Docker + GitHub Actions CI/CD 완전 가이드 -- Dockerfile부터 자동 배포까지

bash # 이미지 관련 docker build -t myapp:1.0 . # 이미지 빌드 docker images # 이미지 목록 docker pull node:24-alpine # 이미지 다운로드 # 컨테이너 관련 docker run -d -p 3000:3000 myapp:1.0 # 백그라운드 실행 + 포트 매핑 docker ps # 실행 중 컨테이너 목록 docker logs -f container_id # 로그 실시간 출력 docker exec -it container_id bash # 컨테이너 내부 접속

dockerfile # 1단계: 의존성 설치 (devDependencies 포함 -- 빌드 도구 필요) FROM node:24-alpine AS deps WORKDIR /app COPY package*.json ./ RUN npm ci # 2단계: 빌드 스테이지 FROM node:24-alpine AS builder WORKDIR /app COPY --from=deps /app/node_modules ./node_modules COPY . . RUN npm run build RUN npm prune --omit=dev # 런타임용 production 의존성만 남김 # 3단계: 런타임 스테이지 (production 의존성만) FROM node:24-alpine AS runner WORKDIR /app ENV NODE_ENV=production RUN addgroup -S appgroup && adduser -S appuser -G appgroup USER appuser COPY --from=builder --chown=appuser:appgroup /app/dist ./dist COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules COPY --from=builder --chown=appuser:appgroup /app/package.json ./ EXPOSE 3000 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \ CMD wget -qO- http://localhost:3000/health || exit 1 CMD ["node", "dist/index.js"]

docker-compose.yml version: '3.9' services: app: build: context: . target: runner image: myapp:latest restart: unless-stopped ports: - "3000:3000" depends_on: db: condition: service_healthy networks: - app-net db: image: postgres:16-alpine restart: unless-stopped volumes: - postgres-data:/var/lib/postgresql/data healthcheck: test: ["CMD-SHELL", "pg_isready -U user -d mydb"] interval: 10s timeout: 5s retries: 5 networks: - app-net cache: image: redis:7-alpine restart: unless-stopped networks: - app-net volumes: postgres-data: networks: app-net: driver: bridge

yaml -- .github/workflows/ci.yml name: CI - 린트 & 테스트 on: pull_request: branches: [main] jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - name: Node.js 설정 (러너 기본 Node 24) uses: actions/setup-node@v5 with: node-version: 24 cache: npm - run: npm ci - run: npm run lint - run: npm test

yaml -- .github/workflows/deploy.yml name: CD - 빌드 & 배포 on: push: branches: [main] env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} jobs: build-and-push: runs-on: ubuntu-latest permissions: contents: read packages: write # GHCR 푸시 id-token: write # OIDC 키리스 + 프로버넌스 서명 attestations: write # 빌드 프로버넌스 attestation outputs: digest: ${{ steps.build.outputs.digest }} steps: - uses: actions/checkout@v5 - name: Docker Buildx 설정 uses: docker/setup-buildx-action@v3 - name: GHCR 로그인 (내장 GITHUB_TOKEN) uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: 태그 & 라벨 메타데이터 id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=sha type=ref,event=branch type=raw,value=latest,enable={{is_default_branch}} - name: 빌드 & 푸시 (멀티 아키텍처 + GHA 캐시) id: build uses: docker/build-push-action@v6 with: context: . platforms: linux/amd64,linux/arm64 push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - name: 빌드 프로버넌스 서명 uses: actions/attest-build-provenance@v2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true deploy: needs: build-and-push runs-on: ubuntu-latest permissions: id-token: write # AWS OIDC 키리스 인증 contents: read steps: - name: AWS 자격증명 (OIDC, 장기 키 없음) uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }} aws-region: ap-northeast-2 - name: ECS 서비스 강제 재배포 run: | aws ecs update-service \ --cluster prod \ --service myapp \ --force-new-deployment

bash -- 서버 측 배포 스크립트 (deploy.sh) #!/usr/bin/env bash set -euo pipefail # GHCR에서 최신 이미지 받기 (사전 docker login ghcr.io 완료 상태) docker compose pull app # 무중단 교체: 새 컨테이너 기동 후 헬스체크 통과 시 전환 docker compose up -d --no-deps --wait app # 오래된 이미지 정리 docker image prune -f