x /usr/local/bin/plugins.sh 
RUN chmod +x /usr/local/bin/jenkins.sh 

# Switch to the jenkins user 
USER ${user} 

# Tini as the entry point to manage zombie processes 
ENTRYPOINT ["/bin/tini", "--", "/usr/local/bin/jenkins.sh"] 

Answer 1

嘗試JAVA_DEBIAN_VERSION的8u111-b14-2~bpo8+1

這裏發生了什麼：當你建立泊塢窗文件，碼頭工人試圖執行的dockerfile所有行。其中之一是這個適當的命令：apt-get install -y openjdk-8-jdk="$JAVA_DEBIAN_VERSION"。這個命令說「安裝OpenJDK版本$ JAVA_DEBIAN_VERSION，完全沒有別的。」。這個版本在Debian軟件庫中不再可用，所以它不能被apt-get安裝！我相信這會發生在官方鏡像中的所有軟件包中：如果發佈新版本的軟件包，舊版本不再需要安裝。

如果你想訪問舊的Debian軟件包，你可以使用類似http://snapshot.debian.org/的東西。較舊的OpenJDK包有已知安全漏洞。我建議使用最新版本。

您可以通過在apt-get命令中忽略顯式版本來使用最新版本。另一方面，這會使圖像的可重複性降低：今天建立圖像可能會幫助你，明天建立圖像可能會使你獲得u112。

至於爲什麼指令在其他Dockerfile中工作，我認爲原因是在構建其他Dockerfile時，該包可用。所以碼頭工人可以apt-get install吧。然後，Docker構建了包含（較舊）OpenJDK的映像。該圖像是一個二進制文件，因此您可以安裝它，或在FROM中使用它，不會有任何問題。但是你不能複製圖像：如果你要自己嘗試構建相同的圖像，則會遇到同樣的錯誤。

這也帶來了有關安全更新的問題：由於碼頭工人的圖像實際是靜態的二進制文件（內置一次，捆綁在所有的依賴），他們沒有得到安全更新一次建成。您需要跟蹤影響碼頭圖像的任何安全更新並重建任何受影響的碼頭圖像。