5.7. Multi-stage builds

FROM python:3.13-slim
RUN apt-get update && apt-get install -y build-essential   # +180 MB
RUN pip install psycopg2
RUN apt-get purge -y build-essential                       # слой не уменьшился

   стадия builder                        финальная стадия
   ┌──────────────────────┐              ┌──────────────────────┐
   │ python:3.13-slim     │              │ python:3.13-slim     │
   │ + build-essential    │   COPY       │ + только .venv       │
   │ + заголовки          │  --from ──►  │                      │
   │ + исходники          │              │                      │
   │ + скомпилированное   │              │                      │
   │                      │              │                      │
   │  ОТБРАСЫВАЕТСЯ       │              │  это и есть образ    │
   └──────────────────────┘              └──────────────────────┘
        420 MB                                  160 MB

FROM python:3.13-slim AS builder
# ... сборка ...

FROM python:3.13-slim
COPY --from=builder /app/.venv /app/.venv

docker build --target builder -t app:builder .

FROM python:3.13-slim AS base
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
WORKDIR /app
RUN useradd --create-home --uid 10001 appuser

FROM base AS builder
RUN apt-get update && apt-get install -y --no-install-recommends build-essential \
 && rm -rf /var/lib/apt/lists/*
# ...

FROM base AS runtime
COPY --from=builder /app/.venv /app/.venv
USER 10001:10001

mkdir -p /tmp/multistage/app && cd /tmp/multistage

cat > requirements.txt <<'EOF'
fastapi==0.141.1
uvicorn[standard]==0.52.0
pydantic==2.13.4
psycopg2==2.9.11
EOF

cat > app/main.py <<'PY'
import sys

print(f"Python {sys.version_info.major}.{sys.version_info.minor}")
try:
    import psycopg2
    print("psycopg2 доступен")
except ImportError:
    print("psycopg2 НЕ доступен")
PY

cat > .dockerignore <<'EOF'
Dockerfile*
.dockerignore
__pycache__
*.pyc
EOF

cat > Dockerfile.single <<'EOF'
FROM python:3.13-slim
WORKDIR /app

RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential libpq-dev \
 && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY app/ ./app/
CMD ["python", "app/main.py"]
EOF

docker build -q -f Dockerfile.single -t ms:single . > /dev/null
docker images ms:single --format '{{.Size}}'
docker run --rm ms:single

612MB
Python 3.13
psycopg2 доступен

cat > Dockerfile.multi <<'EOF'
# syntax=docker/dockerfile:1

# ── Стадия сборки: здесь остаются компиляторы ──
FROM python:3.13-slim AS builder

RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential libpq-dev \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /app
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

COPY requirements.txt .
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install -r requirements.txt

# ── Финальная стадия: только runtime ──
FROM python:3.13-slim

# libpq5 — runtime-библиотека для psycopg2, без заголовков и компилятора
RUN apt-get update \
 && apt-get install -y --no-install-recommends libpq5 \
 && rm -rf /var/lib/apt/lists/*

COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH" \
    PYTHONUNBUFFERED=1

WORKDIR /app
COPY app/ ./app/
CMD ["python", "app/main.py"]
EOF

docker build -q -f Dockerfile.multi -t ms:multi . > /dev/null

echo "=== сравнение ==="
docker images --format 'table {{.Repository}}:{{.Tag}}\t{{.Size}}' | grep -E 'ms:|REPO'
echo
docker run --rm ms:multi

=== сравнение ===
REPOSITORY:TAG   SIZE
ms:multi         198MB
ms:single        612MB

Python 3.13
psycopg2 доступен

for img in ms:single ms:multi; do
    printf '%-12s gcc: %s   make: %s\n' "$img" \
        "$(docker run --rm "$img" sh -c 'command -v gcc >/dev/null && echo есть || echo нет')" \
        "$(docker run --rm "$img" sh -c 'command -v make >/dev/null && echo есть || echo нет')"
done

ms:single    gcc: есть   make: есть
ms:multi     gcc: нет    make: нет

cat > tests_app.py <<'PY'
def test_import():
    import psycopg2  # noqa: F401


def test_math():
    assert 2 + 2 == 4
PY

cat > Dockerfile.test <<'EOF'
# syntax=docker/dockerfile:1

FROM python:3.13-slim AS base
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
WORKDIR /app

FROM base AS builder
RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential libpq-dev \
 && rm -rf /var/lib/apt/lists/*
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY requirements.txt .
RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt

# ── Стадия тестов: не входит в финальный образ ──
FROM builder AS test
RUN --mount=type=cache,target=/root/.cache/pip pip install pytest==9.1.1
COPY app/ ./app/
COPY tests_app.py .
RUN pytest -q tests_app.py

# ── Финальная стадия ──
FROM base AS runtime
RUN apt-get update \
 && apt-get install -y --no-install-recommends libpq5 \
 && rm -rf /var/lib/apt/lists/*
COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY app/ ./app/
CMD ["python", "app/main.py"]
EOF

echo "=== обычная сборка: стадия test пропускается ==="
docker build -q -f Dockerfile.test -t ms:runtime . > /dev/null && echo "собрано"

echo
echo "=== явный запуск тестов ==="
docker build --target test -f Dockerfile.test -t ms:test . 2>&1 | grep -E 'pytest|passed|DONE' | tail -3

=== обычная сборка: стадия test пропускается ===
собрано
=== явный запуск тестов ===
 => [test 4/4] RUN pytest -q tests_app.py

cat >> tests_app.py <<'PY'


def test_failing():
    assert 1 == 2, "намеренно провальный тест"
PY

docker build --target test -f Dockerfile.test -t ms:test . 2>&1 | tail -4
echo "exit code: $?"

 => ERROR [test 4/4] RUN pytest -q tests_app.py
...
FAILED tests_app.py::test_failing - AssertionError: намеренно провальный тест
exit code: 1

# убираем провальный тест
head -n -4 tests_app.py > tmp && mv tmp tests_app.py

cat > Dockerfile.dup <<'EOF'
FROM python:3.13-slim AS builder
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
WORKDIR /app
RUN useradd --create-home --uid 10001 appuser
# ... сборка ...

FROM python:3.13-slim AS runtime
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
WORKDIR /app
RUN useradd --create-home --uid 10001 appuser
# ... runtime ...
CMD ["true"]
EOF

cat > Dockerfile.base <<'EOF'
# syntax=docker/dockerfile:1

FROM python:3.13-slim AS base
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1
WORKDIR /app
RUN useradd --create-home --uid 10001 appuser

FROM base AS builder
RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential libpq-dev \
 && rm -rf /var/lib/apt/lists/*
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY requirements.txt .
RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt

FROM base AS runtime
RUN apt-get update \
 && apt-get install -y --no-install-recommends libpq5 \
 && rm -rf /var/lib/apt/lists/*
COPY --from=builder --chown=appuser:appuser /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY --chown=appuser:appuser app/ ./app/
USER 10001:10001
CMD ["python", "app/main.py"]
EOF

docker build -q -f Dockerfile.base -t ms:base . > /dev/null
docker run --rm ms:base
docker run --rm ms:base id

Python 3.13
psycopg2 доступен
uid=10001(appuser) gid=10001(appuser) groups=10001(appuser)

docker build -q --target builder -f Dockerfile.base -t ms:builder . > /dev/null

echo "=== что есть в стадии сборки ==="
docker run --rm ms:builder sh -c '
    echo -n "gcc: "; command -v gcc || echo нет
    echo -n "venv: "; ls -d /opt/venv 2>/dev/null || echo нет
    echo -n "пакетов в venv: "; ls /opt/venv/lib/python3.13/site-packages | wc -l
'

echo
echo "=== интерактивная отладка ==="
docker run --rm ms:builder python -c "import psycopg2; print(psycopg2.__file__)"

=== что есть в стадии сборки ===
gcc: /usr/bin/gcc
venv: /opt/venv
пакетов в venv: 42
=== интерактивная отладка ===
/opt/venv/lib/python3.13/site-packages/psycopg2/__init__.py

cat > Dockerfile.variants <<'EOF'
# syntax=docker/dockerfile:1

FROM python:3.13-slim AS base
ENV PYTHONUNBUFFERED=1
WORKDIR /app

FROM base AS builder
RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential libpq-dev \
 && rm -rf /var/lib/apt/lists/*
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY requirements.txt .
RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt

# ── Вариант для разработки: с инструментами отладки ──
FROM builder AS dev
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install ipython==9.7.0 pytest==9.1.1
COPY app/ ./app/
CMD ["python", "app/main.py"]

# ── Вариант для production: минимальный ──
FROM base AS prod
RUN apt-get update \
 && apt-get install -y --no-install-recommends libpq5 \
 && rm -rf /var/lib/apt/lists/*
COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY app/ ./app/
CMD ["python", "app/main.py"]
EOF

docker build -q --target dev  -f Dockerfile.variants -t ms:dev  . > /dev/null
docker build -q --target prod -f Dockerfile.variants -t ms:prod . > /dev/null

docker images --format 'table {{.Repository}}:{{.Tag}}\t{{.Size}}' | grep -E 'ms:dev|ms:prod|REPO'

echo
echo "--- ipython есть только в dev ---"
for t in dev prod; do
    printf '%-8s %s\n' "$t" \
        "$(docker run --rm "ms:$t" sh -c 'command -v ipython >/dev/null && echo "есть" || echo "нет"')"
done

REPOSITORY:TAG   SIZE
ms:prod          198MB
ms:dev           681MB

--- ipython есть только в dev ---
dev      есть
prod     нет

cat > Dockerfile.parallel <<'EOF'
# syntax=docker/dockerfile:1
FROM python:3.13-slim AS base
WORKDIR /app

FROM base AS deps-a
RUN sleep 4 && echo "A" > /a.txt

FROM base AS deps-b
RUN sleep 4 && echo "B" > /b.txt

FROM base AS final
COPY --from=deps-a /a.txt /
COPY --from=deps-b /b.txt /
CMD ["sh", "-c", "cat /a.txt /b.txt"]
EOF

s="$(date +%s.%N)"
docker build -q --no-cache -f Dockerfile.parallel -t ms:par . > /dev/null
e="$(date +%s.%N)"
awk -v a="$s" -v b="$e" 'BEGIN{printf "две независимые стадии по 4 c: %.1f c\n", b-a}'

две независимые стадии по 4 c: 6.2 c

mkdir -p /tmp/pure-python/app && cd /tmp/pure-python
cat > requirements.txt <<'EOF'
fastapi==0.141.1
uvicorn[standard]==0.52.0
pydantic==2.13.4
EOF
echo "print('чистый Python')" > app/main.py
cat > .dockerignore <<'EOF'
Dockerfile*
.dockerignore
EOF

cat > Dockerfile.single <<'EOF'
FROM python:3.13-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY app/ ./app/
CMD ["python", "app/main.py"]
EOF

cat > Dockerfile.multi <<'EOF'
# syntax=docker/dockerfile:1
FROM python:3.13-slim AS builder
WORKDIR /app
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY requirements.txt .
RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt

FROM python:3.13-slim
COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
WORKDIR /app
COPY app/ ./app/
CMD ["python", "app/main.py"]
EOF

docker build -q -f Dockerfile.single -t pp:single . > /dev/null
docker build -q -f Dockerfile.multi  -t pp:multi  . > /dev/null
docker images --format 'table {{.Repository}}:{{.Tag}}\t{{.Size}}' | grep -E 'pp:|REPO'

REPOSITORY:TAG   SIZE
pp:multi         243MB
pp:single        246MB

cd /tmp
docker rmi -f $(docker images -q --filter 'reference=ms:*') 2>/dev/null || true
docker rmi -f pp:single pp:multi 2>/dev/null || true
rm -rf /tmp/multistage /tmp/pure-python

FROM python:3.13-slim
WORKDIR /app
RUN apt-get update && apt-get install -y build-essential libpq-dev git curl
COPY . .
RUN pip install --no-cache-dir -r requirements.txt
RUN pip install pytest ruff
RUN ruff check app/
RUN pytest tests/
CMD ["python", "app/main.py"]

mkdir -p /tmp/vms && cd /tmp/vms
printf 'FROM alpine:3.21 AS builder\nRUN echo "артефакт" > /result.txt\nRUN apk add --no-cache gcc\n\nFROM alpine:3.21\nCOPY --from=builder /result.txt /\nCMD ["cat","/result.txt"]\n' > Dockerfile
docker build -q -t vms:1 . > /dev/null
docker run --rm vms:1
docker run --rm vms:1 sh -c 'command -v gcc >/dev/null && echo "gcc есть" || echo "gcc отсутствует"'
docker rmi -f vms:1 > /dev/null; cd /tmp && rm -rf /tmp/vms