Docker Best Practices: Building Efficient and Secure Containers

Docker containers have revolutionized how we package and deploy applications. However, building container images that are both efficient and secure requires following established best practices. This guide covers essential techniques for creating production-ready Docker containers.

Efficient Image Building

Creating efficient Docker images is crucial for faster deployments, reduced storage costs, and improved security. Multi-stage builds and proper layer caching are key techniques for achieving these goals.

Multi-Stage Build Example

# Build stage
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Production stage
FROM node:18-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/package*.json ./
RUN npm ci --only=production
EXPOSE 3000
CMD ["npm", "start"]

Image Security Best Practices

Security should be a primary concern when building Docker images. Following these practices helps minimize vulnerabilities and protect your applications.

| Practice | Description | Impact | |----------|-------------|---------| | Minimal Base Image | Use slim/alpine variants | Reduced attack surface | | Non-root User | Run as non-privileged user | Enhanced security | | Security Scanning | Regular vulnerability scans | Early detection | | Update Dependencies | Keep packages current | Patch vulnerabilities |

Security Configuration Example

# Use specific version for reproducibility
FROM node:18.19.0-alpine3.18

# Add non-root user
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

# Set working directory and permissions
WORKDIR /app
COPY --chown=appuser:appgroup . .

# Install dependencies
RUN npm ci --only=production

# Use non-root user
USER appuser

# Define health check
HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

EXPOSE 3000
CMD ["npm", "start"]

Layer Optimization

Understanding Docker layer caching and optimizing layer order can significantly improve build times and reduce image size.

Layer Ordering Best Practices

1. Place infrequently changing layers first
2. Combine related commands in single layers
3. Use .dockerignore effectively
4. Clean up in the same layer as installation

Example

.git
node_modules
npm-debug.log
Dockerfile
.dockerignore
.env
*.md

Container Runtime Best Practices

Proper container runtime configuration is essential for production deployments. This includes resource limits, logging, and monitoring setup.

version: '3.8'
services:
  app:
    image: myapp:latest
    deploy:
      resources:
        limits:
          cpus: '0.50'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

Development Workflow

Establishing a consistent development workflow helps teams work efficiently with Docker.

Development Environment Setup

Example

version: '3.8'
services:
  app:
    build:
      context: .
      target: development
    volumes:
      - .:/app
      - /app/node_modules
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
    command: npm run dev