spb/ultra-sharp-agent-skills Public

1<!--2Author: Simon-Pierre Boucher3Contact: contact@spboucher.ai4-->56# Patterns — Containerizing Services78## Contents9- Node.js multi-stage Dockerfile10- Python multi-stage Dockerfile11- Go static binary + distroless12- .dockerignore baseline13- Build-time secrets (BuildKit)14- Runtime hardening flags15- Gotchas1617## Node.js multi-stage Dockerfile1819```dockerfile20# syntax=docker/dockerfile:121FROM node:22.4-slim AS build22WORKDIR /app23COPY package*.json ./24RUN npm ci25COPY . .26RUN npm run build && npm prune --omit=dev2728FROM node:22.4-slim29ENV NODE_ENV=production30WORKDIR /app31RUN useradd --uid 10001 --create-home app32COPY --from=build --chown=app:app /app/node_modules ./node_modules33COPY --from=build --chown=app:app /app/dist ./dist34USER app35EXPOSE 300036HEALTHCHECK --interval=30s --timeout=3s --retries=3 \37  CMD node -e "fetch('http://127.0.0.1:3000/healthz').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"38CMD ["node", "dist/server.js"]39```4041## Python multi-stage Dockerfile4243```dockerfile44# syntax=docker/dockerfile:145FROM python:3.12.4-slim AS build46WORKDIR /app47RUN apt-get update && apt-get install -y --no-install-recommends build-essential \48    && rm -rf /var/lib/apt/lists/*49COPY requirements.txt .50RUN pip install --no-cache-dir --prefix=/install -r requirements.txt5152FROM python:3.12.4-slim53WORKDIR /app54RUN useradd --uid 10001 --create-home app55COPY --from=build /install /usr/local56COPY --chown=app:app . .57USER app58EXPOSE 800059HEALTHCHECK --interval=30s --timeout=3s --retries=3 \60  CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/healthz').status==200 else 1)"61CMD ["gunicorn", "-b", "0.0.0.0:8000", "app.wsgi:application"]62```6364## Go static binary + distroless6566```dockerfile67# syntax=docker/dockerfile:168FROM golang:1.23.1 AS build69WORKDIR /src70COPY go.mod go.sum ./71RUN go mod download72COPY . .73RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /out/svc ./cmd/svc7475FROM gcr.io/distroless/static-debian12:nonroot76COPY --from=build /out/svc /svc77EXPOSE 808078ENTRYPOINT ["/svc"]79```8081Distroless has no shell — the orchestrator's HTTP probe replaces `HEALTHCHECK`.8283## .dockerignore baseline8485```86.git87.gitignore88.env*89*.md90node_modules91__pycache__92*.pyc93.venv94dist95coverage96tests/fixtures97Dockerfile98```99100Remove `dist` from the ignore list if you COPY prebuilt artifacts instead of building in-image.101102## Build-time secrets (BuildKit)103104```dockerfile105RUN --mount=type=secret,id=pip_index \106    PIP_INDEX_URL=$(cat /run/secrets/pip_index) pip install -r requirements.txt107```108109```bash110docker build --secret id=pip_index,src=.pip_index_url .111```112113Never `ARG TOKEN` — args are recoverable via `docker history`.114115## Runtime hardening flags116117```bash118docker run --rm \119  --read-only --tmpfs /tmp \120  --cap-drop ALL \121  --security-opt no-new-privileges \122  -p 8000:8000 svc:prod123```124125Start from all-dropped and add back only what breaks.126127## Gotchas128129- **`COPY --from` keeps root ownership** unless `--chown` is given — the classic "works as root, crashes as USER app" cause.130- **alpine + Python wheels**: musl forces source builds of numpy/psycopg2 etc.; use `-slim` (glibc) unless you've verified alpine.131- **`EXPOSE` documents, it does not publish** — publishing is `-p`/orchestrator config.132- **apt cache bloat**: always `rm -rf /var/lib/apt/lists/*` in the same `RUN` as the install, or the cache lands in the layer anyway.133- **CMD shell form (`CMD node server.js`) wraps in `/bin/sh`** → PID 1 is sh, signals (SIGTERM) never reach the app → 10s kill delay on every deploy. Use exec form (JSON array).134- **`HEALTHCHECK` in Dockerfile is ignored by Kubernetes** — it uses its own probes; keep both consistent.135- **Bind-mounting over image content in dev** hides image bugs; test the real image before shipping.136