docker-containerization

Use a builder stage to install dependencies with pip into a prefix directory, then copy only the installed packages into a slim runtime stage. This keeps build tools out of the final image and typically reduces size by 40-70%.

Combine alpine or slim base images (50-80% savings), multi-stage builds (40-70%), pip's --no-cache-dir flag (10-20%), and a .dockerignore excluding .git, node_modules, and tests. Order layers from least to most frequently changing to maximize cache hits.

Define a healthcheck on the database service (e.g., pg_isready for PostgreSQL) and use depends_on with condition: service_healthy on the dependent service. Alternatively, use a wait-for-it entrypoint script that polls until the database accepts connections.

Create a dedicated user and group in the Dockerfile with addgroup and adduser, then switch with the USER instruction before the CMD. Node.js official images already include a node user you can use directly.

Use the Compose secrets top-level element to mount secret files at /run/secrets inside the container, and point your app at the file path via an environment variable like DB_PASSWORD_FILE. Never bake secrets into image layers.

The latest tag is mutable, so builds become non-reproducible and unexpected upstream changes can break deployments. Pin specific versions like postgres:16-alpine or python:3.12-slim to keep environments consistent.