docker

Multi-stage builds reduce final image size by separating compilation from runtime. Use multiple FROM statements to build in one stage and copy only necessary artifacts to the final stage, eliminating build dependencies and keeping images lean for production deployment.

Secrets handling in Docker avoids hardcoding credentials in images. Use Docker secrets for swarm mode, environment variables from external files, or bind mounts to inject sensitive data at runtime without exposing them in image layers or logs.

Docker-compose orchestrates multiple containers by defining services, dependencies, volumes, and networking in a single YAML file. Specify service configurations, link containers, mount persistent storage, and manage startup order for robust multi-container setups.

Running containers as non-root users limits damage from compromised applications by restricting file system and system access. This security practice prevents privilege escalation and reduces attack surface in development, staging, and production environments.

Yes, Docker integrates with CI/CD pipelines to automate image building, testing, and pushing to registries. Automated pipelines ensure consistent image production, apply security scanning, and streamline deployment across environments.

Minimal base images like Alpine, Distroless, or scratch reduce image size and attack surface. Choose based on your application runtime requirements—Alpine for general use, Distroless for compiled languages, scratch for static binaries—balancing size against included utilities.