ENTRYPOINT ["python"]
CMD ["app.py"]

# BAD: Shell form -- signals don't reach node process
CMD npm start

# GOOD: Exec form -- node process is PID 1 and receives signals
CMD ["node", "server.js"]

# Run a web server in the background
docker run -d -p 8080:80 nginx

# Get a shell inside an Alpine image for debugging
docker run -it alpine /bin/sh

# Attach to a running container for debugging
docker exec -it <container_id> /bin/bash

docker context ls                          # List all contexts
docker context create staging --docker "host=ssh://deploy@staging.example.com"
docker context use staging                 # All subsequent commands target staging
docker ps                                  # Shows containers on staging server
docker context use default                 # Switch back to local

docker network create app-net
docker run -d --name api --network app-net myapi
docker run -d --name db --network app-net postgres
# api can reach db at hostname "db" -- no IP addresses needed

-p 8080:80            # Map host 8080 to container 80 (all interfaces)
-p 127.0.0.1:8080:80  # Bind to localhost only (not accessible from network)
-p 8080:80/udp        # UDP instead of TCP
-p 8080-8090:80-90    # Port range mapping

# Named volume (production)
docker run -d -v pgdata:/var/lib/postgresql/data postgres

# Bind mount (development -- hot reload)
docker run -d -v $(pwd)/src:/app/src myapp-dev

docker run -d --tmpfs /tmp:rw,noexec,nosuid,size=100m myapp

docker image prune          # Remove dangling images only
docker image prune -a       # Remove ALL unused images (not just dangling)
docker volume prune         # Remove dangling volumes
docker system prune         # Remove dangling images + stopped containers + unused networks
docker system prune -a      # Nuclear option: remove everything not actively in use

docker run --rm -v myvolume:/data -v $(pwd):/backup alpine \
  tar czf /backup/myvolume-backup.tar.gz -C /data .

docker run --rm -v myvolume:/data -v $(pwd):/backup alpine \
  tar xzf /backup/myvolume-backup.tar.gz -C /data

# GOOD: Dependencies cached when only source code changes
FROM node:18-alpine
WORKDIR /app
COPY package.json package-lock.json ./    # Changes rarely (only when deps update)
RUN npm ci                                 # Cached when package files unchanged
COPY . .                                   # Changes on every commit -- but npm ci is cached
RUN npm run build

# BAD: npm ci reruns on every code change
FROM node:18-alpine
WORKDIR /app
COPY . .                                   # Changes on every commit
RUN npm ci                                 # Cache busted EVERY time
RUN npm run build

FROM node AS builder
RUN npm run build
FROM nginx
COPY --from=builder /app/dist /html

# Single-stage (BAD): 1.2GB
FROM node:18
WORKDIR /app
COPY package*.json ./
RUN npm install  # Includes dev dependencies!
COPY . .
RUN npm run build
CMD ["npm", "start"]

# Multi-stage (GOOD): 150MB
FROM node:18 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build

# Production stage
FROM node:18-alpine  # Smaller base
WORKDIR /app
COPY package*.json ./
RUN npm install --production  # Only prod dependencies
COPY --from=builder /app/dist ./dist
USER node  # Security: non-root
CMD ["node", "dist/server.js"]

# Build stage
FROM golang:1.20 AS builder
WORKDIR /app
COPY . .
RUN go build -o server .

# Test stage (not included in final)
FROM builder AS tester
RUN go test ./...

# Production
FROM alpine:3.18
COPY --from=builder /app/server /server
ENTRYPOINT ["/server"]

# Build with: docker build --target=tester .  (runs tests)
# Build with: docker build .  (production image)

# Option 1: Docker's built-in tini (simplest)
# Tini becomes PID 1, forwards signals, reaps zombies
ENTRYPOINT ["tini", "--"]
CMD ["node", "server.js"]

# Option 2: Use --init flag at runtime (no Dockerfile change)
docker run --init myimage

# Option 3: Handle signals in your application code (best for graceful shutdown)
process.on('SIGTERM', async () => {
  console.log('Graceful shutdown initiated');
  await server.close();
  await db.disconnect();
  process.exit(0);
});

FROM node:18-alpine

# Create a system group and user
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app
COPY --chown=appuser:appgroup . .
RUN npm ci --production

# Switch to non-root user BEFORE CMD
USER appuser

CMD ["node", "server.js"]

HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=60s \
  CMD curl -f http://localhost:3000/health || exit 1

app.get('/health', async (req, res) => {
  try {
    await db.query('SELECT 1');  // Check database connectivity
    // Optionally check Redis, external APIs
    res.status(200).json({ status: 'healthy', uptime: process.uptime() });
  } catch (err) {
    res.status(503).json({ status: 'unhealthy', error: err.message });
  }
});

# .dockerignore
.git
node_modules
.env*
Dockerfile*
docker-compose*
*.md
.vscode
.idea
coverage
dist

ARG NODE_VERSION=18
FROM node:${NODE_VERSION}

ARG BUILD_DATE
ENV APP_BUILD_DATE=${BUILD_DATE}

# syntax=docker/dockerfile:1
RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) npm ci

docker export mycontainer | docker import - myimage:flat

docker exec -it <container_id> /bin/sh      # Interactive shell
docker exec <container_id> cat /etc/hosts   # Run a single command
docker exec -u root <container_id> bash     # Exec as root even if container runs as non-root

docker logs <container_id>            # All logs
docker logs -f <container_id>         # Follow (tail -f equivalent)
docker logs --since 10m <container_id> # Last 10 minutes
docker logs --tail 100 <container_id>  # Last 100 lines

docker inspect <container_id>

# Extract specific fields with Go templates:
docker inspect -f '{{.NetworkSettings.IPAddress}}' <container_id>
docker inspect -f '{{.State.OOMKilled}}' <container_id>
docker inspect -f '{{range .Mounts}}{{.Source}} -> {{.Destination}}{{end}}' <container_id>

# Node.js
server.listen(3000, '0.0.0.0');

# Python Flask
app.run(host='0.0.0.0', port=3000)

# Rails
rails server -b 0.0.0.0

docker events                                           # Stream all events
docker events --filter 'event=die'                      # Only container death events
docker events --filter 'container=myapp' --since 1h     # Events for specific container

docker stats                     # All running containers
docker stats myapp mydb          # Specific containers
docker stats --no-stream         # Single snapshot (useful for scripting)
docker stats --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}"  # Custom columns

docker run --cpus="1.5" --memory="512m" --pids-limit=100 myapp

export DOCKER_CONTENT_TRUST=1
docker pull myregistry/myimage:latest   # Fails if image is not signed
docker push myregistry/myimage:latest   # Automatically signs the image

services:
  api:
    build: ./api
    ports: ["3000:3000"]
    environment:
      DATABASE_URL: postgres://db:5432/myapp
    depends_on:
      db:
        condition: service_healthy
  db:
    image: postgres:15
    volumes: ["pgdata:/var/lib/postgresql/data"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
volumes:
  pgdata:

docker run --security-opt seccomp=custom-profile.json myapp

version: '3.8'
services:
  web:
    image: nginx
    ports:
      - "8080:80"
    depends_on:
      - db
  db:
    image: postgres:14
    environment:
      POSTGRES_PASSWORD: secret
    volumes:
      - db-data:/var/lib/postgresql/data

volumes:
  db-data:

services:
  frontend:
    networks:
      - frontend-net
  backend:
    networks:
      - frontend-net
      - backend-net
  database:
    networks:
      - backend-net

networks:
  frontend-net:
  backend-net:

# docker-compose.yml
services:
  app:
    environment:
      - NODE_ENV=production
      - API_KEY=${API_KEY}
    env_file:
      - .env

# .env file
API_KEY=secret123
DATABASE_URL=postgres://localhost/db

HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
  CMD curl -f http://localhost/ || exit 1

# docker-compose.yml
services:
  web:
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost"]
      interval: 30s
      timeout: 3s
      retries: 3

# ARG: build-time only
ARG NODE_VERSION=18
FROM node:${NODE_VERSION}

# ENV: runtime available
ENV NODE_ENV=production
ENV PORT=3000

# Tag image
docker tag myapp:latest registry.example.com/myapp:v1.0

# Push
docker push registry.example.com/myapp:v1.0

# Pull
docker pull registry.example.com/myapp:v1.0

# Remove unused images
docker image prune -a

# Remove stopped containers
docker container prune

# Remove unused volumes
docker volume prune

# Remove everything
docker system prune -a --volumes

# View logs
docker logs container-name

# Follow logs
docker logs -f container-name

# Last 100 lines
docker logs --tail 100 container-name

# With timestamps
docker logs -t container-name

# Real-time stats
docker stats

# Specific container
docker stats container-name

# Format output
docker stats --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}"

# Full details
docker inspect container-name

# Specific field
docker inspect -f '{{.NetworkSettings.IPAddress}}' container-name

# Multiple containers
docker inspect $(docker ps -q)

# Enable buildx
docker buildx create --use

# Build for multiple platforms
docker buildx build --platform linux/amd64,linux/arm64 \
  -t myapp:latest --push .

# syntax=docker/dockerfile:1
FROM node:18

# Cache npm packages across builds -- /root/.npm persists between builds
RUN --mount=type=cache,target=/root/.npm \
    npm ci

# Cache apt packages -- avoids re-downloading on every build
RUN --mount=type=cache,target=/var/cache/apt \
    --mount=type=cache,target=/var/lib/apt \
    apt-get update && apt-get install -y python3

# syntax=docker/dockerfile:1
RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) npm ci --registry=https://npm.example.com

# Build with: docker build --secret id=npm_token,src=.npmrc .

RUN --mount=type=ssh git clone git@github.com:private/repo.git
# Build with: docker build --ssh default .

export DOCKER_CONTENT_TRUST=1
docker push myapp:latest   # Signs automatically
docker pull myapp:latest   # Fails if not signed

# Sign after CI build
cosign sign --key cosign.key registry.example.com/myapp:v1.0

# Verify before deploy
cosign verify --key cosign.pub registry.example.com/myapp:v1.0

# Keyless signing with GitHub Actions OIDC (recommended)
cosign sign --yes registry.example.com/myapp@sha256:abc123

notation sign registry.example.com/myapp:v1.0
notation verify registry.example.com/myapp:v1.0

# Kyverno policy -- reject unsigned images
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  rules:
  - name: check-cosign
    match:
      resources:
        kinds: [Pod]
    verifyImages:
    - imageReferences: ["registry.example.com/*"]
      attestors:
      - entries:
        - keyless:
            issuer: "https://token.actions.githubusercontent.com"
            subject: "https://github.com/myorg/*"

// /etc/docker/daemon.json
{
  "userns-remap": "default"
}

# Install rootless Docker
curl -fsSL https://get.docker.com/rootless | sh

# Run Docker as your unprivileged user
export DOCKER_HOST=unix:///run/user/1000/docker.sock
docker run -d nginx

# Use Docker's default profile (applied automatically)
docker run nginx

# Use a custom stricter profile
docker run --security-opt seccomp=custom.json nginx

# Disable seccomp entirely (dangerous, needed for some debugging tools)
docker run --security-opt seccomp=unconfined nginx

# Run with Docker's default AppArmor profile
docker run --security-opt apparmor=docker-default nginx

# Run with a custom profile
docker run --security-opt apparmor=my-custom-profile nginx

# Disable AppArmor (dangerous)
docker run --security-opt apparmor=unconfined nginx

docker run \
  --cpus="1.5" \
  --memory="512m" \
  --memory-swap="1g" \
  --pids-limit=100 \
  nginx

# Initialize swarm
docker swarm init

# Deploy stack
docker stack deploy -c docker-compose.yml myapp

# Scale service
docker service scale myapp_web=5

# Update service
docker service update --image nginx:latest myapp_web

# Create secret
echo "my-secret" | docker secret create db_password -

# Use in service
docker service create \
  --secret db_password \
  --env DB_PASSWORD_FILE=/run/secrets/db_password \
  myapp

# Build stage -- full toolchain
FROM golang:1.21 AS builder
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o app .

# Production stage -- distroless, no shell
FROM gcr.io/distroless/static:nonroot
COPY --from=builder /app/app /app
USER nonroot:nonroot
ENTRYPOINT ["/app"]

# You CANNOT do this with distroless:
docker exec -it myapp /bin/sh   # Error: no shell

# Kubernetes debug container workaround:
kubectl debug -it pod/myapp --image=busybox --target=myapp

# Build a debug variant for staging:
FROM gcr.io/distroless/static:debug   # Includes busybox shell

# Avoid mounting Docker socket
# BAD:
docker run -v /var/run/docker.sock:/var/run/docker.sock app

# GOOD: Use Docker API with TLS
docker run --env DOCKER_HOST=tcp://docker:2376 \
  --env DOCKER_TLS_VERIFY=1 app

# Single-process container (most common): tini is sufficient
ENTRYPOINT ["tini", "--"]
CMD ["node", "server.js"]

# Multi-process container (app + nginx + cron): use s6-overlay
FROM alpine
ADD https://github.com/just-containers/s6-overlay/releases/download/v3.1.6.2/s6-overlay-noarch.tar.xz /tmp
RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz
ENTRYPOINT ["/init"]
# Define services in /etc/s6-overlay/s6-rc.d/

FROM ubuntu:22.04
RUN apt-get update
RUN apt-get install -y nodejs npm python3 build-essential git curl wget
RUN npm install -g yarn
COPY . /app
WORKDIR /app
RUN yarn install
RUN yarn build
RUN apt-get install -y nginx
COPY nginx.conf /etc/nginx/nginx.conf
EXPOSE 3000 80
CMD ["sh", "-c", "nginx && node /app/dist/server.js"]

services:
  api:
    build: ./api
    ports: ["3000:3000"]
    networks:
      - frontend
  redis:
    image: redis:7-alpine
    networks:
      - backend
  worker:
    build: ./worker
    networks:
      - frontend
      - backend

networks:
  frontend:
  backend: