Writing Dockerfiles

# Every problem annotated

FROM node:20                 ← Problem 1: full image (1.1 GB!)
                                 should be node:20-alpine (170 MB)

FROM node:latest             ← Problem 2: floating tag
                                 breaks builds unpredictably

WORKDIR /app

COPY . .                     ← Problem 3: copies EVERYTHING first
                                 including node_modules, .git, .env
                                 invalidates ALL layers on code change

RUN npm install              ← Problem 4: not npm ci
                                 non-deterministic, slower
                                 re-runs on EVERY code change
                                 because COPY . . is above it!

EXPOSE 3000

  # No USER instruction → runs as root
                             ← Problem 5: root user in production
                                 container breakout = host root

  # No .dockerignore → sends everything
                             ← Problem 6: node_modules (200 MB!)
                                 sent as build context every time
                                 .env secrets included in image!

CMD ["node", "src/index.js"]  ← Problem 7: shell form CMD
CMD node src/index.js           SIGTERM ignored → 10s delay on stop

# Dependencies — never copy from host
node_modules           ← 200 MB, rebuilt inside image anyway

# Version control
.git                   ← entire git history, large
.gitignore

# Secrets — CRITICAL: never bake into image
.env                   ← DB passwords, API keys
.env.*                 ← .env.local, .env.production
*.pem                  ← SSL certificates
secrets/

# Test + CI artifacts
coverage/              ← test coverage reports
*.test.js              ← test files (not needed in prod)
.github/               ← CI workflow files
jest.config.js         ← test config

# Build artifacts
dist/                  ← if building inside Docker
build/

# Documentation
*.md
docs/

# OS files
.DS_Store              ← macOS metadata
Thumbs.db              ← Windows
*.log

# Stage 1: Install dependencies
FROM node:20-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production   ← prod deps only, no jest/eslint

# Stage 2: Runtime — minimal and secure
FROM node:20-alpine AS runtime
WORKDIR /app

# === SECURITY: Create non-root user ===
RUN addgroup -S appgroup && \
    adduser  -S appuser -G appgroup
# -S = system user (no password, no home dir)
# -G = add to group

# Copy files with correct ownership
COPY --from=deps \
     --chown=appuser:appgroup \
     /app/node_modules ./node_modules

COPY --chown=appuser:appgroup src/ ./src/

# Switch to non-root user BEFORE CMD
USER appuser

EXPOSE 3000

# === EXEC FORM — proper signal handling ===
CMD ["node", "src/index.js"]
# NOT: CMD node src/index.js (shell form)
# Shell form: node runs as child of /bin/sh
# SIGTERM goes to sh, not node → 10s wait
# Exec form: node IS PID 1 → SIGTERM works

# === Runtime security (docker run flags) ===
# docker run --read-only \            # read-only fs
#            --security-opt no-new-privileges \
#            --cap-drop ALL \           # drop all capabilities
#            myapp:latest

# Scan your local image for vulnerabilities
docker scout cves my-devops-app:local

# Example output:
## Overview
#    Analyzed image: my-devops-app:local
#       Digest: sha256:abc123...
#    Packages: 67
# Vulnerabilities:
#    0C  0H  2M  5L
#    ↑   ↑   ↑   ↑
#  Crit High Med Low
#
# Vulnerability details:
# ✗ MEDIUM CVE-2023-12345
#   openssl 3.1.1
#   Fixed version: 3.1.2
#   Upgrade base image to fix

# Quick summary (just the numbers)
docker scout quickview my-devops-app:local

# Compare your image vs a newer base image
docker scout compare \
  --to node:20-alpine \
  my-devops-app:local

# Get fix recommendations
docker scout recommendations my-devops-app:local

# Scan a remote image (from registry)
docker scout cves ghcr.io/user/myapp:latest

# === Alternative: Trivy (open source) ===
trivy image my-devops-app:local
trivy image --severity HIGH,CRITICAL my-devops-app:local
trivy image --exit-code 1 --severity HIGH my-devops-app:local
# exit-code 1 = fail CI if HIGH vulns found

FROM node:20
WORKDIR /app
COPY . .
RUN npm install
EXPOSE 3000
CMD node src/index.js

# Build and measure:
# time docker build -t app:bad -f Dockerfile.bad .
# docker images app:bad
# → SIZE: ~1.1 GB
# → Build time: ~90 seconds
#
# Change src/index.js, rebuild:
# → npm install runs AGAIN (no cache!)
# → Still 90 seconds

node_modules
.git
.env
.env.*
coverage
*.test.js
.github
jest.config.js
*.md
.DS_Store
*.log

# ════════════════════════════════════════
# Stage 1: Install production dependencies
# ════════════════════════════════════════
FROM node:20-alpine AS deps
WORKDIR /app

# Copy ONLY package files (cache this layer)
COPY package*.json ./

# Install prod deps only — no jest, eslint, etc.
RUN npm ci --only=production && \
    npm cache clean --force     ← clean cache inside layer

# ════════════════════════════════════════
# Stage 2: Lean, secure runtime image
# ════════════════════════════════════════
FROM node:20-alpine AS runtime

# Metadata
LABEL org.opencontainers.image.source="https://github.com/user/repo"
LABEL org.opencontainers.image.version="1.0.0"

WORKDIR /app

# Security: create non-root user
RUN addgroup -S appgroup && \
    adduser  -S appuser -G appgroup

# Copy deps from stage 1 with correct ownership
COPY --from=deps \
     --chown=appuser:appgroup \
     /app/node_modules ./node_modules

# Copy source code with correct ownership
COPY --chown=appuser:appgroup src/ ./src/

# Switch to non-root BEFORE everything runtime
USER appuser

EXPOSE 3000

# Health check — Kubernetes uses this
HEALTHCHECK --interval=30s \
            --timeout=5s \
            --start-period=10s \
            --retries=3 \
  CMD wget -qO- http://localhost:3000/health || exit 1

# Exec form — proper signal handling
CMD ["node", "src/index.js"]

# 1. Floating base image tag
FROM node:latest             ← breaks unexpectedly
FROM node:20.11.0-alpine     ← pin exact version

# 2. Secrets in ENV
ENV DB_PASSWORD=s3cr3t       ← baked into image!
# Pass at runtime: docker run -e DB_PASSWORD=s3cr3t

# 3. Multiple RUN commands = multiple layers
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get install -y wget
RUN rm -rf /var/lib/apt/lists/*
← 4 layers, 3 have leftover cache
RUN apt-get update && \
    apt-get install -y curl wget && \
    rm -rf /var/lib/apt/lists/*
← 1 layer, cache cleaned in same RUN

# 4. COPY . . at wrong position
COPY . .
RUN npm ci                   ← kills cache on every change
COPY package*.json ./
RUN npm ci
COPY . .                    ← npm ci cached separately

# 5. Running as root
# (no USER instruction)
RUN adduser -S appuser
USER appuser

# 6. Shell form CMD
CMD node app.js
CMD ["node", "app.js"]

# 7. COPY * instead of specific paths
COPY * /app/                 ← copies everything
COPY src/ /app/src/          ← only what's needed

# 1. Pin base image tag — never :latest
FROM node:20-alpine

# 2. Copy package files first (cache!)
COPY package*.json ./
RUN npm ci --only=production

# 3. Copy source code after deps
COPY src/ ./src/

# 4. Add .dockerignore (node_modules/.git/.env)

# 5. Create non-root user
RUN addgroup -S app && adduser -S app -G app

# 6. chown files when copying
COPY --chown=app:app src/ ./src/

# 7. Switch user before CMD
USER app

# 8. Use exec form CMD
CMD ["node", "src/index.js"]

# 9. Add HEALTHCHECK
HEALTHCHECK CMD wget -qO- localhost:3000/health

# 10. Scan before pushing
docker scout cves myapp:latest