NestJS REST API服务Docker构建失败问题排查与解决

我创建了一个NestJS REST API，以下是用于构建服务的Dockerfile：

FROM node:alpine3.16 AS development
WORKDIR /usr/src/app
COPY --chown=node:node package*.json ./
RUN npm ci
COPY --chown=node:node . .
RUN npm run build
ENV NODE_ENV production
RUN npm ci --only=production --omit=dev && npm cache clean --force

FROM node:alpine3.16 AS production
WORKDIR /app
COPY --chown=node:node --from=build /usr/src/app/node_modules ./node_modules
COPY --chown=node:node --from=build /usr/src/app/dist ./dist
USER node
# start the server using the production build
CMD [ "node", "dist/main.js" ]

执行docker build命令后得到如下输出，构建在复制node_modules文件夹时失败：

Sending build context to Docker daemon 320.4MB
Step 1/16 : FROM node:alpine3.16 AS development
 ---> fbf8faa0b327
Step 2/16 : WORKDIR /usr/src/app
 ---> Using cache
 ---> 9586fc2253da
Step 3/16 : COPY --chown=node:node package*.json ./
 ---> Using cache
 ---> 170ae630fdff
Step 4/16 : RUN npm ci
 ---> Using cache
 ---> 1fd94efbfebb
Step 5/16 : COPY --chown=node:node . .
 ---> 0b8a645d4548
Step 6/16 : USER root
 ---> Running in e7882157586e
Removing intermediate container e7882157586e
 ---> b3ecda575e47
Step 7/16 : RUN npm run build
 ---> Running in 020d3ecc7f2a
> service@0.0.1 prebuild
> rimraf dist

> service@0.0.1 build
> nest build

webpack 5.72.1 compiled successfully in 6222 ms
Removing intermediate container 020d3ecc7f2a
 ---> abe9a1016a92
Step 8/16 : ENV NODE_ENV production
 ---> Running in eda90aa82fd5
Removing intermediate container eda90aa82fd5
 ---> 69070cf4854e
Step 9/16 : RUN npm ci --only=production --omit=dev && npm cache clean --force
 ---> Running in bcbceed9f0b0
npm WARN config only Use `--omit=dev` to omit dev dependencies from the install.
npm WARN deprecated multer@1.4.4: Multer 1.x is affected by CVE-2022-24434. This is fixed in v1.4.4-lts.1 which drops support for versions of Node.js before 6. Please upgrade to at least Node.js 6 and version 1.4.4-lts.1 of Multer. If you need support for older versions of Node.js, we are open to accepting patches that would fix the CVE on the main 1.x release line, whilst maintaining compatibility with Node.js 0.10.
added 260 packages, and audited 261 packages in 19s

23 packages are looking for funding
  run `npm fund` for details

6 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.
npm WARN using --force Recommended protections disabled.
Removing intermediate container bcbceed9f0b0
 ---> f42e890665f0
Step 10/16 : FROM node:alpine3.16 AS production
 ---> fbf8faa0b327
Step 11/16 : WORKDIR /app
 ---> Using cache
 ---> bcd15d86cb7e
Step 12/16 : USER root
 ---> Running in 9d97f5cc54dd
Removing intermediate container 9d97f5cc54dd
 ---> cd1f956a6c91
Step 13/16 : COPY --chown=node:node --from=build /usr/src/app/node_modules ./node_modules
invalid from flag value build: pull access denied for build, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

请问该问题的成因是什么，如何解决？

这个问题的核心原因非常明确：你在多阶段构建的production阶段中，引用了一个不存在的阶段名称build。

成因分析 #

在你的Dockerfile里，第一个构建阶段被命名为AS development，但在production阶段的COPY命令中，你写了--from=build。Docker无法找到名为build的本地构建阶段，就会默认尝试从Docker Hub拉取名为build的公共镜像——显然这个镜像不存在，所以报错"pull access denied for build"。

解决步骤 #

1. 修正阶段引用名称
   把production阶段的两个COPY命令中的--from=build改成--from=development，对应你定义的第一个构建阶段名称。

2. 额外优化（可选但推荐）

   • 处理npm的警告：npm提示Use --omit=dev instead of --only=production，所以把RUN npm ci --only=production --omit=dev改成RUN npm ci --omit=dev即可消除警告。
   • 避免不必要的root切换：你的构建流程中切换到USER root来执行npm run build，但实际上node用户通常拥有足够的权限完成构建，可以去掉这个步骤，保持最小权限原则。

修正后的完整Dockerfile #

FROM node:alpine3.16 AS development
WORKDIR /usr/src/app
COPY --chown=node:node package*.json ./
RUN npm ci
COPY --chown=node:node . .
# 去掉不必要的USER root，用node用户执行构建
RUN npm run build
ENV NODE_ENV production
# 修正npm ci的参数，去掉冗余的--only=production
RUN npm ci --omit=dev && npm cache clean --force

FROM node:alpine3.16 AS production
WORKDIR /app
# 修正阶段引用为development
COPY --chown=node:node --from=development /usr/src/app/node_modules ./node_modules
COPY --chown=node:node --from=development /usr/src/app/dist ./dist
USER node
CMD [ "node", "dist/main.js" ]

现在重新执行docker build命令，应该就能顺利完成构建了。

内容的提问来源于stack exchange，提问作者Simple Fellow