如何在GitHub Actions中拉取需认证的Docker镜像并执行命令

方法一：将私有镜像作为Job运行环境 #

这种方式让整个Job直接在你的私有镜像中运行，无需手动拉取和启动容器，步骤更简洁：

name: Run Node Script in Private Container
on: [push]

jobs:
  run-script:
    runs-on: ubuntu-latest
    container:
      image: your-registry.example.com/your-image:tag # 替换为你的私有镜像地址（如docker.io/xxx、ghcr.io/xxx）
      credentials:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Node script
        run: node index.js

方法二：手动拉取镜像并启动容器执行命令 #

如果需要自定义容器启动参数（如端口映射、额外挂载），可以手动拉取镜像后用docker run执行命令：

name: Pull Private Image and Run Script
on: [push]

jobs:
  run-script:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Login to Docker Registry
        uses: docker/login-action@v3
        with:
          registry: your-registry.example.com # 替换为镜像仓库地址
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Pull private Docker image
        uses: docker/pull-action@v3
        with:
          images: your-registry.example.com/your-image:tag # 替换为私有镜像地址

      - name: Run Node script in container
        run: |
          docker run --rm -v ${{ github.workspace }}:/app your-registry.example.com/your-image:tag node /app/index.js

关键配置说明 #

• 先在GitHub仓库的「Settings -> Secrets and variables -> Actions」中添加两个密钥：DOCKER_USERNAME（镜像仓库用户名）和DOCKER_PASSWORD（镜像仓库密码/访问令牌）。
• 方法二中的-v ${{ github.workspace }}:/app是把当前代码目录挂载到容器内的/app路径，确保容器能访问到本地的index.js文件。
• 替换所有示例中的your-registry.example.com/your-image:tag为实际的私有镜像地址。

内容的提问来源于stack exchange，提问作者bezzoon