Production Best Practices

🚢 Docker Production Best Practices

The Art of Building Ships That Never Sink

Imagine you’re building a toy boat. If you stuff too many toys inside, use heavy wood, and forget to make it waterproof—it sinks! 🛶💦

Docker containers are like little boats carrying your apps across the ocean of the internet. Let’s learn how to build unsinkable containers that run smoothly in production!

🎯 The Golden Rule: One Process Per Container

Think of It Like a Lunchbox 🍱

Each compartment in a lunchbox holds ONE type of food:

• 🍚 Rice in one section
• 🥦 Veggies in another
• 🍗 Chicken in its own spot

Containers work the same way! Each container should do ONE job.

❌ Wrong Way (The Messy Lunchbox)

# BAD: Multiple processes crammed together
CMD ["sh", "-c", "nginx & php-fpm & mysql"]

✅ Right Way (The Organized Lunchbox)

# Container 1: Web Server
CMD ["nginx", "-g", "daemon off;"]

# Container 2: App Server
CMD ["php-fpm"]

# Container 3: Database
CMD ["mysqld"]

Why Does This Matter?

📦 Minimal Base Images

The Backpack Story 🎒

Going on a trip? You pack only what you need!

• Heavy backpack = slow, tiring, might break your back
• Light backpack = fast, easy, comfortable

Docker images work the same way!

Size Comparison

graph TD
    A["ubuntu:latest<br/>77MB"] --> B["debian:slim<br/>22MB"]
    B --> C["alpine:latest<br/>5MB"]
    C --> D["distroless<br/>2MB"]
    style A fill:#ff6b6b
    style B fill:#ffa502
    style C fill:#7bed9f
    style D fill:#2ed573

Real Example: Python App

# ❌ Heavy (900MB+)
FROM python:3.11

# ✅ Light (50MB)
FROM python:3.11-alpine

# ✅ Even Lighter (40MB)
FROM python:3.11-slim

Why Minimal Images Win

👤 Non-Root Container Users

The Superhero Problem 🦸

Imagine every kid in school had superhero powers. Chaos, right? One angry kid could destroy the whole building!

Root user = Superhero powers

If a hacker breaks into a root container, they can escape and damage your whole server!

Creating a Safe User

FROM node:20-alpine

# Create a regular user (no superpowers!)
RUN addgroup -S appgroup && \
    adduser -S appuser -G appgroup

# Set ownership of app files
COPY --chown=appuser:appgroup . /app

# Switch to the safe user
USER appuser

CMD ["node", "server.js"]

The Safety Shield

graph TD
    A["Hacker Breaks In"] --> B{Running as Root?}
    B -->|Yes| C["🔓 Can Escape Container<br/>Access Host System!"]
    B -->|No| D["🔒 Trapped in Container<br/>Limited Damage"]
    style C fill:#ff6b6b
    style D fill:#2ed573

📡 Proper Signal Handling

The Fire Drill 🔔

When the fire alarm rings at school:

1. Teachers give instructions
2. Students line up calmly
3. Everyone exits safely

Your container needs to understand “fire alarms” too!

Container Signals

Node.js Signal Handler

// Listen for the "please stop" signal
process.on('SIGTERM', () => {
  console.log('Received SIGTERM...');

  // Close database connections
  db.close();

  // Stop accepting new requests
  server.close(() => {
    console.log('Graceful shutdown complete');
    process.exit(0);
  });
});

🛑 Graceful Container Shutdown

The Restaurant Closing Analogy 🍽️

Bad closing: Kick everyone out mid-meal! Good closing:

1. Stop accepting new customers
2. Let current diners finish
3. Clean up tables
4. Lock the doors

How Containers Shutdown

graph TD
    A["Docker sends SIGTERM"] --> B["App receives signal"]
    B --> C["Stop new connections"]
    C --> D["Finish current work"]
    D --> E["Close databases"]
    E --> F["Exit cleanly"]
    F --> G["✅ Container Stops"]
    style G fill:#2ed573

The 10-Second Rule

Docker waits 10 seconds after SIGTERM. If your app doesn’t stop, Docker sends SIGKILL (the rude kick-out).

# Give your app more time to cleanup
STOPSIGNAL SIGTERM

# In docker-compose or run command:
# docker stop --time 30 mycontainer

Python Graceful Shutdown

import signal
import sys

def graceful_exit(signum, frame):
    print("Shutting down gracefully...")
    # Save state
    save_to_database()
    # Close connections
    close_all_connections()
    sys.exit(0)

signal.signal(signal.SIGTERM, graceful_exit)

🏁 Container Init Process

The Orphan Problem 👶

When a parent process dies, child processes become “orphans.” Without someone to care for them, they become zombie processes—dead but still taking up space!

What is an Init Process?

An init process (PID 1) is like a babysitter:

• Adopts orphan processes
• Cleans up zombies
• Forwards signals properly

Using Tini (The Best Babysitter)

FROM python:3.11-alpine

# Install tini
RUN apk add --no-cache tini

# Set tini as the entrypoint
ENTRYPOINT ["/sbin/tini", "--"]

# Your actual command
CMD ["python", "app.py"]

Docker’s Built-in Option

# Run with init flag
docker run --init myapp

# In docker-compose
services:
  myapp:
    init: true
    image: myapp:latest

graph TD
    A["Main Process Dies"] --> B{Init Process?}
    B -->|No| C["👻 Zombie Children"]
    B -->|Yes| D["🧹 Tini Cleans Up"]
    style C fill:#ff6b6b
    style D fill:#2ed573

🚫 Container Anti-Patterns

Things That Make Containers Sad 😢

1. Storing Data Inside Containers

# ❌ BAD: Data dies when container dies
RUN mkdir /data
COPY mydata.db /data/

# ✅ GOOD: Use volumes
# docker run -v mydata:/data myapp

2. Hardcoding Secrets

# ❌ NEVER DO THIS
ENV DATABASE_PASSWORD=supersecret123

# ✅ Use secrets or environment variables
# docker run -e DB_PASS_FILE=/run/secrets/db_pass

3. Running as Root (We Covered This!)

# ❌ Dangerous default
FROM node:20
CMD ["node", "app.js"]

# ✅ Safe with USER
FROM node:20
USER node
CMD ["node", "app.js"]

4. Fat Images with Dev Tools

# ❌ Production image with debugging tools
FROM ubuntu:latest
RUN apt-get install -y vim curl wget gcc make

# ✅ Multi-stage build - dev stays in build stage
FROM node:20 AS builder
RUN npm install && npm run build

FROM node:20-alpine
COPY --from=builder /app/dist /app

5. Ignoring Health Checks

# ✅ Always add health checks
HEALTHCHECK --interval=30s \
            --timeout=3s \
            --retries=3 \
  CMD curl -f http://localhost:8080/health || exit 1

⚔️ Docker vs Kubernetes Overview

The Captain vs The Admiral 🚢

Docker = One ship’s captain

• Controls a single container
• Great for one boat

Kubernetes = Fleet admiral

• Commands hundreds of ships
• Coordinates the whole navy

When to Use What

graph TD
    A["Your App"] --> B{How Many Containers?}
    B -->|1-5| C["Docker + Docker Compose"]
    B -->|6-20| D["Docker Swarm"]
    B -->|20+| E["Kubernetes"]
    style C fill:#7bed9f
    style D fill:#ffa502
    style E fill:#ff6b6b

Feature Comparison

Simple Truth

🎯 Quick Summary

🚀 You Did It!

You now understand how to build production-ready containers that are:

• ✅ Safe and secure
• ✅ Fast and efficient
• ✅ Reliable and stable
• ✅ Easy to manage

Your containers are ready to sail the production seas! 🌊🚢

Remember: A well-built container is like a well-built boat—it carries your precious cargo safely through any storm!