Code snippets — Docker Containerization Best Practices

snippet-2.Dockerfile

FROM node:20.11-alpine3.19@sha256:abc123...

snippet-2.sh

# Using Trivy
trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest

snippet-3.Dockerfile

RUN addgroup -g 1001 appgroup && \
    adduser -u 1001 -G appgroup -s /bin/sh -D appuser
USER appuser

snippet-3.sh

docker run -e DATABASE_URL="$(cat /run/secrets/db_url)" myapp:latest

snippet-4.Dockerfile

# Dependencies first (changes rarely)
COPY package.json package-lock.json ./
RUN npm ci --only=production

# Source code last (changes often)
COPY src/ ./src/

snippet-5.Dockerfile

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1

snippet.Dockerfile

# Build stage
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o server ./cmd/server

# Runtime stage
FROM alpine:3.19
RUN apk --no-cache add ca-certificates tzdata
WORKDIR /root/
COPY --from=builder /app/server .
CMD ["./server"]

snippet.sh

docker run --read-only \
  --tmpfs /tmp \
  --tmpfs /var/run \
  myapp:latest

snippet.txt

node_modules
.git
.env
*.log
dist
coverage

snippet.yaml

# docker-compose.yml
services:
  api:
    image: myapp:latest
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          memory: 256M