GitLab CI/CD构建Harbor镜像与本地差异导致Rancher部署异常求助

使用GitLab、Harbor和Rancher搭建CI/CD流水线后，应用部署后无法正常运行，但本地手动构建镜像并推送至Harbor、再通过Rancher部署时完全正常。观察到流水线构建的镜像始终比本地构建的小，推测存在缓存或构建上下文缺失问题。

流水线配置 #

variables:
  HARBOR_URL: "harbor.domain"
  PROJECT_NAME: "ciencia_de_dados/cde"
  KUBECONFIG: "${KUBECONFIG}"

stages:
  - prepare
  - build
  - push
  - deploy

prepare_kubeconfig:
  stage: prepare
  image: bitnami/minideb:latest
  tags:
    - docker
    - rancher
  script:
    - apt-get update && apt-get install -y curl
    - echo "$KUBECONFIG" | base64 -d > temp_kubeconfig

.build_and_push_before_script: &build_and_push_before_script
  - echo "$HARBOR_PASSWORD" | docker login -u "$HARBOR_USER" --password-stdin "$HARBOR_URL"

build_image:
  stage: build
  image: docker:latest
  tags:
    - docker
    - rancher
  before_script:
    *build_and_push_before_script
  script:
    - ls -R
    - docker build --no-cache -t "$HARBOR_URL/$PROJECT_NAME:latest" -f Dockerfile .
  only:
    - develop

push_image:
  stage: push
  image: docker:latest
  tags:
    - docker
  before_script:
    *build_and_push_before_script
  script:
    - docker push "$HARBOR_URL/$PROJECT_NAME:latest"
  only:
    - develop

deploy_to_rancher:
  stage: deploy
  image: bitnami/minideb:latest
  tags:
    - rancher
  before_script:
    - apt-get update && apt-get install -y curl
    - curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
    - install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
    - echo "$KUBECONFIG" | base64 -d > temp_kubeconfig
  script:
    - curl -v -k "https://rancherhml.domain:443/k8s/clusters/c-m-cn8gmtcs/version"
    - KUBECONFIG=temp_kubeconfig kubectl create namespace cde --dry-run=client -o yaml | KUBECONFIG=temp_kubeconfig kubectl apply -f -
    - KUBECONFIG=temp_kubeconfig kubectl apply -f deployment.yaml --validate=false
  only:
    - develop

Dockerfile #

FROM python:3.9.19-bullseye
RUN apt-get update && \
    apt-get install -y libaio1 && \
    rm -rf /var/lib/apt/lists/*
WORKDIR /app/cde
COPY requirements.txt .
RUN pip install --trusted-host pypi.org --trusted-host pypi.python.org --trusted-host files.pythonhosted.org --no-cache-dir --upgrade pip && \
    pip install --trusted-host pypi.org --trusted-host pypi.pythonhosted.org --trusted-host files.pythonhosted.org -r requirements.txt
COPY instantclient_21_12 /opt/oracle/instantclient_21_12
ENV LD_LIBRARY_PATH=/opt/oracle/instantclient_21_12
ENV TNS_ADMIN=/opt/oracle/instantclient_21_12/network/admin
COPY . .
EXPOSE 8000
CMD ["bash", "-c", "python manage.py runserver 0.0.0.0:8000"]

已排查操作 #

• 检查过.dockerignore文件，确认未排除必要文件
• 验证Dockerfile配置，本地执行完全正常
• 构建步骤添加了--no-cache参数
• 配置GitLab Runner为无缓存模式
• 排查Harbor的配置与认证，镜像推送、拉取均无问题

可能的解决方向 #

1. 检查Git仓库提交与构建上下文

   • 确认instantclient_21_12目录是否已提交至Git仓库，流水线构建时ls -R输出是否包含该目录下的所有文件。如果该目录被.gitignore排除，流水线构建时会缺失Oracle客户端文件，导致镜像变小且运行时依赖缺失。
   • 在构建步骤添加git log --oneline -n 5，确认流水线拉取的代码是develop分支的最新版本。

2. 合并构建与推送步骤
   当前流水线将构建、推送拆分为两个独立步骤，若两个步骤使用不同的GitLab Runner，可能出现构建的镜像无法在推送步骤中被找到的情况。建议合并为一个步骤：

   build_and_push_image:
     stage: build
     image: docker:latest
     tags:
       - docker
       - rancher
     before_script:
       *build_and_push_before_script
     script:
       - ls -R
       - docker build --no-cache -t "$HARBOR_URL/$PROJECT_NAME:latest" -f Dockerfile .
       - docker push "$HARBOR_URL/$PROJECT_NAME:latest"
     only:
       - develop
   

3. 查看容器运行日志
   直接查看Rancher中部署失败的容器日志，定位具体错误（如依赖缺失、文件缺失、代码错误等）：

   KUBECONFIG=temp_kubeconfig kubectl logs -n cde <pod-name>
   

内容的提问来源于stack exchange，提问作者Héricles Francisco