Devops Iac

2. Containerization (Docker) Best Practices

• Multi-Stage Builds: Separate build-time toolchains from final minimal runtime images (e.g. Alpine, Distroless, Debian-Slim).
• Non-Root Execution: Explicitly define and switch to a non-root USER inside the Dockerfile before exposing entrypoints.
• Cache Optimization: Order Dockerfile commands from least-frequently changed to most-frequently changed (copy dependency files $\rightarrow$ install packages $\rightarrow$ copy source code).

3. Tool Binary Resolution Chains

When authoring scripts that invoke external binaries (e.g., terraform, ffmpeg, pandoc, ollama):

1. Environment Override: Check explicit environment variable (e.g. os.environ.get("TERRAFORM_PATH")).
2. Known OS Paths: Check standard default installation paths (e.g. C:\Program Files\Terraform\terraform.exe on Windows or /usr/local/bin/terraform on Linux).
3. System PATH Fallback: Resolve via system PATH (shutil.which("terraform")).

4. Sequential & Batch Script Execution Discipline

When authoring automation scripts that process long-running or large data batches:

• Continuous Logging: Flush output (flush=True in Python) to a designated log file so progress updates live.
• Checkpoint Persistence: Save execution state/offsets incrementally to disk to allow resuming on failure.
• Graceful Exit: Attach a SIGINT (Ctrl+C) signal handler to cleanly commit transactions and release resources before termination.