devops-engineer

Use a multi-stage build: install dependencies with npm ci in a builder stage, then copy only build artifacts into a minimal alpine runner image. Add a non-root user, a HEALTHCHECK instruction, and a .dockerignore excluding node_modules, .git, and .env files.

Create a workflow triggered on push and pull_request with jobs for lint, typecheck, tests with coverage, and build. Add a deploy job gated on the main branch that uses repository secrets, and enable concurrency cancellation to stop stale runs.

Blue/green runs two full environments and switches traffic instantly via a load balancer, enabling instant rollback but requiring double infrastructure. Canary shifts traffic gradually (5% to 100%) while monitoring error rates, reducing blast radius with less infrastructure.

Yes. Use depends_on with condition: service_healthy and define a healthcheck on the database service, such as pg_isready for PostgreSQL. The app container starts only after the database passes its health check.

Running as root lets a compromised process gain full control of the container and potentially the host. Create a dedicated system user with adduser, switch with the USER instruction, and the process runs with minimal privileges.

Store secrets in GitHub repository secrets and reference them as ${{ secrets.NAME }} in workflows, never hardcoding values. In production, use a secret manager like AWS Secrets Manager, GCP Secret Manager, or Azure Key Vault, and commit only a .env.example file.