Checklist — Docker explained: images, containers and volumes
Step-by-step guide
A practical checklist for building production-ready Docker images and container environments — covering security, performance, and reproducibility.
Use an official, minimal base image
Prefer Alpine or distroless variants. Smaller attack surface, smaller image, faster pulls. Verify the image digest matches the published checksum before committing to a base.
Pin all image tags to digests
Replace 'node:20-alpine' with 'node@sha256:…' in production Dockerfiles. Add Dependabot or Renovate to receive automated PR updates when a new digest is published.
Write a .dockerignore file
Exclude node_modules, .env files, .git directory, test files, and local build outputs. A lean build context speeds image builds and prevents accidental secret inclusion.
Use multi-stage builds for compiled code
Stage 1: install deps and build. Stage 2: FROM scratch or a minimal base, copy only the compiled binary or bundle. Measure the size reduction — typically 60–80 %.
Run as a non-root user
Add a dedicated user in your Dockerfile: 'RUN addgroup -S app && adduser -S app -G app' then 'USER app'. This limits the blast radius of container escape vulnerabilities.
Add a HEALTHCHECK instruction
HEALTHCHECK tells Docker and orchestrators whether the container is actually ready to serve traffic. Without it, a container reported as running might serve errors. Example: 'HEALTHCHECK CMD wget -qO- http://localhost:3000/health || exit 1'.
Scan the image before pushing
Run 'trivy image my-app:latest' in CI before pushing to the registry. Set a threshold: fail the build on CRITICAL CVEs. Review and update regularly — new CVEs appear daily.
Ready to build?
Tuplify Studio turns these concepts into working software.
Discuss your project