多阶段构建需要经过测试的运行边界

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,tarfile,uuid

BASE='python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84'
def docker(*args,check=True):
    result=subprocess.run(['docker',*args],capture_output=True,text=True,timeout=360)
    if check:assert result.returncode==0,result.stderr
    return result
def inspect(image):return json.loads(docker('image','inspect',image).stdout)[0]

name='xbcatm-stages-'+uuid.uuid4().hex[:10];tags=[name+':builder',name+':good',name+':bad'];container=name+'-inspect'
try:
    with TemporaryDirectory(prefix=name+'-') as directory:
        root=Path(directory)
        (root/'square.c').write_text('#include <stdio.h>\n#include <stdlib.h>\n#include <errno.h>\nint main(int argc,char **argv){\n char *end;long value;\n if(argc!=2){fprintf(stderr,"one integer required\\n");return 2;}\n errno=0;value=strtol(argv[1],&end,10);\n if(errno||end==argv[1]||*end||value<0||value>100){fprintf(stderr,"range 0..100\\n");return 2;}\n printf("%ld\\n",value*value);return 0;\n}\n')
        (root/'Dockerfile').write_text(f'''FROM {BASE} AS builder
RUN apt-get update && apt-get install -y --no-install-recommends gcc libc6-dev && rm -rf /var/lib/apt/lists/*
WORKDIR /source
COPY square.c .
RUN gcc -O2 -Wall -Wextra -Werror -static -o /square-static square.c && gcc -O2 -Wall -Wextra -Werror -o /square-dynamic square.c
FROM scratch AS good
COPY --from=builder /square-static /square
USER 65532:65532
ENTRYPOINT ["/square"]
FROM scratch AS bad
COPY --from=builder /square-dynamic /square
USER 65532:65532
ENTRYPOINT ["/square"]
''')
        for tag,target in zip(tags,['builder','good','bad']):docker('build','--target',target,'-t',tag,str(root))
        print('compiler:',docker('run','--rm','--network','none',tags[0],'gcc','--version').stdout.splitlines()[0])
        for argument,expected in [('0','0'),('7','49'),('100','10000')]:
            assert docker('run','--rm','--network','none',tags[1],argument).stdout.strip()==expected
        for argument in ['7x','-1','101','','999999999999999999999999999']:
            invalid=docker('run','--rm','--network','none',tags[1],argument,check=False)
            assert invalid.returncode==2 and 'range 0..100' in invalid.stderr
        invalid=docker('run','--rm','--network','none',tags[1],check=False)
        assert invalid.returncode==2 and 'one integer required' in invalid.stderr
        invalid=docker('run','--rm','--network','none',tags[1],'7','8',check=False)
        assert invalid.returncode==2 and 'one integer required' in invalid.stderr
        good=inspect(tags[1]);builder=inspect(tags[0]);assert good['Size']<builder['Size'] and len(good['RootFS']['Layers'])==1
        assert good['Config']['User']=='65532:65532'
        docker('create','--name',container,tags[1],'7');archive=root/'rootfs.tar';docker('export','-o',str(archive),container)
        with tarfile.open(archive) as contents:
            names={entry.name.removeprefix('./') for entry in contents}
            assert 'square' in names and 'usr/bin/gcc' not in names and 'source/square.c' not in names
        bad=docker('run','--rm','--network','none',tags[2],'7',check=False)
        assert bad.returncode!=0 and 'no such file or directory' in bad.stderr
        print('the static final image runs valid input, rejects invalid input, and contains one application layer without compiler or source')
        print('recorded image sizes:',builder['Size'],'builder bytes;',good['Size'],'final bytes')
        print('the dynamic scratch image builds successfully but cannot start because its interpreter/runtime was not copied')
finally:
    docker('rm','-f',container,check=False);docker('image','rm',*tags,check=False)