{"slug":"docker-best-practices","title":"Docker Best Practices for Production Environments","description":"Essential Docker practices to optimize security, performance, and maintainability in production deployments","date":"2024-03-10","author":"Elaph Hilful","thumbnail":"/blog-images/docker-practices.avif","tags":["Docker","DevOps","Containers","Security"],"category":"DevOps","featured":false,"readTime":4,"htmlContent":"

Docker has revolutionized application deployment, but running containers in production requires careful consideration of security, performance, and maintainability. Let's explore the essential best practices.

\n

Image Optimization

\n

Use Multi-Stage Builds

\n
# Build stage\nFROM node:18-alpine AS builder\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci --only=production\nCOPY . .\nRUN npm run build\n\n# Production stage\nFROM node:18-alpine\nWORKDIR /app\nCOPY --from=builder /app/dist ./dist\nCOPY --from=builder /app/node_modules ./node_modules\nEXPOSE 3000\nCMD [\"node\", \"dist/server.js\"]\n
\n

Choose Minimal Base Images

\n

Use Alpine or distroless images to minimize attack surface:

\n
# Instead of\nFROM ubuntu:latest\n\n# Use\nFROM node:18-alpine\n# or\nFROM gcr.io/distroless/nodejs18-debian11\n
\n

Optimize Layer Caching

\n

Order Dockerfile instructions from least to most frequently changing:

\n
FROM node:18-alpine\n\n# Dependencies (changes rarely)\nCOPY package*.json ./\nRUN npm ci --only=production\n\n# Application code (changes often)\nCOPY . .\n\n# Build (depends on code)\nRUN npm run build\n
\n

Security Best Practices

\n

Run as Non-Root User

\n

Never run containers as root in production:

\n
FROM node:18-alpine\n\n# Create app user\nRUN addgroup -g 1001 -S nodejs && \\\n    adduser -S nodejs -u 1001\n\nWORKDIR /app\nCOPY --chown=nodejs:nodejs . .\n\n# Switch to non-root user\nUSER nodejs\n\nEXPOSE 3000\nCMD [\"node\", \"server.js\"]\n
\n

Scan Images for Vulnerabilities

\n
# Using Trivy\ndocker run aquasec/trivy image myapp:latest\n\n# Using Snyk\nsnyk container test myapp:latest\n
\n

Use .dockerignore

\n

Prevent sensitive files from being added to images:

\n
# .dockerignore\nnode_modules\nnpm-debug.log\n.git\n.env\n.env.local\n*.md\n.DS_Store\n
\n

Sign and Verify Images

\n
# Enable Docker Content Trust\nexport DOCKER_CONTENT_TRUST=1\n\n# Push signed image\ndocker push myregistry/myapp:latest\n\n# Verify signature\ndocker trust inspect myregistry/myapp:latest\n
\n

Performance Optimization

\n

Minimize Image Layers

\n

Combine related RUN commands:

\n
# Instead of\nRUN apt-get update\nRUN apt-get install -y package1\nRUN apt-get install -y package2\n\n# Use\nRUN apt-get update && \\\n    apt-get install -y package1 package2 && \\\n    rm -rf /var/lib/apt/lists/*\n
\n

Use Build Cache Effectively

\n
# Copy only dependency files first\nCOPY package*.json ./\nRUN npm ci --only=production\n\n# Then copy application code\nCOPY . .\n
\n

Implement Health Checks

\n
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \\\n  CMD node healthcheck.js || exit 1\n
\n

Resource Management

\n

Set Resource Limits

\n
docker run -d \\\n  --memory=\"512m\" \\\n  --cpus=\"0.5\" \\\n  --restart=unless-stopped \\\n  myapp:latest\n
\n

Use Docker Compose for Multi-Container Apps

\n
version: \"3.8\"\n\nservices:\n  app:\n    image: myapp:latest\n    deploy:\n      resources:\n        limits:\n          cpus: \"0.5\"\n          memory: 512M\n        reservations:\n          cpus: \"0.25\"\n          memory: 256M\n    healthcheck:\n      test: [\"CMD\", \"curl\", \"-f\", \"http://localhost:3000/health\"]\n      interval: 30s\n      timeout: 3s\n      retries: 3\n      start_period: 40s\n
\n

Logging and Monitoring

\n

Structured Logging

\n

Configure applications to log to stdout/stderr:

\n
// Use structured logging\nconsole.log(\n  JSON.stringify({\n    timestamp: new Date().toISOString(),\n    level: \"INFO\",\n    message: \"User logged in\",\n    userId: user.id,\n  })\n);\n
\n

Centralized Log Management

\n
# Forward logs to centralized system\ndocker run -d \\\n  --log-driver=fluentd \\\n  --log-opt fluentd-address=localhost:24224 \\\n  myapp:latest\n
\n

CI/CD Integration

\n

Automated Image Building

\n
# .github/workflows/docker.yml\nname: Docker Build\n\non:\n  push:\n    branches: [main]\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v3\n\n      - name: Set up Docker Buildx\n        uses: docker/setup-buildx-action@v2\n\n      - name: Login to Registry\n        uses: docker/login-action@v2\n        with:\n          registry: ghcr.io\n          username: ${{ github.actor }}\n          password: ${{ secrets.GITHUB_TOKEN }}\n\n      - name: Build and push\n        uses: docker/build-push-action@v4\n        with:\n          context: .\n          push: true\n          tags: |\n            ghcr.io/${{ github.repository }}:latest\n            ghcr.io/${{ github.repository }}:${{ github.sha }}\n          cache-from: type=gha\n          cache-to: type=gha,mode=max\n
\n

Container Orchestration

\n

Kubernetes Deployment

\n
apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: myapp\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: myapp\n  template:\n    metadata:\n      labels:\n        app: myapp\n    spec:\n      securityContext:\n        runAsNonRoot: true\n        runAsUser: 1001\n      containers:\n        - name: myapp\n          image: myregistry/myapp:latest\n          ports:\n            - containerPort: 3000\n          resources:\n            requests:\n              memory: \"256Mi\"\n              cpu: \"250m\"\n            limits:\n              memory: \"512Mi\"\n              cpu: \"500m\"\n          livenessProbe:\n            httpGet:\n              path: /health\n              port: 3000\n            initialDelaySeconds: 30\n            periodSeconds: 10\n          readinessProbe:\n            httpGet:\n              path: /ready\n              port: 3000\n            initialDelaySeconds: 5\n            periodSeconds: 5\n
\n

Conclusion

\n

Following these Docker best practices ensures your containers are:

\n\n

Start implementing these practices incrementally in your projects to see immediate improvements in your container workflows.

\n

Additional Resources

\n"}