Docker Skill

Container best practices for development, building, and deployment.

When to Use This Skill

• Writing Dockerfiles
• Configuring docker-compose
• Optimizing container images
• Container security
• Multi-stage builds

📦 Dockerfile Best Practices

Multi-Stage Build (Go)

dockerfile
1# Build stage
2FROM golang:1.22-alpine AS builder
3
4WORKDIR /app
5
6# Cache dependencies
7COPY go.mod go.sum ./
8RUN go mod download
9
10# Build
11COPY . .
12RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o /app/server ./cmd/main.go
13
14# Runtime stage
15FROM alpine:3.19
16
17RUN apk --no-cache add ca-certificates tzdata
18
19WORKDIR /app
20
21# Copy binary from builder
22COPY --from=builder /app/server .
23COPY --from=builder /app/config.yaml .
24
25# Non-root user
26RUN adduser -D -g '' appuser
27USER appuser
28
29EXPOSE 8080
30
31ENTRYPOINT ["./server"]

Multi-Stage Build (Node.js)

dockerfile
1# Dependencies stage
2FROM node:20-alpine AS deps
3WORKDIR /app
4COPY package.json yarn.lock ./
5RUN yarn install --frozen-lockfile
6
7# Build stage
8FROM node:20-alpine AS builder
9WORKDIR /app
10COPY --from=deps /app/node_modules ./node_modules
11COPY . .
12RUN yarn build
13
14# Runtime stage
15FROM node:20-alpine AS runner
16WORKDIR /app
17
18ENV NODE_ENV=production
19
20RUN addgroup -g 1001 -S nodejs
21RUN adduser -S nextjs -u 1001
22
23COPY --from=builder /app/public ./public
24COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
25COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
26
27USER nextjs
28
29EXPOSE 3000
30ENV PORT 3000
31
32CMD ["node", "server.js"]

🔧 Layer Optimization

Order Matters

dockerfile
1# ✅ Good: Least changing files first
2COPY go.mod go.sum ./
3RUN go mod download
4
5COPY . .
6RUN go build -o app
7
8# ❌ Bad: COPY all invalidates cache
9COPY . .
10RUN go mod download
11RUN go build -o app

Reduce Layers

dockerfile
1# ❌ Bad: Multiple RUN commands
2RUN apt-get update
3RUN apt-get install -y curl
4RUN apt-get install -y git
5RUN rm -rf /var/lib/apt/lists/*
6
7# ✅ Good: Single RUN command
8RUN apt-get update && \
9    apt-get install -y --no-install-recommends \
10        curl \
11        git && \
12    rm -rf /var/lib/apt/lists/*

Use .dockerignore

dockerignore
1# Git
2.git
3.gitignore
4
5# Dependencies
6node_modules
7vendor
8
9# Build artifacts
10dist
11build
12*.exe
13
14# Development files
15*.md
16*.log
17.env.local
18.vscode
19.idea
20
21# Tests
22*_test.go
23__tests__
24coverage

🐳 Docker Compose

Development Setup

yaml
1version: '3.8'
2
3services:
4  app:
5    build:
6      context: .
7      dockerfile: Dockerfile.dev
8    ports:
9      - "8080:8080"
10    volumes:
11      - .:/app
12      - /app/node_modules  # Exclude node_modules
13    environment:
14      - DATABASE_URL=postgres://user:pass@db:5432/app
15      - REDIS_URL=redis://redis:6379
16    depends_on:
17      db:
18        condition: service_healthy
19      redis:
20        condition: service_started
21
22  db:
23    image: postgres:16-alpine
24    environment:
25      POSTGRES_USER: user
26      POSTGRES_PASSWORD: pass
27      POSTGRES_DB: app
28    volumes:
29      - postgres_data:/var/lib/postgresql/data
30    ports:
31      - "5432:5432"
32    healthcheck:
33      test: ["CMD-SHELL", "pg_isready -U user -d app"]
34      interval: 5s
35      timeout: 5s
36      retries: 5
37
38  redis:
39    image: redis:7-alpine
40    ports:
41      - "6379:6379"
42    volumes:
43      - redis_data:/data
44
45volumes:
46  postgres_data:
47  redis_data:

Production Setup

yaml
1version: '3.8'
2
3services:
4  app:
5    image: ${REGISTRY}/app:${VERSION}
6    deploy:
7      replicas: 3
8      resources:
9        limits:
10          cpus: '1'
11          memory: 512M
12        reservations:
13          cpus: '0.5'
14          memory: 256M
15      restart_policy:
16        condition: on-failure
17        delay: 5s
18        max_attempts: 3
19    environment:
20      - DATABASE_URL=${DATABASE_URL}
21    healthcheck:
22      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
23      interval: 30s
24      timeout: 10s
25      retries: 3
26      start_period: 40s
27    logging:
28      driver: "json-file"
29      options:
30        max-size: "10m"
31        max-file: "3"
32
33  nginx:
34    image: nginx:alpine
35    ports:
36      - "80:80"
37      - "443:443"
38    volumes:
39      - ./nginx.conf:/etc/nginx/nginx.conf:ro
40      - ./certs:/etc/nginx/certs:ro
41    depends_on:
42      - app

🔒 Security

Run as Non-Root

dockerfile
1# Create non-root user
2RUN addgroup -g 1001 -S appgroup && \
3    adduser -u 1001 -S appuser -G appgroup
4
5# Change ownership
6COPY --chown=appuser:appgroup . .
7
8# Switch to non-root user
9USER appuser

Scan for Vulnerabilities

bash
1# Using Docker Scout
2docker scout cves myimage:latest
3
4# Using Trivy
5trivy image myimage:latest
6
7# Using Snyk
8snyk container test myimage:latest

Read-Only Filesystem

yaml
1services:
2  app:
3    read_only: true
4    tmpfs:
5      - /tmp
6      - /var/run

📊 Health Checks

dockerfile
1HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
2  CMD curl -f http://localhost:8080/health || exit 1

go
1// Health endpoint
2func (h *Handler) Health(w http.ResponseWriter, r *http.Request) {
3    checks := map[string]string{
4        "database": h.checkDB(),
5        "redis":    h.checkRedis(),
6    }
7    
8    healthy := true
9    for _, status := range checks {
10        if status != "ok" {
11            healthy = false
12            break
13        }
14    }
15    
16    if healthy {
17        w.WriteHeader(http.StatusOK)
18    } else {
19        w.WriteHeader(http.StatusServiceUnavailable)
20    }
21    json.NewEncoder(w).Encode(checks)
22}

🛠️ Useful Commands

bash
1# Build
2docker build -t myapp:latest .
3docker build --no-cache -t myapp:latest .  # Fresh build
4
5# Run
6docker run -d -p 8080:8080 --name myapp myapp:latest
7docker run --rm -it myapp:latest /bin/sh  # Interactive
8
9# Logs
10docker logs -f myapp
11docker logs --tail 100 myapp
12
13# Exec into container
14docker exec -it myapp /bin/sh
15
16# Cleanup
17docker system prune -a  # Remove all unused
18docker volume prune     # Remove unused volumes
19docker image prune      # Remove dangling images
20
21# Inspect
22docker stats            # Resource usage
23docker inspect myapp    # Container details
24docker history myapp    # Image layers

📚 References

• Docker Best Practices
• Docker Security
• dmmulroy/cloudflare-skill