Forem: Smooth Code

Dockerize & Deploy a MERN Application (MongoDB, Express.js, React, Node.js)

Smooth Code — Wed, 05 Nov 2025 16:50:12 +0000

Containerizing a MERN application helps streamline development, ensure consistent environments, and enable smooth production deployments. In this guide, we’ll walk through Dockerizing both the Node.js backend and React/Next.js frontend, orchestrating services with Docker Compose, and finally configuring an Nginx reverse proxy for production.

🧱 Why Use Multi-Stage Docker Builds?

Traditional Docker builds often produce large images containing dependencies and files needed only during development. Multi-stage builds solve this by:

Separating build dependencies from the runtime environment
Significantly reducing the final image size
Improving security by excluding tooling from production

🔧 Environment Variables Overview

Backend (Node.js)

Environment variables determine how the Express server connects to MongoDB:

const MONGO_USER = process.env.MONGO_USER || "admin";
const MONGO_PASS = process.env.MONGO_PASS || "admin";
const MONGO_HOST = process.env.MONGO_HOST || "localhost";
const MONGO_PORT = process.env.MONGO_PORT || "27017";
const MONGO_DB   = process.env.MONGO_DB   || "notesdb";
const PORT = process.env.PORT || 5000;

Frontend (Next.js / React)

These are embedded during the build:

const API_HOST = process.env.NEXT_PUBLIC_BACKEND_HOST || "http://localhost:5000";
const BG_COLOR = process.env.NEXT_PUBLIC_BG_COLOR || "#f5f5f5";

Note: Variables prefixed with NEXT_PUBLIC_ are compiled into the build.
Changing them later requires rebuilding the frontend unless runtime config is implemented.

🏗️ Dockerizing the Node.js Backend

# Base image for dependencies
FROM node:20-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# Final minimal image
FROM node:20-alpine AS final
WORKDIR /app
RUN addgroup -S app && adduser -S app -G app
COPY --from=build /app/node_modules ./node_modules
COPY . .
USER app
EXPOSE 5000
CMD ["node", "server.js"]

🎨 Dockerizing the Next.js Frontend

# Build stage
FROM node:18-bookworm-slim AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
ARG NEXT_PUBLIC_BG_COLOR="red"
RUN NEXT_PUBLIC_BG_COLOR=${NEXT_PUBLIC_BG_COLOR} npm run build

# Production stage
FROM node:18-bookworm-slim AS final
WORKDIR /app
COPY --from=builder /app/.next ./.next
COPY --from=builder /app/public ./public
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./
CMD ["npm", "run", "start"]

This Dockerfile builds a Next.js app in a multi-stage process, optimizing the final image by copying only necessary files. It sets a customizable background color via an argument during build.

For production, define backend host at build time:

ARG NEXT_PUBLIC_BACKEND_HOST="http://your-server-ip"
RUN NEXT_PUBLIC_BACKEND_HOST=${NEXT_PUBLIC_BACKEND_HOST} npm run build

🧩 Orchestrating Everything with Docker Compose

services:
  mongodb:
    image: mongo:7
    container_name: mongodb
    restart: unless-stopped
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: admin
      MONGO_INITDB_DATABASE: notesdb
    volumes:
      - mongo-data:/data/db
    ports:
      - "27017:27017"
    networks:
      - mern-net

  nodejs:
    build:
      context: ./backend
    image: smoothcoode/mernbackend #change this to you username/imagename
    container_name: nodeapp
    restart: unless-stopped
    ports:
      - "5000:5000"
    environment:
      - MONGO_HOST=mongodb
    depends_on:
      - mongodb
    networks:
      - mern-net

  frontend:
    build:
      context: ./frontend
    image: smoothcoode/mernfrontend #change this to you username/imagename
    ports:
      - "3000:3000"
    restart: unless-stopped
    depends_on:
      - nodejs
    networks:
      - mern-net

volumes:
  mongo-data:

networks:
  mern-net:
    driver: bridge

🌐 Setting Up Nginx Reverse Proxy (Production)

server {
    listen 80;
    server_name _;

    # Frontend
    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_redirect http://localhost:3000/ http://$host/;
    }

    # Backend API
    location /api/ {
        proxy_pass http://localhost:5000;
        proxy_set_header Host $host;
    }
}

✅ Conclusion

By using multi-stage Docker builds and Docker Compose, we create a lightweight, secure, and scalable deployment workflow for MERN applications. Adding Nginx allows us to cleanly route frontend web traffic and API requests in production.

You now have:

Dockerized Node.js and Next.js applications
A persistent MongoDB container
A unified environment via Docker Compose
A production-ready reverse proxy setup

Dockerize & Deploy Spring Boot + Angular + MySQL | Full Guide

Smooth Code — Wed, 05 Nov 2025 16:15:11 +0000

Containerizing a full-stack application can be challenging—especially when you want to keep builds efficient, secure, and optimized for production. In this guide, we’ll walk through how to dockerize a Spring Boot backend, Angular frontend, and MySQL database using multi-stage Docker builds and Docker Compose.

🧠 Why Multi-Stage Docker Builds?

Traditional Docker builds bundle everything—including build tools and dev dependencies—into the final image. This results in:

❌ Large image sizes
❌ Slower deployments
❌ Unnecessary security exposure

Multi-Stage Builds solve these issues by:

✅ Separating build and runtime environments
✅ Producing smaller, optimized final images
✅ Improving image security

🎨 Dockerizing the Angular Frontend

We use a two-stage Dockerfile:

# Build stage
FROM node:lts-slim AS build
WORKDIR /src
COPY package*.json ./
RUN npm ci
COPY . ./
RUN npm run build -- --configuration=production --output-path=dist

# Production stage
FROM nginx:stable AS final
EXPOSE 4200
RUN rm -f /usr/share/nginx/html/index.html
COPY --from=build /src/dist/browser /usr/share/nginx/html
COPY nginx.conf /etc/nginx/nginx.conf

This approach ensures the production image contains only the compiled Angular assets and nginx, without the Node.js build tools.

`nginx.conf` (runs frontend on port 4200):

events { }

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    server {
        listen 4200;
        root /usr/share/nginx/html;

        index index.html;
        location / {
            try_files $uri /index.html;
        }
    }
}

✅ Final image contains only compiled Angular + Nginx, not Node.js.

🏗️ Dockerizing the Spring Boot Backend

We again use a multi-stage approach:

# Build Stage
FROM eclipse-temurin:17-jdk-jammy AS builder
WORKDIR /app
COPY mvnw .
COPY .mvn/ .mvn/
COPY pom.xml .
COPY src/ src/
RUN ./mvnw clean package -DskipTests

# Runtime Stage
FROM eclipse-temurin:17-jre-jammy AS runtime
RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
RUN groupadd -r spring && useradd -r -g spring spring
USER spring
WORKDIR /app
COPY --from=builder /app/target/*.jar app.jar
EXPOSE 9090
ENTRYPOINT ["java", "-jar", "/app/app.jar"]

`application.properties`

spring.application.name=projectassignment
spring.datasource.url=jdbc:mysql://${MYSQL_HOST:localhost}:${MYSQL_PORT:3306}/projectassignment?allowPublicKeyRetrieval=true&useSSL=false
spring.datasource.username=${MYSQL_USERNAME:root}
spring.datasource.password=${MYSQL_PASSWORD:root}
spring.jpa.hibernate.ddl-auto=${MYSQL_STRATEGY:update}
server.port=${SERVER_PORT:9090}

🔁 Notice: MYSQL_HOST will be overridden by Docker Compose.

🧱 Docker Compose: Orchestrating All Services

services:
  mysql-db:
    image: mysql:8.0
    container_name: mysql-db
    environment:
      MYSQL_ROOT_PASSWORD: root
      MYSQL_DATABASE: projectassignment
    ports:
      - "3306:3306"
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-proot"]
      interval: 10s
      timeout: 5s
      retries: 5

  spring-backend:
    build:
      context: ./project_assignment(backend)
      dockerfile: Dockerfile
    image: pabackend
    container_name: spring-backend
    ports:
      - "9090:9090"
    environment:
      - MYSQL_HOST=mysql-db
    depends_on:
      mysql-db:
        condition: service_healthy
    restart: unless-stopped

  angular-frontend:
    build:
      context: ./project_assignment(frontend)
      dockerfile: Dockerfile
    image: pafrontend
    container_name: angular-frontend
    ports:
      - "4200:4200"
    depends_on:
      - spring-backend
    restart: unless-stopped

🌐 Nginx Reverse Proxy

If you want all traffic via port 80:

server {
    listen 80;
    server_name _;

    location / {
        proxy_pass http://localhost:4200;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect http://localhost:4200/ http://$host/;
    }

    location /api/ {
        proxy_pass http://localhost:9090/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

✅ Final Result

After running:

docker compose up --build -d

You will have:

Service	URL
Frontend	http://localhost:4200
Backend API	http://localhost:9090
Database	localhost:3306

🎯 Summary

Using multi-stage builds + Docker Compose makes your application:

Faster to build
Smaller to deploy
Easier to maintain
More secure in production

🎙️ Building a Text-to-Speech (TTS) GUI with Python

Smooth Code — Wed, 05 Nov 2025 15:41:31 +0000

Have you ever wanted to turn text into natural-sounding speech directly from your computer? With Python, it's easier than ever! By combining Microsoft Edge's neural voices (via the edge-tts library) and Python's built-in tkinter GUI framework, we can create a simple yet powerful Text-to-Speech (TTS) application.

This project lets you input text (or upload a file), select a voice, adjust the speaking speed, and save the output as an MP3 audio file.

✨ Features

🎤 Multiple Voice Options

Supports various neural voices such as US English, British English, Australian English, Canadian English, Spanish, and more.
⚡ Customizable Speech Rate

Adjust speed from -50% (slower) to +50% (faster) using a slider.
📝 Flexible Text Input

Enter text directly or upload a text file.
💾 Export as MP3

Save the generated speech to your preferred location.
🖥️ Clean GUI

Built with tkinter, offering a simple and user-friendly interface.

Dependencies

Ensure you have Python 3.7+ installed on your system. Then, install the edge-tts module:

pip install edge-tts

📦 Installation

Clone the repository:

git clone https://github.com/smoothcoode/edge-tts-gui
cd edge-tts-gui

Install dependencies:

pip install edge-tts

Run the application:

python main.py

🗣️ Listing Available Voices

To see all available neural voices, run:

python -m edge_tts --list-voices

You'll find a variety of voices you can experiment with.

🧑‍💻 Source Code

Here's the complete Python script that powers the application:

import edge_tts
import tkinter as tk
from tkinter import ttk, messagebox, filedialog
import asyncio

async def generate_audio(text, voice, rate, output_file):
    communicate = edge_tts.Communicate(text=text, voice=voice, rate=rate)
    await communicate.save(output_file)
    messagebox.showinfo("Success", "File saved successfully: " + output_file)

# Initialize main window
root = tk.Tk()
root.title("Text to Speech")
root.geometry("600x400")

# Voice selection
VOICES = [
    "en-US-AndrewNeural", "en-US-AriaNeural", "en-US-AshTurboMultilingualNeural",
    "en-US-AshleyNeural", "en-US-AvaMultilingualNeural", "en-US-AvaNeural"
]
ttk.Label(root, text="Select a Voice:").grid(column=0, row=0, padx=10, pady=10, sticky="w")
voice_var = tk.StringVar(value=VOICES[0])
voice_dropdown = ttk.Combobox(root, values=VOICES, textvariable=voice_var, state="readonly")
voice_dropdown.grid(row=0, column=1, padx=10, pady=10, sticky="ew")
root.columnconfigure(1, weight=3)

# Speed slider
ttk.Label(root, text="Select a speed Rate").grid(row=1, column=0, padx=10, pady=10, sticky="w")
speed_var = tk.IntVar(value=0)
speed_slider = ttk.Scale(root, from_=-50, to=50, orient="horizontal", variable=speed_var)
speed_slider.grid(row=1, column=1, padx=10, pady=10, sticky="ew")

# Text input
ttk.Label(root, text="Enter a text").grid(row=2, column=0, padx=10, pady=10, sticky="w")
text_box = tk.Text(root, wrap="word")
text_box.grid(row=2, column=1, padx=10, pady=10, sticky="nsew")
root.rowconfigure(2, weight=1)

# Upload file button
def on_upload():
    file_path = filedialog.askopenfilename(filetypes=[("Text File", "*.txt")])
    if file_path:
        with open(file_path, "r") as f:
            content = f.read()
            text_box.delete("1.0", tk.END)
            text_box.insert("1.0", content)

upload_button = ttk.Button(root, text="Upload a text", command=on_upload)
upload_button.grid(row=3, column=1, padx=10, pady=10, sticky="e")

# Generate audio
def on_generate_audio():
    voice = voice_var.get()
    rate = speed_var.get()
    rate_str = f"+{rate}%" if rate >= 0 else f"{rate}%"
    text = text_box.get("1.0", tk.END).strip()
    if not text:
        messagebox.showwarning("Warning", "No text Provided")
        return
    output_file = filedialog.asksaveasfilename(defaultextension=".mp3", filetypes=[("MP3", "*.mp3")])
    if not output_file:
        return
    asyncio.run(generate_audio(text=text, voice=voice, rate=rate_str, output_file=output_file))

generate_button = ttk.Button(root, text="Generate Audio", command=on_generate_audio)
generate_button.grid(row=4, column=1, padx=10, pady=10)

# Run the GUI
root.mainloop()

🚀 Conclusion

This project is a great starting point for anyone exploring Text-to-Speech applications in Python. By leveraging edge-tts and tkinter, you can create a fully functional GUI tool that makes text come alive as natural-sounding speech.

Whether you want to narrate articles, build accessibility tools, or experiment with voice synthesis, this Python TTS GUI is a practical and fun project to try out.

Automate Dynamic Application Security Testing (DAST) with CI/CD

Smooth Code — Wed, 05 Nov 2025 13:45:18 +0000

Dynamic Application Security Testing (DAST) is a security testing technique that focuses on identifying vulnerabilities in running web applications. It simulates real-world attacks by sending requests to the application and analyzing the responses. DAST tools, like OWASP ZAP (Zed Attack Proxy), help organizations uncover vulnerabilities such as cross-site scripting (XSS), SQL injection, and security misconfigurations.

Dast can perform well automated with Gitlab CI/CD
In my example I will launch dast attack on facturation website called testphp.vulnweb .

Gitlab-CiCd

Add the following script to .gitlab-ci.yml :

stages:
    - security

run-dast-job:
  stage: security
  image: maven:3.8.5-openjdk-17-slim    
  script:
    - apt-get update
    - apt-get -y install wget unzip wkhtmltopdf
    - wget https://github.com/zaproxy/zaproxy/releases/download/v2.16.1/ZAP_2.16.1_Linux.tar.gz
    - mkdir zap
    - tar -xvf ZAP_2.16.1_Linux.tar.gz -C zap
    - cd zap/ZAP_2.16.1
    - ./zap.sh -cmd -quickurl http://testphp.vulnweb.com/ -quickout ../zap_report.html
    - cd ..
    - wkhtmltopdf zap_report.html zap_report.pdf
  artifacts:
    when: always
    paths:
      - zap/zap_report.pdf
    expire_in: 1 week
  allow_failure: true

Github Actions

name: DAST (ZAP) scan

on:
  push:
    branches: [ main ]
  workflow_dispatch:

jobs:
  dast:
    name: Run DAST (ZAP)
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4

      - name: Setup Java 17 (for ZAP)
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get -y install wget unzip wkhtmltopdf

      - name: Download and extract ZAP
        run: |
          wget https://github.com/zaproxy/zaproxy/releases/download/v2.16.1/ZAP_2.16.1_Linux.tar.gz
          mkdir -p zap
          tar -xvf ZAP_2.16.1_Linux.tar.gz -C zap

      - name: Run ZAP quick scan + convert to PDF
        id: run-zap
        continue-on-error: true                     # allow failure (similar to allow_failure: true)
        run: |
          set -e || true
          cd zap/ZAP_2.16.1
          chmod +x zap.sh
          # run the quick scan (replace URL with your target)
          ./zap.sh -cmd -quickurl http://testphp.vulnweb.com/ -quickout ../zap_report.html || true
          cd ..
          # convert html to pdf (may require additional libs on some runners)
          wkhtmltopdf zap_report.html zap_report.pdf || true

      - name: Upload ZAP PDF artifact
        if: always()                                # ensure artifact is uploaded even if previous step failed
        uses: actions/upload-artifact@v4
        with:
          name: zap-report
          path: zap/zap_report.pdf
          retention-days: 7                         # equivalent to expire_in: 1 week

The pipeline should be successfull and you will manage to download the artifcat file containing the dast pdf rapport after clicking on the successful stage.

DAST provides an effective way to identify vulnerabilities in running applications by simulating real attack scenarios. By integrating OWASP ZAP with CI/CD pipelines—whether using GitLab or GitHub Actions—security testing becomes automated and continuous. This ensures that every new change is checked for potential security risks early in the development cycle. The result is a more secure application and faster vulnerability detection, with scan reports easily accessible as pipeline artifacts.

Stop Tagging Docker Images Manually | Automate Docker Tagging full guide

Smooth Code — Wed, 05 Nov 2025 13:02:11 +0000

This Article provides a streamlined approach to automate Docker image tagging using versioning strategies.

It supports two main versioning approaches:

Semantic Versioning
Timestamp-based Versioning

Usage in Docker

After configuring Semantic/DateTimeStamp versioning, you can use it in docker like the following

docker build -t "imagename:$(pyv)" . #build docker image with semantic versioning
docker push "username/imagename:$(pyv)" #push docker image created with semantic versioning
docker build -t "imagename:$(dtsv)" . #build docker image with TimeStamp based versioning

Docker Image Reference Structure

🔹 REGISTRY_HOST:PORT (Optional): Specifies the hostname (and optional port) of the Docker registry.
🔹 NAMESPACE (Optional): Represents the user or organization account within the registry.
🔹 REPOSITORY (Required): The actual name of the image.
🔹 TAG (Optional but Important): Identifies a specific version or variant of the image.
myapp:1.0.0 (semantic version)
myapp:2025_10_14_1200 (timestamp-based tag)
myapp:latest (default if none specified)

Semantic Versioning

Semantic versioning is a widely adopted version scheme that encodes a version by a three-part version number (Major. Minor. Patch), an optional pre-release tag, and an optional build meta tag. In this scheme, risk and functionality are the measures of significance.

The core script pyv.py manages semantic versioning stored in a docker_version.json file. It allows incrementing major, minor, and patch versions, and displays the current version.

import json
import sys
import os

default_version={"major":1,"minor":0,"patch":0}

VERSION_FILE="docker_version.json"

def get_version():
    if not os.path.exists(VERSION_FILE):
        return default_version
    with open(VERSION_FILE,"r") as f:
        return json.load(f)
def save_version(version):
    with open(VERSION_FILE,"w") as f:
        json.dump(version,f,indent=2)

def format_version(version):
    major=version["major"]
    minor=version["minor"]
    patch=version["patch"]
    if patch==0:
        if minor==0:
            return f"{major}"
        else:
            return f"{major}.{minor}"
    else:
        return f"{major}.{minor}.{patch}"

def show_version():
    v=get_version()
    return format_version(v)

def update_version(version):
    save_version(version)
    return format_version(version)

def increment_major():
    v=get_version()
    v["major"]+=1
    v["minor"]=0
    v["patch"]=0
    return update_version(v)

def increment_minor():
    v=get_version()
    v["minor"]+=1
    v["patch"]=0
    return update_version(v)

def increment_patch():
    v=get_version()
    v["patch"]+=1
    return update_version(v)

if __name__ == '__main__':

    if len(sys.argv)==1:
        print(show_version())
        sys.exit(0)
    if len(sys.argv)>2:
        print("Usage: pyv <major|minor|patch|show>")
        sys.exit(1)

    command=sys.argv[1]

    if command=="major":
        print(increment_major())
    elif command=="minor":
        print(increment_minor())
    elif command=="patch":
        print(increment_patch())
    elif command=="show":
        print(show_version())
    else:
        print("Invalid command. Use major|minor|patch|show as argument.")
        sys.exit(1)

How it works

If the version file does not exist, it initializes to version 1.0.0. Supports commands: show: Displays current version, major: Increments major version, minor: Increments minor version, patch: Increments patch version

Usage

python pyv.py show
python pyv.py major
python pyv.py minor
python pyv.py patch

Global Command Setup

Linux Terminal

Create a pyv script (without.py extension)

#!/usr/bin/env python3
# Add the Python script code here

Make it executable and copy it to /usr/local/bin/

chmod +x pyv
sudo cp pyv /usr/local/bin/

Windows PowerShell

Create a batch file (pyv.bat)

@echo off
python "%~dp0pyv.py" %*

Set up PowerShell Profile

Test-Path $PROFILE
New-Item -ItemType File -Path $PROFILE -Force
notepad $PROFILE

Add alias to profile

Set-Alias pyv "C:\path\to\pyv.bat" #copy the absolute path of your pyv.bat file

Configure execution policy (if you are having restrected execution policy)

Get-ExecutionPolicy
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Date Timestamps

This format automatically tags using timestamps in the pattern Year_Month_Day__Hour_Minute_Second to ensure unique and chronologically ordered names.

Linux

echo $SHELL #To know your shell

Set Date-Timestamps alias:

alias dtsv="date +'%Y_%m_%d__%H_%M_%S'"

Add Date-Timestamps alias to Shell configuration:

nano ~/.bashrc # or nano ~/.zshrc

After editing, source the profile:

source ~/.bashrc # or source ~/.zshrc

Windows PowerShell

Add the following function to your PowerShell profile to generate timestamp strings:

notepad $PROFILE

Add this function:

function dtsv { Get-Date -Format "yyyy_MM_dd__HH_mm_ss" }

Usage:

dtsv

This setup enables efficient Docker image tagging through semantic or timestamp-based versioning, with cross-platform support and easy integration into your build process.

Master Pro Docker Techniques: A Best Practices Guide for Lean, Secure Containers

Smooth Code — Tue, 04 Nov 2025 17:27:46 +0000

Welcome back, developers and DevOps enthusiasts! If you're using Docker, you've already taken a massive step toward streamlined development and deployment. But are you using it to its full potential? Moving beyond the basics can transform your containers from merely functional to exceptionally efficient, secure, and robust. In this guide, we're diving into the professional Docker techniques that make your containers faster, smaller, and significantly more secure.

1. Master Multi-Stage Builds

A multi-stage build uses a single Dockerfile with multiple FROM statements. Each FROM instruction starts a new build stage, allowing you to cleanly separate your build environment from your final runtime environment. You can use one stage with all the heavy compilers and build tools to create your application, and then copy only the necessary compiled artifacts into a lean, final stage.

The benefits are profound. By leaving behind the build tools, you achieve a dramatic reduction in image size - often by hundreds of megabytes. This directly translates to a reduced attack surface, as there are fewer packages that could contain vulnerabilities. While the startup speed gain might be small, pulling a smaller image from a registry is undeniably faster, improving your scaling and deployment responsiveness.
For instance this is a great example of angular multi stage dockerfile:

# Stage 1: Build Angular app
FROM node:lts-slim AS build
WORKDIR /src
COPY package*.json ./
RUN npm ci
COPY . ./
RUN npm run build -- --configuration=production --output-path=dist

# Stage 2: Serve with Nginx
FROM nginx:stable AS final
EXPOSE 80
# Copy built Angular app to nginx
COPY --from=build /src/dist/browser /usr/share/nginx/html

2. Leverage the .dockerignore File

Think of .dockerignore as .gitignore for Docker. It's a simple file that tells the Docker CLI which files and directories to exclude when sending the "build context" to the Docker daemon.

Why it's non-negotiable:
This small file delivers huge wins. By excluding directories like node_modules, .git, logs, and local IDE files, you drastically speed up your builds by reducing the amount of data transferred. More importantly, it's a critical security practice. It prevents you from accidentally copying sensitive files like .env files or SSH keys into your image, a common and dangerous mistake.

3. Choose and Pin Your Base Image Strategically

The Strategy:
Your base image is your container's foundation. Never, ever use the default latest tag in production. This is a recipe for inconsistency and breakage.

Key Details:

Choose a Minimal Image: Ditch the full-fat OS images. Opt for minimal variants like alpine or Google's distroless images. These are stripped down to the bare essentials needed to run your application, making them smaller and more secure.
Pin with Specific Versions: Always use a precise tag, such as node:18.18.2-alpine3.18. This guarantees that every build is identical, preventing unexpected changes when the latest tag is updated.
Source from Trusted Providers: Prefer Docker Official Images which are vetted and maintained, ensuring quality and security best practices.

4. Implement the Principle of Least Privilege: Run as a Non-Root User

By default, containers run as the root user. If an attacker breaches your application, they have root-level access inside the container, which can be a launchpad for host-level exploits.

The solution is simple. In your Dockerfile, create a dedicated, non-privileged user and group. Then, use the USER instruction to switch to that user before running your application.

FROM python:3.14.0-alpine3.22
WORKDIR /code
RUN apk add --no-cache gcc musl-dev libffi-dev python3-dev build-base
COPY ./requirements.txt /code/requirements.txt
RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt
COPY ./app /code/app

# Create a non-root user and group
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
# Fix permissions for the app directory recursively (include #allfiles/folders inside)
RUN chown -R appuser:appgroup /code
# Switch to non-root user
USER appuser

CMD ["fastapi", "run", "app/main.py", "--port", "80"]

5. Use Immutable, Versioned Tags for Your Own Images

The Problem with latest:
The latest tag is mutable and ambiguous. The image it points to today might be different tomorrow, leading to unpredictable deployments and a nightmare for debugging.

The Solution:

Tag your images with specific, immutable identifiers. Semantic Versioning: For example, my-app:1.5.2.

Git Commit SHA: The most precise method, e.g., my-app:ba781a0. This directly links your Docker image to the exact source code it was built from.

This practice ensures absolute reproducibility and gives you a clear, safe target for rollbacks if a new deployment fails.

6. Enforce Container Resource Limits

The Reality:
Containers share the host's physical resources. A single misbehaving container can greedily consume all available CPU or memory, causing a "noisy neighbor" problem that starves other services and can bring down the entire host.

How to Implement:

Set hard limits when running your containers using Docker's runtime flags:

--memory="200m": Strictly forbids the container from using more than 200MB of RAM.

--cpus="0.5": Limits the container to using 50% of a single CPU core's time.

--memory-swap="300m": Controls the total memory and swap usage.

Mastering these techniques is a significant step toward professional-grade containerization. While the tools and platforms around Docker may change, the underlying principles of building lean, secure, and reproducible images are timeless. Integrating these practices shifts your focus from simply making things work to building systems that are resilient, efficient, and ready for the complexities of modern development and deployment.