containerizing-applications

Use a multi-stage build with python:3.13-slim: install dependencies with uv in a builder stage, copy site-packages into the final stage, create a non-root user, and run uvicorn on port 8000. Always include the syntax=docker/dockerfile:1 directive as the first line.

Use a three-stage Dockerfile with node:20-alpine: install dependencies, build with NEXT_PUBLIC_ build args baked in, then copy the standalone output into a minimal runner stage. Run as a non-root user and start with node server.js on port 3000.

Healthchecks using localhost can fail due to IPv6 resolution inside containers. Use 127.0.0.1 explicitly in the healthcheck test command, for example wget --spider http://127.0.0.1:3000/ instead of localhost.

Browser-side code runs on the host and needs localhost URLs passed as build args, while server-side code runs inside the container network and must use Docker service names like http://api:8000 set via environment variables.

Use Trivy in your CI pipeline with the command trivy image --severity HIGH,CRITICAL --exit-code 1 to fail builds on serious vulnerabilities. You can also generate SBOMs and use a .trivyignore file to document accepted CVEs.

Use distroless images when you want minimal attack surface since they contain no shell or package manager and run as non-root by default. They work well for Python, Node.js, and Go production workloads but make debugging harder since you cannot exec into the container.