Docker ও Container — শুরু থেকে শেষ

Container কেন?

• "Works on my machine" সমাধান
• Code + deps + runtime portable
• Lightweight vs VM
• Fast startup (seconds)
• Dense packing

Container vs VM

VM: [App][OS][Hypervisor][HW] — full OS each
Container: [App][Runtime][OS][HW] — shares kernel

Dockerfile ⭐

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
EXPOSE 3000
USER node
CMD ["node", "server.js"]

Multi-Stage Build ⭐

FROM node:20 AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci && npm run build

FROM node:20-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
USER node
CMD ["node", "dist/server.js"]
# Final: ~150MB vs 1GB

Image Optimization

• Alpine base (5MB vs 100MB Ubuntu)
• Multi-stage build
• .dockerignore (node_modules, .git)
• Combine RUN commands (layer)
• COPY package.json first (cache deps)
• Distroless — even smaller

.dockerignore

node_modules
.git
.env
*.log
dist
coverage

Common Commands

docker build -t myapp:1.0 .
docker run -d -p 3000:3000 --name app myapp:1.0
docker ps, docker logs app, docker exec -it app sh
docker stop app, docker rm app, docker rmi myapp:1.0
docker system prune -a   # clean unused

Docker Compose ⭐

# docker-compose.yml
version: "3.8"
services:
  app:
    build: .
    ports: ["3000:3000"]
    environment:
      DATABASE_URL: postgresql://user:pass@db:5432/app
    depends_on: [db, redis]
  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: app
    volumes: ["pgdata:/var/lib/postgresql/data"]
  redis:
    image: redis:7-alpine
volumes:
  pgdata:

docker-compose up -d
docker-compose logs -f app
docker-compose down -v

Volumes

• Named — Docker managed (pgdata)
• Bind mount — host path (./data:/app/data)
• tmpfs — memory only

Networks

docker network create mynet
docker run --network mynet ...
# Compose: services auto-connected by name
# app can reach db at hostname "db"

Container Security ⭐

• Non-root user (USER node)
• Minimal base image
• Scan image — Trivy, Snyk, Clair
• Read-only filesystem: --read-only
• Drop capabilities: --cap-drop=ALL
• No privileged mode
• Sign images (Docker Content Trust)
• Secrets via Docker Secrets/env (not in image)

Registry

Docker Hub, ECR (AWS), ACR (Azure), GCR (GCP), GitHub Container Registry, Harbor (self-host)।

docker login
docker tag myapp:1.0 myuser/myapp:1.0
docker push myuser/myapp:1.0