Docker Manager

Container lifecycle management with production-ready patterns.

When to Use

User mentions Docker, containers, images, or Dockerfiles

User wants to containerize an application

User needs docker-compose orchestration

User asks about container debugging or optimization

Procedure

Building Images

Analyze the project to determine base image and dependencies

Create a multi-stage Dockerfile for minimal final image

Build: docker build -t name:tag .

Verify: docker images | grep name

Running Containers

Run: docker run -d --name my-app -p 8080:3000 name:tag

Check logs: docker logs -f my-app

Exec into: docker exec -it my-app /bin/sh

Docker Compose

Create docker-compose.yml with service definitions

Start: docker compose up -d

Monitor: docker compose logs -f

Scale: docker compose up -d --scale web=3

Cleanup

Stop containers: docker stop $(docker ps -q)

Remove containers: docker container prune

Remove images: docker image prune -a

Remove volumes: docker volume prune

Best Practices

Use .dockerignore to exclude unnecessary files

Pin base image versions (node:20-alpine, not node:latest)

Use multi-stage builds to reduce final image size

Run as non-root user in production

Use HEALTHCHECK for container health monitoring

Pitfalls

Never store secrets in Dockerfiles or images

Avoid running as root in production containers

Watch for large context sizes slowing builds

Handle signal propagation for graceful shutdown

Advanced Techniques

Docker Compose v5 (2025–2026)

Compose v1 is dead. The docker-compose (hyphenated) command was removed in April 2025. All commands must use the v2 plugin syntax:

# ✅ Correct — Compose v2+ plugin syntax
docker compose up -d
docker compose logs -f

❌ Deprecated — will fail on modern Docker
docker-compose up -d

version field removed. Compose YAML no longer requires (or accepts) the top-level version: field. Start files directly with services::

# ✅ Correct — modern Compose file
services:
  web:
    image: nginx:alpine
    # ...

❌ Deprecated — remove the version field
version: "3.8"
services:
  web:
    image: nginx:alpine

Watch mode enables live sync of local changes into containers. Production-ready since v2.32.0 (Sept 2025) with initial_sync support:

services:
  web:
    image: node:20-alpine
    develop:
      watch:
        - action: sync
          path: ./src
          target: /app/src
          initial_sync: true    # Sync full directory on start (v2.32.0+)
        - action: rebuild
          path: ./package.json

docker compose watch    # Start watch mode

Compose profiles for environment-specific service selection:

services:
  web:
    image: myapp
  debug-tools:
    image: debug-toolkit
    profiles: ["debug"]
  load-generator:
    image: hey
    profiles: ["stress"]

docker compose --profile debug up -d      # Include debug tools
docker compose --profile stress up -d     # Include load generator
docker compose up -d                        # Only default services

OCI includes for modular Compose files — split large projects across multiple files:

# compose.yml
include:
  - docker-compose.monitoring.yml
  - docker-compose.logging.yml
  - path: docker-compose.override.yml
    project_directory: .

⚠️ CVE-2025-62725 (Critical). Path traversal vulnerability in OCI includes allows arbitrary file reads on the host. Update Docker Compose to v2.40.2+ immediately.

# Check your version
docker compose version
Upgrade

sudo apt-get update && sudo apt-get install docker-compose-v2
Or via Docker Desktop update

Compose Bridge converts Compose files to Kubernetes manifests:

docker compose convert-to-kubernetes    # Generate K8s manifests from compose.yml

Compose Go SDK for programmatic management:

import "github.com/docker/compose/v2/pkg/api"

project, _ := compose.ProjectFromOptions(ctx, &api.ProjectOptions{
    ConfigPaths: []string{"compose.yml"},
})
composeAPI := api.NewDockerCompose()
composeAPI.Up(ctx, project, api.UpOptions{})

Systemd Security Hardening

When running Docker or container services under systemd, apply these hardening directives:

Filesystem and privilege isolation:

[Service]
PrivateTmp=true                    # Isolated /tmp directory
ProtectSystem=strict               # Make /usr, /boot, /etc read-only
NoNewPrivileges=true               # Prevent privilege escalation (no sudo, no suid)
PrivateDevices=true                # No access to /dev devices except pts
ReadWritePaths=/var/lib/docker     # Whitelist specific write paths

Memory and execution restrictions:

[Service]
MemoryDenyWriteExecute=true        # W^X — prevent JIT/self-modifying code
LockPersonality=true               # Lock process personality flags
RestrictNamespaces=net             # Only allow network namespace creation
Or restrict all: RestrictNamespaces=true

Audit service security:

# Get a security score for any unit
systemd-analyze security docker.service
systemd-analyze security my-app.service

Output includes individual directive scores and overall rating

cgroups v2 resource limits:

[Service]
CPUQuota=200%                      # 2 CPU cores max
MemoryMax=2G                       # Hard memory limit (OOM kill on exceed)
MemoryHigh=1.5G                     # Soft memory limit (throttle, not kill)
StartupCPUWeight=100               # CPU priority during startup

Socket activation — start services on-demand via systemd socket units:

# my-app.socket
[Socket]
ListenStream=8080

[Install]
WantedBy=sockets.target

# my-app.service
[Service]
ExecStart=/usr/bin/my-app
Systemd passes the accepted socket as fd 0

systemctl enable --now my-app.socket    # Socket starts immediately; service starts on connection

Verification

Container running: docker ps | grep name

Health check passing: docker inspect --format='{{.State.Health}}' name

Logs clean: docker logs --tail 50 name

Compose version: docker compose version (ensure v2.40.2+ for CVE-2025-62725 fix)

Systemd security audit: systemd-analyze security

Ask

📄 Export PDF ← All Skills