Docker for Node.js: वो Production-Ready Setup जिसके बारे में कोई नहीं बताता | Akousa

10 नवंबर 202525 मिनट पढ़ने का समय

Docker for Node.js: वो Production-Ready Setup जिसके बारे में कोई नहीं बताता

Multi-stage builds, non-root users, health checks, secrets management, और image size optimization। हर Node.js production deployment के लिए मेरे Docker patterns।

ज़्यादातर production Node.js Dockerfiles bad हैं। "थोड़ा suboptimal" bad नहीं। Root के रूप में run हो रही, devDependencies baked-in 600MB images, कोई health checks नहीं, और secrets hardcoded environment variables में जो कोई भी docker inspect से पढ़ सकता है।

मुझे पता है क्योंकि मैंने वो Dockerfiles लिखीं। सालों तक। काम करती थीं, तो मैंने कभी सवाल नहीं किया। फिर एक दिन security audit ने flag किया कि container PID 1 root के रूप में पूरे filesystem पर write access के साथ run हो रहा है, और मुझे realize हुआ कि "काम करता है" और "production-ready" बहुत अलग bars हैं।

This setup is a production-tested baseline for Node.js services. Every pattern here exists because the weaker alternative tends to fail under real traffic.

आपकी Current Dockerfile शायद गलत है

चलिए guess करता हूं आपकी Dockerfile कैसी दिखती है:

dockerfile

# Single stage: ~600MB
FROM node:20
WORKDIR /app
COPY . .
RUN npm install
CMD ["node", "server.js"]
 
# Multi-stage: ~150MB
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
 
FROM node:20-alpine AS runner
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./
CMD ["node", "dist/server.js"]

dockerfile

# ============================================
# Stage 1: Dependencies install करें
# ============================================
FROM node:20-alpine AS deps
 
# Security: कुछ भी करने से पहले working directory create करें
WORKDIR /app
 
# Lockfile के आधार पर dependencies install करें
# पहले सिर्फ package files copy करें — layer caching के लिए critical
COPY package.json package-lock.json ./
 
# ci install से better है: faster, stricter, और reproducible
# --omit=dev इस stage से devDependencies exclude करता है
RUN npm ci --omit=dev
 
# ============================================
# Stage 2: Application build करें
# ============================================
FROM node:20-alpine AS builder
 
WORKDIR /app
 
# Package files copy करें और सभी dependencies install करें (dev सहित)
COPY package.json package-lock.json ./
RUN npm ci
 
# अब source code copy करें — यहां changes npm ci cache invalidate नहीं करतीं
COPY . .
 
# Application build करें (TypeScript compile, Next.js build, etc.)
RUN npm run build
 
# ============================================
# Stage 3: Production runner
# ============================================
FROM node:20-alpine AS runner
 
# Image metadata के लिए labels add करें
LABEL maintainer="your-email@example.com"
LABEL org.opencontainers.image.source="https://github.com/yourorg/yourrepo"
 
# Security: proper PID 1 signal handling के लिए dumb-init install करें
RUN apk add --no-cache dumb-init
 
# Security: कुछ भी करने से पहले NODE_ENV set करें
ENV NODE_ENV=production
 
# Security: non-root user इस्तेमाल करें
# Node image में पहले से 'node' user है (uid 1000)
USER node
 
# Node user owned app directory create करें
WORKDIR /app
 
# deps stage से production dependencies copy करें
COPY --from=deps --chown=node:node /app/node_modules ./node_modules
 
# builder stage से built application copy करें
COPY --from=deps --chown=node:node /app/package.json ./
COPY --from=builder --chown=node:node /app/dist ./dist
 
# Port expose करें (documentation only — publish नहीं करता)
EXPOSE 3000
 
# Health check: alpine में curl available नहीं, node इस्तेमाल करें
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
  CMD node -e "require('http').get('http://localhost:3000/health', (r) => { process.exit(r.statusCode === 200 ? 0 : 1) })"
 
# Signals properly handle करने के लिए dumb-init PID 1 के रूप में
ENTRYPOINT ["dumb-init", "--"]
 
# Application start करें
CMD ["node", "dist/server.js"]

javascript

// server.js
const server = app.listen(3000);
 
process.on("SIGTERM", () => {
  console.log("SIGTERM received, shutting down gracefully");
  server.close(() => {
    console.log("HTTP server closed");
    // Database connections close करें, logs flush करें, etc.
    process.exit(0);
  });
});

# .dockerignore
node_modules
npm-debug.log*
.git
.gitignore
.env
.env.*
!.env.example
Dockerfile
docker-compose*.yml
.dockerignore
README.md
LICENSE
.github
.vscode
.idea
coverage
.nyc_output
*.test.ts
*.test.js
*.spec.ts
*.spec.js
__tests__
test
tests
docs
.husky
.eslintrc*
.prettierrc*
tsconfig.json
jest.config.*
vitest.config.*

dockerfile

# syntax=docker/dockerfile:1
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
 
# Build time पर secret mount करें — कभी image में store नहीं होता
RUN --mount=type=secret,id=npmrc,target=/app/.npmrc \
    npm ci
 
COPY . .
RUN npm run build

yaml

# docker-compose.yml (Swarm mode)
version: "3.8"
services:
  api:
    image: myapp:latest
    secrets:
      - db_password
      - api_key
 
secrets:
  db_password:
    external: true
  api_key:
    external: true

javascript

import { readFileSync } from "fs";
 
function getSecret(name) {
  try {
    return readFileSync(`/run/secrets/${name}`, "utf8").trim();
  } catch {
    // Local development के लिए environment variable पर fall back
    return process.env[name.toUpperCase()];
  }
}
 
const dbPassword = getSecret("db_password");

dockerfile

HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
  CMD node -e "require('http').get('http://localhost:3000/health', (r) => { process.exit(r.statusCode === 200 ? 0 : 1) })"

javascript

// healthcheck.js
const http = require("http");
 
const options = {
  hostname: "localhost",
  port: 3000,
  path: "/health",
  timeout: 5000,
};
 
const req = http.request(options, (res) => {
  process.exit(res.statusCode === 200 ? 0 : 1);
});
 
req.on("error", () => process.exit(1));
req.on("timeout", () => {
  req.destroy();
  process.exit(1);
});
 
req.end();

javascript

app.get("/health", async (req, res) => {
  const checks = {
    uptime: process.uptime(),
    timestamp: Date.now(),
    status: "ok",
  };
 
  try {
    // Database connection check करें
    await db.query("SELECT 1");
    checks.database = "connected";
  } catch (err) {
    checks.database = "disconnected";
    checks.status = "degraded";
  }
 
  try {
    // Redis connection check करें
    await redis.ping();
    checks.redis = "connected";
  } catch (err) {
    checks.redis = "disconnected";
    checks.status = "degraded";
  }
 
  const statusCode = checks.status === "ok" ? 200 : 503;
  res.status(statusCode).json(checks);
});

yaml

# docker-compose.dev.yml
services:
  app:
    build:
      context: .
      dockerfile: Dockerfile.dev
      args:
        NODE_VERSION: "20"
    ports:
      - "3000:3000"
      - "9229:9229" # Node.js debugger
    volumes:
      # Hot reload के लिए source code mount करें
      - .:/app
      # Image के node_modules preserve करने के लिए anonymous volume
      # Host के node_modules container के override करने से रोकता है
      - /app/node_modules
    environment:
      - NODE_ENV=development
      - DATABASE_URL=postgres://postgres:devpassword@db:5432/myapp_dev
      - REDIS_URL=redis://redis:6379
    env_file:
      - .env.local
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    command: npm run dev
 
  db:
    image: postgres:16-alpine
    ports:
      - "5432:5432"
    environment:
      POSTGRES_DB: myapp_dev
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: devpassword
    volumes:
      # Container restarts में persistent data के लिए named volume
      - pgdata:/var/lib/postgresql/data
      # Initialization scripts
      - ./scripts/init-db.sql:/docker-entrypoint-initdb.d/init.sql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
 
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redisdata:/data
    command: redis-server --appendonly yes
 
  # Optional: database admin UI
  adminer:
    image: adminer:latest
    ports:
      - "8080:8080"
    depends_on:
      - db
 
volumes:
  pgdata:
  redisdata:

dockerfile

# Dockerfile.dev
ARG NODE_VERSION=20
FROM node:${NODE_VERSION}-alpine
 
WORKDIR /app
 
# सभी dependencies install करें (devDependencies सहित)
COPY package*.json ./
RUN npm ci
 
# Source code volume से mount होता है, copy नहीं
# लेकिन initial build के लिए अभी भी चाहिए
COPY . .
 
EXPOSE 3000 9229
 
CMD ["npm", "run", "dev"]

yaml

# docker-compose.prod.yml
services:
  app:
    image: ghcr.io/yourorg/myapp:${TAG:-latest}
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
    env_file:
      - .env.production
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 128M
      replicas: 2
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "require('http').get('http://localhost:3000/health', r => process.exit(r.statusCode === 200 ? 0 : 1))",
        ]
      interval: 30s
      timeout: 10s
      start_period: 40s
      retries: 3
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - internal
      - web
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
 
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1G
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - internal
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
 
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: >
      redis-server
      --appendonly yes
      --maxmemory 256mb
      --maxmemory-policy allkeys-lru
    volumes:
      - redisdata:/data
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 512M
    networks:
      - internal
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "3"
 
volumes:
  pgdata:
    driver: local
  redisdata:
    driver: local
 
networks:
  internal:
    driver: bridge
  web:
    external: true

dockerfile

# ============================================
# Stage 1: Dependencies install करें
# ============================================
FROM node:20-alpine AS deps
RUN apk add --no-cache libc6-compat
WORKDIR /app
 
COPY package.json package-lock.json ./
RUN npm ci
 
# ============================================
# Stage 2: Application build करें
# ============================================
FROM node:20-alpine AS builder
WORKDIR /app
 
COPY --from=deps /app/node_modules ./node_modules
COPY . .
 
# Build के दौरान Next.js telemetry disable करें
ENV NEXT_TELEMETRY_DISABLED=1
 
RUN npm run build
 
# ============================================
# Stage 3: Production runner
# ============================================
FROM node:20-alpine AS runner
WORKDIR /app
 
RUN apk add --no-cache dumb-init
 
ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1
 
# Non-root user
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs
 
# Public assets copy करें
COPY --from=builder /app/public ./public
 
# Standalone output directory set up करें
# Image size reduce करने के लिए automatically output traces leverage करता है
RUN mkdir .next
RUN chown nextjs:nodejs .next
 
# Standalone server और static files copy करें
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 
USER nextjs
 
EXPOSE 3000
 
ENV PORT=3000
ENV HOSTNAME="0.0.0.0"
 
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
  CMD node -e "require('http').get('http://localhost:3000/api/health', (r) => { process.exit(r.statusCode === 200 ? 0 : 1) })"
 
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "server.js"]

yaml

# .github/workflows/docker.yml
- name: Build image
  run: docker build -t myapp:${{ github.sha }} .
 
- name: Scan image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: myapp:${{ github.sha }}
    exit-code: 1
    severity: CRITICAL,HIGH
    ignore-unfixed: true

yaml

# .github/workflows/docker.yml
name: Build and Push Docker Image
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
 
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write
 
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
 
      - name: Log in to Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
 
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha
            type=ref,event=branch
            type=semver,pattern={{version}}
 
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
 
      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}
          exit-code: 1
          severity: CRITICAL,HIGH
          ignore-unfixed: true
 
      - name: Upload Trivy results
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

dockerfile

# Build-time configuration
ARG NODE_VERSION=20
FROM node:${NODE_VERSION}-alpine
 
# Runtime configuration
ENV PORT=3000
 
# गलत: Secret image में visible हो जाता है
ARG API_KEY
ENV API_KEY=${API_KEY}
 
# सही: Runtime पर secrets pass करें
# docker run -e API_KEY=secret myapp

yaml

# docker-compose.monitoring.yml
services:
  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"
    networks:
      - internal
 
  grafana:
    image: grafana/grafana:latest
    volumes:
      - grafana_data:/var/lib/grafana
    ports:
      - "3001:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
    networks:
      - internal
 
volumes:
  prometheus_data:
  grafana_data:

javascript

import { collectDefaultMetrics, Registry, Histogram } from "prom-client";
 
const register = new Registry();
collectDefaultMetrics({ register });
 
const httpRequestDuration = new Histogram({
  name: "http_request_duration_seconds",
  help: "Duration of HTTP requests in seconds",
  labelNames: ["method", "route", "status_code"],
  buckets: [0.01, 0.05, 0.1, 0.5, 1, 5],
  registers: [register],
});
 
// Middleware
app.use((req, res, next) => {
  const end = httpRequestDuration.startTimer();
  res.on("finish", () => {
    end({ method: req.method, route: req.route?.path || req.path, status_code: res.statusCode });
  });
  next();
});
 
// Metrics endpoint
app.get("/metrics", async (req, res) => {
  res.set("Content-Type", register.contentType);
  res.end(await register.metrics());
});

Approach	Image Size
`node:20` + `npm install`	1.1 GB
`node:20-slim` + `npm install`	420 MB
`node:20-alpine` + `npm ci`	280 MB
Multi-stage + alpine + production deps only	150 MB
Multi-stage + alpine + pruned deps	95 MB

Approach	Image Size
`node:20` + full `node_modules` + `.next`	1.4 GB
`node:20-alpine` + full `node_modules` + `.next`	600 MB
`node:20-alpine` + standalone output	120 MB

आपकी Current Dockerfile शायद गलत है

Root के रूप में Run होना

Production में devDependencies Install करना

Everything COPY करना

कोई Health Checks नहीं

कोई Layer Caching Strategy नहीं

Multi-Stage Builds: सबसे बड़ी जीत

Real Size Comparisons

Alpine क्यों?

Complete Production Dockerfile

दो की बजाय तीन Stages क्यों?

dumb-init क्यों?

.dockerignore File

Layer Caching: Per Build 3 Minutes Wait करना बंद करें

गलत Order

सही Order

npm के लिए Cache Mount

Cache Busting के लिए ARG

Secrets Management: Dockerfile में Secrets रखना बंद करें

Secrets के तीन Levels

.env Files और Docker

Health Checks: Docker को बताएं App वाकई काम कर रही है

HEALTHCHECK Instruction

curl क्यों नहीं?

Health Endpoint

Orchestrators के लिए Health Checks क्यों Matter करती हैं

Development के लिए docker-compose

Key Development Patterns

Development Dockerfile

Production Docker Compose

Development से क्या अलग है

Next.js Specific: Standalone Output

Next.js Production Dockerfile

Next.js Size Comparison

Static File Handling

Image Optimization के लिए Sharp

Image Scanning और Security

Trivy: Images Scan करें

Read-Only Filesystem

सभी Capabilities Drop करें

Base Image Digest Pin करें

CI/CD Integration: सब एक साथ

CI में BuildKit Cache

Common Pitfalls और कैसे Avoid करें

Image के अंदर node_modules vs Host Conflict

TypeScript Projects में SIGTERM Handling

Memory Limits और Node.js

Timezone Issues

Build Arguments vs Environment Variables

Production में Monitoring

Checklist

संबंधित पोस्ट

Monorepos in 2026: Nx, Turborepo, and the Lessons Nobody Shares

YAML Validator Guide: Catch Config Errors Before Deploy