docker-composer

Docker Composer

Workflow en étapes

1. Analyser le contexte

Identifier avant d'écrire une seule ligne :

• Runtime : Node 22 / Python 3.12 / Java 21 / Go 1.22 / .NET 9 ?
• Services : DB (Postgres, Redis, MongoDB ?), broker (RabbitMQ, Kafka ?), reverse proxy ?
• Usage cible : dev local avec hot-reload / CI / image de prod déployée ?
• Contraintes : taille d'image, rootless obligatoire, registry cible ?

2. Choisir la base image

Besoin	Base recommandée	Remarque
Prod légère	node:22-alpine / python:3.12-slim	~50–80 Mo
Prod ultra-sécurisée	gcr.io/distroless/nodejs22-debian12	Pas de shell
Build seulement	node:22-bookworm / maven:3.9-eclipse-temurin-21	Jamais en prod
Go / Rust	scratch ou distroless/static	Binaire statique

Règle : jamais utiliser latest en prod. Épingler le digest ou le tag mineur.

3. Rédiger le Dockerfile (multi-stage)

Pattern canonique Node.js :

# ── Build stage ──────────────────────────────────────────
FROM node:22-alpine AS builder
WORKDIR /app
# Copier UNIQUEMENT les manifestes avant le code → cache layer npm install
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
RUN npm run build

# ── Runtime stage ─────────────────────────────────────────
FROM node:22-alpine AS runtime
ENV NODE_ENV=production
WORKDIR /app
# User non-root AVANT de copier les fichiers
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
USER appuser
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD wget -qO- http://localhost:3000/health || exit 1
CMD ["node", "dist/index.js"]

Pattern Java (Maven → JRE slim) :

FROM maven:3.9-eclipse-temurin-21 AS build
WORKDIR /build
COPY pom.xml .
RUN mvn dependency:go-offline -q
COPY src ./src
RUN mvn package -DskipTests -q

FROM eclipse-temurin:21-jre-alpine AS runtime
RUN addgroup -S app && adduser -S app -G app
WORKDIR /app
COPY --from=build --chown=app:app /build/target/*.jar app.jar
USER app
EXPOSE 8080
HEALTHCHECK CMD wget -qO- http://localhost:8080/actuator/health || exit 1
ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75.0", "-jar", "app.jar"]