Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Container and Docker best practices for production workloads. Use when user asks to "optimize Docker", "Docker best practices", "container security", "image optimization", "layer caching", "multi-stage builds", "container networking", "volume management", "Docker performance", "reduce image size", "container hardening", "Dockerfile lint", "health checks", "graceful shutdown", "container debugging", "resource limits", "distroless", "tini init", "container logging", or mentions containerization strategies and Docker optimization.
Containerization & Docker Best Practices
Production-grade Docker and containerization strategies for building efficient, secure, and maintainable containers.
Dockerfile Best Practices
Layer Ordering
Order instructions from least to most frequently changing. System deps first, then app deps, then source code. Each instruction creates a layer. Docker caches layers top-down and invalidates everything below a changed layer.
FROM node:20-alpine
RUN apk add --no-cache tini curl
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY . .
ENTRYPOINT ["/sbin/tini", "--"]
CMD ["node", "server.js"]
Multi-Stage Builds
Separate build-time dependencies from runtime. Only copy artifacts you need.
FROM node:20-alpine AS builder
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build
FROM node:20-alpine AS runtime
WORKDIR /app
RUN addgroup -S app && adduser -S app -G app
COPY --from=builder --chown=app:app /app/dist ./dist
COPY --from=builder --chown=app:app /app/node_modules ./node_modules
USER app
CMD ["node", "dist/index.js"]
For statically linked binaries (Go, Rust), use scratch or gcr.io/distroless/static-debian12 as the final stage for minimal images (~2MB).
.dockerignore
Reduces build context size and prevents secrets from leaking into images.
# Bridge - isolated network, containers resolve by name
docker network create app-net
docker run --network app-net --name api myapp
docker run --network app-net --name worker myworker
# worker reaches api at http://api:3000# Host - shares host network stack, no port mapping needed
docker run --network host myapp
# Overlay - multi-host (Swarm)
docker network create --driver overlay --attachable cluster-net
Containers on user-defined bridge networks get DNS resolution by container name. The default bridge network does not provide this.
Volume Management
# Named volumes - Docker-managed, persistent data
docker volume create pgdata
docker run -v pgdata:/var/lib/postgresql/data postgres:16-alpine
# Bind mounts - host directory, good for dev
docker run -v "$(pwd)/src":/app/src:ro myapp
# tmpfs - in-memory, good for secrets/scratch
docker run --tmpfs /tmp:rw,noexec,nosuid,size=128m myapp
# Backup a volume
docker run --rm -v pgdata:/data -v "$(pwd)":/backup \
alpine tar czf /backup/pgdata-backup.tar.gz -C /data .
Logging Best Practices
Applications should write to stdout/stderr, never to files inside the container.
docker exec -it <container> sh # shell into running container
docker logs -f --timestamps --tail 100 <ctr> # follow logs
docker inspect <container> # full config/state/network
docker inspect --format='{{.State.Health.Status}}' <ctr>
docker stats <container> # live resource usage
docker history --no-trunc myapp:latest # image layer sizes
docker cp <ctr>:/app/error.log ./error.log # copy files out
docker run -it --entrypoint sh myapp:latest # debug crashed container
docker run --rm --network container:<ctr> nicolaka/netshoot # network debug
Production Patterns
Graceful Shutdown and Signal Handling
Containers receive SIGTERM on stop. The app must handle it or Docker sends SIGKILL after the grace period (default 10s). Always use exec form so the app is PID 1.
