Skip to content

Docker Engineering Standard

Version: 1.0.0

Status: official

Author: Enterprise AI Standards

Description

Official engineering standard for building secure, reproducible, optimized and cloud-native containerized applications using Docker.

Objective

Define mandatory engineering practices for containerizing applications with Docker, ensuring portability, security, scalability and operational excellence across development, testing and production environments.

Philosophy

Containers must be immutable, lightweight, reproducible and secure. Every application should be deployable with minimal configuration changes across environments.

Principles

  • Container First.
  • Immutable Infrastructure.
  • Build Once, Run Anywhere.
  • Least Privilege.
  • Small Images.
  • Multi-stage Builds.
  • Security by Default.
  • Reproducible Builds.
  • External Configuration.
  • Cloud Native.

Project Structure

Language Features

Virtual Threads

Structured Concurrency

Records

Sealed Classes

Pattern Matching

Collections

Streams

Optional

Exceptions

Logging

  • Log to stdout/stderr.
  • Never write logs to container filesystem.

Performance

  • Minimize image size.
  • Optimize startup time.
  • JVM container awareness.
  • Resource limits documented.

Security

  • Never run as root.
  • Use dedicated application user.
  • Read-only filesystem when possible.
  • Drop unnecessary Linux capabilities.
  • Scan images for vulnerabilities.

Testing

Observability

Documentation

  • Docker commands documented.
  • Compose documented.
  • Required ports documented.

Best Practices

  • Multi-stage Builds.
  • Non-root User.
  • Small Images.
  • Explicit Versions.
  • Health Checks.
  • Docker Compose.
  • External Configuration.
  • Immutable Containers.
  • Security Scanning.
  • Container Optimization.

Anti Patterns

  • Running as root.
  • Using latest tag.
  • Large images.
  • Hardcoded secrets.
  • Multiple applications per container.
  • Missing health checks.
  • Copying unnecessary files.
  • Writing logs to disk.
  • Mutable containers.
  • Manual container changes.

Review Checklist

  • [ ] Multi-stage build.
  • [ ] Non-root user.
  • [ ] HEALTHCHECK configured.
  • [ ] Docker Compose included.
  • [ ] External configuration.
  • [ ] No secrets.
  • [ ] Optimized image.
  • [ ] Vulnerability scan.
  • [ ] Documentation updated.

Examples

References

  • https://docs.docker.com/
  • https://docs.docker.com/build/
  • https://docs.docker.com/compose/
  • https://github.com/GoogleContainerTools/distroless
  • https://hub.docker.com/_/eclipse-temurin