From Dockerfile to production-grade container — without the CVE debt.
8 micro-lessons · ~78 min · Real Docker images
Docker in Production
From Dockerfile to production-grade container — without the CVE debt.
Real skills, real career delta.
Skills you'll gain
10- Multi-stage Dockerfile authoringProduction
Students write multi-stage Dockerfiles that separate build and runtime layers, apply .dockerignore, set non-root USER, and reduce images from 900 MB to under 50 MB using BuildKit 0.29.0 cache mounts.
- BuildKit layer cache optimizationWorking
Students order COPY and RUN instructions to maximize cache hits, use --mount=type=cache for package managers, and measure rebuild times before and after reordering.
- Docker Compose multi-service orchestrationProduction
Students write Compose files with service dependencies, healthcheck directives, named volumes, env_file secrets, and override files to achieve dev/prod parity across a Node API, PostgreSQL, and Redis stack.
- Container networking: user-defined bridge and DNS discoveryWorking
Students create user-defined bridge networks, verify DNS-based service resolution between containers, and isolate services across multiple networks — replacing the deprecated --links flag.
- Named volume and bind mount lifecycle managementWorking
Students distinguish named volume persistence from bind mount behavior, implement a PostgreSQL backup script using volume mounts, and reproduce a deliberate data-loss scenario to understand container-restart semantics.
- Docker Scout CVE scanning and image hardeningProduction
Students run docker scout cves against a full-OS base image, migrate to a distroless or Alpine base, apply read-only filesystems, drop Linux capabilities, and set no-new-privileges — measuring CVE count reduction at each step.
- GitHub Actions CI/CD pipeline for container imagesProduction
Students build a GitHub Actions workflow that runs docker buildx build for multi-platform targets, executes Docker Scout policy gates, pushes semver-tagged and SHA-pinned images to GHCR, and includes a digest-pinned rollback step.
- Container image tagging and registry managementWorking
Students apply semver and SHA digest tagging strategies, push and pull from GHCR using Organization Access Tokens, and pin production deployments to immutable digest references rather than mutable tags.
- Prometheus + cAdvisor + Grafana observability stackWorking
Students deploy cAdvisor to expose container CPU, memory, and network metrics, configure a Prometheus scrape job, build a Grafana dashboard from those metrics, and wire an alert rule that fires on memory threshold breach.
- Traefik reverse proxy with TLS termination and label-based routingWorking
Students configure Traefik v3 via Docker labels to route HTTP traffic to multiple containerized services, provision Let's Encrypt TLS certificates automatically via ACME, and add basic-auth middleware — all without modifying application code.