docker

# Docker ## Image security - Never run as root. Prefer images with built-in non-root user: distroless `nonroot`, `node` user in Node images, `nobody` in Alpine. Otherwise add non-root user and switch: `USER appuser` - Minimal base: `distroless`, `alpine`, or official slim variants - Pin by digest or immutable tag. Never `FROM node:latest` or `image: myapp:latest` in Compose - Multi-stage builds: build in full image, copy only artifact to minimal runtime image - No build tools in final image - Scan with Trivy or Grype in CI. Fail on critical/high CVEs - Multi-arch: build with `--platform linux/amd64,linux/arm64` for cross-platform targets ## Dockerfile - One process per container - Enable BuildKit: `DOCKER_BUILDKIT=1`. Use `--mount=type=cache` for dependency caches, `--mount=type=secret` for build-time secrets - `COPY` specific files. Avoid `COPY . .` when targeted copy suffices - Layer order: least → most frequently changed. `COPY package.json` before `COPY src/` - `.dockerignore`: exclude `.git`, `node_modules`, test files, secrets, `.env` - Explicit `WORKDIR`. No implicit root working dir - `ENTRYPOINT` for executable, `CMD` for default args - No secrets in `ENV`, `ARG`, or `RUN` — persist in layer history. Use `--mount=type=secret` - `HEALTHCHECK` on all long-running services ## Runtime - Read-only root filesystem where possible: `--read-only` - Drop all capabilities, re-add only what's needed: `--cap-drop ALL --cap-add NET_BIND_SERVICE` - No `--privileged` in production - Set resource limits: `--memory`, `--cpus` - Named volumes for persistent data. No bind mounts in production - No secrets via env vars. Use Docker secrets or mounted secret files - Log rotation: set `--log-opt max-size=10m --log-opt max-file=3`. Unbounded logs fill disks ## Compose - `compose.yml` for local dev only. Production: Kubernetes, ECS, or equivalent - Explicit dependencies: `depends_on` + `condition: service_healthy` - Named volumes for persistent data. Never rely on container filesystem - `env_file` for local config. Never commit `.env` with real secrets - `restart: unless-stopped` for crash-resilient services - Custom networks per service group. Avoid default bridge - `profiles:` for optional services (e.g. debug tools, mock servers). Keep default startup lean ## Maintenance - `docker system prune -f` regularly. Dangling images and stopped containers accumulate fast - `docker image prune -a` to remove unused images. Run in CI after builds - Inspect layer bloat with `dive` before pushing large images ## Local tooling - **Colima**: `colima start --cpu 4 --memory 8 --disk 60`. Default VM is undersized - Switch context after start: `docker context use colima` - `colima stop` when not in use. Idle VM still consumes resources - **OrbStack**: preferred on Apple Silicon — lower memory overhead, faster mounts - Both are license-free alternatives to Docker Desktop for teams - Lima/Colima: use `~/.lima/<profile>` for multiple VM profiles (e.g. `arm64`, `rosetta`)