Intermediate

# File: Dockerfile

# Build stage (includes build tools)
FROM node:18-alpine AS builder
# => Stage name: "builder"
# => Includes npm, node-gyp, build tools

WORKDIR /app

# Copy and install all dependencies (including devDependencies)
COPY package*.json ./
RUN npm ci
# => Installs all dependencies for building

# Copy source code
COPY . .

# Build production bundle
RUN npm run build
# => Creates optimized production build in /app/dist/
# => Includes transpilation, minification, bundling

# Production stage (minimal runtime)
FROM node:18-alpine
# => Fresh FROM instruction starts new stage
# => Previous stage (builder) layers are discarded

WORKDIR /app

# Copy only production package files
COPY package*.json ./

# Install only production dependencies
RUN npm ci --only=production
# => Excludes devDependencies (webpack, babel, etc.)
# => Smaller node_modules

# Copy built artifacts from builder stage
COPY --from=builder /app/dist ./dist
# => COPY --from=<stage-name> copies files from previous stage
# => Only production bundle, not source code

# Non-root user for security
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001 && \
    chown -R nodejs:nodejs /app
# => Creates non-privileged user
# => Changes ownership of /app

USER nodejs
# => Runs container as nodejs user (not root)

EXPOSE 3000
CMD ["node", "dist/main.js"]
# => Starts production server

# Build multi-stage image
docker build -t my-app:multi-stage .
# => [builder 1/5] FROM node:18-alpine (build stage)
# => [builder 2/5] WORKDIR /app
# => [builder 3/5] COPY package*.json ./
# => [builder 4/5] RUN npm ci (all dependencies)
# => [builder 5/5] RUN npm run build
# => [stage-1 1/4] FROM node:18-alpine (production stage)
# => [stage-1 2/4] COPY package*.json ./
# => [stage-1 3/4] RUN npm ci --only=production
# => [stage-1 4/4] COPY --from=builder /app/dist ./dist
# => Successfully tagged my-app:multi-stage

# Compare with single-stage image size
docker images my-app
# => REPOSITORY   TAG           SIZE
# => my-app       single-stage  450MB (includes source, devDependencies, build tools)
# => my-app       multi-stage   120MB (only runtime + production bundle)
# => 73% size reduction!

# Verify production image contents
docker run --rm my-app:multi-stage ls -lh /app
# => total 8K
# => drwxr-xr-x 3 nodejs nodejs 4.0K dist (production bundle only)
# => drwxr-xr-x 200 nodejs nodejs 12K node_modules (production deps only)
# => -rw-r--r-- 1 nodejs nodejs 500 package.json

# Source code NOT in production image (security)
docker run --rm my-app:multi-stage ls /app/src
# => ls: /app/src: No such file or directory
# => Source code remains in builder stage, not in final image

# Check user (runs as nodejs, not root)
docker run --rm my-app:multi-stage whoami
# => nodejs

# File: Dockerfile

# Build stage
FROM golang:1.21-alpine AS builder

# Build arguments for version information
ARG VERSION=dev
ARG BUILD_DATE
ARG GIT_COMMIT=unknown

WORKDIR /app

# Copy dependency files
COPY go.mod go.sum ./
RUN go mod download
# => Downloads Go dependencies

# Copy source code
COPY . .

# Build binary with version information
RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags="-X main.Version=${VERSION} \
              -X main.BuildDate=${BUILD_DATE} \
              -X main.GitCommit=${GIT_COMMIT} \
              -w -s" \
    -o /app/server ./cmd/server
# => Compiles Go binary with embedded version metadata
# => -ldflags=-w -s strips debug symbols (smaller binary)
# => CGO_ENABLED=0 creates fully static binary

# Production stage
FROM alpine:3.19
# => Minimal base image (~5MB)
# => golang:1.21 image not needed at runtime

# Security: Install CA certificates for HTTPS
RUN apk --no-cache add ca-certificates
# => Required for HTTPS requests
# => --no-cache prevents storing package index

# Create non-root user
RUN addgroup -g 1001 app && \
    adduser -D -u 1001 -G app app

WORKDIR /app

# Copy binary from builder stage
COPY --from=builder /app/server .
# => Only the compiled binary, no Go toolchain

# Change ownership
RUN chown -R app:app /app

USER app

EXPOSE 8080

# Pass build args as labels
ARG VERSION
ARG BUILD_DATE
ARG GIT_COMMIT
LABEL version="${VERSION}" \
      build_date="${BUILD_DATE}" \
      git_commit="${GIT_COMMIT}"
# => Metadata queryable via docker inspect

CMD ["./server"]

# Build with version information
docker build \
  --build-arg VERSION=1.2.3 \
  --build-arg BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
  --build-arg GIT_COMMIT=$(git rev-parse --short HEAD) \
  -t my-go-app:1.2.3 \
  .
# => Embeds version metadata in binary and image labels

# Verify version embedded in binary
docker run --rm my-go-app:1.2.3 ./server --version
# => my-go-app version 1.2.3
# => Built: 2025-12-29T10:50:00Z
# => Commit: abc1234

# Check image labels
docker inspect my-go-app:1.2.3 --format='{{json .Config.Labels}}' | jq
# => {
# =>   "version": "1.2.3",
# =>   "build_date": "2025-12-29T10:50:00Z",
# =>   "git_commit": "abc1234"
# => }

# Compare image sizes
docker images | grep my-go-app
# => my-go-app   1.2.3   15MB (alpine + binary)
# => If built from golang base: ~350MB
# => 96% size reduction!

# Verify binary is static (no dynamic linking)
docker run --rm my-go-app:1.2.3 ldd /app/server
# => not a dynamic executable
# => Fully static binary (portable across Linux distros)

# File: Dockerfile

# Stage 1: Build frontend (Node.js)
FROM node:18-alpine AS frontend-builder

WORKDIR /app/frontend

COPY frontend/package*.json ./
RUN npm ci
# => Install frontend dependencies

COPY frontend/ ./
RUN npm run build
# => Creates static assets in /app/frontend/dist

# Stage 2: Build backend (Go)
FROM golang:1.21-alpine AS backend-builder

WORKDIR /app/backend

COPY backend/go.mod backend/go.sum ./
RUN go mod download

COPY backend/ ./
RUN CGO_ENABLED=0 go build -o /app/backend/server ./cmd/server
# => Compiles Go backend server

# Stage 3: Generate API documentation (Python)
FROM python:3.11-slim AS docs-builder

WORKDIR /app

RUN pip install --no-cache-dir mkdocs mkdocs-material
# => Install documentation generator

COPY docs/ ./docs/
RUN mkdocs build -d /app/docs-output
# => Generates static documentation site

# Stage 4: Production runtime (Nginx + backend)
FROM nginx:alpine

# Copy frontend static assets
COPY --from=frontend-builder /app/frontend/dist /usr/share/nginx/html/
# => Frontend served by Nginx

# Copy API documentation
COPY --from=docs-builder /app/docs-output /usr/share/nginx/html/docs/
# => Documentation at /docs path

# Copy Go backend binary
COPY --from=backend-builder /app/backend/server /usr/local/bin/
# => Backend binary in PATH

# Nginx configuration for SPA + API
COPY nginx.conf /etc/nginx/conf.d/default.conf
# => Routes /api/* to backend, /* to frontend

# Startup script to run both Nginx and backend
COPY start.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/start.sh

EXPOSE 80

CMD ["/usr/local/bin/start.sh"]

# File: start.sh
#!/bin/sh

# Start backend in background
/usr/local/bin/server &
BACKEND_PID=$!

# Start Nginx in foreground
nginx -g 'daemon off;' &
NGINX_PID=$!

# Wait for either process to exit
wait -n

# Kill both processes
kill $BACKEND_PID $NGINX_PID

# File: nginx.conf
server {
    listen 80;

    # Frontend SPA
    location / {
        root /usr/share/nginx/html;
        try_files $uri $uri/ /index.html;
    }

    # API proxy to backend
    location /api/ {
        proxy_pass http://localhost:8080/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    # API documentation
    location /docs/ {
        alias /usr/share/nginx/html/docs/;
        try_files $uri $uri/ /docs/index.html;
    }
}

# Build multi-runtime image
docker build -t fullstack-app .
# => [frontend-builder] Builds React/Vue/Angular app
# => [backend-builder] Compiles Go API server
# => [docs-builder] Generates MkDocs site
# => [final] Combines all artifacts in Nginx image

# Check final image size
docker images fullstack-app
# => REPOSITORY       TAG      SIZE
# => fullstack-app    latest   45MB
# => Nginx base: 23MB, frontend assets: 15MB, backend binary: 7MB

# Run full-stack container
docker run -d -p 8080:80 --name fullstack fullstack-app
# => Frontend at http://localhost:8080/
# => API at http://localhost:8080/api/
# => Docs at http://localhost:8080/docs/

# Test all components
curl http://localhost:8080/
# => <!DOCTYPE html>...(frontend SPA)

curl http://localhost:8080/api/health
# => {"status":"ok","version":"1.0.0"} (backend API)

curl http://localhost:8080/docs/
# => <!DOCTYPE html>...(MkDocs documentation)

# Verify no build tools in final image
docker run --rm fullstack-app which node
# => (no output - Node.js not in final image)

docker run --rm fullstack-app which go
# => (no output - Go not in final image)

docker run --rm fullstack-app which python
# => (no output - Python not in final image)

# File: Dockerfile

# syntax=docker/dockerfile:1.4
# => Enable BuildKit features (required for --mount=type=secret)

FROM node:18-alpine AS builder

WORKDIR /app

# Install dependencies from private registry using secret
COPY package*.json ./

# Mount secret during npm install (doesn't persist in layer)
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    npm ci
# => Mounts secret file at /root/.npmrc during RUN only
# => Secret is NOT stored in image layer
# => Secret file is removed after RUN completes

COPY . .

# Build with API key from secret
RUN --mount=type=secret,id=build_api_key \
    export BUILD_API_KEY=$(cat /run/secrets/build_api_key) && \
    npm run build
# => Reads secret from /run/secrets/<id>
# => Secret available only during this RUN command

# Production stage (no secrets)
FROM node:18-alpine

WORKDIR /app

COPY package*.json ./
RUN npm ci --only=production

COPY --from=builder /app/dist ./dist
# => Only built artifacts, no secrets

EXPOSE 3000
CMD ["node", "dist/main.js"]

# Create secret files (DO NOT commit to git)
echo "//registry.npmjs.org/:_authToken=npm_secret_token" > .npmrc
echo "build-api-key-12345" > build_api_key.txt

# Add secrets to .gitignore
cat >> .gitignore << 'EOF'
.npmrc
build_api_key.txt
EOF

# Build with secrets (BuildKit required)
DOCKER_BUILDKIT=1 docker build \
  --secret id=npmrc,src=.npmrc \
  --secret id=build_api_key,src=build_api_key.txt \
  -t secure-app .
# => Mounts secrets during build without persisting in layers

# Verify secrets are NOT in image layers
docker history secure-app --no-trunc | grep -i "secret\|npmrc\|api_key"
# => (no matches - secrets not visible in history)

# Alternative: Use environment secrets
DOCKER_BUILDKIT=1 docker build \
  --secret id=build_api_key,env=BUILD_API_KEY \
  -t secure-app .
# => Reads secret from BUILD_API_KEY environment variable on host

# Environment variable secret (cleaner for CI/CD)
BUILD_API_KEY=secret-value DOCKER_BUILDKIT=1 docker build \
  --secret id=build_api_key,env=BUILD_API_KEY \
  -t secure-app .

# Inspect final image for leaked secrets (security check)
docker save secure-app | tar -xOf - | grep -a "secret_token"
# => (no matches - secret not in any layer)

# Bad example (INSECURE - secrets in layers)
cat > Dockerfile.insecure << 'EOF'
FROM node:18-alpine
WORKDIR /app
COPY .npmrc /root/.npmrc  # BAD! Secret persists in layer
RUN npm ci
RUN rm /root/.npmrc  # Still in previous layer!
EOF

docker build -f Dockerfile.insecure -t insecure-app .
docker history insecure-app --no-trunc | grep -i "npmrc"
# => Shows "COPY .npmrc" in layer history
# => Secret is exposed in image layer (security risk!)

# File: docker-compose.yml

version: "3.8"

services:
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      cache_from:
        - myregistry/frontend:latest
        - myregistry/frontend:${GIT_BRANCH:-main}
        # => Uses remote images as cache sources
        # => Speeds up builds by reusing layers
      args:
        NODE_ENV: ${NODE_ENV:-production}
      target: ${BUILD_TARGET:-production}
      # => Allows switching between dev/prod stages
    image: myregistry/frontend:${GIT_COMMIT:-latest}
    # => Tags with git commit for traceability

  backend:
    build:
      context: ./backend
      cache_from:
        - myregistry/backend:latest
      args:
        GO_VERSION: 1.21
    image: myregistry/backend:${GIT_COMMIT:-latest}

  database:
    image: postgres:15-alpine
    # => No build needed - uses pre-built image

# Enable BuildKit for better caching
export DOCKER_BUILDKIT=1
export COMPOSE_DOCKER_CLI_BUILD=1

# Build all services in parallel
docker compose build --parallel
# => Builds frontend and backend simultaneously
# => Utilizes multi-core CPUs efficiently

# Build with specific target (development)
BUILD_TARGET=development docker compose build frontend
# => Builds development stage with hot reloading support

# Pull cache images before building (CI/CD optimization)
docker compose pull frontend backend
docker compose build --pull frontend backend
# => Pulls latest images to use as cache
# => --pull ensures base images are up-to-date

# Build without cache (force rebuild)
docker compose build --no-cache
# => Rebuilds all layers from scratch
# => Useful when dependencies are corrupted

# Build with progress output
docker compose build --progress=plain frontend
# => Shows detailed build output
# => Useful for debugging build failures

# Build and push to registry (CI/CD)
GIT_COMMIT=$(git rev-parse --short HEAD) \
GIT_BRANCH=$(git branch --show-current) \
docker compose build --push
# => Builds and pushes images to registry
# => Uses GIT_COMMIT and GIT_BRANCH variables for tagging

# Build-time performance: Use .dockerignore
cat > .dockerignore << 'EOF'
node_modules
.git
.env*
*.md
docs/
tests/
.vscode/
.idea/
EOF
# => Excludes files from build context
# => Reduces context size sent to Docker daemon
# => Significantly speeds up builds

# Measure build time
time docker compose build frontend
# => real    0m15.234s (with cache)
# => real    2m30.123s (without cache)

# Use BuildKit cache mounts for dependencies
cat >> frontend/Dockerfile << 'EOF'
RUN --mount=type=cache,target=/root/.npm \
    npm ci
EOF
# => Caches npm packages across builds
# => Dramatically speeds up dependency installation

# File: docker-compose.yml

version: "3.8"
# => Docker Compose file version

services:
  database:
    image: postgres:15-alpine
    # => PostgreSQL 15 on Alpine Linux base
    environment:
      POSTGRES_PASSWORD: secret
      # => Database superuser password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      # => Executes pg_isready command to check PostgreSQL status
      # => Returns 0 if accepting connections, non-zero if not ready
      interval: 10s
      # => Run health check every 10 seconds
      timeout: 5s
      # => Mark check as failed if it takes longer than 5 seconds
      retries: 5
      # => Mark service unhealthy after 5 consecutive check failures
      start_period: 30s
      # => Grace period allowing database initialization before health checks count
      # => Failed checks during this period don't count toward retries

  redis:
    image: redis:7-alpine
    # => Redis 7 key-value cache on Alpine
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      # => Executes redis-cli ping command
      # => Returns PONG if Redis is responsive
      interval: 5s
      # => Check every 5 seconds (faster than database)
      timeout: 3s
      # => Redis should respond quickly
      retries: 3
      # => Mark unhealthy after 3 failures
      start_period: 10s
      # => Redis starts faster than PostgreSQL

  api:
    build: ./api
    # => Builds API service from ./api directory
    depends_on:
      database:
        condition: service_healthy
        # => API waits for database health check to pass
        # => Prevents connection errors during startup
      redis:
        condition: service_healthy
        # => API waits for Redis to be ready
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      # => HTTP GET request to application health endpoint
      # => -f flag makes curl fail on HTTP errors (4xx, 5xx)
      interval: 15s
      # => Check every 15 seconds
      timeout: 10s
      # => Allow up to 10 seconds for health endpoint response
      retries: 3
      # => Mark unhealthy after 3 consecutive failures
      start_period: 40s
      # => API needs time to connect to database and initialize
    environment:
      DATABASE_URL: postgresql://postgres:secret@database:5432/mydb
      # => Database connection string using service name "database"
      REDIS_URL: redis://redis:6379
      # => Redis connection using service name "redis"

  web:
    image: nginx:alpine
    # => Nginx web server on Alpine
    depends_on:
      api:
        condition: service_healthy
        # => Nginx starts only after API is healthy
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/health"]
      # => wget downloads health endpoint without saving (--spider)
      # => --quiet suppresses output, --tries=1 attempts once
      interval: 10s
      # => Check every 10 seconds
      timeout: 5s
      # => Nginx should respond quickly
      retries: 3
      # => Unhealthy after 3 failures
      start_period: 20s
      # => Nginx startup time
    ports:
      - "8080:80"
      # => Expose Nginx on host port 8080

// File: api/health.js (API health endpoint implementation)
const express = require("express");
const { Pool } = require("pg");
const Redis = require("ioredis");

const app = express();
const db = new Pool({ connectionString: process.env.DATABASE_URL });
const redis = new Redis(process.env.REDIS_URL);

app.get("/health", async (req, res) => {
  try {
    // Check database connection
    await db.query("SELECT 1");

    // Check Redis connection
    await redis.ping();

    // All dependencies healthy
    res.status(200).json({
      status: "healthy",
      timestamp: new Date().toISOString(),
      dependencies: {
        database: "up",
        redis: "up",
      },
    });
  } catch (error) {
    // Dependency failure - unhealthy
    res.status(503).json({
      status: "unhealthy",
      error: error.message,
      timestamp: new Date().toISOString(),
    });
  }
});

app.listen(3000);

# Start services (observe startup coordination)
docker compose up -d
# => database and redis start first (no dependencies)
# => Health checks run during start_period
# => After 30s, database marked healthy
# => After 10s, redis marked healthy
# => api starts after both dependencies healthy
# => After 40s, api marked healthy
# => web starts after api healthy

# Monitor health status in real-time
watch -n 1 'docker compose ps'
# => NAME      STATUS                    HEALTH
# => database  Up 35 seconds             healthy (5/5)
# => redis     Up 35 seconds             healthy (7/7)
# => api       Up 10 seconds             starting (health: starting)
# => web       Created                   (waiting for api)

# Check health check logs
docker inspect myproject-database-1 --format='{{json .State.Health}}' | jq
# => {
# =>   "Status": "healthy",
# =>   "FailingStreak": 0,
# =>   "Log": [
# =>     {
# =>       "Start": "2025-12-29T11:00:00Z",
# =>       "End": "2025-12-29T11:00:00Z",
# =>       "ExitCode": 0,
# =>       "Output": "accepting connections\n"
# =>     }
# =>   ]
# => }

# Test health endpoint manually
curl http://localhost:8080/health
# => {
# =>   "status": "healthy",
# =>   "timestamp": "2025-12-29T11:00:00Z",
# =>   "dependencies": {
# =>     "database": "up",
# =>     "redis": "up"
# =>   }
# => }

# Simulate database failure
docker compose pause database
# => Database pauses (stops accepting connections)

# Wait for health checks to detect failure
sleep 30

docker compose ps
# => NAME      STATUS        HEALTH
# => database  Up (Paused)   unhealthy
# => api       Up            unhealthy (database check fails)
# => web       Up            healthy (Nginx still serves)

# Resume database
docker compose unpause database

# Health checks recover automatically
sleep 30
docker compose ps
# => All services return to healthy state

# File: docker-compose.yml

version: "3.8"

services:
  database:
    image: postgres:15-alpine
    restart: always
    # => Restarts on any failure or Docker restart
    environment:
      POSTGRES_PASSWORD: secret
    healthcheck:
      test: ["CMD-SHELL", "pg_isready"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    volumes:
      - db-data:/var/lib/postgresql/data
      # => Data persists across restarts

  message-queue:
    image: rabbitmq:3-management-alpine
    restart: unless-stopped
    # => Restarts on failure but not if manually stopped
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "ping"]
      interval: 15s
      timeout: 10s
      retries: 3
      start_period: 40s

  worker:
    build: ./worker
    restart: on-failure:3
    # => Restarts up to 3 times on failure
    # => Gives up after 3 consecutive failures
    depends_on:
      database:
        condition: service_healthy
      message-queue:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://postgres:secret@database:5432/jobs
      RABBITMQ_URL: amqp://guest:guest@message-queue:5672
    healthcheck:
      test: ["CMD", "pgrep", "-f", "worker"]
      # => Checks if worker process is running
      interval: 20s
      timeout: 5s
      retries: 2
      start_period: 60s

  api:
    build: ./api
    restart: unless-stopped
    depends_on:
      database:
        condition: service_healthy
      message-queue:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 30s
    ports:
      - "3000:3000"

volumes:
  db-data:

# Start all services
docker compose up -d

# Simulate database crash
docker compose exec database pkill postgres
# => Database main process killed

# Observe automatic recovery
docker compose ps -a
# => database: Restarting (restart policy: always)
# => worker: Up (waiting for database to be healthy)
# => api: Up (health check will fail until database recovers)

# Wait for database to recover
sleep 40

docker compose ps
# => database: Up, healthy (auto-restarted)
# => worker: Up, healthy (reconnected after database recovery)
# => api: Up, healthy (health check passes after database recovery)

# Simulate repeated worker failures
docker compose exec worker sh -c 'exit 1'
# => Worker exits with error code 1

# First restart attempt
sleep 5
docker compose ps worker
# => STATUS: Restarting (1/3 attempts)

# Simulate second failure
docker compose exec worker sh -c 'exit 1'
sleep 5
docker compose ps worker
# => STATUS: Restarting (2/3 attempts)

# Simulate third failure
docker compose exec worker sh -c 'exit 1'
sleep 5
docker compose ps worker
# => STATUS: Exited (1) (max restarts reached)
# => Worker stops trying after 3 failures

# Manually restart worker after fixing issue
docker compose up -d worker
# => Restart count resets
# => Worker starts fresh

# Test API resilience during message queue restart
docker compose restart message-queue
# => Message queue restarts

docker compose ps
# => message-queue: Up (restarting)
# => api: Up (health check may fail temporarily)
# => worker: Up (will reconnect when queue is healthy)

# Wait for queue to become healthy
sleep 40

# All services recover automatically
docker compose ps
# => All services: Up, healthy

# File: docker-compose.yml

version: "3.8"

services:
  # CPU-intensive task (limited)
  video-encoder:
    image: my-encoder
    deploy:
      resources:
        limits:
          cpus: "2.0"
          # => Maximum 2 CPU cores
          # => Can burst to 2 cores max
        reservations:
          cpus: "0.5"
          # => Guaranteed 0.5 CPU cores minimum
          # => Scheduler ensures this baseline
    command: encode --input video.mp4 --output compressed.mp4

  # Web API (moderate CPU)
  api:
    image: my-api
    deploy:
      resources:
        limits:
          cpus: "1.0"
          # => Maximum 1 CPU core
        reservations:
          cpus: "0.25"
          # => Guaranteed 0.25 CPU cores
    ports:
      - "3000:3000"

  # Background worker (low priority)
  worker:
    image: my-worker
    deploy:
      resources:
        limits:
          cpus: "0.5"
          # => Maximum 0.5 CPU cores (50% of 1 core)
        reservations:
          cpus: "0.1"
          # => Guaranteed 0.1 CPU cores minimum
    # CPU shares for relative priority
    cpu_shares: 512
    # => Default is 1024
    # => Half the priority of default containers

# Run containers with CPU limits (requires Docker Swarm mode or docker run)
docker run -d --name encoder \
  --cpus="2.0" \
  --cpu-shares=1024 \
  my-encoder
# => Limited to 2 CPU cores maximum
# => --cpu-shares sets relative CPU priority

# Check CPU usage in real-time
docker stats encoder
# => CONTAINER   CPU %    MEM USAGE / LIMIT
# => encoder     200.00%  1.5GiB / 8GiB
# => CPU % capped at 200% (2 cores)

# Run CPU stress test inside container
docker exec encoder sh -c 'for i in $(seq 1 8); do
  sh -c "while true; do :; done" &
done'
# => Spawns 8 infinite loops (tries to use all CPUs)

docker stats encoder
# => encoder     200.00%  (capped at 2 cores even with 8 busy loops)

# Without limits (comparison)
docker run -d --name encoder-unlimited my-encoder
docker exec encoder-unlimited sh -c 'for i in $(seq 1 8); do
  sh -c "while true; do :; done" &
done'

docker stats encoder-unlimited
# => encoder-unlimited     800.00%  (uses all 8 cores)

# CPU shares test: Relative priority
docker run -d --name high-priority --cpu-shares=2048 alpine sh -c 'while true; do :; done'
docker run -d --name low-priority --cpu-shares=512 alpine sh -c 'while true; do :; done'
# => high-priority gets 4x more CPU time than low-priority when both compete

docker stats high-priority low-priority
# => high-priority    400.00%  (4 cores)
# => low-priority     100.00%  (1 core)
# => Ratio matches cpu-shares ratio (2048:512 = 4:1)

# Inspect CPU settings
docker inspect encoder --format='{{.HostConfig.NanoCpus}}'
# => 2000000000 (2.0 CPUs in nanoseconds)

docker inspect encoder --format='{{.HostConfig.CpuShares}}'
# => 1024 (default CPU shares)

# Clean up
docker rm -f encoder encoder-unlimited high-priority low-priority

# File: docker-compose.yml

version: "3.8"

services:
  database:
    image: postgres:15-alpine
    deploy:
      resources:
        limits:
          memory: 2G
          # => Hard limit: 2 gigabytes
          # => Container killed if exceeds (OOM kill)
        reservations:
          memory: 1G
          # => Guaranteed minimum: 1 gigabyte
    environment:
      POSTGRES_PASSWORD: secret

  redis:
    image: redis:7-alpine
    deploy:
      resources:
        limits:
          memory: 512M
          # => 512 megabytes max
    command: redis-server --maxmemory 400mb --maxmemory-policy allkeys-lru
    # => Redis internal limit (400MB) below Docker limit (512MB)
    # => LRU eviction when Redis reaches 400MB

  api:
    image: my-api
    deploy:
      resources:
        limits:
          memory: 1G
        reservations:
          memory: 256M
    environment:
      NODE_OPTIONS: "--max-old-space-size=896"
      # => Node.js heap limit (896MB) below Docker limit (1GB)
      # => Prevents Node from triggering OOM kill

  worker:
    image: my-worker
    deploy:
      resources:
        limits:
          memory: 512M
    # Memory swap disabled for predictable performance
    mem_swappiness: 0
    # => Prevents swapping (keeps everything in RAM)

# Run container with memory limit
docker run -d --name mem-limited \
  --memory="512m" \
  --memory-reservation="256m" \
  my-app
# => Hard limit: 512MB (OOM kill if exceeded)
# => Soft limit: 256MB (preferred maximum)

# Monitor memory usage
docker stats mem-limited
# => CONTAINER     MEM USAGE / LIMIT
# => mem-limited   312MiB / 512MiB

# Test OOM behavior (exceeds limit)
docker exec mem-limited sh -c '
  # Allocate 600MB (exceeds 512MB limit)
  python3 -c "s = \" \" * (600 * 1024 * 1024); import time; time.sleep(60)"
'
# => Container killed by OOM killer after a few seconds

docker ps -a --filter name=mem-limited
# => STATUS: Exited (137)
# => Exit code 137 = SIGKILL from OOM killer

# Check OOM kill event
docker inspect mem-limited --format='{{.State.OOMKilled}}'
# => true

# Memory swap control
docker run -d --name no-swap \
  --memory="1g" \
  --memory-swap="1g" \
  my-app
# => memory-swap = memory means NO swap
# => All memory must be RAM (no swapping to disk)

docker run -d --name with-swap \
  --memory="1g" \
  --memory-swap="2g" \
  my-app
# => Can use 1GB RAM + 1GB swap (2GB total virtual memory)

# Memory reservation (soft limit)
docker run -d --name soft-limit \
  --memory-reservation="256m" \
  my-app
# => No hard limit, but tries to stay under 256MB
# => Can exceed 256MB if host has available memory
# => Reclaimed to 256MB when host is under pressure

docker stats soft-limit
# => MEM USAGE / LIMIT
# => 512MiB / unlimited
# => Can grow beyond 256MB reservation

# Inspect memory settings
docker inspect mem-limited --format='{{.HostConfig.Memory}}'
# => 536870912 (512MB in bytes)

docker inspect mem-limited --format='{{.HostConfig.MemoryReservation}}'
# => 268435456 (256MB in bytes)

# Clean up
docker rm -f mem-limited no-swap with-swap soft-limit

# File: docker-compose.yml

version: "3.8"

services:
  database:
    image: postgres:15-alpine
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 4G
        reservations:
          cpus: "1.0"
          memory: 2G
    environment:
      POSTGRES_PASSWORD: secret
      # PostgreSQL configuration matching resource limits
      POSTGRES_SHARED_BUFFERS: 1GB
      # => 25% of memory reservation
      POSTGRES_EFFECTIVE_CACHE_SIZE: 3GB
      # => 75% of memory limit
    volumes:
      - db-data:/var/lib/postgresql/data

  redis:
    image: redis:7-alpine
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1G
        reservations:
          cpus: "0.25"
          memory: 512M
    command: >
      redis-server
      --maxmemory 900mb
      --maxmemory-policy allkeys-lru
      --save ""
    # => maxmemory 900MB (90% of limit for safety)
    # => Disabled persistence (--save "") reduces I/O

  api:
    build: ./api
    deploy:
      resources:
        limits:
          cpus: "1.5"
          memory: 2G
        reservations:
          cpus: "0.5"
          memory: 512M
      replicas: 3
      # => 3 instances for load distribution
    environment:
      NODE_OPTIONS: "--max-old-space-size=1792"
      # => Node heap: 1792MB (90% of 2GB limit)
    ports:
      - "3000-3002:3000"

  worker:
    build: ./worker
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 1G
        reservations:
          cpus: "0.5"
          memory: 256M
      replicas: 2
    environment:
      MAX_JOBS: 4
      # => Limit concurrent jobs to match CPU limit

volumes:
  db-data:

# Deploy stack with resource limits (Swarm mode)
docker stack deploy -c docker-compose.yml myapp
# => Creates services with specified resource constraints

# Monitor resource usage across all services
docker stats $(docker ps --format '{{.Names}}')
# => CONTAINER    CPU %   MEM USAGE / LIMIT
# => db-1         45.2%   1.8GiB / 4GiB
# => redis-1      12.3%   800MiB / 1GiB
# => api-1        28.1%   1.2GiB / 2GiB
# => api-2        31.4%   1.4GiB / 2GiB
# => api-3        25.7%   1.1GiB / 2GiB
# => worker-1     98.5%   700MiB / 1GiB
# => worker-2     102.3%  750MiB / 1GiB

# Total resource allocation
# => CPU: 2 + 1 + (1.5 * 3) + (2 * 2) = 11.5 cores reserved
# => Memory: 4 + 1 + (2 * 3) + (1 * 2) = 13GB reserved

# Load test to verify limits
# Install apache bench
docker run --rm --network host jordi/ab \
  -n 10000 -c 100 http://localhost:3000/api/test
# => 10000 requests, 100 concurrent

# During load test, verify API doesn't exceed limits
watch -n 1 'docker stats --no-stream $(docker ps --filter name=api --format "{{.Names}}")'
# => Each API instance stays under 1.5 CPUs and 2GB RAM

# Check for OOM kills during load
docker ps -a --filter name=api --format '{{.Names}}: {{.Status}}'
# => api-1: Up 5 minutes (healthy)
# => api-2: Up 5 minutes (healthy)
# => api-3: Up 5 minutes (healthy)
# => No OOM kills occurred

# Verify resource reservations (Swarm mode)
docker service inspect myapp_api --format='{{json .Spec.TaskTemplate.Resources}}' | jq
# => {
# =>   "Limits": {
# =>     "NanoCPUs": 1500000000,
# =>     "MemoryBytes": 2147483648
# =>   },
# =>   "Reservations": {
# =>     "NanoCPUs": 500000000,
# =>     "MemoryBytes": 536870912
# =>   }
# => }

# File: docker-compose.yml

version: "3.8"

services:
  # Default JSON file logging (local)
  app-default:
    image: my-app
    logging:
      driver: json-file
      options:
        max-size: "10m"
        # => Rotate when log file reaches 10MB
        max-file: "3"
        # => Keep 3 rotated files
        # => Total max: 30MB per container
        labels: "service,environment"
        # => Include service and environment labels in logs

  # Syslog driver (centralized)
  app-syslog:
    image: my-app
    logging:
      driver: syslog
      options:
        syslog-address: "tcp://192.168.1.100:514"
        # => Remote syslog server
        syslog-format: "rfc5424"
        # => RFC5424 format (structured)
        tag: "{{.Name}}/{{.ID}}"
        # => Log tag with container name and ID

  # Fluentd driver (EFK stack)
  app-fluentd:
    image: my-app
    logging:
      driver: fluentd
      options:
        fluentd-address: "localhost:24224"
        # => Fluentd forwarder address
        fluentd-async: "true"
        # => Non-blocking async mode
        tag: "docker.{{.Name}}"
        # => Tag for fluentd routing
    depends_on:
      - fluentd

  # GELF driver (Graylog/ELK)
  app-gelf:
    image: my-app
    logging:
      driver: gelf
      options:
        gelf-address: "udp://graylog.example.com:12201"
        # => Graylog server
        tag: "{{.Name}}"
        gelf-compression-type: "gzip"
        # => Compress logs before sending

  # Splunk driver
  app-splunk:
    image: my-app
    logging:
      driver: splunk
      options:
        splunk-token: "B5A79AAD-D822-46CC-80D1-819F80D7BFB0"
        splunk-url: "https://splunk.example.com:8088"
        splunk-insecureskipverify: "false"
        # => Verify SSL certificate

  # AWS CloudWatch driver
  app-cloudwatch:
    image: my-app
    logging:
      driver: awslogs
      options:
        awslogs-region: "us-east-1"
        awslogs-group: "myapp"
        awslogs-stream: "{{.Name}}"
        awslogs-create-group: "true"

  # Fluentd service (for fluentd driver example)
  fluentd:
    image: fluent/fluentd:v1.16-1
    ports:
      - "24224:24224"
    volumes:
      - ./fluentd.conf:/fluentd/etc/fluent.conf

# File: fluentd.conf
<source>
  @type forward
  port 24224
  bind 0.0.0.0
</source>

<match docker.**>
  @type file
  path /fluentd/log/docker
  append true
  <format>
    @type json
  </format>
  <buffer>
    flush_interval 10s
  </buffer>
</match>

# Start services with different logging drivers
docker compose up -d

# View logs from json-file driver (works with docker logs)
docker logs app-default
# => Shows logs via docker logs command
# => Stored in /var/lib/docker/containers/<id>/<id>-json.log

# Check log file size and rotation
docker inspect app-default --format='{{.LogPath}}'
# => /var/lib/docker/containers/.../...-json.log

ls -lh $(docker inspect app-default --format='{{.LogPath}}')
# => -rw-r----- 1 root root 8.5M Dec 29 11:00 ...-json.log
# => File rotates at 10MB

# Syslog driver: docker logs doesn't work (logs sent remotely)
docker logs app-syslog
# => Error: configured logging driver does not support reading

# Check syslog server instead
ssh syslog-server "tail -f /var/log/syslog | grep app-syslog"
# => Dec 29 11:00:00 app-syslog[12345]: Application started

# Fluentd driver: Logs sent to fluentd
docker logs app-fluentd
# => Error: configured logging driver does not support reading

# Check fluentd logs
docker exec fluentd cat /fluentd/log/docker.log
# => {"container_name":"app-fluentd","message":"Application log"}

# GELF driver: Logs sent to Graylog
# Access Graylog web UI: http://graylog.example.com:9000
# Search for logs: source:app-gelf

# Inspect logging configuration
docker inspect app-default --format='{{json .HostConfig.LogConfig}}' | jq
# => {
# =>   "Type": "json-file",
# =>   "Config": {
# =>     "max-size": "10m",
# =>     "max-file": "3"
# =>   }
# => }

# Change logging driver for running container (requires restart)
docker update --log-driver=syslog app-default
# => Note: Requires container restart to take effect

# Set default logging driver globally (daemon.json)
cat > /etc/docker/daemon.json << 'EOF'
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}
EOF

sudo systemctl restart docker
# => All new containers use this driver by default

// File: logger.js (Winston structured logger)
const winston = require("winston");

const logger = winston.createLogger({
  level: process.env.LOG_LEVEL || "info",
  format: winston.format.combine(
    winston.format.timestamp({
      format: "YYYY-MM-DDTHH:mm:ss.SSSZ",
    }),
    winston.format.errors({ stack: true }),
    winston.format.json(),
    // => JSON format for structured logging
  ),
  defaultMeta: {
    service: "api",
    environment: process.env.NODE_ENV,
    container_id: process.env.HOSTNAME,
    // => HOSTNAME env var = container ID in Docker
  },
  transports: [
    new winston.transports.Console(),
    // => Logs to stdout (captured by Docker)
  ],
});

module.exports = logger;

// File: app.js (Example usage)
const express = require("express");
const logger = require("./logger");

const app = express();

// Request logging middleware
app.use((req, res, next) => {
  logger.info("HTTP request", {
    method: req.method,
    path: req.path,
    ip: req.ip,
    user_agent: req.get("user-agent"),
    request_id: req.id,
  });
  next();
});

app.get("/api/users/:id", async (req, res) => {
  const userId = req.params.id;

  logger.debug("Fetching user", { user_id: userId });
  // => {
  // =>   "timestamp": "2025-12-29T11:10:00.123Z",
  // =>   "level": "debug",
  // =>   "message": "Fetching user",
  // =>   "user_id": "12345",
  // =>   "service": "api",
  // =>   "environment": "production"
  // => }

  try {
    const user = await db.getUser(userId);

    logger.info("User retrieved successfully", {
      user_id: userId,
      duration_ms: 45,
    });

    res.json(user);
  } catch (error) {
    logger.error("Failed to fetch user", {
      user_id: userId,
      error: error.message,
      stack: error.stack,
    });
    // => {
    // =>   "timestamp": "2025-12-29T11:10:00.500Z",
    // =>   "level": "error",
    // =>   "message": "Failed to fetch user",
    // =>   "user_id": "12345",
    // =>   "error": "Database connection timeout",
    // =>   "stack": "Error: Database connection timeout\n    at ...",
    // =>   "service": "api",
    // =>   "container_id": "abc123def456"
    // => }

    res.status(500).json({ error: "Internal server error" });
  }
});

app.listen(3000, () => {
  logger.info("Server started", { port: 3000 });
});

# File: docker-compose.yml

version: "3.8"

services:
  api:
    build: .
    environment:
      NODE_ENV: production
      LOG_LEVEL: info
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service,environment"
    labels:
      service: "api"
      environment: "production"

# View structured logs
docker logs api --tail 20
# => {"timestamp":"2025-12-29T11:10:00.123Z","level":"info","message":"Server started","port":3000,"service":"api","environment":"production","container_id":"abc123"}
# => {"timestamp":"2025-12-29T11:10:01.456Z","level":"info","message":"HTTP request","method":"GET","path":"/api/users/12345","ip":"::ffff:172.18.0.1","service":"api"}
# => {"timestamp":"2025-12-29T11:10:01.500Z","level":"debug","message":"Fetching user","user_id":"12345","service":"api"}

# Filter logs with jq (extract specific fields)
docker logs api --tail 100 2>&1 | grep '^{' | jq 'select(.level=="error")'
# => {
# =>   "timestamp": "2025-12-29T11:10:00.500Z",
# =>   "level": "error",
# =>   "message": "Failed to fetch user",
# =>   "user_id": "12345",
# =>   "error": "Database connection timeout"
# => }

# Extract all error messages from last 1000 lines
docker logs api --tail 1000 2>&1 | \
  grep '^{' | \
  jq -r 'select(.level=="error") | "\(.timestamp) \(.message) [\(.error)]"'
# => 2025-12-29T11:10:00.500Z Failed to fetch user [Database connection timeout]
# => 2025-12-29T11:12:30.789Z Payment processing failed [Stripe API error]

# Count log levels
docker logs api --tail 1000 2>&1 | \
  grep '^{' | \
  jq -r '.level' | \
  sort | uniq -c
# =>  850 info
# =>  120 debug
# =>   25 warn
# =>    5 error

# Find slowest API requests (using duration_ms field)
docker logs api --tail 1000 2>&1 | \
  grep '^{' | \
  jq -r 'select(.duration_ms != null) | "\(.duration_ms) \(.method) \(.path)"' | \
  sort -n | tail -10
# => 1250 GET /api/reports/monthly
# => 1450 POST /api/exports/csv
# => 2100 GET /api/analytics/dashboard

# Export logs to file for analysis
docker logs api --since 24h > api-logs-$(date +%Y%m%d).json
# => Creates daily log file for archival or analysis

# File: docker-compose.yml

version: "3.8"

services:
  # Application services using fluentd driver
  api:
    build: ./api
    logging:
      driver: fluentd
      options:
        fluentd-address: localhost:24224
        tag: "docker.api"
    depends_on:
      - fluentd

  web:
    build: ./web
    logging:
      driver: fluentd
      options:
        fluentd-address: localhost:24224
        tag: "docker.web"
    depends_on:
      - fluentd

  # Fluentd log forwarder
  fluentd:
    image: fluent/fluentd:v1.16-debian-1
    ports:
      - "24224:24224"
      - "24224:24224/udp"
    volumes:
      - ./fluentd/fluent.conf:/fluentd/etc/fluent.conf
      - ./fluentd/plugins:/fluentd/plugins
    environment:
      FLUENT_ELASTICSEARCH_HOST: elasticsearch
      FLUENT_ELASTICSEARCH_PORT: 9200
    depends_on:
      - elasticsearch

  # Elasticsearch for log storage
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      # => Heap size: 512MB
    ports:
      - "9200:9200"
    volumes:
      - es-data:/usr/share/elasticsearch/data

  # Kibana for log visualization
  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    ports:
      - "5601:5601"
    environment:
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200
    depends_on:
      - elasticsearch

volumes:
  es-data:

# Start EFK stack
docker compose up -d

# Wait for Elasticsearch to be ready
until curl -s http://localhost:9200/_cluster/health | grep -q '"status":"green\|yellow"'; do
  echo "Waiting for Elasticsearch..."
  sleep 5
done

# Generate some application logs
curl http://localhost:3000/api/test
# => Logs sent to fluentd → elasticsearch

# Query Elasticsearch directly
curl -X GET "localhost:9200/docker-*/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "level": "error"
    }
  },
  "size": 10,
  "sort": [
    { "@timestamp": "desc" }
  ]
}'
# => Returns last 10 error logs as JSON

# Count logs by level
curl -X GET "localhost:9200/docker-*/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "levels": {
      "terms": {
        "field": "level.keyword"
      }
    }
  }
}'
# => {
# =>   "aggregations": {
# =>     "levels": {
# =>       "buckets": [
# =>         { "key": "info", "doc_count": 1250 },
# =>         { "key": "debug", "doc_count": 340 },
# =>         { "key": "error", "doc_count": 15 },
# =>         { "key": "warn", "doc_count": 8 }
# =>       ]
# =>     }
# =>   }
# => }

# Access Kibana web UI
# => Open http://localhost:5601
# => Create index pattern: docker-*
# => Discover tab: View real-time logs
# => Visualize tab: Create dashboards

# Example Kibana query (KQL - Kibana Query Language)
# => level: "error" AND service: "api"
# => Shows only API error logs

# Create Kibana dashboard with visualizations:
# => 1. Error rate over time (line chart)
# => 2. Log level distribution (pie chart)
# => 3. Top error messages (data table)
# => 4. Request duration percentiles (histogram)

# Backup Elasticsearch data
docker exec elasticsearch curl -X PUT "localhost:9200/_snapshot/backup" -H 'Content-Type: application/json' -d'
{
  "type": "fs",
  "settings": {
    "location": "/usr/share/elasticsearch/backup"
  }
}'
# => Creates backup repository

docker exec elasticsearch curl -X PUT "localhost:9200/_snapshot/backup/snapshot_1?wait_for_completion=true"
# => Creates snapshot (backup) of all indices