Docker & Containerization Fundamentals for Full-Stack Developers

The Problem Containerization Solves

Every developer has experienced the frustration of setting up a project only for it to fail due to mismatched Node.js versions, missing system libraries, or conflicting database drivers. Docker bundles an application together with its entire runtime environment into an immutable, portable container image.

Virtual Machines vs Docker Containers

• **Virtual Machines**: Emulate an entire hardware layer and run a complete guest operating system. They take minutes to boot and consume gigabytes of RAM.
• **Docker Containers**: Share the host OS kernel and isolate processes using Linux namespaces and cgroups. They start in seconds and require only a fraction of system memory.

Writing Production-Grade Multi-Stage Dockerfiles

Multi-stage builds allow you to compile TypeScript and install build tools in an intermediate stage, then copy only the production artifacts into a featherweight runtime image:

```dockerfile # Stage 1: Build stage FROM node:20-alpine AS builder WORKDIR /app COPY package*.json ./ RUN npm ci COPY . . RUN npm run build

# Stage 2: Minimal Production Runner FROM node:20-alpine AS runner WORKDIR /app ENV NODE_ENV=production COPY package*.json ./ RUN npm ci --only=production COPY --from=builder /app/.next ./.next COPY --from=builder /app/public ./public

EXPOSE 3000 CMD ["npm", "start"] ```

Orchestrating with Docker Compose

Run full local development stacks—including your Next.js application, PostgreSQL database, and Redis cache—with a single command: `docker compose up`:

```yaml version: '3.8'

services: web: build: . ports: - "3000:3000" environment: - DATABASE_URL=postgres://postgres:secret@db:5432/devvoltz depends_on: - db

db: image: postgres:16-alpine restart: always environment: POSTGRES_USER: postgres POSTGRES_PASSWORD: secret POSTGRES_DB: devvoltz ports: - "5432:5432" volumes: - pgdata:/var/lib/postgresql/data

volumes: pgdata: ```

Container Best Practices - Never run production container processes as root. Use the unprivileged `node` user. - Add sensitive credentials to `.dockerignore` to prevent leaking secrets into image layers. - Tag production images with Git commit SHAs rather than relying on the mutable `:latest` tag.