Docker

docker run -d --name api -p 3000:3000 \
  -e NODE_ENV=production --restart unless-stopped \
  ghcr.io/acme/api:1.4.2

create ──► created ──start──► running ──stop/kill──► exited ──rm──► gone
                               │  ▲                     │
                          pause│  │unpause        start │ (restart)
                               ▼  │                     ▼
                              paused                 running

echo "$GITHUB_TOKEN" | docker login ghcr.io \
  -u "$GITHUB_ACTOR" --password-stdin

docker volume create pgdata
docker volume ls
docker volume inspect pgdata
docker run --rm -v pgdata:/v alpine du -sh /v
 
# explicit form; fails if the host path is missing
docker run --mount \
  type=bind,src="$PWD"/config,dst=/etc/app,readonly \
  api

docker network create app
docker run -d --name db --network app postgres:18
docker run --rm --network app postgres:18 \
  pg_isready -h db            # "db" resolves via DNS
docker network connect app api    # add a 2nd network
docker network inspect app

services:
  api:
    image: ghcr.io/acme/api:1.4.2
    environment:
      LOG_LEVEL: ${LOG_LEVEL:-info}   # default
      API_URL: ${API_URL:?set API_URL} # required
      DB_PASSWORD_FILE: /run/secrets/db_password
    secrets: [db_password]
 
secrets:
  db_password:
    file: ./secrets/db_password.txt

docker run -d --name api \
  --health-cmd 'curl -fsS localhost:3000/health || exit 1' \
  --health-interval 30s --health-timeout 3s \
  --health-retries 3 --health-start-period 20s \
  --health-start-interval 2s \
  api
docker inspect -f '{{.State.Health.Status}}' api

services:
  api:
    depends_on:
      db:
        condition: service_healthy   # waits for healthcheck
        restart: true   # restart api when db is recreated
      migrate:
        condition: service_completed_successfully
      cache:
        condition: service_started   # the short-form default
        required: false  # only warn if it isn't running

services:
  api: { build: ./api }          # no profile: always starts
  adminer:
    image: adminer
    profiles: [debug]

docker compose --profile debug up -d
COMPOSE_PROFILES=debug,tools docker compose up -d
docker compose run --rm adminer   # run starts it anyway

docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t ghcr.io/acme/api:1.4.2 --push .

docker scout quickview api:1.4.2   # summary + base image
docker scout cves api:1.4.2 \
  --only-severity critical,high --exit-code
docker scout recommendations api:1.4.2  # better bases

docker debug api          # shell with vim, curl, htop…
docker debug --command 'ls -la /app' api
docker exec -u root -it api sh   # when it has a shell
docker logs --since 5m -t api 2>&1 | grep -i error

services:
  db:
    image: postgres:18
    environment:
      POSTGRES_USER: app
      POSTGRES_PASSWORD: app
      POSTGRES_DB: app
    volumes: [pgdata:/var/lib/postgresql]
    ports: ["127.0.0.1:5432:5432"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app -d app"]
      interval: 5s
      timeout: 3s
      retries: 10
  api:
    build: ./api
    environment:
      DATABASE_URL: postgres://app:app@db:5432/app
    ports: ["3000:3000"]
    depends_on:
      db: { condition: service_healthy, restart: true }
volumes:
  pgdata:

docker run --rm -it -v "$PWD":/work -w /work \
  -u "$(id -u):$(id -g)" oven/bun:1 bun --version
 
docker run --rm -i hadolint/hadolint < Dockerfile
 
# join a Compose project's network: <project>_default
docker run --rm -it --network my-app_default \
  postgres:18 psql postgres://app:app@db/app
 
alias jq='docker run --rm -i ghcr.io/jqlang/jq'

docker system df
docker container prune -f
docker image prune -a -f --filter until=168h
docker builder prune -f --keep-storage 10GB
docker volume ls -f dangling=true   # review first!
docker volume prune -f
# one project, including its volumes
docker compose down -v --remove-orphans --rmi local

docker cp api:/app/logs/app.log ./app.log
docker cp api:/app/logs - | tar -t   # stream as tar
 
# from an image without running it
id=$(docker create ghcr.io/acme/api:1.4.2)
docker cp "$id":/app/dist ./dist
docker rm "$id"
 
# straight from a build stage, no image at all
docker build --target build \
  --output type=local,dest=./out .

docker buildx create --name multi \
  --driver docker-container --use --bootstrap
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t ghcr.io/acme/api:1.4.2 \
  -t ghcr.io/acme/api:1.4 \
  --cache-to type=registry,ref=ghcr.io/acme/api:cache \
  --cache-from type=registry,ref=ghcr.io/acme/api:cache \
  --push .
docker buildx imagetools inspect ghcr.io/acme/api:1.4.2

services:
  api:
    build: { context: ., target: dev }
    command: bun --watch src/index.ts
    ports: ["3000:3000"]
    env_file: [.env]
    develop:
      watch:
        - action: sync
          path: ./src
          target: /app/src
        - action: rebuild
          path: package.json
        - action: rebuild
          path: bun.lock

docker compose up --watch