Skip to content
CoderConda

Docker & operations

Production-ready code is not yet a stably operated product. An excerpt from this website’s files shows what lies in between: one line starts the application, the rest keep it running.

Operations sheet, line by line

operations-sheet.diff
Lines
+14−14
Sections
7

Excerpt from this website’s Dockerfile and docker-compose.yml, shortened. The first line is an example command.

View

  1. Example command

    docker run -p 3000:3000 anwendung

    00

    It runs

    This is how the application runs on a laptop, in testing and at sign-off.

    That is not enough Visitors arrive at any hour, and this one line is not enough for that.

  2. docker-compose.yml

    services:  app:    restart: unless-stopped

    01

    Restart on its own

    If the service crashes or the server restarts, the application comes back on its own. Only a deliberate stop keeps it down.

    Without the line After the first crash the service stays off until somebody notices.

  3. Dockerfile

    EXPOSE 3000HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD wget -qO- http://127.0.0.1:3000/api/health || exit 1CMD ["node", "server.js"]

    02

    A self-check every 30 seconds

    Every 30 seconds the application asks itself whether it answers. Three failed attempts in a row and it counts as unwell.

    Without the line Docker sees that a process is running, not whether it still answers.

  4. docker-compose.yml

      nginx:    image: nginx:1.29-alpine    depends_on:      app:        condition: service_healthy

    03

    The web server waits

    The web server only takes visitors once the application reports healthy.

    Without the line While the application is still starting, visitors see error pages.

  5. docker-compose.yml

      app:    expose:      - "3000"  nginx:    ports:      - "80:80"      - "443:443"

    04

    One way in from outside

    From outside there is one path to the application: the web server, on port 80 and, encrypted, on 443. The application itself listens on the internal network only.

    On the server this website runs on, shared by several projects, an existing web server takes that role. The container listens locally only.

    Without the line Every extra open port is another way in that somebody has to secure.

  6. docker-compose.yml

      app:    env_file: .env.production

    05

    Secrets outside the code

    Passwords and keys sit in a file of their own, in neither the code repository nor the image.

    Without the line Passwords would have to sit in the code or in the image.

  7. Dockerfile

    COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile

    06

    Every build matches the last

    The install takes exactly the package versions in the lockfile. If the file does not match the project, the build stops.

    Without the line A new build can pull other package versions, and something suddenly behaves differently.

  8. Dockerfile

    WORKDIR /appRUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 nextjsUSER nextjs

    07

    No administrator in the container

    The application runs as a user of its own, without administrator rights.

    Without the line It would run as administrator, and a fault in it would have every right inside the container.

Result

The system keeps running when nobody is watching it

What no file holds

3 promises cannot be written as a line. They sit in the documentation that comes with the handover.

Rollback
A bad update rolls back in minutes
Documented
Backups, certificates and access are set up and documented
Handover
It ends in a handover with every key

GuideWhy operations are part of the product:When is a customer portal worthwhile?

Typical uses

  1. 01Moving from Vercel or shared hosting to a dedicated server
  2. 02Operating a client portal with several services
  3. 03A staging environment for sign-off before go-live
  4. 04Recovery after an outage or a misconfiguration
  5. 05Handover to an in-house team or another provider

Matching offers

Docker is used in these offers.

Other technologies

Next step

The project first, then the stack.

Which technology fits is settled last. The first call of 15 minutes shows where the application runs today and what it needs to keep running.

Discuss operations

Or directly: info@coderconda.com