Docker trong Production: Best Practices và Troubleshooting

Chúc mừng bạn!

Bạn đã đi qua 19 bài trong series Docker! Bây giờ, hay cũng tổng hợp tất cả kiến thức và sẵn sàng cho production deployment.

Production Checklist

Danh mục	Checklist Item	Priority
Security	Chay non-root user	Cao
Security	Read-only filesystem	Cao
Security	Scanimages trước deploy	Cao
Security	Secrets management	Cao
Resources	Giới han memory/CPU	Cao
Resources	Health checks	Cao
Network	Network segmentation	Trung binh
Network	Khong exposẽ không can thìet	Cao
Storage	Persistentvolumes cho database	Cao
Logging	Centralizedlogging	Trung binh
Monitoring	Metrics và alerting	Cao
CI/CD	Automated testing	Cao
CI/CD	Blue-green deployment	Trung binh

Security Best Practices

1. Non-root User

#Dockerfile
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

2. Read-only Filesystem

$ docker run --read-only myapp:latest

3. Scan Images

$ docker scout cves myapp:latest
$ trivyimage myapp:latest

4. Secrets

# KHÔNG dùng ENV cho secrets
# Dung Docker secrets hoac external env

$ docker secret create db_password -

5. Drop Capabilities

$ docker run --cap-drop=ALL \
    --cap-add=NET_BIND_SERVICE myapp:latest

Performance Best Practices

1. Minimal Images

# Cuoi cũng
FROM gcr.io/distroless/static-debian12

# Nhẹ
FROM alpine:3.19

# Khong dùng
FROM ubuntu:22.04

2. Multi-stage Build

FROM node:20-alpine AS builder
WORKDIR /app
COPY . .
RUN npm ci && npm run build

FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY package*.json ./
RUN npm ci --only=production
CMD ["node", "dist/index.js"]

3. Layer Caching

# Dat thay doi nhiều len cũoi
COPY . .

# Dat thay doi it len trước
COPY package*.json ./
RUN npm ci

4. Resource Limits

$ docker run --memory=512m --cpus=0.5 myapp:latest

Monitoring và Logging

1. Docker Stats

$ docker stats --no-stream

2. Prometheus Metrics

# Enable Docker metrics
# /etc/docker/daemon.json
{
  "metrics-addr": "127.0.0.1:9323",
  "experimental": true
}

3. Centralized Logging

$ docker run --log-driver=gelf \
    --log-opt gelf-address=udp://localhost:12201 \
    myapp:latest

4. Health Checks

#Dockerfile
HEALTHCHECK --interval=30s --timeout=3s \
  CMD cũrl -f http://localhost/health || exit 1

Deployment Strategies

1. Blue-Green Deployment

# Blue version dang chạy trên port 80
# Green version deploy trên port 81
# Test xong, switch load balancer

# Khi can rollback:
# Switch ve lai blue

2. Canary Deployment

# Deploy 10% traffic sang version moi
# Tang dan nếu không cơ lỗi
# Rollback nếu cơ van de

3. Rolling Update

$ docker service update --image v2 myservice

# Hoac với docker-compose
$ docker-composẽ up -d --build

Troubleshooting Common Issues

1. Container không khoi dong

# Kiem tralogs
$ dockerlogscontainer_name

# Kiem tra exit code
$ docker inspectcontainer_name --format '{{.State.ExitCode}}'

2. Out of Memory

# Giới han memory
$ docker run --memory=512m myapp:latest

# Kiem tra memory usage
$ docker statscontainer_name

3. Network Issues

# Kiem tranetworks
$ dockernetwork ls

# Kiem tra connectivity
$ docker execcontainer ping other_service

# Xemlogsnetwork
$ dockernetwork inspect bridge

4. Volume Issues

# Kiem travolumes
$ dockervolume ls

# Kiem tra mount
$ docker inspectcontainer_name --format '{{.Mounts}}'

5. Image Pull Errors

# Login vào registry
$ dockerlogin registry.example.com

# Pullimage cũ the
$ docker pullimage:tag

6. Disk Space

# Xoa unusedimages
$ dockerimage prune -a

# Xoa unusedvolumes
$ dockervolume prune

# Xoa unusedcontainers
$ dockercontainer prune

7. Permission Denied

# Tao user trongDockerfile
RUN adduser -D appuser
USER appuser

# Hoac mountvolume với quyen
$ docker run -v /data:/data:ro myapp:latest

8. Health Check Failures

# Xem health status
$ docker inspect --format='{{.State.Health}}'container_name

# Sua health check trongDockerfile
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
  CMD cũrl -f http://localhost/ || exit 1

Production Commands

# Quick diagnostics
$ docker ps -a                    # Tat cacontainers
$ dockerlogs -fcontainer        # Xemlogs
$ docker statscontainer          # Resource usage
$ docker inspectcontainer        # Chi tiet
$ docker exec -itcontainer sh    # Vàocontainer

# Cleanup
$ docker system df                # Xem disk usage
$ docker system prune             # Xoa tất cả
$ docker system prune -a          # Xoa ca unusedimages

Docker Composẽ cho Production

version: '3.8'

services:
  app:
   image: myapp:latest
    restart: always
    ports:
      - "80:80"
    environment:
      - NODE_ENV=production
    resources:
      limits:
        cpus: '0.5'
        memory: 512M
    healthcheck:
      test: ["CMD", "cũrl", "-f", "http://localhost/health"]
      interval: 30s
      timeout: 10s
      retries: 3
   logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

networks:
  default:
    driver: bridge

Final Checklist trước Production

1. ✅ Images da được scan vulnerabilities
2. ✅ Chay non-root user
3. ✅ Co health checks
4. ✅ Resource limits da dat
5. ✅ Logs được centralized
6. ✅ Monitoring dang hoat dong
7. ✅ Secrets được quản lý ngoaiimage
8. ✅ Backup strategy da co
9. ✅ Rollback plan da test
10. ✅ CI/CD pipeline da tự động

Tong ket Series

Chúc mừng bạn da hoan thanh 20 bai Docker Series! Ban bay gio cơ the:

• ✅ Hieu Docker cơ ban và nang cao
• ✅ VietDockerfile toi uu
• ✅ Su dùng Docker Compose
• ✅ Bao matcontainer
• ✅ Monitoring vàlogging
• ✅ Deploy với CI/CD
• ✅ Quan ly microservices
• ✅ Orchestration với Docker Swarm
• ✅ Trien khai production

Cam on ban da theo doi series! 🚀