docker

Docker

Docker standardizes application delivery by packaging software into portable OCI containers, utilizing BuildKit multi-stage builds and vulnerability scanning for secure supply chains.

When to Use

• Application Containerization: Packaging code, runtime, system libraries, and settings into portable, reproducible container images.
• Multi-Stage Build Optimization: Creating ultra-small, secure production container images stripped of compilers and build tooling.
• Local Microservice Development: Orchestrating multi-container environments (app, database, cache) with Docker Compose.
• Standardized CI/CD Artifacts: Building OCI-compliant images deployed to Kubernetes, ECS, or serverless container runtimes.

Quick Start

# syntax=docker/dockerfile:1
FROM node:22-alpine AS base
WORKDIR /app
COPY package*.json ./

FROM base AS deps
RUN npm ci

FROM base AS release
COPY --from=deps /app/node_modules ./node_modules
COPY . .
CMD ["node", "index.js"]

Core Concepts

Multi-Stage Production Dockerfile

Building a minimal, secure Node.js container with non-root user:

# syntax=docker/dockerfile:1.7
# Stage 1: Build & Dependencies
FROM node:22-alpine AS builder
WORKDIR /app

COPY package*.json ./
RUN npm ci

COPY . .
RUN npm run build && npm prune --production

# Stage 2: Distroless/Minimal Production Runtime
FROM node:22-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production

# Security: Run as unprivileged non-root user
USER node

# Copy only production artifacts
COPY --chown=node:node --from=builder /app/node_modules ./node_modules
COPY --chown=node:node --from=builder /app/dist ./dist
COPY --chown=node:node --from=builder /app/package.json ./package.json

EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/healthz || exit 1

ENTRYPOINT ["node", "dist/index.js"]

Multi-Container Orchestration with Docker Compose

Defining local development stacks with health checks: