Docker

Summary: Docker popularized OCI-compatible layered images and the image-distribution model that underpins cloud‑native delivery, and remains the pragmatic default for AI startups needing reproducible model packaging, CI/CD artifactization, and local parity with Kubernetes. Successfully running Docker at scale requires operational discipline around image hygiene, supply‑chain controls, runtime security, efficient caching and mastery of core primitives layered, content‑addressable images; containers as runtime instances (containerd/runc + namespaces/cgroups); Dockerfiles/BuildKit; registries (manifests and blobs); and networking/storage.

Why Docker still matters for modern DevOps

Docker popularized Linux container packaging and the image distribution model that underpins cloud-native delivery. For AI startups, Docker remains the most pragmatic tool for reproducible model packaging, CI/CD artifactization, and local parity with Kubernetes. But running Docker at scale requires operational discipline: image hygiene, supply-chain controls, runtime security, and efficient caching.

Core technical primitives (concise)

• Images: layered, content-addressable artifacts (OCI-compatible). Layers are immutable; a new layer for each filesystem diff.
• Containers: runtime instances of images; use a container runtime (containerd, runc) and kernel primitives (namespaces, cgroups).
• Dockerfile: declarative build instructions; use BuildKit for advanced features (cache mounts, secrets).
• Registries: artifact stores (Docker Hub, private registries, ECR/GCR/ACR). Registries hold manifests and blobs (layers).
• Networking & storage: user-defined bridge/overlay networks and volumes for stateful workloads.
• Security: capability bounding, seccomp/AppArmor profiles, user namespaces, rootless mode.

Best-practice patterns (technical and actionable)

• BuildKit & multi-stage builds

  • Enable BuildKit: DOCKER_BUILDKIT=1 docker build .
  • Use multi-stage to shrink runtime images: compile in a builder stage, copy only necessary artifacts to a minimal base (distroless/scratch).
  • Use --mount=type=cache to cache package manager downloads and speed CI.

• Image hygiene and size control

  • Prefer distroless or gcr.io/distroless/static for Go/python runtime binaries.
  • Minimize layer count and ordering: put frequently changing files (app code) late in the Dockerfile.
  • Clean caches in the same RUN command: RUN apt-get update && apt-get install -y ... && rm -rf /var/lib/apt/lists/*.

• Reproducible, cross-platform builds

  • Use Buildx for multi-arch images: docker buildx build --platform linux/amd64,linux/arm64 --push -t repo/image:tag .
  • Pin base image digests for immutability: FROM ubuntu@sha256:....

• Secure supply chain

  • Generate SBOMs: integrate syft during CI and attach to artifacts.
  • Scan images in CI: trivy image --severity CRITICAL,HIGH repo/image:tag.
  • Sign images (verification on pull): use cosign/Notation and enforce signature policies in registries or admission controllers.

• Runtime security

  • Run non-root inside containers; set USER and use --user if needed.
  • Drop unnecessary capabilities: --cap-drop=ALL --cap-add=NET_BIND_SERVICE.
  • Use seccomp profile and AppArmor where supported; prefer rootless Docker for host protection.

• Resource and lifecycle management

  • Set resource constraints: docker run --cpus=1.5 --memory=2g.
  • Implement graceful shutdown: handle SIGTERM in the process or use an init process (--init) to forward signals and reap zombies.
  • Add HEALTHCHECK and rely on orchestrator (Kubernetes liveness/readiness) for restart policies.

CI/CD integration checklist (practical)

1. Build:

   • Enable BuildKit, use multi-stage, produce signed, multi-arch images.
   • Generate SBOM and run vulnerability scans; fail pipeline on critical findings.

2. Tagging & promotion:

   • Use immutable tags in production (semantic version + commit SHA). Example: v1.2.3+sha.abcdef.
   • Use latest only for CI/dev; never for reproducible rollbacks.

3. Registry lifecycle:

   • Implement garbage collection, retention policies, and vulnerability scanning at the registry level.
   • Cache pulls in CI runners or use a registry mirror to reduce external dependency and latency.

4. Deploy:

   • Prefer immutable deployments on Kubernetes; use imagePullPolicy: IfNotPresent for stable images or Always for CI snapshots.
   • Enforce image signature verification via admission controllers.

Operational trade-offs and closing recommendations

• Docker composition is excellent for local development; for production orchestration, rely on Kubernetes (EKS/GKE/AKS) or a managed alternative Docker Swarm is simpler but less feature-rich.
• Invest in BuildKit + build cache sharing early; it reduces CI cost and speeds iterations.
• Treat images as first-class artifacts: sign, SBOM, scan, immutable tag, and tie to release metadata for traceability.

Actionable next steps:

• Turn on BuildKit across CI runners, add --mount=type=cache to key RUN steps.
• Add Trivy/Grype scans and SBOM generation to your pipeline; block critical CVEs.
• Adopt multi-arch builds and cosign for production images; enforce verification at deploy time.