14 Prompts for Docker: From Dockerfile to Multi-Stage Optimization

Create a Dockerfile for a Python Flask application that:
- Uses python:3.11-slim as the base image
- Installs dependencies from requirements.txt
- Creates a non-root user 'appuser'
- Copies only necessary files (use .dockerignore)
- Exposes port 5000
- Runs the app with gunicorn
- Uses multi-stage build to reduce final image size

FROM python:3.11-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

FROM python:3.11-slim
RUN useradd -m appuser
WORKDIR /home/appuser
COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
COPY app.py .
USER appuser
EXPOSE 5000
CMD ["gunicorn", "-w", "4", "-b", "0.0.0.0:5000", "app:app"]

Write a multi-stage Dockerfile for a Go application that:
- Stage 1: Uses golang:1.21-alpine to compile the binary
- Stage 2: Uses alpine:3.18 as the runtime image
- Copies only the compiled binary
- Sets the binary as the entrypoint

FROM golang:1.21-alpine AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /app -ldflags="-s -w" .

FROM alpine:3.18
RUN apk add --no-cache ca-certificates
COPY --from=builder /app /app
CMD ["/app"]

Create a docker-compose.override.yml that:
- Mounts the current directory to /app
- Overrides the command to 'tail -f /dev/null'
- Sets environment variable DEBUG=1
- Opens port 9229 for Node.js inspector

version: '3.8'
services:
  app:
    volumes:
      - .:/app
    command: tail -f /dev/null
    environment:
      - DEBUG=1
    ports:
      - "9229:9229"

Write a docker-compose.yml for a web app with:
- React frontend (nginx)
- Node.js API backend
- PostgreSQL database
- A shared network 'appnet'
- Health checks on the API and database
- Volume for DB persistence

version: '3.8'
services:
  db:
    image: postgres:15-alpine
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
    networks:
      - appnet
  api:
    build: ./api
    depends_on:
      db:
        condition: service_healthy
    networks:
      - appnet
  frontend:
    build: ./frontend
    ports:
      - "80:80"
    depends_on:
      - api
    networks:
      - appnet
volumes:
  pgdata:
networks:
  appnet:

Refactor this Dockerfile to improve layer caching:
FROM node:18
WORKDIR /app
COPY . .
RUN npm install
RUN npm run build

FROM node:18
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm install
COPY . .
RUN npm run build

Write a Dockerfile that uses BuildKit secrets to pass an npm token securely:
- Use --mount=type=secret for the token
- Use --mount=type=cache for npm cache
- Build with DOCKER_BUILDKIT=1

# syntax=docker/dockerfile:1
FROM node:18
WORKDIR /app
COPY package.json .
RUN --mount=type=cache,target=/root/.npm \
    --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) \
    npm install
COPY . .

Add a health check to a Docker Compose service that:
- Pings an HTTP endpoint every 5 seconds
- Retries 3 times before marking unhealthy
- Uses curl inside the container

healthcheck:
  test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
  interval: 5s
  timeout: 3s
  retries: 3
  start_period: 10s

Create a base compose file and an override for production that:
- Sets environment variables via .env.prod
- Uses different port mappings
- Adds a reverse proxy (Traefik)

version: '3.8'
services:
  app:
    image: myapp:latest
    env_file: .env

services:
  app:
    ports:
      - "80:3000"
    env_file: .env.prod
  proxy:
    image: traefik:v2.10
    command: --providers.docker
    ports:
      - "443:443"

Run a temporary container on the same network to debug:
- Use alpine with curl, ping, and dig
- Attach to the service's network
- Test connection to another service by name

docker run --rm -it --network myapp_appnet alpine ash -c "apk add bind-tools curl; curl http://api:3000/health; dig db"

Scan the local image 'myapp:latest' for vulnerabilities using Docker Scout:
- Output a summary table
- Filter by critical and high severity
- Suggest fixes for the top 3 findings

docker scout quickview myapp:latest
docker scout recommendations myapp:latest --only-cve-fix-available --severity critical,high

Write a Dockerfile that:
- Uses nginx:alpine
- Copies a custom nginx.conf
- Copies static HTML files
- Changes the default server to /usr/share/nginx/html
- Runs nginx as non-root

FROM nginx:alpine
COPY nginx.conf /etc/nginx/nginx.conf
COPY static/ /usr/share/nginx/html
RUN chown -R 1001:0 /usr/share/nginx/html && chmod -R g+r /usr/share/nginx/html
USER 1001
EXPOSE 8080

Create a daily cron job script that:
- Removes all stopped containers older than 24 hours
- Deletes dangling images (none:<none>)
- Keeps volumes in use by any container
- Logs the results to /var/log/docker-prune.log

#!/bin/bash
docker container prune -f --filter "until=24h" >> /var/log/docker-prune.log 2>&1
docker image prune -f >> /var/log/docker-prune.log 2>&1
docker volume prune -f >> /var/log/docker-prune.log 2>&1
echo "Prune completed at $(date)" >> /var/log/docker-prune.log

Convert this docker run command to a docker-compose service:
docker run -d --name myapp -p 8080:3000 -e DB_HOST=db.mysite.com -v /data:/app/data --restart unless-stopped myapp:1.0

services:
  myapp:
    image: myapp:1.0
    container_name: myapp
    ports:
      - "8080:3000"
    environment:
      - DB_HOST=db.mysite.com
    volumes:
      - /data:/app/data
    restart: unless-stopped

Add profiles to a docker-compose.yml so that:
- Services 'api' and 'frontend' belong to profile 'full'
- Service 'db' belongs to profile 'core'
- Running without --profile starts only 'db'

services:
  db:
    image: postgres:15
  api:
    image: myapi
    profiles: ["full"]
  frontend:
    image: myfrontend
    profiles: ["full"]