docker

docker Best Practices

Docker is the cornerstone of modern container-first development. Treat your Dockerfile and docker-compose.yml as critical source code. These rules ensure your images are fast, secure, reproducible, and aligned with modern DevOps practices.

1. Optimize for Multi-Stage Builds

Always use multi-stage builds. This pattern isolates build-time dependencies from runtime, drastically reducing final image size and attack surface.

❌ BAD: Single-stage build with all dependencies

FROM node:20
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build
CMD ["node", "dist/server.js"]

✅ GOOD: Multi-stage build for production

# Stage 1: Build application artifacts
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production # Install only production dependencies for build
COPY . .
RUN npm run build

# Stage 2: Create minimal runtime image
FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules # Copy only necessary runtime modules
USER node # Run as non-root user
EXPOSE 3000
CMD ["node", "dist/server.js"]

2. Choose Minimal, Trusted Base Images

Start with the smallest possible base image from a trusted source (Docker Official Images, Verified Publishers). Alpine variants are often the best choice for minimal footprints.

❌ BAD: Large, generic base image

FROM ubuntu:latest # Too large, many unnecessary packages and vulnerabilities

✅ GOOD: Minimal, specific base image

FROM node:20-alpine # Official, small, specific to Node.js
# Or for static content:
FROM nginx:alpine

3. Leverage .dockerignore

Always use a .dockerignore file to exclude irrelevant files and directories from your build context. This significantly speeds up builds and prevents sensitive or unnecessary files from being copied into the image.

❌ BAD: No .dockerignore (sends node_modules, .git, .env, etc., to the daemon)