Docker untuk Developer 2025: Containerization, Deployment, dan Best Practices

Panduan lengkap Docker untuk developer Indonesia 2025: containerization, Dockerfile, Docker Compose, deployment strategies, security, dan best practices dengan contoh praktis step-by-step.

15 Januari 2025 • 24 menit baca • Oleh Hilal Technologic

#docker #containerization #deployment #devops #web development #microservices #kubernetes #ci dan cd #best practices

🐳 Docker untuk Developer 2025: Containerization, Deployment, dan Best Practices

Docker telah merevolusi cara developer membangun, mengirim, dan menjalankan aplikasi. Di tahun 2025, containerization bukan lagi pilihan, tapi keharusan untuk setiap developer modern. Dengan 83% perusahaan menggunakan container dalam production dan pertumbuhan adopsi Kubernetes yang mencapai 48% year-over-year, memahami Docker adalah skill wajib yang harus dikuasai.

“Docker enables you to separate your applications from your infrastructure so you can deliver software quickly.” - Docker Official Documentation

Mari kita pelajari Docker dari dasar hingga advanced dengan pendekatan praktis yang langsung bisa diterapkan!

🎯 Mengapa Docker Penting di 2025?

Statistik Adopsi Container 2025

83% perusahaan menggunakan container dalam production
48% growth dalam adopsi Kubernetes year-over-year
67% developer menggunakan Docker untuk development
$2.1 billion market size untuk container technology
40% faster deployment dengan containerization

Masalah yang Dipecahkan Docker

// Masalah Tradisional vs Solusi Docker
const developmentChallenges = {
  traditional: {
    environment: "Works on my machine syndrome",
    dependencies: "Dependency hell dan version conflicts",
    deployment: "Complex deployment procedures",
    scaling: "Difficult horizontal scaling",
    isolation: "Applications interfere with each other",
    portability: "Platform-specific configurations"
  },
  
  dockerSolution: {
    environment: "Consistent environments across all stages",
    dependencies: "Isolated dependencies per container",
    deployment: "Simple, repeatable deployments",
    scaling: "Easy horizontal and vertical scaling",
    isolation: "Complete application isolation",
    portability: "Run anywhere - laptop, server, cloud"
  }
};

Benefits untuk Developer

# Docker Benefits untuk Developer
developer_benefits:
  productivity:
    - "Faster onboarding untuk new team members"
    - "Consistent development environments"
    - "Quick setup untuk complex applications"
    - "Easy switching between project versions"
  
  reliability:
    - "Eliminates environment-related bugs"
    - "Predictable application behavior"
    - "Easier debugging dan troubleshooting"
    - "Consistent testing environments"
  
  collaboration:
    - "Shareable development environments"
    - "Version-controlled infrastructure"
    - "Simplified CI/CD pipelines"
    - "Better team collaboration"

🚀 Docker Installation & Setup

1. Installation di Berbagai Platform

Windows (Docker Desktop)

# Download Docker Desktop dari docker.com
# Atau menggunakan Chocolatey
choco install docker-desktop

# Verify installation
docker --version
docker-compose --version

# Test Docker installation
docker run hello-world

macOS (Docker Desktop)

# Download Docker Desktop dari docker.com
# Atau menggunakan Homebrew
brew install --cask docker

# Verify installation
docker --version
docker-compose --version

# Test Docker installation
docker run hello-world

Linux (Ubuntu/Debian)

# Update package index
sudo apt-get update

# Install required packages
sudo apt-get install \
    ca-certificates \
    curl \
    gnupg \
    lsb-release

# Add Docker's official GPG key
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

# Set up repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker Engine
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Add user to docker group (optional)
sudo usermod -aG docker $USER

# Verify installation
docker --version
docker compose version

2. Docker Configuration & Optimization

// ~/.docker/daemon.json - Docker daemon configuration
{
  "builder": {
    "gc": {
      "enabled": true,
      "defaultKeepStorage": "20GB"
    }
  },
  "experimental": false,
  "features": {
    "buildkit": true
  },
  "insecure-registries": [],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "storage-driver": "overlay2",
  "storage-opts": [
    "overlay2.override_kernel_check=true"
  ]
}

3. Essential Docker Commands

# Container Management
docker run <image>              # Run container
docker ps                       # List running containers
docker ps -a                    # List all containers
docker stop <container>         # Stop container
docker start <container>        # Start container
docker restart <container>      # Restart container
docker rm <container>           # Remove container
docker logs <container>         # View container logs

# Image Management
docker images                   # List images
docker pull <image>             # Download image
docker build -t <name> .        # Build image
docker rmi <image>              # Remove image
docker tag <image> <new-name>   # Tag image

# System Management
docker system df               # Show disk usage
docker system prune            # Clean up unused resources
docker volume ls               # List volumes
docker network ls              # List networks

# Inspection & Debugging
docker inspect <container>     # Inspect container
docker exec -it <container> bash  # Access container shell
docker stats                   # Show resource usage

📦 Docker Fundamentals: Images, Containers, dan Volumes

1. Understanding Docker Architecture

graph TB
    A[Docker Client] --> B[Docker Daemon]
    B --> C[Images]
    B --> D[Containers]
    B --> E[Volumes]
    B --> F[Networks]
    
    C --> G[Registry/Hub]
    D --> H[Running Applications]
    E --> I[Persistent Data]
    F --> J[Container Communication]

2. Docker Images Deep Dive

# Dockerfile Example - Multi-stage Build
# Stage 1: Build stage
FROM node:18-alpine AS builder

# Set working directory
WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies
RUN npm ci --only=production && npm cache clean --force

# Copy source code
COPY . .

# Build application
RUN npm run build

# Stage 2: Production stage
FROM node:18-alpine AS production

# Create non-root user
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nextjs -u 1001

# Set working directory
WORKDIR /app

# Copy built application from builder stage
COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist
COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=nextjs:nodejs /app/package.json ./package.json

# Switch to non-root user
USER nextjs

# Expose port
EXPOSE 3000

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

# Start application
CMD ["npm", "start"]

3. Container Lifecycle Management

# Container Lifecycle Commands
# Create container without starting
docker create --name myapp -p 3000:3000 myapp:latest

# Start existing container
docker start myapp

# Run container (create + start)
docker run -d --name myapp -p 3000:3000 myapp:latest

# Execute command in running container
docker exec -it myapp /bin/sh

# Copy files to/from container
docker cp ./file.txt myapp:/app/file.txt
docker cp myapp:/app/logs ./logs

# Monitor container
docker stats myapp
docker logs -f myapp

# Stop container gracefully
docker stop myapp

# Kill container forcefully
docker kill myapp

# Remove container
docker rm myapp

4. Volume Management untuk Data Persistence

# Volume Types dan Usage
# Named volumes (recommended for production)
docker volume create myapp-data
docker run -v myapp-data:/app/data myapp:latest

# Bind mounts (good for development)
docker run -v $(pwd)/data:/app/data myapp:latest

# Anonymous volumes
docker run -v /app/data myapp:latest

# Volume management commands
docker volume ls                    # List volumes
docker volume inspect myapp-data   # Inspect volume
docker volume rm myapp-data        # Remove volume
docker volume prune                # Remove unused volumes

# docker-compose.yml - Volume configuration
version: '3.8'
services:
  app:
    build: .
    volumes:
      # Named volume for database data
      - postgres_data:/var/lib/postgresql/data
      # Bind mount for development
      - ./src:/app/src:ro
      # Anonymous volume for node_modules
      - /app/node_modules
    ports:
      - "3000:3000"
  
  database:
    image: postgres:15-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password

volumes:
  postgres_data:
    driver: local

🏗️ Dockerfile Best Practices & Optimization

1. Dockerfile Structure & Layering

# Optimized Dockerfile Example
# Use specific version tags
FROM node:18.19.0-alpine3.19

# Set metadata
LABEL maintainer="hilal@hilaltechnologic.info"
LABEL version="1.0.0"
LABEL description="Production-ready Node.js application"

# Install system dependencies in single layer
RUN apk add --no-cache \
    dumb-init \
    curl \
    && rm -rf /var/cache/apk/*

# Create app directory and user
RUN addgroup -g 1001 -S nodejs \
    && adduser -S nextjs -u 1001 -G nodejs

WORKDIR /app

# Copy package files first (for better caching)
COPY package*.json ./

# Install dependencies
RUN npm ci --only=production \
    && npm cache clean --force \
    && rm -rf /tmp/*

# Copy application code
COPY --chown=nextjs:nodejs . .

# Build application
RUN npm run build

# Switch to non-root user
USER nextjs

# Expose port
EXPOSE 3000

# Use dumb-init for proper signal handling
ENTRYPOINT ["dumb-init", "--"]

# Start application
CMD ["node", "dist/index.js"]

2. Multi-stage Builds untuk Size Optimization

# Multi-stage Build Example - React Application
# Stage 1: Build dependencies
FROM node:18-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --frozen-lockfile

# Stage 2: Build application
FROM node:18-alpine AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build

# Stage 3: Production image
FROM nginx:alpine AS production

# Copy built assets
COPY --from=builder /app/dist /usr/share/nginx/html

# Copy nginx configuration
COPY nginx.conf /etc/nginx/nginx.conf

# Add health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:80/ || exit 1

EXPOSE 80

CMD ["nginx", "-g", "daemon off;"]

3. Security Best Practices

# Security-focused Dockerfile
FROM node:18-alpine

# Update packages and install security updates
RUN apk update && apk upgrade && apk add --no-cache dumb-init

# Create non-root user
RUN addgroup -g 1001 -S appgroup \
    && adduser -S appuser -u 1001 -G appgroup

# Set working directory
WORKDIR /app

# Copy and install dependencies as root
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force

# Copy application files
COPY --chown=appuser:appgroup . .

# Remove unnecessary files
RUN rm -rf \
    /tmp/* \
    /var/cache/apk/* \
    /root/.npm \
    package*.json

# Switch to non-root user
USER appuser

# Use read-only root filesystem
# docker run --read-only --tmpfs /tmp myapp

# Drop capabilities
# docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE myapp

EXPOSE 3000

ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "index.js"]

4. Performance Optimization Techniques

# Performance-optimized Dockerfile
FROM node:18-alpine

# Use BuildKit for better performance
# docker build --progress=plain .

# Optimize layer caching
WORKDIR /app

# Copy package files first
COPY package*.json ./

# Use npm ci for faster, reliable builds
RUN npm ci --only=production --silent

# Copy source code
COPY . .

# Build with optimizations
ENV NODE_ENV=production
RUN npm run build

# Clean up
RUN npm prune --production && \
    rm -rf /tmp/* /var/cache/apk/* ~/.npm

# Use specific user
USER node

EXPOSE 3000

CMD ["node", "dist/index.js"]

5. .dockerignore untuk Build Efficiency

# .dockerignore - Exclude unnecessary files
node_modules
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# Git
.git
.gitignore

# Documentation
README.md
CHANGELOG.md
LICENSE

# IDE
.vscode
.idea
*.swp
*.swo

# OS
.DS_Store
Thumbs.db

# Logs
logs
*.log

# Runtime data
pids
*.pid
*.seed
*.pid.lock

# Coverage directory used by tools like istanbul
coverage
.nyc_output

# Environment variables
.env
.env.local
.env.development.local
.env.test.local
.env.production.local

# Build outputs
dist
build
.next

# Testing
.coverage
test-results

# Temporary files
tmp
temp

🔧 Docker Compose: Multi-Service Applications

1. Docker Compose Fundamentals

# docker-compose.yml - Full-stack application
version: '3.8'

services:
  # Frontend Service
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      target: production
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - API_URL=http://backend:5000
    depends_on:
      - backend
    networks:
      - app-network
    restart: unless-stopped

  # Backend Service
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    ports:
      - "5000:5000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://user:password@database:5432/myapp
      - REDIS_URL=redis://redis:6379
    depends_on:
      database:
        condition: service_healthy
      redis:
        condition: service_started
    volumes:
      - ./backend/uploads:/app/uploads
    networks:
      - app-network
    restart: unless-stopped

  # Database Service
  database:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./database/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    ports:
      - "5432:5432"
    networks:
      - app-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d myapp"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    restart: unless-stopped

  # Redis Cache
  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    ports:
      - "6379:6379"
    networks:
      - app-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

  # Nginx Reverse Proxy
  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      - frontend
      - backend
    networks:
      - app-network
    restart: unless-stopped

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local

networks:
  app-network:
    driver: bridge

2. Environment-specific Configurations

# docker-compose.override.yml - Development overrides
version: '3.8'

services:
  frontend:
    build:
      target: development
    volumes:
      - ./frontend/src:/app/src:ro
      - /app/node_modules
    environment:
      - NODE_ENV=development
      - CHOKIDAR_USEPOLLING=true
    command: npm run dev

  backend:
    volumes:
      - ./backend/src:/app/src:ro
      - /app/node_modules
    environment:
      - NODE_ENV=development
      - DEBUG=app:*
    command: npm run dev

  database:
    ports:
      - "5432:5432"  # Expose for development tools

# docker-compose.prod.yml - Production configuration
version: '3.8'

services:
  frontend:
    build:
      target: production
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  backend:
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M

  database:
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '1.0'
          memory: 1G

3. Docker Compose Commands

# Basic Commands
docker-compose up                    # Start services
docker-compose up -d                 # Start in background
docker-compose down                  # Stop and remove services
docker-compose down -v               # Stop and remove volumes
docker-compose restart               # Restart services

# Build Commands
docker-compose build                 # Build all services
docker-compose build --no-cache      # Build without cache
docker-compose up --build            # Build and start

# Service Management
docker-compose start <service>       # Start specific service
docker-compose stop <service>        # Stop specific service
docker-compose restart <service>     # Restart specific service

# Logs and Monitoring
docker-compose logs                  # View all logs
docker-compose logs -f <service>     # Follow service logs
docker-compose ps                    # List running services
docker-compose top                   # Show running processes

# Scaling
docker-compose up --scale backend=3  # Scale service
docker-compose up --scale web=2 --scale worker=3

# Environment-specific
docker-compose -f docker-compose.yml -f docker-compose.prod.yml up

4. Advanced Docker Compose Features

# Advanced docker-compose.yml features
version: '3.8'

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - NODE_VERSION=18
        - BUILD_DATE=${BUILD_DATE}
    environment:
      # Environment variables from file
      - NODE_ENV=${NODE_ENV:-production}
    env_file:
      - .env
      - .env.local
    
    # Health checks
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '0.50'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    
    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    
    # Security options
    security_opt:
      - no-new-privileges:true
    
    # Read-only root filesystem
    read_only: true
    tmpfs:
      - /tmp
      - /var/run
    
    # User specification
    user: "1001:1001"
    
    # Capabilities
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

# External networks and volumes
networks:
  default:
    external:
      name: my-external-network

volumes:
  data:
    external:
      name: my-external-volume

🚀 Production Deployment Strategies

1. Container Orchestration dengan Docker Swarm

# Initialize Docker Swarm
docker swarm init --advertise-addr <manager-ip>

# Join worker nodes
docker swarm join --token <token> <manager-ip>:2377

# Deploy stack
docker stack deploy -c docker-compose.yml myapp

# Swarm management
docker node ls                       # List nodes
docker service ls                    # List services
docker service ps <service>          # Service tasks
docker service scale myapp_web=5     # Scale service

# docker-compose.swarm.yml - Swarm deployment
version: '3.8'

services:
  web:
    image: myapp:latest
    ports:
      - "80:3000"
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
      rollback_config:
        parallelism: 1
        delay: 10s
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      placement:
        constraints:
          - node.role == worker
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    networks:
      - webnet

  database:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: user
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    volumes:
      - db_data:/var/lib/postgresql/data
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    secrets:
      - db_password
    networks:
      - webnet

secrets:
  db_password:
    external: true

volumes:
  db_data:
    driver: local

networks:
  webnet:
    driver: overlay

2. Kubernetes Deployment

# kubernetes/namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: myapp
---
# kubernetes/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
  namespace: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: myapp:latest
        ports:
        - containerPort: 3000
        env:
        - name: NODE_ENV
          value: "production"
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: myapp-secrets
              key: database-url
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 3000
          initialDelaySeconds: 5
          periodSeconds: 5
---
# kubernetes/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: myapp-service
  namespace: myapp
spec:
  selector:
    app: myapp
  ports:
  - protocol: TCP
    port: 80
    targetPort: 3000
  type: LoadBalancer
---
# kubernetes/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
  namespace: myapp
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
  - hosts:
    - myapp.hilaltechnologic.info
    secretName: myapp-tls
  rules:
  - host: myapp.hilaltechnologic.info
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp-service
            port:
              number: 80

3. Cloud Deployment (AWS ECS)

{
  "family": "myapp-task",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::account:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::account:role/ecsTaskRole",
  "containerDefinitions": [
    {
      "name": "myapp",
      "image": "account.dkr.ecr.region.amazonaws.com/myapp:latest",
      "portMappings": [
        {
          "containerPort": 3000,
          "protocol": "tcp"
        }
      ],
      "environment": [
        {
          "name": "NODE_ENV",
          "value": "production"
        }
      ],
      "secrets": [
        {
          "name": "DATABASE_URL",
          "valueFrom": "arn:aws:secretsmanager:region:account:secret:myapp/database-url"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/myapp",
          "awslogs-region": "us-west-2",
          "awslogs-stream-prefix": "ecs"
        }
      },
      "healthCheck": {
        "command": [
          "CMD-SHELL",
          "curl -f http://localhost:3000/health || exit 1"
        ],
        "interval": 30,
        "timeout": 5,
        "retries": 3,
        "startPeriod": 60
      }
    }
  ]
}

4. CI/CD Pipeline Integration

# .github/workflows/docker-deploy.yml
name: Docker Build and Deploy

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to Container Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=sha,prefix={{branch}}-
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Build and push Docker image
      uses: docker/build-push-action@v5
      with:
        context: .
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

  deploy:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'

    steps:
    - name: Deploy to production
      uses: appleboy/ssh-action@v1.0.0
      with:
        host: ${{ secrets.HOST }}
        username: ${{ secrets.USERNAME }}
        key: ${{ secrets.SSH_KEY }}
        script: |
          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          docker-compose -f /opt/myapp/docker-compose.prod.yml up -d
          docker system prune -f

🔒 Docker Security Best Practices

1. Image Security

# Security-hardened Dockerfile
FROM node:18-alpine AS base

# Install security updates
RUN apk update && apk upgrade && \
    apk add --no-cache dumb-init curl

# Create non-root user
RUN addgroup -g 1001 -S appgroup && \
    adduser -S appuser -u 1001 -G appgroup

# Set working directory
WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies
RUN npm ci --only=production && \
    npm cache clean --force

# Copy application code
COPY --chown=appuser:appgroup . .

# Remove unnecessary packages
RUN apk del curl && \
    rm -rf /var/cache/apk/* /tmp/*

# Switch to non-root user
USER appuser

# Use dumb-init for proper signal handling
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "index.js"]

2. Container Runtime Security

# Security-focused container execution
docker run \
  --read-only \                    # Read-only root filesystem
  --tmpfs /tmp \                   # Writable tmp directory
  --tmpfs /var/run \               # Writable run directory
  --cap-drop=ALL \                 # Drop all capabilities
  --cap-add=NET_BIND_SERVICE \     # Add only needed capabilities
  --no-new-privileges \            # Prevent privilege escalation
  --user 1001:1001 \               # Run as non-root user
  --security-opt=no-new-privileges \
  --security-opt=apparmor:docker-default \
  myapp:latest

3. Image Scanning & Vulnerability Management

# Docker Scout (built-in security scanning)
docker scout cves myapp:latest
docker scout recommendations myapp:latest

# Trivy security scanner
trivy image myapp:latest

# Snyk container scanning
snyk container test myapp:latest

# Clair vulnerability scanner
docker run -d --name clair-db arminc/clair-db:latest
docker run -p 6060:6060 --link clair-db:postgres -d --name clair arminc/clair-local-scan:latest

4. Secrets Management

# docker-compose.yml with secrets
version: '3.8'

services:
  app:
    image: myapp:latest
    environment:
      - DATABASE_URL_FILE=/run/secrets/db_url
      - API_KEY_FILE=/run/secrets/api_key
    secrets:
      - db_url
      - api_key

secrets:
  db_url:
    file: ./secrets/database_url.txt
  api_key:
    external: true

// Application code for reading secrets
const fs = require('fs');

function readSecret(secretPath) {
  try {
    return fs.readFileSync(secretPath, 'utf8').trim();
  } catch (error) {
    console.error(`Failed to read secret from ${secretPath}:`, error);
    process.exit(1);
  }
}

// Read secrets from files
const databaseUrl = process.env.DATABASE_URL_FILE 
  ? readSecret(process.env.DATABASE_URL_FILE)
  : process.env.DATABASE_URL;

const apiKey = process.env.API_KEY_FILE
  ? readSecret(process.env.API_KEY_FILE)
  : process.env.API_KEY;

⚡ Performance Optimization

1. Image Size Optimization

# Multi-stage build for minimal image size
FROM node:18-alpine AS dependencies
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

FROM node:18-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:18-alpine AS runtime
WORKDIR /app

# Copy only production dependencies
COPY --from=dependencies /app/node_modules ./node_modules

# Copy built application
COPY --from=build /app/dist ./dist
COPY package*.json ./

# Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nextjs -u 1001 -G nodejs

USER nextjs

EXPOSE 3000
CMD ["node", "dist/index.js"]

2. Build Cache Optimization

# Optimized layer caching
FROM node:18-alpine

WORKDIR /app

# Copy package files first (changes less frequently)
COPY package*.json ./

# Install dependencies (cached if package.json unchanged)
RUN npm ci --only=production

# Copy source code (changes more frequently)
COPY . .

# Build application
RUN npm run build

CMD ["npm", "start"]

3. Resource Management

# docker-compose.yml with resource limits
version: '3.8'

services:
  web:
    image: myapp:latest
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  database:
    image: postgres:15-alpine
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password

volumes:
  postgres_data:

4. Network Optimization

# Custom networks for better performance
version: '3.8'

services:
  frontend:
    image: frontend:latest
    networks:
      - frontend-network
      - backend-network

  backend:
    image: backend:latest
    networks:
      - backend-network
      - database-network

  database:
    image: postgres:15-alpine
    networks:
      - database-network

networks:
  frontend-network:
    driver: bridge
  backend-network:
    driver: bridge
  database-network:
    driver: bridge
    internal: true  # Database not accessible from outside

🛠️ Real-World Examples

1. Full-Stack JavaScript Application

# Frontend Dockerfile (React)
FROM node:18-alpine AS build

WORKDIR /app
COPY package*.json ./
RUN npm ci

COPY . .
RUN npm run build

FROM nginx:alpine
COPY --from=build /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/nginx.conf

EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

# Backend Dockerfile (Node.js/Express)
FROM node:18-alpine

RUN addgroup -g 1001 -S nodejs && \
    adduser -S nextjs -u 1001 -G nodejs

WORKDIR /app

COPY package*.json ./
RUN npm ci --only=production

COPY --chown=nextjs:nodejs . .

USER nextjs

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

CMD ["node", "server.js"]

# docker-compose.yml
version: '3.8'

services:
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    ports:
      - "80:80"
    depends_on:
      - backend
    networks:
      - app-network

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://user:password@database:5432/myapp
      - REDIS_URL=redis://redis:6379
    depends_on:
      database:
        condition: service_healthy
      redis:
        condition: service_started
    networks:
      - app-network

  database:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d myapp"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - app-network

  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - app-network

volumes:
  postgres_data:
  redis_data:

networks:
  app-network:
    driver: bridge

2. Microservices Architecture

# docker-compose.microservices.yml
version: '3.8'

services:
  # API Gateway
  gateway:
    image: nginx:alpine
    ports:
      - "80:80"
    volumes:
      - ./gateway/nginx.conf:/etc/nginx/nginx.conf
    depends_on:
      - user-service
      - product-service
      - order-service
    networks:
      - microservices-network

  # User Service
  user-service:
    build: ./services/user-service
    environment:
      - DATABASE_URL=postgresql://user:password@user-db:5432/users
    depends_on:
      - user-db
    networks:
      - microservices-network
      - user-network

  user-db:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: users
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
    volumes:
      - user_data:/var/lib/postgresql/data
    networks:
      - user-network

  # Product Service
  product-service:
    build: ./services/product-service
    environment:
      - DATABASE_URL=postgresql://user:password@product-db:5432/products
    depends_on:
      - product-db
    networks:
      - microservices-network
      - product-network

  product-db:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: products
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
    volumes:
      - product_data:/var/lib/postgresql/data
    networks:
      - product-network

  # Order Service
  order-service:
    build: ./services/order-service
    environment:
      - DATABASE_URL=postgresql://user:password@order-db:5432/orders
      - USER_SERVICE_URL=http://user-service:3000
      - PRODUCT_SERVICE_URL=http://product-service:3000
    depends_on:
      - order-db
      - user-service
      - product-service
    networks:
      - microservices-network
      - order-network

  order-db:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: orders
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
    volumes:
      - order_data:/var/lib/postgresql/data
    networks:
      - order-network

volumes:
  user_data:
  product_data:
  order_data:

networks:
  microservices-network:
    driver: bridge
  user-network:
    driver: bridge
    internal: true
  product-network:
    driver: bridge
    internal: true
  order-network:
    driver: bridge
    internal: true

🐛 Troubleshooting Common Issues

1. Container Debugging

# Debug running container
docker exec -it <container> /bin/sh

# Check container logs
docker logs -f <container>

# Inspect container configuration
docker inspect <container>

# Check resource usage
docker stats <container>

# Debug networking
docker network ls
docker network inspect <network>

# Check port bindings
docker port <container>

2. Build Issues

# Build with verbose output
docker build --progress=plain --no-cache .

# Debug multi-stage builds
docker build --target=<stage> .

# Check build context
docker build --dry-run .

# Inspect intermediate layers
docker history <image>

# Clean build cache
docker builder prune

3. Common Error Solutions

# Permission denied errors
# Solution: Check user permissions and file ownership
docker run --user $(id -u):$(id -g) myapp

# Port already in use
# Solution: Check and kill processes using the port
lsof -i :3000
kill -9 <PID>

# Out of disk space
# Solution: Clean up Docker resources
docker system prune -a
docker volume prune

# Memory issues
# Solution: Increase Docker memory limits or optimize application
docker run -m 512m myapp

# Network connectivity issues
# Solution: Check network configuration
docker network inspect bridge

4. Performance Issues

# Monitor container performance
docker stats --no-stream

# Check container resource limits
docker inspect <container> | grep -A 10 "Resources"

# Analyze image layers
docker history --no-trunc <image>

# Check for memory leaks
docker exec <container> cat /proc/meminfo

🔮 Future of Docker & Containerization

1. Emerging Technologies

# WebAssembly (WASM) containers
# Future: Running WASM modules in containers
services:
  wasm-app:
    image: wasmtime/wasmtime
    command: ["wasmtime", "app.wasm"]
    volumes:
      - ./app.wasm:/app.wasm

# Confidential Computing
# Future: Encrypted containers for sensitive workloads
services:
  secure-app:
    image: myapp:latest
    security_opt:
      - "confidential-computing=enabled"

2. Container Trends 2025+

Serverless Containers - AWS Fargate, Google Cloud Run
Edge Computing - Containers at edge locations
AI/ML Workloads - GPU-enabled containers
Green Computing - Energy-efficient containerization
Zero-Trust Security - Enhanced container security

3. Tools & Ecosystem Evolution

// Future Docker alternatives and complementary tools
const containerEcosystem2025 = {
  runtimes: [
    "Docker Engine",
    "containerd", 
    "CRI-O",
    "Podman",
    "gVisor",
    "Kata Containers"
  ],
  
  orchestration: [
    "Kubernetes",
    "Docker Swarm", 
    "Nomad",
    "OpenShift",
    "Rancher"
  ],
  
  security: [
    "Falco",
    "Twistlock",
    "Aqua Security",
    "Sysdig Secure",
    "StackRox"
  ],
  
  monitoring: [
    "Prometheus",
    "Grafana",
    "Jaeger",
    "Zipkin",
    "New Relic"
  ]
};

🎯 Kesimpulan & Best Practices

✅ Docker Checklist 2025

Development

Docker Desktop installed dan configured
Multi-stage builds untuk optimasi size
.dockerignore file untuk build efficiency
Health checks implemented
Non-root user dalam containers

Production

Security scanning integrated dalam CI/CD
Resource limits configured
Secrets management implemented
Monitoring & logging setup
Backup strategy untuk volumes

Team Collaboration

Docker Compose untuk development environment
Environment-specific configurations
Documentation untuk setup procedures
CI/CD pipeline dengan Docker
Container registry strategy

🚀 Implementation Roadmap

Week 1: Foundation

✅ Install Docker dan setup development environment
✅ Create basic Dockerfile untuk existing application
✅ Setup Docker Compose untuk local development
✅ Implement basic health checks

Week 2: Optimization

✅ Implement multi-stage builds
✅ Optimize image sizes dan build times
✅ Setup proper .dockerignore files
✅ Configure resource limits

Week 3: Security & Production

✅ Implement security best practices
✅ Setup secrets management
✅ Configure production deployment
✅ Setup monitoring dan logging

Week 4: Advanced Features

✅ Implement CI/CD pipeline
✅ Setup container orchestration
✅ Performance tuning dan optimization
✅ Team training dan documentation

📊 Success Metrics

// Docker adoption success metrics
const dockerMetrics = {
  development: {
    setupTime: "< 30 minutes untuk new developers",
    environmentConsistency: "100% parity dev/staging/prod",
    buildTime: "< 5 minutes untuk typical application",
    imageSize: "< 100MB untuk optimized images"
  },
  
  production: {
    deploymentTime: "< 2 minutes untuk rolling updates",
    uptime: "99.9% availability",
    scalability: "Auto-scaling based on metrics",
    security: "Zero critical vulnerabilities"
  },
  
  team: {
    productivity: "50% faster onboarding",
    collaboration: "Shared development environments",
    debugging: "Faster issue resolution",
    knowledge: "Team-wide Docker proficiency"
  }
};

🔗 Resources & Learning Path

Essential Resources

Docker Official Documentation - Comprehensive Docker guide
Docker Hub - Container image registry
Play with Docker - Interactive Docker playground

Advanced Learning

Kubernetes Documentation - Container orchestration
Docker Security - Security best practices
Container Patterns - Design patterns

Community & Updates

Docker Blog - Latest Docker news
CNCF - Cloud Native Computing Foundation
Container Journal - Industry insights

🔗 Artikel Terkait:

Docker telah mengubah cara kita membangun, mengirim, dan menjalankan aplikasi. Dengan memahami konsep containerization, Dockerfile optimization, Docker Compose, dan deployment strategies, Anda sudah siap menghadapi tantangan development modern di 2025.

Ingat: Containerization is not just about Docker, it’s about building better software. Terus eksplorasi dan praktikkan konsep-konsep yang telah dipelajari!

Ditulis dengan ❤️ oleh Hilal Technologic