## Curation Note Docker skills remain essential as containerization becomes standard for both development and production. This skill compiles best practices from cloud provider documentation, security audits, and performance optimization guides. The emphasis on multi-stage builds and non-root users addresses the two most common security and efficiency issues in Docker deployments. Image size reduction techniques can cut build times and storage costs by 80%+. ## Multi-Stage Build Pattern ```dockerfile FROM node:20-alpine AS builder WORKDIR /app COPY package*.json ./ RUN npm ci --only=production COPY . . RUN npm run build FROM node:20-alpine AS production RUN addgroup -g 1001 -S nodejs && \ adduser -S nextjs -u 1001 WORKDIR /app COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules COPY --from=builder --chown=nextjs:nodejs /app/package.json ./ USER nextjs EXPOSE 3000 CMD ["node", "dist/server.js"] ``` ## Docker Compose for Development ```yaml version: '3.8' services: app: build: context: . dockerfile: Dockerfile.dev volumes: - .:/app - /app/node_modules # Preserve container node_modules ports: - '3000:3000' environment: - NODE_ENV=development - DATABASE_URL=postgres://user:pass@db:5432/myapp depends_on: db: condition: service_healthy command: npm run dev db: image: postgres:15-alpine volumes: - postgres_data:/var/lib/postgresql/data environment: POSTGRES_USER: user POSTGRES_PASSWORD: pass POSTGRES_DB: myapp healthcheck: test: ['CMD-SHELL', 'pg_isready -U user -d myapp'] interval: 5s timeout: 5s retries: 5 redis: image: redis:7-alpine volumes: - redis_data:/data command: redis-server --appendonly yes volumes: postgres_data: redis_data: ``` ## Security Best Practices ```dockerfile FROM node:20-alpine RUN apk update && apk upgrade && \ apk add --no-cache dumb-init && \ rm -rf /var/cache/apk/* RUN addgroup -g 1001 -S appgroup && \ adduser -S appuser -u 1001 -G appgroup WORKDIR /app RUN chown -R appuser:appgroup /app COPY --chown=appuser:appgroup . . USER appuser ENTRYPOINT ["dumb-init", "--"] CMD ["node", "server.js"] ``` ## Image Optimization ```dockerfile FROM node:20 FROM node:20-alpine FROM node:20.10.0-alpine3.18 RUN apk add --no-cache python3 make g++ && \ npm ci --only=production && \ npm cache clean --force && \ apk del python3 make g++ ``` ## Health Checks ```dockerfile HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \ CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1 ``` ```javascript // Health check endpoint app.get('/health', (req, res) => { res.json({ status: 'healthy', timestamp: new Date().toISOString(), uptime: process.uptime() }); }); ``` ## Debugging Containers ```bash docker logs -f container_name docker exec -it container_name /bin/sh docker inspect container_name docker stats container_name docker top container_name ``` ## Best Practices Summary 1. **Use multi-stage builds** - Separate build and runtime 2. **Run as non-root** - Never run as root in production 3. **Use Alpine images** - Smaller, more secure 4. **Pin versions** - Avoid `latest` tag 5. **Minimize layers** - Combine RUN commands 6. **Add health checks** - Enable orchestrator monitoring 7. **Use .dockerignore** - Exclude unnecessary files 8. **Don't store secrets** - Use runtime injection ## Related Resources - [Docker Documentation](https://docs.docker.com/) - [Docker Best Practices](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/)