> **如果前端是React项目，不用这样配置，使用scp的Action部署到服务器中即可。** ## 前置知识在读本文之前，需要对以下概念有所简单的了解。 - Docker [阮一峰-Docker入门教程](http://www.ruanyifeng.com/blog/2018/02/docker-tutorial.html) - SSH remote [SSH教程](https://wangdoc.com/ssh/) - Github Actions [阮一峰-GitHub Actions教程](http://www.ruanyifeng.com/blog/2019/09/getting-started-with-github-actions.html) - Next.js [官方文档](https://www.nextjs.cn/docs/getting-started) ## 目标进度 - [x] 在Github Actions中`build` Docker镜像并push到阿里ACR。 - [x] 在Github Actions中使用SSH链接阿里ECS，`pull`并`run`镜像。 - [ ] ACR中自动删除过期版本的镜像。 - [ ] 服务器中自动删除过期版本的镜像。 - [ ] 构建缓存。 - [ ] 配置docker的network与其他容器交互。 ## 主要流程 ![](https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/aa58a0c28be34d4b827a84bce2d2c7fa~tplv-k3u1fbpfcp-zoom-1.image) 1. 本地使用`git push origin main`命令。 1. `Github Actions`根据根目录的`.github/workflows`下的`yaml`文件的配置进行`jobs`操作。 ### Dockerfile ```dockerfile # Install dependencies only when needed FROM node:alpine AS deps # Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed. RUN apk add --no-cache libc6-compat WORKDIR /information-manage-com COPY package.json yarn.lock ./ RUN yarn config set registry https://registry.npm.taobao.org/ RUN yarn install --frozen-lockfile # Rebuild the source code only when needed FROM node:alpine AS builder WORKDIR /information-manage-com COPY . . COPY --from=deps /information-manage-com/node_modules ./node_modules RUN yarn build # Production image, copy all the files and run next FROM node:alpine AS runner WORKDIR /information-manage-com ENV NODE_ENV production # You only need to copy next.config.js if you are NOT using the default configuration # COPY --from=builder /information-manage-com/next.config.js ./ COPY --from=builder /information-manage-com/public ./public COPY --from=builder /information-manage-com/.next ./.next COPY --from=builder /information-manage-com/node_modules ./node_modules RUN addgroup -g 1001 -S nodejs RUN adduser -S nextjs -u 1001 RUN chown -R nextjs:nodejs /information-manage-com/.next USER nextjs EXPOSE 3000 # Next.js collects completely anonymous telemetry data about general usage. # Learn more here: https://nextjs.org/telemetry # Uncomment the following line in case you want to disable telemetry. # RUN npx next telemetry disable CMD ["node_modules/.bin/next", "start"]d ``` [Next.js的docker官方配置](https://www.nextjs.cn/docs/deployment#docker-image)，我在其中加了npm的国内镜像。 ### build-docker 创建了两个`job`，依此是`build-docker`功能是构建`docker`并`push`到`Docker Hub`或阿里`ACR`。 ```yaml build-docker: runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v2 with: ref: main - name: Login to ACR uses: aliyun/acr-login@v1 with: login-server: username: "${{ secrets.ACR_USERNAME }}" password: "${{ secrets.ACR_PASSWORD }}" - name: Build and push image env: IMAGE_TAG: ${{ github.sha }} run: | docker build -t //:$IMAGE_TAG . docker push //:$IMAGE_TAG ``` 其中涉密信息可以放在github项目的setting中设置secrets。项目中就可以使用`${{ secrets.<你设置的键> }}` 。`${{ github.sha }}`代表这次提交的独一无二的`id`可用做`docker`的`tag`。其次使用了两个Action，具体参数参考文档。 - 切换分支 [actions/checkout@v2](https://github.com/marketplace/actions/checkout) - 登录ACR [aliyun/acr-login@v1](https://github.com/marketplace/actions/alibaba-cloud-container-registry-acr-login) ### ecs-pull ```yaml ecs-pull: needs: build-docker runs-on: ubuntu-latest steps: - name: Execute SSH commmands on remote server uses: fifsky/ssh-action@master with: user: root host: "${{ secrets.ECS_HOST }}" key: ${{ secrets.ECS_PRIVATE_KEY }} command: | cd / docker login --username=${{ secrets.ACR_USERNAME }} --password=${{ secrets.ACR_PASSWORD }} docker pull //:${{ github.sha }} docker run -p 80:3000 -d //:${{ github.sha }} ``` **_注意：其中的key是服务器生成的私钥（全文复制，不只复制中间部分），而且需要将与这私钥一起生成的公钥放到授权文件中（阿里云就是authorized_keys)。_** 其中的needs代表此job需要等待build-docker完成才执行。否则会并行处理jobs。其中的Action官方文档如下： - [fifsky/ssh-action@master](https://github.com/marketplace/actions/remote-ssh-commands) SSH链接 ## 横向对比肤浅的对比：使用自己服务器的Jenkins与其他网站的Web Hook联动也能做到自动部署，但Jenkins需要耗费自己的服务资源。而GitHub Actions提供了免费的服务资源。而且不使用Docker的话需要在自己的服务器上安装配置一堆的服务非常麻烦，易错。