|
| 1 | +# Working with Docker |
| 2 | + |
| 3 | +This document provides guidelines and best practices for AI agents working with Docker. Docker is a fundamental tool for creating consistent, isolated, and portable development and production environments. |
| 4 | + |
| 5 | +## 1. Core Concepts |
| 6 | + |
| 7 | +A solid understanding of Docker's core concepts is essential. |
| 8 | + |
| 9 | +- **Images**: A read-only template with instructions for creating a Docker container. Images are the blueprints of your application. They are built from a `Dockerfile`. |
| 10 | +- **Containers**: A runnable instance of an image. You can create, start, stop, move, or delete a container. Containers are isolated from one another and from the host machine. |
| 11 | +- **Dockerfile**: A text document that contains all the commands a user could call on the command line to assemble an image. `docker build` uses this file to create an image. |
| 12 | +- **Volumes**: The preferred mechanism for persisting data generated by and used by Docker containers. While bind mounts are dependent on the directory structure of the host machine, volumes are completely managed by Docker. |
| 13 | +- **Docker Hub / Registries**: A registry of Docker images. Docker Hub is the default public registry. You can pull images from a registry and push your own images to it. |
| 14 | +- **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services. |
| 15 | + |
| 16 | +## 2. Dockerfile Best Practices |
| 17 | + |
| 18 | +Writing a clean, efficient, and secure `Dockerfile` is critical. |
| 19 | + |
| 20 | +- **Use a `.dockerignore` file**: Exclude files and directories that are not necessary for the build, such as `.git`, `node_modules`, and temporary files. This reduces the build context size and improves build performance. |
| 21 | +- **Use Multi-Stage Builds**: Use multi-stage builds to separate the build environment from the final runtime environment. This dramatically reduces the size of your final image by excluding build-time dependencies and tools. |
| 22 | + |
| 23 | + ```dockerfile |
| 24 | + # Build stage |
| 25 | + FROM node:18 as builder |
| 26 | + WORKDIR /app |
| 27 | + COPY package.json . |
| 28 | + RUN npm install |
| 29 | + COPY . . |
| 30 | + RUN npm run build |
| 31 | + |
| 32 | + # Final stage |
| 33 | + FROM nginx:stable-alpine |
| 34 | + COPY --from=builder /app/build /usr/share/nginx/html |
| 35 | + EXPOSE 80 |
| 36 | + CMD ["nginx", "-g", "daemon off;"] |
| 37 | + ``` |
| 38 | + |
| 39 | +- **Choose Minimal Base Images**: Start with a minimal base image, like `alpine`, to reduce the image size and attack surface. |
| 40 | +- **Don't Install Unnecessary Packages**: Avoid installing debugging tools or other packages that are not needed in the final image. |
| 41 | +- **Combine `RUN` instructions**: Chain `RUN` commands using `&&` to reduce the number of layers in your image. Clean up temporary files in the same layer. |
| 42 | + |
| 43 | + ```dockerfile |
| 44 | + RUN apt-get update && apt-get install -y \ |
| 45 | + package-one \ |
| 46 | + package-two \ |
| 47 | + && rm -rf /var/lib/apt/lists/* |
| 48 | + ``` |
| 49 | + |
| 50 | +- **Leverage Build Cache**: Order your `Dockerfile` instructions from least to most frequently changing. `COPY package.json` and `RUN npm install` should come before `COPY . .` so that you don't have to re-install dependencies every time a source file changes. |
| 51 | +- **Run as a Non-Root User**: Create a non-root user and use the `USER` instruction to run your application. This is a crucial security best practice. |
| 52 | + |
| 53 | + ```dockerfile |
| 54 | + RUN addgroup -S appgroup && adduser -S appuser -G appgroup |
| 55 | + USER appuser |
| 56 | + ``` |
| 57 | + |
| 58 | +## 3. Essential CLI Commands |
| 59 | + |
| 60 | +You will frequently interact with the Docker daemon via the CLI. |
| 61 | + |
| 62 | +### Single Container Management |
| 63 | + |
| 64 | +- `docker build -t <image-name>:<tag> .`: Build an image from a Dockerfile. |
| 65 | +- `docker run [OPTIONS] <image-name>`: Run a container from an image. |
| 66 | + - `-d`: Detached mode (run in the background). |
| 67 | + - `-p <host-port>:<container-port>`: Map a port. |
| 68 | + - `--rm`: Automatically remove the container when it exits. |
| 69 | + - `-v <volume-name>:<container-path>`: Mount a volume. |
| 70 | + - `--name <container-name>`: Assign a name to the container. |
| 71 | +- `docker ps`: List running containers. (`-a` to show all). |
| 72 | +- `docker stop <container-id|name>`: Stop a running container. |
| 73 | +- `docker rm <container-id|name>`: Remove a stopped container. |
| 74 | +- `docker logs <container-id|name>`: View the logs of a container. |
| 75 | +- `docker exec -it <container-id|name> <command>`: Execute a command in a running container (e.g., `bash`). |
| 76 | +- `docker images`: List all images on the system. |
| 77 | +- `docker rmi <image-id>`: Remove an image. |
| 78 | +- `docker pull <image-name>:<tag>`: Pull an image from a registry. |
| 79 | +- `docker push <image-name>:<tag>`: Push an image to a registry. |
| 80 | + |
| 81 | +### Multi-Container Management (Docker Compose) |
| 82 | + |
| 83 | +- `docker-compose up`: Build, (re)create, start, and attach to containers for a service. Use `-d` to run in detached mode. |
| 84 | +- `docker-compose down`: Stop and remove containers, networks, images, and volumes. Use `-v` to remove named volumes. |
| 85 | +- `docker-compose ps`: List containers. |
| 86 | +- `docker-compose logs`: View logs from services. |
| 87 | +- `docker-compose build`: Build or rebuild services. |
| 88 | +- `docker-compose exec <service-name> <command>`: Execute a command in a running service. |
| 89 | + |
| 90 | +## 4. Security Best Practices |
| 91 | + |
| 92 | +- **Principle of Least Privilege**: |
| 93 | + - Always run containers as a non-root user (`USER` instruction). |
| 94 | + - Use `COPY` instead of `ADD` where possible, as `ADD` can have unexpected behavior (e.g., auto-extracting tarballs). |
| 95 | +- **Reduce Attack Surface**: |
| 96 | + - Use minimal base images. |
| 97 | + - Don't install unnecessary packages. |
| 98 | + - Use multi-stage builds to discard build tools. |
| 99 | +- **Scan for Vulnerabilities**: Use tools like Docker Scout, Trivy, or Snyk to scan your images for known vulnerabilities. |
| 100 | +- **Manage Secrets Securely**: |
| 101 | + - Do not copy secrets (API keys, passwords) directly into your `Dockerfile`. |
| 102 | + - Use build-time secrets (`--secret`) or runtime environment variables/Docker secrets to handle sensitive data. |
| 103 | +- **Prevent Privilege Escalation**: Run containers with `--security-opt=no-new-privileges` to prevent processes from gaining new privileges. |
0 commit comments