# Containerization

> Application containerization with Docker

- Skill: `ffsshhttiikk/containerization` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ffsshhttiikk/containerization`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ffsshhttiikk/containerization/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: ffsshhttiikk (https://skillmd.com/u/ffsshhttiikk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ffsshhttiikk/containerization

---


## What I do

- Containerize applications using Docker and containerd
- Optimize Docker images for size and security
- Configure multi-stage builds for efficient deployments
- Set up private container registries
- Implement container security scanning
- Build containerized development workflows

## When to use me

- When packaging applications for deployment
- When creating consistent development environments
- When migrating applications to Kubernetes
- When optimizing application delivery
- When implementing microservices
- When building CI/CD pipelines

## Key Concepts

### Dockerfile Best Practices

```dockerfile
# Multi-stage build for Go application
# Build stage
FROM golang:1.21-alpine AS builder

WORKDIR /app

# Install dependencies first for better caching
COPY go.mod go.sum ./
RUN go mod download

# Copy source code
COPY . .

# Build binary
RUN CGO_ENABLED=0 GOOS=linux go build \
    -a -installsuffix cgo \
    -o main .

# Production stage
FROM alpine:3.18

# Install certificates
RUN apk --no-cache add ca-certificates

# Create non-root user
RUN adduser -D -u 1000 appuser

WORKDIR /app

# Copy binary from builder
COPY --from=builder /app/main .

# Switch to non-root user
USER appuser

EXPOSE 8080

CMD ["./main"]
```

### Docker Compose

```yaml
version: '3.8'

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "8080:8080"
    environment:
      - DATABASE_URL=postgres://db:5432/app
      - REDIS_URL=redis://cache:6379
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_started
    networks:
      - backend
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  db:
    image: postgres:15-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: app
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d app"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - backend

  cache:
    image: redis:7-alpine
    networks:
      - backend

volumes:
  postgres_data:

networks:
  backend:
    driver: bridge
```

### Image Optimization

```dockerfile
# Use specific tags, not latest
FROM node:20-alpine

# Use .dockerignore
# node_modules
# .git
# *.md
# tests/

# Combine RUN commands
RUN apk add --no-cache \
    && rm -rf /var/cache/apk/*

# Don't run as root
USER node

# Use COPY, not ADD (unless extracting archives)
COPY --chown=node:node package*.json ./
RUN npm ci --only=production

# Health check
HEALTHCHECK --interval=30s --timeout=3s \
    CMD wget --quiet --tries=1 --spider http://localhost:3000/health || exit 1
```

### Security Scanning

```bash
# Scan for vulnerabilities
trivy image myapp:latest

# Scan with severity filter
trivy image --severity HIGH,CRITICAL myapp:latest

# Scan in CI/CD
docker scout cves myapp:latest

# Sysbox for secure containers
docker run --runtime=sysbox-runc myapp:latest
```

### Registry Configuration

```yaml
# Docker config for private registry
{
  "auths": {
    "registry.example.com": {
      "username": "deploy",
      "password": "${REGISTRY_PASSWORD}"
    }
  },
  "experimental": "disabled",
  "debug": "false"
}
```