docker-patterns

Define services in docker-compose.yml with build contexts, port mappings, bind mounts for hot reload, and healthchecks so dependent services wait for readiness. Use an anonymous volume over node_modules to prevent the host bind mount from overwriting container dependencies.

Add a healthcheck to the database service, such as pg_isready for Postgres, then set depends_on with condition: service_healthy on the dependent service. Compose will start the app only after the database passes its healthcheck.

Use bind mounts for source code during development to enable hot reload, and named volumes for persistent data like Postgres storage that must survive container restarts. Anonymous volumes protect container-generated directories like node_modules from bind mount overrides.

Inject secrets at runtime using env_file pointing to a gitignored .env file, or use Docker secrets in Swarm mode. Never hardcode credentials with ENV instructions in a Dockerfile, since they persist in image layers.

A root process inside a container can escalate to host access if the container is compromised. Create a non-root user in the Dockerfile with adduser, switch with USER, and combine with no-new-privileges, dropped capabilities, and a read-only filesystem.

Docker Compose lacks orchestration features like auto-healing, scaling, and rolling deployments across hosts. For production multi-container workloads, use Kubernetes, ECS, or Docker Swarm instead, keeping Compose for local development.