Docker CI CD Integration

Docker CI/CD Integration

Using Docker in CI/CD pipelines for build, test, and deploy.

GitHub Actions

# .github/workflows/docker.yml
name: Docker Build and Push

on:
  push:
    branches: [main]
    tags: ['v*']

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=sha,format=short

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

GitLab CI

# .gitlab-ci.yml
variables:
  DOCKER_HOST: tcp://docker:2375
  DOCKER_TLS_CERTDIR: ""
  DOCKER_DRIVER: overlay2

services:
  - docker:dind

stages:
  - test
  - build
  - deploy

test:
  stage: test
  script:
    - docker compose -f docker-compose.test.yml up -d --wait
    - docker compose exec -T app npm test
    - docker compose down -v

build:
  stage: build
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker buildx create --use
    - docker buildx build --platform linux/amd64,linux/arm64
        -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
        -t $CI_REGISTRY_IMAGE:latest
        --push .

Local CI Simulation

# Run the same build locally
docker buildx build --platform linux/amd64 -t myapp:test .
docker compose -f docker-compose.test.yml up -d --wait
docker compose exec -T app npm test
docker compose down -v

Docker-in-Docker (DinD) vs Docker-Outside-Docker (DooD)

# DinD (run Docker inside Docker -- needs privileged)
services:
  docker:
    image: docker:dind
    privileged: true

# DooD (bind-mount host Docker socket -- no privileged mode)
runs-on: ubuntu-latest
services:
  docker:
    image: docker:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

Caching Strategy

# GitHub Actions: cache between runs
- uses: docker/build-push-action@v5
  with:
    cache-from: type=gha
    cache-to: type=gha,mode=max

# Self-hosted: registry cache
  with:
    cache-from: type=registry,ref=myrepo/cache
    cache-to: type=registry,ref=myrepo/cache,mode=max

# Local: filesystem cache
  with:
    cache-from: type=local,src=/tmp/.buildx-cache
    cache-to: type=local,dest=/tmp/.buildx-cache

Testing in CI

# Service containers in CI
jobs:
  test:
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_PASSWORD: testpass
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - run: npm test
        env:
          DB_URL: postgres://postgres:testpass@postgres:5432/postgres

Pitfalls

• DinD needs privileged: true -- security risk; prefer DooD when possible
• Cache registry needs mode=max to cache multi-stage build layers
• GitHub Actions cache has 10GB limit per repo -- rotate regularly
• Docker socket mounting gives container root access to host -- restrict carefully
• Matrix builds for multi-arch can be separate jobs or one multi-platform build