Containerization

---
name: Containerization
description: Package apps with their dependencies.
---
# Containerization

A container bundles an app with exactly the libraries and runtime it needs, so it runs identically anywhere. "Works on my machine" becomes "works everywhere a container runs".

## Principles
- **One process per container.** Don't bundle app + DB + queue into one image; orchestrate separate containers.
- **Images are layered and cacheable.** Order Dockerfile from least-changing (base, deps) to most-changing (code). Cache hits make rebuilds fast.
- **Small images.** Multi-stage builds copy only the runtime artifacts; the build tooling stays out of the final image. Smaller = faster pull, smaller attack surface.
- **Config via environment, not baked-in files.** Same image across environments; only env vars differ.

## Avoid
- Running as root. Drop privileges in the image.
- Pinning nothing. `latest` tag is a moving target; pin versions for reproducibility.