Docker Cheatsheet 12 — Production Patterns

docker run --restart=no app                 # default
docker run --restart=on-failure app
docker run --restart=on-failure:3 app       # max 3 retries
docker run --restart=always app             # also on docker daemon restart
docker run --restart=unless-stopped app     # like always but respects manual stop

// /etc/docker/daemon.json
{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" },
  "default-ulimits": { "nofile": { "soft": 65536, "hard": 65536 } },
  "live-restore": true,
  "userns-remap": "default",
  "dns": ["1.1.1.1", "8.8.8.8"]
}

systemctl restart docker

docker run myreg/app@sha256:abc...

docker compose -f compose.prod.yml up -d
docker compose -f compose.prod.yml pull
docker compose -f compose.prod.yml up -d --no-deps web   # update only web

docker compose -f compose.yml -f compose.prod.yml up -d

docker compose up -d --no-deps --force-recreate web

services:
  web-blue:
    image: myapp:v1
  web-green:
    image: myapp:v2
  proxy:
    image: nginx
    volumes: ["./active.conf:/etc/nginx/conf.d/default.conf"]

services:
  watchtower:
    image: containrrr/watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: --interval 300 --cleanup

docker login ghcr.io -u USER -p TOKEN
docker login myreg.example.com

docker run -d -p 5000:5000 \
  -v $(pwd)/registry:/var/lib/registry \
  --restart=unless-stopped \
  registry:2

docker context create remote --docker host=ssh://user@host
docker context use remote
docker ps                       # runs on remote host

0 2 * * * docker run --rm myreg/backup:v1

services:
  proxy:
    image: caddy:2
    ports: ["80:80", "443:443"]
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
    networks: [public, app]
  
  web:
    image: myreg/app:v1
    networks: [app]
    expose: ["8000"]
    restart: unless-stopped

networks:
  public:
  app:

volumes:
  caddy_data:

example.com {
    reverse_proxy web:8000
}

# DB
docker exec db pg_dump -U postgres myapp | gzip > backup-$(date +%F).sql.gz

# Named volume
docker run --rm -v pg_data:/data -v $(pwd):/backup alpine \
  tar czf /backup/pg_data.tar.gz -C /data .

GET /health          # liveness — minimal
GET /health/ready    # readiness — DB, cache, etc.

docker system prune -a --filter "until=24h"
docker system prune --volumes

0 3 * * 0 docker system prune -af --filter "until=168h"

services:
  deployer:
    image: myreg/deploy
    secrets:
      - ssh_key

secrets:
  ssh_key:
    file: ~/.ssh/id_ed25519