Feedback before writing: A list of generic Docker practices

[goldbergyoni]

Context: This is used to share my TOC of a new best practice so I can solicit feedback and ideas before start writing. From my experience, this makes the writing experience much easier and shorter. And fun.

Title: A list of generic Docker practices

TL&DR: A list of generic Docker good practices that are not related specifically to Node

• Don't apt-update or do any modification to the base layer
• Prefer COPY over ADD
• Use unprivileged containers
• Help me with more?

[js-kyle]

Leverage build cache https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#leverage-build-cache

[kevynb]

Use a .dockerignore to avoid "uploading" unneeded files in the daemon context

Edit: Sorry, this is already in #703

[goldbergyoni]

Inspect your built image with image inspectors (e.g. dive)

[goldbergyoni]

• Label the image with useful classification
• FROM: should have a tag and it shouldn't be latest

[goldbergyoni]

• Integrity check
• Avoid apt-upgrade
• Label

[kevynb]

Closing as we merged #722

[stale]

Hello there! 👋
This issue has gone silent. Eerily silent. ⏳
We currently close issues after 100 days of inactivity. It has been 90 days since the last update here.
If needed, you can keep it open by replying here.
Thanks for being a part of the Node.js Best Practices community! 💚

[jamonit42]

Thank you

…

On Sun, Nov 15, 2020, 1:13 PM stale[bot] ***@***.***> wrote: Hello there! 👋 This issue has gone silent. Eerily silent. ⏳ We currently close issues after 100 days of inactivity. It has been 90 days since the last update here. If needed, you can keep it open by replying here. Thanks for being a part of the Node.js Best Practices community! 💚 — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#708 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AROGP77IKYQF4YWHMDH7CLDSQAK4RANCNFSM4NTKDNLQ> .

[ajimae]

• Always ensure you check if the full image is what you need or an alpine version of the image, this will save you a lot of space.

• Always use multistage build for your images and deployments.
  https://docs.docker.com/develop/develop-images/multistage-build/

• Use standard secret management
  https://www.docker.com/blog/docker-secrets-management/

[goldbergyoni]

@ajimae Thanks for these nice ideas, we already published the Docker best practices section, see on the home page. Given our list, do you think that anything is missing there?