Docker Setup

16 items · Technical · Hard difficulty · 1 hour

Set up secure, efficient Docker images and local dev containers.

• Initialize repository with a Dockerfile and .dockerignore

  .dockerignore should exclude node_modules, .git, build artifacts, and local env files.

• Write a multi-stage Dockerfile to separate build and runtime

  Compile in a builder stage and copy only runtime artifacts to the final image to reduce size.

• Pin base image versions and use a lightweight base

  Use exact tags (e.g., node:18-slim) and prefer slim/alpine images when appropriate.

• Create a non-root user and drop privileges in the image

  Use USER, set correct ownership, and avoid running processes as root.

• Optimize Dockerfile layers and caching
• Set WORKDIR and copy dependency manifests before source to leverage cache
• Combine package manager commands and clean caches in a single RUN

  Reduce layer count and remove package lists or temp files in the same command.

• Minimize image contents by removing build tools and unnecessary files

  Install build tools only in the builder stage and exclude tests/tools from final image.

• Add HEALTHCHECK in the Dockerfile or in docker-compose

  Set sensible interval, timeout, and retries for realistic health probes.

• Inject environment variables securely using env_file for dev and secrets for prod

  Use docker-compose env_file locally and Docker secrets or a secret manager in production.

• Avoid baking secrets into images and use build-args only for non-sensitive values

  Never commit .env or credentials to the repo; treat build args as non-secret.

• Configure logging and mount log volumes or set a logging driver

  Mount host paths for logs or configure drivers (json-file, syslog, fluentd) for aggregation.

• Create docker-compose.yml for local development with ports, volumes, and dependencies

  Use depends_on with healthchecks and define env_file, named volumes, and networks.

• Build, tag (semantic + latest), and run the image locally; run smoke tests

  Verify healthcheck, exposed ports, and logs before publishing.

• Tag and push images to your registry from CI using stored credentials

  Use CI secrets, short-lived tokens, and avoid embedding creds in pipelines.

• Scan images for vulnerabilities and enforce policies in the CI pipeline

  Use tools like Trivy or Clair and fail builds on critical CVEs; consider image signing.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.