docker-cicd

Docker CI/CD — Continuous Integration and Continuous Deployment

Guidance for integrating Docker into automated build, test, and deployment pipelines.

When to Use

ALWAYS use this skill when the user mentions:

• "docker CI", "docker CD", "CI/CD pipeline"
• "GitHub Actions docker", "Jenkins docker"
• "buildx", "multi-platform build", "multi-platform build"
• "Docker Build Cloud"
• "Image build pipeline"

GitHub Actions

Build & Push Pipeline

name: Build and Push
on:
  push:
    tags: ['v*']

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          push: true
          tags: user/app:${{ github.ref_name }},user/app:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

Multi-Platform Build

- name: Build and push multi-platform
  uses: docker/build-push-action@v6
  with:
    platforms: linux/amd64,linux/arm64
    push: true
    tags: user/app:latest

Jenkins Pipeline

pipeline {
    agent any
    environment {
        DOCKER_IMAGE = 'myapp'
        DOCKER_TAG = "${env.BUILD_NUMBER}"
    }
    stages {
        stage('Build') {
            steps {
                sh "docker build -t ${DOCKER_IMAGE}:${DOCKER_TAG} ."
            }
        }
        stage('Test') {
            steps {
                sh "docker run --rm ${DOCKER_IMAGE}:${DOCKER_TAG} npm test"
            }
        }
        stage('Push') {
            steps {
                withDockerRegistry([credentialsId: 'docker-hub']) {
                    sh "docker push ${DOCKER_IMAGE}:${DOCKER_TAG}"
                }
            }
        }
    }
}

Layer Caching in CI

# Pull previous image for layer cache
docker pull $IMAGE:latest || true
docker build \
  --cache-from $IMAGE:latest \
  --build-arg BUILDKIT_INLINE_CACHE=1 \
  -t $IMAGE:$TAG .

Workflow — Recommended CI/CD process

Step 1: Configure CI environment: docker/login-action + docker/setup-buildx-action Step 2: Build image: docker/build-push-action + registry cache acceleration Step 3: Security scan: docker/scout-action scans CVEs + policy gate Step 4: Push to registry: multiple tags (semver + sha + latest) pushed to ghcr.io/Docker Hub Step 5: Deploy: ArgoCD/Flux watch registry changes and deploy automatically

Gotchas — Common Pitfalls

• CI cache miss: Without --cache-from, every CI build starts from scratch. → Recovery: docker pull myapp:latest || true before build; use --cache-from type=gha in GitHub Actions.
• Build secrets in CI logs: Never echo or print secrets. Use buildx --secret or CI secrets masking. → Recovery: docker buildx build --secret id=npmrc,src=$HOME/.npmrc; check CI secrets are masked in logs.
• Disk space in CI: Multi-stage builds can consume CI disk. → Recovery: docker system prune -af between builds; monitor with docker system df.
• Multi-platform emulation slow: QEMU emulation for ARM on AMD is slow (~10x). → Recovery: Use native ARM runners (e.g., GitHub Actions ARM64 runners) or Docker Build Cloud for multi-platform.

Boundary — Capability boundaries (applicable and non-applicable scenarios)

Category	Scenario	Description
✅ Can do	GitHub Actions Docker integration	docker/build-push-action + QEMU + multi-arch
✅ Can do	Jenkins Pipeline Docker	Docker agent + build/push/scan
✅ Can do	Multi-platform CI build	buildx + QEMU + multi-architecture manifest
⚠️ Requires conditions	Docker Build Cloud acceleration	Requires paid subscription
⚠️ Requires conditions	Non-GitHub/Jenkins CI	Adapt by referring to general patterns
❌ Out of scope	Dockerfile authoring	Use docker-dockerfile
❌ Out of scope	K8s CD（ArgoCD/Flux）	K8s deployment skills
❌ Out of scope	CI platform setup (Jenkins installation)	DevOps infrastructure

When NOT to Use

❌ Skip	✅ Use Instead
Writing Dockerfile	docker-build
Security scanning	docker-security / docker-scout
Production deployment	docker-production
Registry management	docker-hub

Security & Stability

• Never hardcode registry credentials in CI configs. Use CI secrets manager (GitHub Secrets, Jenkins Credentials).
• Use OIDC (OpenID Connect) for cloud registry auth instead of long-lived credentials.
• Scan images with Docker Scout before pushing to production registry.
• Tag images with SHA digest for audit trails: image:sha-${GITHUB_SHA::7}.
• Rotate registry tokens regularly. Never use personal access tokens for CI.

📚 Official documentation references

Documentation	Address
Docker Build CI	https://docs.docker.com/build/ci/
Docker Build Cloud	https://docs.docker.com/build-cloud/
GitHub Actions Docker	https://docs.docker.com/build/ci/github-actions/
Docker Scout CI	https://docs.docker.com/scout/policy/ci/
Buildx CI integration	https://docs.docker.com/build/ci/github-actions/build-push-action/

🧭 Docker Skills Journey

📍 You are here: docker-cicd — CI/CD automation

← Previous: docker-build | → Next: docker-production

FAQ

Q1: How do I quickly get started with this skill? A: Refer to the Quick Start section above and follow the steps.

Q2: What should I do if I encounter version incompatibility issues? A: Check dependency versions, lock them with a lock file, and refer to the Common Pitfalls section.

Q3: How do I use it in a production environment? A: Refer to the Best Practices section, ensure the configuration is correct, and implement monitoring and logging.

Q4: How can performance be optimized? A: Refer to the performance optimization documentation and use methods such as caching and indexing.

Q5: How do I contribute or report issues? A: Submit an Issue or Pull Request in the GitHub repository.

Q6: Is Chinese supported? A: Chinese documentation and Chinese comments are supported. See the China adaptation section for details.