基于Node镜像构建含Google Chrome的Docker镜像失败求助

尝试以node:14.17.1为基础镜像构建包含Google Chrome的Docker镜像失败，已尝试安装Chrome Driver、添加--platform=linux/amd64参数仍无法解决。以下是Dockerfile及报错信息：

FROM node:14.17.1
RUN echo "deb http://security.debian.org/debian-security bullseye-security main contrib non-free" /etc/apt/sources.list
RUN apt-get update
RUN apt-get upgrade -y

ARG CHROME_VERSION="google-chrome-stable"
RUN wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
  && echo "deb http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list \
  && apt-get update -qqy \
  && apt-get -y install ${CHROME_VERSION:-google-chrome-stable} vim curl bash \
  && rm /etc/apt/sources.list.d/google-chrome.list \
  && rm -rf /var/lib/apt/lists/* /var/cache/apt/*

RUN bash -v
CMD 'cat'

报错信息：

> [5/7] RUN wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add -   && echo "deb http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list   && apt-get update -qqy   && apt-get -y install google-chrome-stable vim curl bash   && rm /etc/apt/sources.list.d/google-chrome.list   && rm -rf /var/lib/apt/lists/* /var/cache/apt/*:
#8 0.292 Warning: apt-key output should not be parsed (stdout is not a terminal)
#8 0.422 gpg: no valid OpenPGP data found.
------
executor failed running [/bin/sh -c wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add -   && echo "deb http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list   && apt-get update -qqy   && apt-get -y install ${CHROME_VERSION:-google-chrome-stable} vim curl bash   && rm /etc/apt/sources.list.d/google-chrome.list   && rm -rf /var/lib/apt/lists/* /var/cache/apt/*]: exit code: 2

问题分析 #

1. sources.list配置错误：第一个RUN命令缺少重定向符号（>>），导致Debian安全源未被正确写入配置文件，后续apt操作无法获取必要依赖。
2. apt-key已废弃：apt-key add命令已被官方弃用，且wget获取密钥时可能因证书问题拿到无效数据，触发gpg: no valid OpenPGP data found错误。

修正后的Dockerfile #

FROM node:14.17.1

# 修复Debian安全源写入命令，追加而非覆盖原有配置
RUN echo "deb http://security.debian.org/debian-security bullseye-security main contrib non-free" >> /etc/apt/sources.list \
    && apt-get update \
    && apt-get upgrade -y \
    # 安装证书包，确保HTTPS请求证书验证正常
    && apt-get install -y ca-certificates \
    && rm -rf /var/lib/apt/lists/*

ARG CHROME_VERSION="google-chrome-stable"
RUN # 用gpg导入密钥到官方推荐的keyrings目录，替代废弃的apt-key
    wget -q -O /tmp/google-linux-signing-key.pub https://dl-ssl.google.com/linux/linux_signing_key.pub \
    && gpg --dearmor -o /usr/share/keyrings/google-chrome-keyring.gpg /tmp/google-linux-signing-key.pub \
    && rm /tmp/google-linux-signing-key.pub \
    # 添加Chrome源并指定签名密钥路径
    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list \
    && apt-get update -qqy \
    && apt-get -y install ${CHROME_VERSION:-google-chrome-stable} vim curl bash \
    && rm /etc/apt/sources.list.d/google-chrome.list \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/*

CMD ["cat"]

关键改动说明 #

• 修正安全源写入命令，添加>>确保配置被追加到文件，不覆盖原有内容。
• 安装ca-certificates解决证书验证问题，保证wget能正确获取Google密钥文件。
• 替换apt-key add为gpg --dearmor，将密钥导入到/usr/share/keyrings/目录，符合Debian新的密钥管理规范。
• 在Chrome源配置中添加signed-by参数，明确指定密钥文件路径，避免密钥信任问题。
• 合并部分RUN命令，减少镜像分层，优化镜像体积。

内容的提问来源于stack exchange，提问作者Bhimesh