Dockerfile 与从容器创建映像

Question

Is there some difference between creating image using Dockerfile vs Creating image from container? (eg run a container from the same base as Dockerfile, transfer isntaller to the container, run them from command line and then create image from container).

At least I found out that installing VC Runtime from Windows Base docker container does not work :(

Answer 1

If you create an image using a Dockerfile, it's all but trivial to update the image by checking it out from source control, updating the tag on a base image or docker pull ing a newer version of it, and re-running docker build .

If you create an image by running docker commit , and you discover in a year that there's a critical security vulnerability in the base Linux distribution and you need to stop using it immediately , you need to remember what it was you did a year ago to build the image and exactly what steps you did to repeat them, and you'd better hope you do them exactly the same way again. Oh, if only you had written down in a text file what base image you started FROM , what files you had to COPY in, and then what commands you need to RUN to set up the application in the image...

In short, writing a Dockerfile, committing it to source control, and running docker build is almost always vastly better practice than running docker commit . You can set up a continuous-integration system to rebuild the image whenever your source code changes; when there is that security vulnerability it's trivial to bump the FROM line to a newer base image and rebuild.