devops-practices

DevOps Practices

Directives for CI/CD, containerisation, orchestration, IaC, monitoring, and logging.

---

CI/CD Pipeline Directives

Stages and quality gates

• Use separate stages: test → build → deploy; do not run deploy without passing test and build.
• Run lint, type-check, and unit tests before build; fail the pipeline on any failure.
• Run security audit (npm audit --audit-level=high or equivalent) before build; treat high/critical as blocking.
• Build and push images only after tests pass; tag images with commit SHA or short hash, not only latest.
• Deploy only from protected branches (e.g. main); gate deployments on approval or environment checks.
• Use matrix builds for multi-version testing when relevant; cache dependencies between jobs.
• Upload coverage reports; fail if coverage falls below thresholds.

What to include

• Checkout, dependency install, lint, test, security audit in sequence.
• Build stage with caching (e.g. cache-from / cache-to for Docker).
• Deploy stage with explicit rollout verification (e.g. kubectl rollout status).
• Use secrets for credentials; never commit secrets or use env vars in config files.

---

Docker Directives

Multi-stage builds

• Use multi-stage builds: separate build stage from runtime stage; copy only built artefacts.
• Use FROM for each stage; do not mix build and runtime tools in the final image.
• Use --only=production or equivalent for install when building runtime images.

Non-root and security

• Create and use a non-root user; run as that user in the final stage.
• Use COPY --chown=user:group to avoid root-owned files.
• Apply security updates in the base image (apk update && apk upgrade or equivalent).
• Remove cache, temp files, and unnecessary tools before final image.

Health checks and image size

• Add HEALTHCHECK with interval, timeout, start-period, and retries.
• Point health checks at a dedicated /health or similar endpoint; avoid heavy logic.
• Prefer smaller base images (e.g. -alpine); avoid latest tag; pin versions.
• Use .dockerignore to exclude build artefacts, tests, and docs from the build context.