Docker
Published on
A container image packages a filesystem and process configuration. A container runtime starts that image with kernel isolation and resource controls. Containers improve portability; they do not create a complete security boundary or remove host, network, storage, and identity dependencies.
Build images deliberately
FROM python:3.12-slim AS runtime
WORKDIR /app
COPY app.py .
USER 10001
EXPOSE 8080
ENTRYPOINT ["python", "app.py"]- Pin base images by digest when reproducibility and provenance require it.
- Keep the build context small with
.dockerignore. - Use multi-stage builds to exclude compilers, source, caches, and credentials.
- Run as a non-root user and use a read-only filesystem where the application supports it.
- Put configuration outside the image and deliver secrets through a purpose-built mechanism.
- Record image provenance and scan both packages and application dependencies.
EXPOSE documents an intended port; it does not publish the port or create a firewall rule. HEALTHCHECK describes container health, but an orchestrator may use its own probe model. CMD supplies default arguments; ENTRYPOINT defines the executable when used in exec form.
Runtime boundaries
Containers share the host kernel. Namespaces isolate views of processes, networks, mounts, and users; cgroups control resource use; capabilities and security profiles restrict kernel operations. Avoid privileged containers and mounting the container runtime socket because both can collapse the host boundary.
Set CPU and memory constraints from measured behavior. Understand whether an out-of-memory condition kills one process, a container, or causes node pressure. Persist state in managed volumes or external services with defined backup and recovery.
Diagnose systematically
Inspect image identity, configuration, process state, logs, exit code, health, resource use, mounts, network, DNS, and credentials. Reproduce with the same immutable image before changing it interactively. A debugging shell is useful evidence gathering, not a production configuration mechanism.
The service lab builds and runs a minimal image before loading it into Kubernetes.