Page 8 - Docker

Local Docker development environments running several projects need a reverse proxy that routes domains to containers and manages HTTPS certificates. Traefik and nginx-proxy solve the same problem with fundamentally different approaches. This article shows which proxy is the better choice in which scenario.

A dashboard nobody looks at at night does not help in an incident. Resource alerting for containers with Prometheus rules and Alertmanager automatically reports CPU bottlenecks, memory pressure and restart loops, groups related alerts, and uses silencing and inhibition to prevent a single incident from flooding the team with dozens of notifications.

A single container without limits can bring an entire host to its knees. Understanding Docker CPU and memory limits prevents resource monopolies, makes capacity planning measurable, and protects every service on the same host, not just your own.

A container that runs as root, with every Linux capability and a writable filesystem, is technically speaking a privileged process behind a thin namespace curtain. Docker offers several complementary security layers: a non-root USER, minimal capabilities, a read-only filesystem, and seccomp profiles. This article shows how these layers work and how to implement them in real Dockerfiles and Compose configurations.

A multi-stage Dockerfile consistently separates the build environment from the runtime. Builder stages with Composer, npm and build tools hand their output forward, without ever landing in the final image themselves. The result: smaller images, less attack surface and reproducible builds for PHP and Node projects.

Once an application consists of several containers, the chosen communication pattern determines the stability, coupling and fault tolerance of the entire system. From direct name resolution through sidecar and ambassador patterns to asynchronous message queues, this article shows which pattern fits which requirement.

Image promotion describes how an already built Docker image moves in a controlled way from staging to production, without being rebuilt. Retagging, digest pinning and manual approvals replace the fragile reflex of simply rebuilding on every deploy and hoping nothing changed.

Production problems in Docker containers call for precise tooling, not guesswork. With exec, inspect, stats, top and events you can fully examine the processes, configuration, memory and events of a running container, with no restart and no data loss.

Not every file a container writes should outlive the container's lifecycle, especially when it comes to decrypted secrets, session tokens, or temporary encryption keys. tmpfs mounts keep such data exclusively in memory, so it never gets written to the host's disk, making them a simple yet effective security tool for Docker containers.

A 1.2 GB Docker image is not a sign of completeness, it is a sign of missing optimization. Multi-stage builds, precise layer order, a well thought out .dockerignore and the right choice of base image make the difference between a lean, fast CI build and a deployment bottleneck.