{"id":4774,"date":"2026-04-29T22:18:17","date_gmt":"2026-04-29T16:48:17","guid":{"rendered":"https:\/\/itsupportwale.com\/blog\/docker-best-practices-optimize-and-secure-your-containers\/"},"modified":"2026-04-29T22:18:17","modified_gmt":"2026-04-29T16:48:17","slug":"docker-best-practices-optimize-and-secure-your-containers","status":"publish","type":"post","link":"https:\/\/itsupportwale.com\/blog\/docker-best-practices-optimize-and-secure-your-containers\/","title":{"rendered":"Docker Best Practices: Optimize and Secure Your Containers"},"content":{"rendered":"

It was 3:14 AM when the heap dump hit the fan.<\/p>\n

I was three hours into a deep REM cycle when the PagerDuty “EHEHEHEHE” alert ripped through my skull like a rusted chainsaw. I didn’t even have to look at the dashboard to know what was happening. The payment-processor-v2<\/code> service, the one the “rockstar” developers pushed on Friday afternoon while I was busy fixing the staging ingress, had finally decided to commit ritual suicide.<\/p>\n

By 3:20 AM, I was staring at a Grafana dashboard that looked like a crime scene. Latency was spiking into the tens of seconds. The CPU usage on the worker nodes was pegged at 100%, but the actual throughput was near zero. Then came the dreaded OOMKilled<\/code> events. One by one, the pods were being executed by the kernel like prisoners in a dystopian novel.<\/p>\n

$ kubectl get pods -n production\nNAME                                 READY   STATUS             RESTARTS   AGE\npayment-processor-v2-7f8d9b6-x4j2l   0\/1     CrashLoopBackOff   12         45m\npayment-processor-v2-7f8d9b6-z9k1p   0\/1     OOMKilled          8          42m\npayment-processor-v2-7f8d9b6-m2n5q   0\/1     CrashLoopBackOff   15         50m\n<\/code><\/pre>\n
I pulled the logs. It was a wall of garbage. But then I saw it\u2014the smoking gun.<\/p>\n
2024-05-20T03:15:22.441Z ERROR: Failed to load configuration. \nError: Cannot find module '\/app\/config\/secrets.json'\n    at Function.Module._resolveFilename (node:internal\/modules\/cjs\/loader:1077:15)\n...\n2024-05-20T03:15:23.102Z INFO: Attempting to pull latest image...\n<\/code><\/pre>\n
The “latest” image. My blood ran cold. Some junior dev had configured the deployment to use image: payment-processor:latest<\/code>. Overnight, a CI\/CD job had finished, pushed a broken build to the registry, and because the image pull policy was set to Always<\/code>, the cluster dutifully pulled the poison pill and distributed it to every node. <\/p>\n
I spent the next 44 hours manually rolling back tags, purging bloated layers from our local registry that had hit 98% disk utilization, and rewriting Dockerfiles that were so poorly constructed they should have been considered a violation of the Geneva Convention. <\/p>\n
If you think you’re following docker best practices while still using :latest<\/code> or running your processes as root, you\u2019re delusional. You\u2019re not a developer; you\u2019re a liability.<\/p>\n
\n
Table of Contents<\/p>\n