docker

name	docker
description	Docker containerization for application packaging, isolation, and deployment
license	MIT
compatibility	opencode
metadata	{"audience":"developers","category":"systems-administration"}

What I do

• Create Docker images with Dockerfiles
• Manage containers and multi-container applications
• Configure Docker networking and volumes
• Implement container security
• Optimize image sizes with multi-stage builds
• Use Docker Compose for local development
• Manage Docker registries
• Implement health checks and logging
• Handle container orchestration basics
• Debug container issues

When to use me

When containerizing applications, creating Docker images, managing containers locally or in CI/CD pipelines.

Core Concepts

• Dockerfile instructions and best practices
• Multi-stage builds for optimization
• Container networking (bridge, host, overlay)
• Volume management and bind mounts
• Docker Compose for multi-container apps
• Image layering and caching
• Container security (non-root, seccomp, capabilities)
• Health checks and restart policies
• Registry operations and image scanning
• Docker daemon configuration

Code Examples

Dockerfile Examples

# Multi-stage build for Go application
# ======== BUILDER STAGE ========
FROM golang:1.21-alpine AS builder

WORKDIR /build

# Copy go modules first for better caching
COPY go.mod go.sum ./
RUN go mod download && go mod verify

# Copy source code
COPY . .

# Build the application
RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags="-s -w" \
    -o /app/server \
    ./cmd/server

# ======== RUNTIME STAGE ========
FROM alpine:3.19 AS runtime

# Install minimal runtime dependencies
RUN apk --no-cache add \
    ca-certificates \
    tzdata \
    && rm -rf /var/cache/apk/*

# Create non-root user
RUN addgroup -g 1000 appgroup && \
    adduser -u 1000 -G appgroup -s /bin/sh -D appuser

# Set working directory
WORKDIR /home/appuser

# Copy binary from builder
COPY --from=builder /app/server .

# Create data directory
RUN mkdir -p /home/appuser/data && chown -R appuser:appgroup /home/appuser

# Switch to non-root user
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1

# Expose application port
EXPOSE 8080

# Set environment variables
ENV APP_ENV=production
ENV APP_PORT=8080

# Run the application
ENTRYPOINT ["/app/server"]

# Multi-service application with Docker Compose
# Frontend service
FROM node:20-alpine AS frontend-builder

WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM nginx:alpine
COPY --from=frontend-builder /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/nginx.conf
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

Docker Compose Configuration

version: "3.8"

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    image: myapp:${VERSION:-latest}
    container_name: myapp
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      - DATABASE_URL=postgresql://user:pass@db:5432/myapp
      - REDIS_URL=redis://cache:6379
      - APP_ENV=production
    env_file:
      - .env.production
    volumes:
      - app-data:/home/appuser/data
      - ./logs:/home/appuser/logs
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_started
    networks:
      - app-network
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
      interval: 
       
       
       
    
      
        
           
           
        
           
           
    
       
      
         
         

  
     
     
     
    
       
       
       
    
       
       
    
       [, ]
       
       
       
    
       

  
     
     
     
       
    
       
    
       

  
     
     
     
    
       
       
    
       
       
    
       
    
       


  
     
    
      
          


  
  
  

Container Management Scripts

#!/bin/bash
set -euo pipefail

# Docker utility functions
docker_cleanup() {
    echo "=== Docker Cleanup ==="
    
    # Stop all containers
    docker stop $(docker ps -aq) 2>/dev/null || true
    
    # Remove all containers
    docker rm $(docker ps -aq) 2>/dev/null || true
    
    # Remove dangling images
    docker rmi $(docker images -f "dangling=true" -q) 2>/dev/null || true
    
    # Remove unused volumes
    docker volume prune -f
    
    # Remove unused networks
    docker network prune -f
    
    # System prune
    docker system prune -af --volumes
    
    echo "Docker cleanup complete"
}

docker_health_monitor() {
    local container="${1:-}"
    
    echo "=== Docker Health Monitor ==="
    echo "Date: $(date)"
    
    if [ -n "$container" ]; then
        # Monitor specific container
        docker inspect --format='{{.State.Health.Status}}' "$container" 2>/dev/null || echo "Container not found"
        docker stats --no-stream --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.MemPerc}}\t{{.PIDs}}" "$container"
    else
        
         
        docker ps --format 
        
         
         
        docker stats --no-stream
    
}

() {
     image=
    
     
    
    
     [[  == * ]]; 
         
    
    
    
     size=$(docker image inspect  --format=)
     
    
    
    docker inspect  --format=
    
    
     user=$(docker inspect  --format= 2>/dev/null)
     [ -z  ] || [  =  ] || [  =  ]; 
         
    
         
    
    
     
     
}


() {
     image=
     registry=
    
    docker tag  
    docker push 
    
    
     version=$(docker inspect  --format= 2>/dev/null)
     [ -n  ]; 
        docker tag  
        docker push 
    
    
     
}

Best Practices

• Use multi-stage builds to minimize final image size
• Always specify image tags, avoid using latest
• Run containers as non-root user
• Use .dockerignore to exclude unnecessary files
• Never include secrets in Dockerfiles or images
• Use named volumes instead of bind mounts for persistent data
• Implement health checks in your images
• Use specific image versions for reproducibility
• Keep base images updated for security patches
• Scan images for vulnerabilities before deployment