Page 13 - Docker

A server change, a hosting provider switch, or consolidating multiple Docker hosts eventually requires moving a running database container from one machine to another. Depending on data volume, downtime tolerance, and network connectivity between hosts, logical dumps, raw volume copies via rsync, or a replication cutover each suit different scenarios, with their own pitfalls around consistency and integrity.

A good Magento workflow depends heavily on using the right commands. In a Mark Shust setup, the wrappers in the `bin/` directory are the clean way to handle Magento, Composer, logs, debugging, the database and code quality.

Running every container in the default bridge network means giving up name resolution, isolation between projects and the ability to cut containers off from the internet on purpose. A dedicated bridge network per project solves exactly these three problems with a few lines of configuration.

A container is not a virtual machine, it is an isolated process sharing the same kernel with the host. Container escape prevention means consistently hardening exactly that boundary: no unnecessary privileges, no mounted sockets, active seccomp and AppArmor profiles, and a current kernel, so a compromised container never becomes a stepping stone to the host.

Approval rules make sure code review does not depend on individual good will but is technically enforced, with CODEOWNERS integration, minimum approval counts, and clear rules for exceptions.

Docker Desktop is the standard entry point into containers for many development teams, but since 2021 larger companies fall under paid licensing terms. Teams that do not know the criteria risk either unnecessary spending or a license violation, and by now several mature alternatives exist that are more than sufficient for many teams.

A Docker image is not a black box. It is an ordered sequence of read-only layers that together form the container's filesystem. Anyone who understands how layers are built, why the build cache gets invalidated, and how registries distribute images efficiently writes Dockerfiles that build fast and produce small images.

The more merge requests race against the same protected branch at the same time, the greater the risk that two individually well tested changes break each other once merged. Merge trains solve this by testing every merge request not against the current state but against the expected future state of the target branch, sequentially, one after another, like carriages on a train.

Integration and end-to-end tests rarely fail because of the test logic itself, they fail because of the environment: the wrong database version, services that never started, race conditions during startup. Docker Compose solves exactly that, with declared dependencies, healthchecks and network isolation that make every test run reproducible.

Anyone who only ever runs tests and CLI commands in the terminal loses valuable seconds on every cycle. Run configurations in PhpStorm turn the green play button into a real tool, with a Docker interpreter, Xdebug integration and compound runs for complex workflows.