docker-patterns

Docker Patterns

This skill covers building the image and running it locally. What to do with that image in production (rollout strategy, health probes, rollback) is deployment-patterns; how it gets built and pushed in automation is ci-cd-and-automation.

Multi-stage Dockerfile (Go)

Go's static binary output makes a minimal final image straightforward — this should be the default shape for any Go service in this organization:

# Stage 1: build
FROM golang:1.23-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /server ./cmd/server

# Stage 2: minimal runtime — no shell, no package manager, no Go toolchain
FROM gcr.io/distroless/static-debian12:nonroot AS runner
COPY --from=builder /server /server
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/server"]

distroless/static has no shell — this is a deliberate security choice (smaller attack surface, nothing for an attacker to exec into even with a code-execution bug), not an oversight. If you genuinely need shell debugging in the runtime image, use distroless/static-debian12:debug (adds busybox) rather than reverting to a full Alpine/Debian base for every service.

Copying go.mod/go.sum before the rest of the source lets Docker cache the go mod download layer across builds where only application code changed — reordering COPY . . before dependency install defeats this caching and slows every rebuild.

Multi-stage Dockerfile (TypeScript/Node)

FROM node:22-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci

FROM node:22-alpine AS build
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build && npm prune --production

FROM node:22-alpine AS production
WORKDIR /app
RUN addgroup -g 1001 -S appgroup && adduser -S appuser -u 1001 -G appgroup
USER appuser
COPY --from=build --chown=appuser:appgroup /app/dist ./dist
COPY --from=build --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=build --chown=appuser:appgroup /app/package.json ./
ENV NODE_ENV=production
EXPOSE 3000
CMD ["node", "dist/server.js"]