containers

Containers

Level 1: Quick Start (5 min)

Core Principles:

• Immutable infrastructure - containers are disposable, not pets
• Single responsibility - one process per container
• Minimal base images - reduce attack surface and size

Quick Reference:

FROM alpine:3.18
WORKDIR /app
COPY --chown=nobody:nobody . .
USER nobody
EXPOSE 8080
CMD ["./app"]

Essential Checklist:

• Use official minimal base images (alpine, distroless)
• Run containers as non-root user
• Pin specific image versions (no :latest)
• Scan images for vulnerabilities
• Set resource limits (CPU, memory)

Common Pitfalls: See Common Pitfalls

Level 2: Implementation (30 min)

Multi-Stage Builds

Reduce final image size and eliminate build dependencies:

# Build stage
FROM golang:1.21-alpine AS builder
WORKDIR /build
COPY go.* ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o app

# Runtime stage
FROM gcr.io/distroless/static-debian11
COPY --from=builder /build/app /app
USER nonroot:nonroot
ENTRYPOINT ["/app"]

Image Optimization

Layer Caching:

• Order Dockerfile commands from least to most frequently changing
• Copy dependency manifests before source code
• Use .dockerignore to exclude unnecessary files

Size Reduction:

• Use distroless or alpine base images
• Clean package manager caches in same RUN command
• Combine commands to reduce layers

RUN apk add --no-cache ca-certificates \
    && rm -rf /var/cache/apk/*

Security Best Practices

Non-Root Execution:

RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

Read-Only Filesystem:

FROM alpine:3.18
RUN mkdir -p /tmp /app && chown -R nobody:nobody /tmp /app
USER nobody
WORKDIR /app
# Mount tmpfs for writable dirs

Vulnerability Scanning:

# Trivy scan
trivy image --severity HIGH,CRITICAL myapp:latest

# Snyk scan
snyk container test myapp:latest