DevOpsIntermediate
Docker & Container Architecture
Docker isolates processes using Linux kernel cgroups, namespaces, and union file systems (overlay2).
Key Mental Models & Invariants
- -Containers are isolated OS processes, NOT lightweight virtual machines.
- -Namespaces isolate what a process can SEE (PID, NET, MNT, IPC, UTS, USER).
- -Control Groups (cgroups) isolate what a process can USE (CPU, memory, I/O).
- -Multi-stage Docker builds separate build tooling from minimal production runtimes.
Deep Dive Architecture
### Docker Multi-Stage Optimization
In a standard Docker build, your compiler, npm dependencies, and source files bloat the image to 1.5GB.
A multi-stage build discards build tools:
```dockerfile
# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
# Stage 2: Minimal Runner
FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
COPY package*.json ./
RUN npm ci --only=production
COPY --from=builder /app/dist ./dist
USER node
EXPOSE 3000
CMD ["node", "dist/server.js"]
```
Image size drops from 1.2GB down to 110MB!
Code Exampledockerfile
# Run as non-root user for container security USER node # Optimize layer caching: copy lockfiles before source code COPY package*.json ./ RUN npm ci
Docker caches layers sequentially. Putting package.json before source prevents running npm ci on every minor code edit.