docker

20 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Official Deno Docker images

Deno provides official Docker images available at hub.docker.com/r/denoland/deno. These are the recommended base images for containerizing Deno applications.

Basic Dockerfile for Deno app

A minimal Dockerfile using the official image follows this pattern: FROM denoland/deno:latest, set WORKDIR to /app, COPY deno.json deno.lock package.json* to cache dependencies, run deno ci --prod --skip-types to install dependencies reproducibly, then COPY the rest of the source, and CMD to run the application with appropriate permission flags.

deno ci command in Docker

The deno ci command performs reproducible installation from deno.lock. The --prod flag skips devDependencies and --skip-types drops @types/* packages. Both flags reduce image size without affecting runtime behavior.

Multi-stage Docker builds for Deno

Use multi-stage builds to produce smaller production images. Create a builder stage with FROM denoland/deno:latest AS builder that runs deno ci and copies source code. Then create a production stage that copies only the built application and the Deno cache directory from the builder. Set ENV DENO_DIR=/deno-dir in both stages and use COPY --from=builder to transfer files. Without copying DENO_DIR, deno ci writes only to the builder stage cache, causing the production container to re-download dependencies on first run.

Permission flags in Docker CMD

Specify required permissions explicitly in the CMD instruction using --allow-* flags with specific targets. For example: CMD ["deno", "run", "--allow-net=api.example.com", "--allow-read=/data", "main.ts"]

Development Dockerfile with hot-reload

For development containers with hot-reload capability, use FROM denoland/deno:latest, set WORKDIR /app, COPY the source, and CMD ["deno", "run", "--watch", "--allow-net", "main.ts"]. The --watch flag enables hot-reload on file changes.

Available Deno Docker tags

Deno provides multiple official Docker image tags: denoland/deno:latest (latest stable release), denoland/deno:alpine (Alpine-based smaller image), denoland/deno:distroless (Google's distroless-based image), denoland/deno:ubuntu (Ubuntu-based image), and denoland/deno:2.x (pin to specific release line, use the version you target).

Environment variables for Deno in Docker

Common Deno environment variables for Docker: ENV DENO_DIR=/deno-dir/ (Deno cache directory), ENV DENO_INSTALL_ROOT=/usr/local (installation root), ENV PATH=${DENO_INSTALL_ROOT}/bin:${PATH} (add to PATH). Optional variables: ENV DENO_NO_UPDATE_CHECK=1 (disable update checks) and ENV DENO_NO_PROMPT=1 (disable interactive prompts).

Example .dockerignore for Deno projects

Recommended .dockerignore entries for Deno projects: .git, .gitignore, Dockerfile, README.md, *.log, _build/, and node_modules/

Running tests in Docker

To run tests in a Docker container, use a Dockerfile with FROM denoland/deno:latest, set WORKDIR /app, COPY the source, and CMD ["deno", "test", "--allow-none"]

Basic Docker Compose setup for Deno

A basic docker-compose.yml for development includes a deno-app service with build: ., volumes mounting the current directory to /app, ports mapping 8000:8000, environment variables like DENO_ENV=development, and command ["deno", "run", "--watch", "--allow-net", "main.ts"]

Docker Compose with database service

For a realistic Docker Compose setup with a database, define an app service with build: ., ports, environment (DATABASE_URL), depends_on db with service_healthy condition, restart: unless-stopped, and command with appropriate permission flags. Define a db service (e.g., postgres:16-alpine) with environment variables, volumes for persistence, healthcheck with test: ["CMD-SHELL", "pg_isready -U deno"], interval: 5s, timeout: 3s, retries: 5, and restart: unless-stopped. Define volumes at top level for named volumes like pgdata. Put secrets in a .env file next to docker-compose.yml, which Compose loads automatically.

Docker health checks for Deno apps

Configure health checks with HEALTHCHECK --interval=30s --timeout=3s followed by CMD deno eval with a try-catch block that fetches the health endpoint and exits with code 1 on failure. Example: CMD deno eval "try { await fetch('http://localhost:8000/health'); } catch { Deno.exit(1); }"

Docker development workflow commands

Common Docker workflow: Build image with docker build -t my-deno-app . Run with volume mount using docker run -it --rm -v ${PWD}:/app -p 8000:8000 my-deno-app

Running Deno as non-root user in Docker

For security, run Deno as a non-root user. Create a deno group and user with RUN addgroup --system deno && adduser --system --ingroup deno deno Then switch to the user with USER deno before the CMD instruction.

Security best practices for Deno in Docker

Use minimal permissions with --allow-* flags targeting specific resources (e.g., --allow-net=api.example.com, --allow-read=/app). Consider using --deny-* flags for additional security. Run as non-root user.

Full workspace containerization in Docker

When containerizing a Deno workspace, include the entire workspace by copying deno.json at the root level and all project directories. Set WORKDIR to the specific project directory and run deno run -A mod.ts from there.

Minimal workspace containerization in Docker

For smaller workspace images, use a build context script to include only required workspace members. Create a temporary build directory, copy the root deno.json, copy the main project directory, and conditionally copy only required dependencies by checking imports. Use .dockerignore to exclude unnecessary files and a build script to manage the build context. Remove the temporary directory after building.

Workspace Docker best practices

Always include the root deno.json file in workspace containers. Maintain the same directory structure as development. Document workspace dependencies clearly. Use build scripts to manage context. Include only required workspace members. Update .dockerignore when dependencies change.

Docker Compose up commands

Start Docker Compose services with docker compose up (foreground) or docker compose up -d (background/detached mode).

Give your agent this brain