Deploying with
Docker & Containers

Every developer has heard "But it works on my machine!" — the classic symptom of environment inconsistency between development, staging, and production.

# Node.js Express API Dockerfile
FROM node:20-alpine

# Create app directory
WORKDIR /app

# Install dependencies first (better caching)
COPY package*.json ./
RUN npm ci --only=production

# Copy application source
COPY src/ ./src/
COPY tsconfig.json ./

# Build TypeScript
RUN npm run build

# Expose the port
EXPOSE 3000

# Health check
HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget -qO- http://localhost:3000/health || exit 1

# Run as non-root user
USER node

# Start the app
CMD ["node", "dist/server.js"]

# ── Stage 1: Build ──
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
RUN npm prune --production

# ── Stage 2: Production ──
FROM node:20-alpine AS production
WORKDIR /app

# Only copy what we need
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./

USER node
EXPOSE 3000
CMD ["node", "dist/server.js"]

# docker-compose.yml
services:
  app:
    build: .
    ports:
      - "3000:3000"
    environment:
      - DATABASE_URL=postgres://user:pass@db:5432/myapp
      - REDIS_URL=redis://cache:6379
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_started
    volumes:
      - ./src:/app/src   # dev hot-reload

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: myapp
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user"]
      interval: 5s
      timeout: 3s
      retries: 5

  cache:
    image: redis:7-alpine
    ports:
      - "6379:6379"

volumes:
  pgdata:

# 1. Build the image
docker build -t myapp:v1.0.0 .

# 2. Tag for your registry
docker tag myapp:v1.0.0 \
  ghcr.io/myorg/myapp:v1.0.0

# 3. Authenticate
echo $GITHUB_TOKEN | docker login \
  ghcr.io -u USERNAME --password-stdin

# 4. Push to registry
docker push ghcr.io/myorg/myapp:v1.0.0

# 5. Pull on another machine
docker pull ghcr.io/myorg/myapp:v1.0.0
docker run -d -p 3000:3000 \
  ghcr.io/myorg/myapp:v1.0.0

# .github/workflows/docker.yml
name: Build & Push
on:
  push:
    tags: ['v*']
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v5
        with:
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:${{ github.ref_name }}
            ghcr.io/${{ github.repository }}:latest

# Create a custom network
docker network create mynet

# Run containers on the same network
docker run -d --name api \
  --network mynet myapp:1.0
docker run -d --name db \
  --network mynet postgres:16

# 'api' container can connect to:
#   postgres://db:5432/mydb
# Docker resolves 'db' to the container IP

# Secure Dockerfile example
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM gcr.io/distroless/nodejs20-debian12
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules

# No shell, no package manager, no root
USER nonroot:nonroot
EXPOSE 3000
CMD ["dist/server.js"]

# Scan image for vulnerabilities
trivy image myapp:v1.0.0

# Output:
# Total: 2 (HIGH: 1, CRITICAL: 1)
# ┌──────────┬────────────┬──────────┐
# │ Library  │ Vuln ID    │ Severity │
# ├──────────┼────────────┼──────────┤
# │ openssl  │ CVE-2024-… │ CRITICAL │
# │ curl     │ CVE-2024-… │ HIGH     │
# └──────────┴────────────┴──────────┘

# Common kubectl commands
kubectl get pods
kubectl apply -f deployment.yaml
kubectl scale deploy myapp --replicas=5
kubectl rollout status deploy/myapp
kubectl logs -f deploy/myapp

# Why did my container crash?
docker logs myapp --tail 50

# What's happening inside right now?
docker exec -it myapp sh

# Inspect the full container config
docker inspect myapp

# Check resource usage
docker stats myapp

# See what's eating disk space
docker system df

# Debug a failed build
docker build --progress=plain \
  --no-cache -t myapp .

# Dive into image layers
# (install 'dive' tool)
dive myapp:latest