Docker

What I do

• Write efficient Dockerfiles using multi-stage builds
• Optimize image size with minimal base images
• Properly structure docker-compose configurations
• Implement health checks
• Use .dockerignore effectively
• Follow security best practices for containers
• Manage environment variables and secrets properly

When to use me

When creating Dockerfiles, docker-compose files, or container-related configurations.

Multi-stage Dockerfile

# Builder stage
FROM python:3.11-slim-bookworm AS builder

WORKDIR /build

RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

# Runtime stage
FROM python:3.11-slim-bookworm AS runtime

WORKDIR /home/runner/workspace

COPY --from=builder /install /usr/local

COPY src/ ./src/

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

RUN addgroup --gid 1000 appgroup && \
    adduser --uid 1000 --gid 1000 --shell /bin/bash appuser

USER appuser

EXPOSE 5000

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:5000/health')" || exit 1

CMD ["python", "src/main.py"]

Docker Compose

version: '3.8'

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "5000:5000"
    environment:
      - DATABASE_URL=postgres://user:pass@db:5432/app
      - REDIS_URL=redis://cache:6379
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_started
    volumes:
      - ./src:/home/runner/workspace/src
      - app_data:/home/runner/workspace/data
    networks:
      - app_network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:5000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3

  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: app
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d app"]
      interval: 10s
      timeout: 5s
      retries: 5

  cache:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data

volumes:
  postgres_data:
  redis_data:
  app_data:

networks:
  app_network:
    driver: bridge

Security Best Practices

• Don't run as root
• Use specific tags, not :latest
• Scan images for vulnerabilities
• Don't include secrets in build context
• Use read-only filesystems where possible
• Limit capabilities

Commands

# Build and run
docker build -t myapp:latest .
docker run -p 5000:5000 myapp:latest

# View logs and debug
docker compose logs -f
docker exec -it container_name bash

# Clean up
docker system prune -a
docker volume prune