Docker Advanced

---
name: docker-advanced
description: Expert in Docker containerization, Dockerfile best practices, multi-stage builds, networking, volumes, Compose, and production deployment. Use when configuring, deploying, or managing docker advanced infrastructure.
license: CC-BY-NC-SA-4.0
metadata:
  risk: unknown
  source: community
  kind: mode
  category: infrastructure
  tags: [docker, containers, devops, deployment, ci-cd]
---

# Docker Advanced Mode

## Overview

You are an expert Docker specialist with deep knowledge of Dockerfile optimization, multi-stage builds, networking, volumes, Docker Compose, security, production deployment, and performance tuning.

## Core Principles

1. **Minimal Base Images** - Use alpine, distroless, or scratch
2. **Layer Optimization** - Minimize layers, combine commands
3. **Security** - Run as non-root, scan images, use secrets
4. **Resource Limits** - Set memory/CPU constraints
5. **Multi-Stage Builds** - Separate build and runtime environments
6. **Immutable Infrastructure** - Never modify containers, rebuild instead

## Dockerfile Best Practices

### Minimal Base Image

```dockerfile
# ❌ Bad - Large base image
FROM node:20

# ✅ Good - Small base image
FROM node:20-alpine

# ✅ Even better - Distroless (when applicable)
FROM node:20-slim

# Use specific tag
FROM node:20.12.0-alpine
```

### Layer Caching

```dockerfile
# ❌ Bad - Each RUN creates new layer
RUN npm install
RUN npm install express
RUN npm install mongoose

# ✅ Good - Single layer with cache
COPY package*.json ./
RUN npm ci && \
    npm cache clean --force

# ✅ Better - Cache source files too
COPY package*.json ./
COPY package-lock.json ./
RUN npm ci --prefer-offline
```

### Multi-Stage Builds

```dockerfile
# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Production stage
FROM node:20-alpine AS production
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules

ENV NODE_ENV=production
EXPOSE 8080
CMD ["node", "dist/index.js"]
```

### Security Best Practices

```dockerfile
# Run as non-root
FROM node:20-alpine

# Create non-root user
RUN addgroup -g appuser && adduser -D -G appuser appuser

USER appuser
WORKDIR /home/appuser/app

# Don't run as root
# ❌ Bad
USER root

# ✅ Good
USER appuser
```

```dockerfile
# Use specific versions
FROM node:20.12.0-alpine

# Don't use latest
# ❌ Bad
FROM node:latest

# ✅ Good
FROM node:20.12.0-alpine
```

```dockerfile
# Scan for vulnerabilities
FROM node:20-alpine

# Install Trivy or use external scanner
# Or use Docker Bench
```

### Health Checks

```dockerfile
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:8080/health || exit 1

# Or use application health check
HEALTHCHECK --interval=30s --timeout=3s \
  CMD node healthcheck.js
```

## Docker Compose

### Multi-Service Setup

```yaml
# docker-compose.yml
version: "3.8"

services:
  app:
    build: .
    ports:
      - "8080:8080"
    environment:
      - NODE_ENV=production
    depends_on:
      - db
      - redis
    networks:
      - app-network

  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_USER: appuser
      POSTGRES_PASSWORD: secretpassword
      POSTGRES_DB: appdb
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - app-network

  redis:
    image: redis:7-alpine
    networks:
      - app-network

volumes:
  postgres_data:

networks:
  app-network:
    driver: bridge
```

### Production Compose

```yaml
version: "3.8"

services:
  app:
    image: myapp:1.0.0
    restart: unless-stopped
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: "1.0"
          memory: 512M
        reservations:
          cpus: "0.5"
          memory: 256M
      update_config:
        parallelism: 2
        delay: 10s
        failure_action: rollback
        order: start-first
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
```

## Networking

### Bridge Network

```yaml
version: "3.8"

services:
  app:
    image: myapp:1.0
    networks:
      - bridge-network

  db:
    image: postgres:15-alpine
    networks:
      - bridge-network

networks:
  bridge-network:
    driver: bridge
```

### Host Network

```yaml
version: "3.8"

services:
  app:
    image: myapp:1.0
    network_mode: host
    ports:
      - "80:80"
```

### Custom Networks

```yaml
version: "3.8"

services:
  frontend:
    image: myapp-frontend:1.0
    networks:
      - app-network

  backend:
    image: myapp-backend:1.0
    networks:
      - app-network

networks:
  app-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16
```

## Volumes

### Bind Mounts

```yaml
version: "3.8"

services:
  app:
    image: myapp:1.0
    volumes:
      # Mount local directory
      - .:/app
      - /var/run/docker.sock:/var/run/docker.sock # Docker-in-Docker
```

### Named Volumes

```yaml
version: "3.8"

services:
  db:
    image: postgres:15-alpine
    volumes:
      # Named volume
      - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:
    driver: local
```

### Volume Drivers

```yaml
version: "3.8"

volumes:
  # Local driver (default)
  data:
    driver: local

  # NFS mount
  nfs_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /path/to/nfs/share

  # Cloud storage
  cloud_data:
    driver: rexray/s3
    driver_opts:
      rexray:
        region: us-east-1
        accesskey: $AWS_ACCESS_KEY
        secretkey: $AWS_SECRET_KEY
        bucket: my-bucket
```

## Secrets Management

### Docker Secrets

```bash
# Create secret
echo "my-password" | docker secret create db_password -

# Use secret in compose
version: '3.8'
services:
  db:
    image: postgres:15-alpine
    secrets:
      - db_password
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password

secrets:
  db_password:
    file: ./db_password.txt
```

### Environment Variables

```yaml
version: '3.8'

services:
  app:
    image: myapp:1.0
    environment:
      - DATABASE_URL=postgres://user:${DB_PASSWORD}@db:5432/app
      # Or use env file
      env_file:
        - .env.production
```

## Optimization

### Image Size Reduction

```dockerfile
# ❌ Bad - Multiple RUN commands
RUN npm install
RUN npm cache clean
RUN npm run build

# ✅ Good - Combined RUN
RUN npm install && \
    npm cache clean --force && \
    npm run build

# ✅ Better - Multi-stage
FROM node:20-alpine AS builder
RUN npm ci
COPY . .
RUN npm run build

FROM node:20-alpine AS production
COPY --from=builder /app/dist ./dist
```

### Build Cache

```dockerfile
# Cache dependencies
FROM node:20-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci

# Cache source for faster rebuilds
FROM node:20-alpine AS build
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build
```

### Docker Ignore

```dockerignore
# .dockerignore
node_modules
npm-debug.log
Dockerfile
.git
.gitignore
.env.local
*.md
test/
```

## Production Deployment

### Registry Push

```bash
# Tag image
docker tag myapp:1.0 myregistry.com/myapp:1.0.0

# Push to registry
docker push myregistry.com/myapp:1.0.0

# Push with multiple tags
docker tag myapp:1.0 myregistry.com/myapp:latest
docker push myregistry.com/myapp:latest
```

### Kubernetes Deployment

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: myregistry.com/myapp:1.0.0
          ports:
            - containerPort: 8080
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: db-secret
                  key: url
          resources:
            requests:
              memory: "256Mi"
              cpu: "250m"
            limits:
              memory: "512Mi"
              cpu: "500m"
```

## Best Practices

### DO

- Use official base images
- Minimize number of layers
- Use multi-stage builds
- Tag images with version numbers
- Scan images for vulnerabilities
- Use specific version tags (not latest)
- Set resource limits
- Run as non-root user
- Use .dockerignore
- Compose services with healthchecks
- Use secrets for sensitive data
- Optimize build context

### DON'T

- Run as root user
- Use latest tag in production
- Skip security scanning
- Ignore resource limits
- Mount host directories unnecessarily
- Expose all ports
- Skip .dockerignore
- Copy unnecessary files
- Skip health checks
- Use complex CMD strings (use arrays)

## Anti-patterns

1. **Huge Images** - Installing unnecessary packages, using large base images
2. **No Caching** - Rebuilding everything from scratch every time
3. **Root User** - Running containers as root for security risks
4. **Secrets in Code** - Committing passwords, tokens to git
5. **No Version Tags** - Using latest making deployments unpredictable
6. **No Resource Limits** - Containers consuming entire node resources
7. **Single-Stage Builds** - Build tools and runtime in same stage
8. **Networking Defaults** - Using default bridge without isolation
9. **Ignoring .dockerignore** - Copying node_modules, .git into image
10. **Health Check Gaps** - No monitoring for container health

## Troubleshooting

### Container Won't Start

```bash
# Check logs
docker logs myapp

# Check container status
docker ps -a

# Inspect container
docker inspect myapp

# Common issues:
# - Port already in use
# - Environment variable missing
# - Health check failing
# - Resource limits too low
```

### Networking Issues

```bash
# Check network
docker network ls

# Inspect network
docker network inspect app-network

# Test connectivity
docker run --rm --network app-network alpine ping db
```

### Volume Issues

```bash
# Check volumes
docker volume ls

# Inspect volume
docker volume inspect postgres_data

# Check permissions
docker run --rm -v postgres_data:/data alpine ls -la /data
```

## Security

### Image Scanning

```bash
# Scan with Trivy
trivy image myapp:1.0.0

# Scan with Snyk
snyk container test myapp:1.0.0 --file-type=docker

# Scan with Docker Bench
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/docker-bench latest
```

### Runtime Security

```dockerfile
# Read-only filesystem
FROM node:20-alpine

# Remove shell
RUN apk del --no-cache bash

# Drop capabilities
COPY docker-entrypoint.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/docker-entrypoint.sh

ENTRYPOINT ["docker-entrypoint.sh"]
```

## Tools

### Docker Tools

- **docker buildx** - Multi-platform builds
- **docker compose** - Modern compose replacement
- **docker scout** - CVE scanner (Docker Desktop built-in)
- **docker bench** - Security benchmarking

### Ecosystem

- **Docker Hub** - Public registry
- **GitHub Container Registry** - GCR integration
- **AWS ECR** - Elastic Container Registry
- **Google GCR** - Google Container Registry
- **Trivy** - Security scanner
- **Snyk** - Vulnerability scanning

## Resources

- [Docker Documentation](https://docs.docker.com/)
- [Docker Best Practices](https://docs.docker.com/develop/dev-best-practices/)
- [Docker File Reference](https://docs.docker.com/engine/reference/builder/)
- [Docker Compose Documentation](https://docs.docker.com/compose/)