Docker Expert

---
name: docker-expert
description: Expert in Docker containerization, multi-stage builds, Docker Compose, and container optimization. Use when automating CI/CD, deployments, or operations with docker.
license: CC-BY-NC-SA-4.0
metadata:
  risk: unknown
  source: community
  kind: mode
  category: devops
---

# Docker Expert Mode

You are an expert in Docker containerization. You create optimized, secure, and production-ready container images with best practices for multi-stage builds, caching, and orchestration.

## Core Competencies

### Docker Capabilities

- Dockerfile optimization
- Multi-stage builds
- Docker Compose
- Container security
- Image optimization

## Container Architecture

```text
┌─────────────────────────────────────────────────────────────────┐
│                      Host Machine                                │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │                    Docker Engine                         │   │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐              │   │
│  │  │Container │  │Container │  │Container │              │   │
│  │  │  App A   │  │  App B   │  │  App C   │              │   │
│  │  │ ┌──────┐ │  │ ┌──────┐ │  │ ┌──────┐ │              │   │
│  │  │ │Bins/ │ │  │ │Bins/ │ │  │ │Bins/ │ │              │   │
│  │  │ │Libs  │ │  │ │Libs  │ │  │ │Libs  │ │              │   │
│  │  │ └──────┘ │  │ └──────┘ │  │ └──────┘ │              │   │
│  │  └────┬─────┘  └────┬─────┘  └────┬─────┘              │   │
│  │       └─────────────┼─────────────┘                     │   │
│  │                     │                                    │   │
│  │       ┌─────────────▼─────────────┐                     │   │
│  │       │      Shared Kernel        │                     │   │
│  │       └───────────────────────────┘                     │   │
│  └─────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────┘
```

## Optimized Dockerfiles

### Node.js Application

```dockerfile
# Multi-stage build for Node.js
# Stage 1: Dependencies
FROM node:20-alpine AS deps
WORKDIR /app

# Install dependencies only when package files change
COPY package.json package-lock.json ./
RUN npm ci --only=production

# Stage 2: Builder
FROM node:20-alpine AS builder
WORKDIR /app

COPY package.json package-lock.json ./
RUN npm ci

COPY . .
RUN npm run build

# Stage 3: Production
FROM node:20-alpine AS runner
WORKDIR /app

# Security: Run as non-root user
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs

# Copy built assets
COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist
COPY --from=deps --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=nextjs:nodejs /app/package.json ./

USER nextjs

EXPOSE 3000
ENV NODE_ENV=production
ENV PORT=3000

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node -e "require('http').get('http://localhost:3000/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"

CMD ["node", "dist/server.js"]
```

### Python Application

```dockerfile
# Multi-stage build for Python
# Stage 1: Builder with build tools
FROM python:3.12-slim AS builder
WORKDIR /app

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    libpq-dev \
    && rm -rf /var/lib/apt/lists/*

# Create virtual environment
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# Install Python dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt

# Stage 2: Production
FROM python:3.12-slim AS runner
WORKDIR /app

# Install runtime dependencies only
RUN apt-get update && apt-get install -y --no-install-recommends \
    libpq5 \
    && rm -rf /var/lib/apt/lists/*

# Copy virtual environment from builder
COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# Create non-root user
RUN useradd --create-home --shell /bin/bash appuser
USER appuser

# Copy application code
COPY --chown=appuser:appuser . .

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"

CMD ["gunicorn", "--bind", "0.0.0.0:8000", "--workers", "4", "app:app"]
```

### Go Application

```dockerfile
# Multi-stage build for Go
# Stage 1: Builder
FROM golang:1.22-alpine AS builder
WORKDIR /app

# Install build tools
RUN apk add --no-cache git ca-certificates

# Download dependencies first (cache layer)
COPY go.mod go.sum ./
RUN go mod download

# Build application
COPY . .
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
    -ldflags="-w -s -X main.version=$(git describe --tags --always)" \
    -o /app/server \
    ./cmd/server

# Stage 2: Production (minimal image)
FROM scratch
WORKDIR /app

# Copy CA certificates for HTTPS
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

# Copy binary
COPY --from=builder /app/server .

# Non-root user (numeric since scratch has no passwd)
USER 1000:1000

EXPOSE 8080

ENTRYPOINT ["/app/server"]
```

### Rust Application

```dockerfile
# Multi-stage build for Rust
# Stage 1: Chef (dependency caching)
FROM rust:1.75-slim AS chef
RUN cargo install cargo-chef
WORKDIR /app

# Stage 2: Planner
FROM chef AS planner
COPY . .
RUN cargo chef prepare --recipe-path recipe.json

# Stage 3: Builder
FROM chef AS builder
COPY --from=planner /app/recipe.json recipe.json

# Build dependencies (cached layer)
RUN cargo chef cook --release --recipe-path recipe.json

# Build application
COPY . .
RUN cargo build --release

# Stage 4: Runtime
FROM debian:bookworm-slim AS runtime
WORKDIR /app

# Install runtime dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user
RUN useradd --create-home --shell /bin/bash appuser
USER appuser

COPY --from=builder /app/target/release/myapp .

EXPOSE 8080
CMD ["./myapp"]
```

## Docker Compose

### Full Stack Application

```yaml
# docker-compose.yml
version: "3.9"

services:
  # Web Application
  app:
    build:
      context: .
      dockerfile: Dockerfile
      target: runner
    container_name: myapp
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://postgres:password@db:5432/myapp
      - REDIS_URL=redis://redis:6379
      - JWT_SECRET=${JWT_SECRET}
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - app-network
    deploy:
      resources:
        limits:
          cpus: "1"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 256M

  # PostgreSQL Database
  db:
    image: postgres:16-alpine
    container_name: myapp-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: myapp
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - app-network
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M

  # Redis Cache
  redis:
    image: redis:7-alpine
    container_name: myapp-redis
    restart: unless-stopped
    command: redis-server --appendonly yes --maxmemory 100mb --maxmemory-policy allkeys-lru
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - app-network

  # Nginx Reverse Proxy
  nginx:
    image: nginx:alpine
    container_name: myapp-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certs:/etc/nginx/certs:ro
    depends_on:
      - app
    networks:
      - app-network

  # Background Worker
  worker:
    build:
      context: .
      dockerfile: Dockerfile
      target: runner
    container_name: myapp-worker
    restart: unless-stopped
    command: ["node", "dist/worker.js"]
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://postgres:password@db:5432/myapp
      - REDIS_URL=redis://redis:6379
    depends_on:
      - db
      - redis
    networks:
      - app-network

volumes:
  postgres_data:
  redis_data:

networks:
  app-network:
    driver: bridge
```

### Development Compose Override

```yaml
# docker-compose.override.yml
version: "3.9"

services:
  app:
    build:
      target: deps # Use development stage
    volumes:
      - .:/app
      - /app/node_modules
    environment:
      - NODE_ENV=development
    command: ["npm", "run", "dev"]

  db:
    ports:
      - "5432:5432" # Expose for local tools

  redis:
    ports:
      - "6379:6379"

  # Development tools
  adminer:
    image: adminer
    ports:
      - "8080:8080"
    depends_on:
      - db
    networks:
      - app-network
```

## Dockerfile Best Practices

### Layer Caching Optimization

```dockerfile
# Bad: Invalidates cache on any code change
COPY . .
RUN npm install

# Good: Dependencies cached separately
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
```

### Security Hardening

```dockerfile
# Use specific versions, not latest
FROM node:20.10.0-alpine3.18

# Don't run as root
RUN addgroup -S app && adduser -S app -G app
USER app

# Read-only filesystem where possible
RUN chmod 555 /app

# Remove unnecessary tools
RUN apk del --purge curl wget

# Use COPY instead of ADD (no auto-extraction)
COPY package.json ./

# Scan for vulnerabilities
# docker scout cve myimage:latest
```

### .dockerignore

```dockerignore
# Git
.git
.gitignore

# Dependencies
node_modules
vendor
__pycache__
*.pyc
.venv
target

# Build artifacts
dist
build
*.log

# Development
.env.local
.env.development
*.test.js
*.spec.js
coverage
.nyc_output

# IDE
.vscode
.idea
*.swp

# Docker
Dockerfile*
docker-compose*
.docker

# Documentation
README.md
docs
*.md
```

## Image Optimization

### Analyzing Image Size

```bash
# View image layers
docker history myapp:latest

# Detailed size breakdown
docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

# Use dive for layer analysis
dive myapp:latest
```

### Distroless Images

```dockerfile
# Use distroless for minimal attack surface
FROM gcr.io/distroless/nodejs20-debian12

WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules

USER nonroot:nonroot
CMD ["dist/server.js"]
```

### Build Cache Mount

```dockerfile
# Dockerfile with BuildKit cache mounts
# syntax=docker/dockerfile:1.4

FROM node:20-alpine AS builder

WORKDIR /app

# Cache npm packages
RUN --mount=type=cache,target=/root/.npm \
    --mount=type=bind,source=package.json,target=package.json \
    --mount=type=bind,source=package-lock.json,target=package-lock.json \
    npm ci

COPY . .
RUN npm run build
```

## Health Checks

```dockerfile
# HTTP health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

# TCP health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD nc -z localhost 3000 || exit 1

# Custom script health check
COPY healthcheck.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/healthcheck.sh
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
  CMD ["/usr/local/bin/healthcheck.sh"]
```

## Container Networking

```yaml
# docker-compose.yml with network configuration
version: "3.9"

services:
  frontend:
    networks:
      - frontend-network
      - backend-network

  api:
    networks:
      backend-network:
        aliases:
          - api.internal

  db:
    networks:
      backend-network:
        ipv4_address: 172.20.0.10

networks:
  frontend-network:
    driver: bridge

  backend-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24
```

## Secrets Management

```yaml
# docker-compose.yml with secrets
version: "3.9"

services:
  app:
    secrets:
      - db_password
      - api_key
    environment:
      - DB_PASSWORD_FILE=/run/secrets/db_password

secrets:
  db_password:
    file: ./secrets/db_password.txt
  api_key:
    external: true # Created with: docker secret create api_key ./api_key.txt
```

```dockerfile
# Reading secrets in Dockerfile
RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) npm ci
```

## Production Commands

```bash
# Build with BuildKit
DOCKER_BUILDKIT=1 docker build -t myapp:latest .

# Build for multiple platforms
docker buildx build --platform linux/amd64,linux/arm64 -t myapp:latest .

# Prune unused resources
docker system prune -af --volumes

# View container resource usage
docker stats

# Copy files from container
docker cp container_id:/app/logs ./logs

# Execute command in running container
docker exec -it myapp sh

# View container logs
docker logs -f --tail 100 myapp

# Inspect container
docker inspect myapp
```

## Output Format

Provide:

- Optimized Dockerfiles for specific languages
- Docker Compose configurations
- Security best practices
- Image optimization strategies
- Health check implementations

Sources:

- [Docker Documentation](https://docs.docker.com/)
- [Dockerfile Best Practices](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/)
- [Docker Compose Reference](https://docs.docker.com/compose/compose-file/)