惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

TaoSecurity Blog
TaoSecurity Blog
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
F
Fortinet All Blogs
Cisco Talos Blog
Cisco Talos Blog
D
Darknet – Hacking Tools, Hacker News & Cyber Security
S
Secure Thoughts
美团技术团队
雷峰网
雷峰网
Hugging Face - Blog
Hugging Face - Blog
博客园_首页
C
CXSECURITY Database RSS Feed - CXSecurity.com
Engineering at Meta
Engineering at Meta
人人都是产品经理
人人都是产品经理
月光博客
月光博客
T
Tor Project blog
P
Privacy & Cybersecurity Law Blog
Recorded Future
Recorded Future
I
Intezer
博客园 - 【当耐特】
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
GbyAI
GbyAI
罗磊的独立博客
V
V2EX
Google DeepMind News
Google DeepMind News
D
DataBreaches.Net
Last Week in AI
Last Week in AI
T
Tailwind CSS Blog
www.infosecurity-magazine.com
www.infosecurity-magazine.com
A
About on SuperTechFans
Scott Helme
Scott Helme
Vercel News
Vercel News
Spread Privacy
Spread Privacy
T
Threat Research - Cisco Blogs
Recent Announcements
Recent Announcements
Hacker News: Ask HN
Hacker News: Ask HN
C
CERT Recently Published Vulnerability Notes
G
Google Developers Blog
B
Blog
博客园 - 叶小钗
WordPress大学
WordPress大学
博客园 - 聂微东
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
Jina AI
Jina AI
IT之家
IT之家
C
Cybersecurity and Infrastructure Security Agency CISA
P
Palo Alto Networks Blog
小众软件
小众软件
博客园 - Franky
Microsoft Azure Blog
Microsoft Azure Blog
AWS News Blog
AWS News Blog

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
Docker Deep Dive: Beyond docker run (2026)
Alex Chen · 2026-05-27 · via DEV Community

Alex Chen

Docker Deep Dive: Beyond docker run (2026)

You know docker run -p 3000:3000. Here's everything else that makes Docker powerful in production.

Dockerfile Best Practices

# ❌ BAD: Bloated image, slow builds, security risks
FROM node:20

RUN apt-get update && apt-get install -y vim curl git
WORKDIR /app
COPY . .
RUN npm install
CMD ["node", "server.js"]

# ✅ GOOD: Optimized for size, speed, and security
FROM node:20-alpine AS base

# Build stage — install deps only (layer caching!)
FROM base AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --only=production && npm cache clean --force

# Production stage — minimal final image
FROM base AS production
WORKDIR /app

# Create non-root user (security best practice)
RUN addgroup --system --gid 1001 appgroup && \
    adduser --system --uid 1001 appuser

# Copy from build stage
COPY --from=deps /app/node_modules ./node_modules
COPY . .

# Set ownership
RUN chown -R appuser:appgroup /app
USER appuser

EXPOSE 3000

# Health check (Docker can monitor your app!)
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

CMD ["node", "server.js"]

Enter fullscreen mode Exit fullscreen mode

Key Dockerfile Rules

1. Layer caching is your friend
   → COPY package.json FIRST (before source code)
   → npm install runs only when package.json changes
   → Source code changes don't trigger reinstall!

2. Use .dockerignore (like .gitignore for Docker)
   node_modules          # Rebuild fresh each time
   .git                  # Don't copy repo history
   .env                  # Secrets!
   *.md                  # Documentation not needed at runtime
   .DS_Store             # macOS junk
   coverage/             # Test output
   dist/                 # If you're building inside Docker

3. Alpine images are tiny (~8MB vs ~180MB for full Node)
   Trade-off: Some tools missing (glibc compatibility issues)
   For most Node apps: alpine works perfectly fine

4. Multi-stage builds = smaller production images
   Build stage has all dev tools
   Production stage only gets what's needed
   Result: Image goes from 500MB+ to ~80MB

5. Never run as root
   USER appuser after setup
   Prevents container escape attacks
   Required by many Kubernetes clusters anyway

Enter fullscreen mode Exit fullscreen mode

Docker Compose for Local Development

# docker-compose.yml
version: '3.9'

services:
  app:
    build:
      context: .
      target: development       # Use a different stage for dev
    ports:
      - "3000:3000"
      - "9229:9229"            # Node debugger port
    environment:
      - NODE_ENV=development
      - DATABASE_URL=postgres://dev:dev@db:5432/myapp
      - REDIS_URL=redis://redis:6379
    volumes:
      - .:/app                  # Live reload! Code changes reflect immediately
      - /app/node_modules       # Prevent host node_modules overwriting container's
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped     # Auto-restart on crash
    networks:
      - backend

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: dev
      POSTGRES_PASSWORD: dev
      POSTGRES_DB: myapp
    volumes:
      - pgdata:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U dev"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - backend

  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redisdata:/data
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - backend

volumes:
  pgdata:                       # Named volume (persists across containers)
  redisdata:

networks:
  backend:
    driver: bridge              # Isolated network for services

Enter fullscreen mode Exit fullscreen mode

Essential Compose Commands

# Start everything
docker compose up -d            # Detached mode (background)
docker compose up               # Foreground (see logs live)

# Development workflow
docker compose up --build       # Rebuild before starting
docker compose logs -f app      # Follow logs for one service
docker compose logs -f --tail=50  # Last 50 lines, then follow
docker compose exec app sh      # Shell into running container
docker compose exec app npm run migrate  # Run commands inside container

# Debugging
docker compose ps               # Show all services status
docker compose top              # Show processes in each container
docker compose stats            # Resource usage (CPU, memory, network)

# Cleanup
docker compose down             # Stop and remove containers + networks
docker compose down -v          # Also remove volumes (resets data!)
docker compose down --rmi all   # Also remove images (full reset)

# One-off tasks
docker compose run --rm app npm run test         # Run tests then exit
docker compose run --rm db psql -U dev -d myapp   # Connect to DB directly

Enter fullscreen mode Exit fullscreen mode

Docker Networks Explained

# Default networks:
# bridge   → Default, containers on same host can communicate
# host     → Container uses host's network stack (no isolation)
# none     → No networking (rarely used)

# Custom networks (recommended):
docker network create myapp-net
docker run --network myapp-net ...

# DNS resolution works automatically!
# Container names become hostnames:
# app container can reach db via: postgres://db:5432/myapp

# Network types:
bridge     # Most common, isolated per network
host       # Direct host access (good for performance monitoring)
overlay    # Multi-host (Docker Swarm/Kubernetes)
macvlan    # Container gets its own MAC address (appears as physical device)
ipvlan     # Like macvlan but shares host MAC

Enter fullscreen mode Exit fullscreen mode

Volumes vs Bind Mounts

# Bind mount: Host path → Container path
# Good for: Development (live code sync), config files
docker run -v $(pwd)/src:/app/src nginx

# Named volume: Managed by Docker, stored in /var/lib/docker/volumes/
# Good for: Data persistence, databases, caches
docker run -v mydata:/data/app nginx

# Read-only bind mount (security!)
docker run -v $(pwd)/config:/etc/app/config:ro nginx

# tmpfs: In-memory only (gone when container stops)
# Good for: Temporary files, secrets, sensitive processing
docker run --tmpfs /tmp:rw,noexec,nosuid,size=100m nginx

# Volume lifecycle:
docker volume create mydata           # Create
docker volume inspect mydata          # See details (where it lives)
docker volume ls                      # List all
docker volume prune                   # Remove unused volumes (frees disk space!)

Enter fullscreen mode Exit fullscreen mode

Useful Docker Commands You Might Not Know

# Container management
docker ps -a                          # All containers (including stopped)
docker stats                          # Real-time resource usage (like top)
docker top <container>                # Processes inside container
docker update --memory=512m <container>  # Update resource limits live!
docker rename old-name new-name       # Rename a container

# Inspecting
docker inspect <container> | jq '.[0].NetworkSettings.IPAddress'  # Get IP
docker inspect <container> --format='{{.State.Status}}'            # Quick status
docker logs <container> --since 1h         # Logs from last hour
docker logs <container> --tail 100 -f      # Tail last 100 lines

# Copying files
docker cp file.txt container:/path/inside/   # Host → Container
docker cp container:/path/file.txt ./local/  # Container → Host

# Cleaning up (run regularly!)
docker system prune                    # Remove stopped containers, unused networks, dangling images
docker system prune -a                 # ALSO remove unused images (not just dangling)
docker volume prune                    # Remove unused volumes
docker builder prune                   # Remove build cache (can be GBs!)

# Image management
docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"  # Pretty table
docker history <image>                 # See each layer and its size
docker save myimage | gzip > image.tar.gz  # Export image for transfer
docker load < image.tar.gz             # Import exported image

# Debugging a failing container
docker run --rm -it --entrypoint sh myimage  # Override entrypoint to get shell
docker commit <container> myimage:debug      # Save container state as new image

Enter fullscreen mode Exit fullscreen mode

Docker in CI/CD

# GitHub Actions example
name: Build & Push Docker Image
on:
  push:
    branches: [main]

jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ${{ secrets.DOCKERHUB_USERNAME }}/myapp:${{ github.sha }}
            ${{ secrets.DOCKERHUB_USERNAME }}/myapp:latest
          cache-from: type=gha              # GitHub Actions cache
          cache-to: type=gha,mode=max        # Speed up future builds
          platforms: linux/amd64,linux/arm64 # Multi-architecture support!

Enter fullscreen mode Exit fullscreen mode

Common Docker Problems & Solutions

# Problem: Container exits immediately
# Solution: Check the process! Containers die when their main process exits.
docker logs <container>                     # Always first step
# Fix: Make sure your CMD/ENTRYPOINT runs a long-running process

# Problem: Permission denied errors
# Solution: UID mismatch between host and container
# In Dockerfile: RUN adduser --uid 1001 appuser; USER appuser
# Or: docker run -u $(id -u):$(id -g) ...

# Problem: Disk space full
# Solution: Regular cleanup
docker system df                           # See what's using space
docker system prune -a --volumes           # Nuclear option (frees most space)

# Problem: Networking issues (can't reach other containers)
# Solution: Check they're on the same network
docker network inspect <network-name>
# Ensure both services use the same network in compose

# Problem: Stale layers making rebuilds slow
# Solution: Clear build cache
docker builder prune
# Then rebuild with --no-cache once

# Problem: Timezone wrong inside container
# Solution: Pass TZ environment variable
docker run -e TZ=Asia/Shanghai ...
# Or in Dockerfile: ENV TZ=Asia/Shanghai

Enter fullscreen mode Exit fullscreen mode


What's your favorite Docker tip?

Follow @armorbreak for more practical developer guides.