🧠 Docker Best Practices

Production‑grade guidelines for building, running and maintaining Docker‑based environments.

---

🏗️ Image Design

• Use minimal base images (alpine, distroless)
• Prefer multi‑stage builds
• Pin versions of base images
• Avoid unnecessary packages
• Always include a .dockerignore
• Clean caches in the same layer
• Use non‑root users (USER appuser)

---

🚀 Container Runtime

• Use restart: unless-stopped for production
• Add healthchecks for critical services
• Avoid writing logs to files inside containers
• Keep containers stateless
• Use volumes for persistent data
• Prefer environment variables over baked‑in config

---

🌐 Networking

• Use dedicated networks for isolation
• Avoid exposing ports unless required
• Use service names instead of IPs
• Keep Traefik on its own network (traefik-net)

---

🔐 Security

• Scan images regularly (trivy, docker scout)
• Do not store secrets in images
• Use read‑only root filesystem when possible
• Limit container capabilities
• Keep host OS updated