How Docker Helps You Land a DevOps Engineer Job Faster

# Build an image and tag it with a version
docker build -t myapp:1.0.0 .

# Run it in the background, mapping port 8000
docker run -d --name myapp -p 8000:8000 myapp:1.0.0

# List running containers and local images
docker ps
docker images

# See how each layer contributes to image size
docker history myapp:1.0.0

# Stop and remove the container
docker stop myapp && docker rm myapp

# Container exits immediately? Check the logs first
docker logs myapp

# Include stopped containers and see the exit code
docker ps -a
docker inspect myapp --format '{{.State.ExitCode}} {{.State.Error}}'

# Open a shell inside a running container
docker exec -it myapp sh

# Check environment variables and ports the container sees
docker exec myapp env
docker port myapp

# Live CPU and memory usage
docker stats --no-stream

# ---- build stage: install dependencies into a virtual env ----
FROM python:3.12-slim AS build
WORKDIR /app
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# ---- runtime stage: only what the app needs ----
FROM python:3.12-slim
WORKDIR /app
RUN useradd --create-home appuser
COPY --from=build /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH" \
    PYTHONUNBUFFERED=1
COPY --chown=appuser:appuser . .
USER appuser
EXPOSE 8000
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

# ---- build stage: compile the static site ----
FROM node:20-alpine AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build

# ---- runtime stage: serve files with nginx ----
FROM nginx:1.27-alpine
COPY --from=build /app/dist /usr/share/nginx/html
EXPOSE 80
# nginx image already defines the start command

# .dockerignore (separate file, same folder)
# node_modules
# dist
# .git
# .env

services:
  api:
    build: .
    ports:
      - "8000:8000"
    env_file: .env
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_started

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: app
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: appdb
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app -d appdb"]
      interval: 5s
      retries: 10

  cache:
    image: redis:7-alpine

volumes:
  pgdata:

# .github/workflows/docker.yml
name: build-and-push
on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

# Containerised Task API

FastAPI + PostgreSQL + Redis, fully containerised.

## Run locally
cp .env.example .env
docker compose up --build
# open http://localhost:8000/docs

## What this shows
- Multi-stage Dockerfile, non-root user
- Image size: single-stage ___ MB -> multi-stage ___ MB
- Compose with health checks and a named volume
- GitHub Actions builds and pushes to GHCR on every push

## Architecture
[diagram: browser -> api -> postgres / redis]

## Next steps
- Kubernetes manifests, image scanning in CI

DOCKERFILE REVIEW CHECKLIST

[ ] Pinned, slim base image (no :latest)
[ ] Dependency files copied and installed before app code
[ ] Multi-stage build; build tools not in final image
[ ] .dockerignore excludes .git, .env, node_modules, venv
[ ] Runs as a non-root USER
[ ] No secrets in ENV, ARG or copied files
[ ] One main process per container
[ ] EXPOSE and CMD in exec (JSON array) form
[ ] Image scanned (e.g. docker scout or Trivy)
[ ] Size recorded in README

30-SECOND INTERVIEW PITCH

"I containerised a FastAPI app with PostgreSQL and Redis.
I used a multi-stage Dockerfile on a slim base and run the
app as a non-root user, which cut the image size noticeably.
Compose starts the stack with health checks so the API waits
for the database. A GitHub Actions workflow builds and
pushes a tagged image to a registry on every push to main.
Next I am adding Kubernetes manifests and image scanning."

Then pause and let them ask follow-up questions.