dare-docker

/dare-docker

Containerização DARE com Dockerfile e docker-compose seguros, performantes e idiomáticos. Multi-stage, usuário não-root, healthchecks, redes isoladas.

Como usar

/dare-docker                        # detecta stack e gera Dockerfile + compose + .dockerignore
/dare-docker dockerfile             # só Dockerfile
/dare-docker compose                # só docker-compose.yml
/dare-docker review                 # audita Dockerfile/compose existente

Padrões para Dockerfile

1. Multi-stage build (obrigatório)

Separe build (compiladores) de runtime (artefato + libs mínimas).

2. Imagens base

• Alpine ou distroless quando possível
• Tag explícita (php:8.3-fpm-alpine, nunca latest)
• Pin de versão

3. Usuário não-root

RUN adduser -D -u 1000 appuser
USER appuser

4. Cache de camadas

Ordem: FROM → install deps → COPY deps lockfile → install deps → COPY src → build.

5. Limpeza na mesma camada

RUN apt-get update && \
    apt-get install -y --no-install-recommends pkg && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

Padrões por stack

PHP/Laravel

FROM php:8.3-fpm-alpine
RUN docker-php-ext-install pdo_pgsql opcache bcmath
WORKDIR /var/www/html
COPY composer.json composer.lock ./
RUN composer install --no-dev --no-interaction --optimize-autoloader
COPY . .
USER www-data
EXPOSE 9000
CMD ["php-fpm"]

Python/FastAPI

FROM python:3.11-slim
RUN useradd -m -u 1000 appuser
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY --chown=appuser:appuser . .
USER appuser
EXPOSE 8000
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

Go

FROM golang:1.22-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /server ./cmd/server

FROM scratch
COPY --from=builder /server /server
EXPOSE 8080
USER 1000:1000
ENTRYPOINT ["/server"]