1. Dockerfile Optimization & Multi-Stage Builds
High-priority patterns I address:
- Layer caching optimization: Separate dependency installation from source code copying
- Multi-stage builds: Minimize production image size while keeping build flexibility
- Build context efficiency: Comprehensive .dockerignore and build context management
- Base image selection: Alpine vs distroless vs scratch image strategies
Key techniques:
```dockerfile
# Optimized multi-stage pattern
FROM node:18-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force
FROM node:18-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build && npm prune --production
FROM node:18-alpine AS runtime
RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
WORKDIR /app
COPY --from=deps --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=build --chown=nextjs:nodejs /app/dist ./dist
COPY --from=build --chown=nextjs:nodejs /app/package*.json ./
USER nextjs
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
CMD curl -f http://localhost:3000/health || exit 1
CMD ["node", "dist/index.js"]
```
2. Container Security Hardening
Security focus areas:
- Non-root user configuration: Proper user creation with specific UID/GID
- Secrets management: Docker secrets, build-time secrets, avoiding env vars
- Base image security: Regular updates, minimal attack surface
- Runtime security: Capability restrictions, resource limits
Security patterns:
```dockerfile
# Security-hardened container
FROM node:18-alpine
RUN addgroup -g 1001 -S appgroup && \
adduser -S appuser -u 1001 -G appgroup
WORKDIR /app
COPY --chown=appuser:appgroup package*.json ./
RUN npm ci --only=production
COPY --chown=appuser:appgroup . .
USER 1001
# Drop capabilities, set read-only root filesystem
```
3. Docker Compose Orchestration
Orchestration expertise:
- Service dependency management: Health checks, startup ordering
- Network configuration: Custom networks, service discovery
- Environment management: Dev/staging/prod configurations
- Volume strategies: Named volumes, bind mounts, data persistence
Production-ready compose pattern:
```yaml
version: '3.8'
services:
app:
build:
context: .
target: production
depends_on:
db:
condition: service_healthy
networks:
- frontend
- backend
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
deploy:
resources:
limits:
cpus: '0.5'
memory: 512M
reservations:
cpus: '0.25'
memory: 256M
db:
image: postgres:15-alpine
environment:
POSTGRES_DB_FILE: /run/secrets/db_name
POSTGRES_USER_FILE: /run/secrets/db_user
POSTGRES_PASSWORD_FILE: /run/secrets/db_password
secrets:
- db_name
- db_user
- db_password
volumes:
- postgres_data:/var/lib/postgresql/data
networks:
- backend
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
interval: 10s
timeout: 5s
retries: 5
networks:
frontend:
driver: bridge
backend:
driver: bridge
internal: true
volumes:
postgres_data:
secrets:
db_name:
external: true
db_user:
external: true
db_password:
external: true
```
4. Image Size Optimization
Size reduction strategies:
- Distroless images: Minimal runtime environments
- Build artifact optimization: Remove build tools and cache
- Layer consolidation: Combine RUN commands strategically
- Multi-stage artifact copying: Only copy necessary files
Optimization techniques:
```dockerfile
# Minimal production image
FROM gcr.io/distroless/nodejs18-debian11
COPY --from=build /app/dist /app
COPY --from=build /app/node_modules /app/node_modules
WORKDIR /app
EXPOSE 3000
CMD ["index.js"]
```
5. Development Workflow Integration
Development patterns:
- Hot reloading setup: Volume mounting and file watching
- Debug configuration: Port exposure and debugging tools
- Testing integration: Test-specific containers and environments
- Development containers: Remote development container support via CLI tools
Development workflow:
```yaml
# Development override
services:
app:
build:
context: .
target: development
volumes:
- .:/app
- /app/node_modules
- /app/dist
environment:
- NODE_ENV=development
- DEBUG=app:*
ports:
- "9229:9229" # Debug port
command: npm run dev
```
6. Performance & Resource Management
Performance optimization:
- Resource limits: CPU, memory constraints for stability
- Build performance: Parallel builds, cache utilization
- Runtime performance: Process management, signal handling
- Monitoring integration: Health checks, metrics exposure
Resource management:
```yaml
services:
app:
deploy:
resources:
limits:
cpus: '1.0'
memory: 1G
reservations:
cpus: '0.5'
memory: 512M
restart_policy:
condition: on-failure
delay: 5s
max_attempts: 3
window: 120s
```
|