image: nginx:1.25-alpine
image: postgres:16
image: myregistry.io/myapp:latest

container_name: my-nginx

pull_policy: always   # vždy
pull_policy: missing  # jen pokud chybí (výchozí)
pull_policy: never    # nikdy nestahovat
pull_policy: build    # vždy buildovat

platform: linux/amd64
platform: linux/arm64

ports:
  - "8080:80"           # host:container
  - "443:443"
  - "127.0.0.1:3000:3000" # vázat na IP
  - "3000"              # náhodný host port
  - target: 80
    published: "8080"
    protocol: tcp
    mode: host

expose:
  - "3000"
  - "8080"

# Zkrácená syntaxe
networks:
  - frontend
  - backend

# Rozšířená syntaxe
networks:
  backend:
    aliases:
      - database
    ipv4_address: 172.20.0.10
    priority: 100

network_mode: host
network_mode: none
network_mode: "service:db"
network_mode: "container:my-nginx"

extra_hosts:
  - "myhost:192.168.1.10"
  - "gateway:host-gateway"

dns:
  - 8.8.8.8
  - 1.1.1.1
dns_search:
  - example.com

# Seznam
environment:
  - NODE_ENV=production
  - DB_HOST=db
  - SECRET          # převezme hodnotu z hostu

# Mapa
environment:
  NODE_ENV: production
  DB_PORT: 5432

env_file:
  - .env
  - .env.production
  - path: ./default.env
    required: false   # Compose V2.24+

volumes:
  - ./data:/app/data      # bind mount
  - pgdata:/var/lib/pg    # pojmenovaný
  - /tmp                  # anonymní

  # Dlouhá syntaxe
  - type: bind
    source: ./config.yml
    target: /etc/app/config.yml
    read_only: true
    bind:
      create_host_path: true
      propagation: shared

tmpfs:
  - /run
  - /tmp:size=100m,mode=1777

working_dir: /app

command: python app.py --port 8080
command: ["npm", "run", "start"]

entrypoint: /entrypoint.sh
entrypoint: ["/bin/sh", "-c"]

restart: no             # výchozí – nikdy
restart: always         # vždy restartovat
restart: on-failure     # jen při nenulové exit
restart: on-failure:3   # max 3 pokusy
restart: unless-stopped # kromě ručního stop

stop_signal: SIGINT

stop_grace_period: 30s

depends_on:
  db:
    condition: service_healthy  # čeká na healthcheck
  redis:
    condition: service_started  # výchozí
  migrate:
    condition: service_completed_successfully

healthcheck:
  test: ["CMD", "curl", "-f", "http://localhost/health"]
  # Alternativy:
  # test: ["CMD-SHELL", "pg_isready -U postgres"]
  # test: ["NONE"]  # zakáže healthcheck
  interval: 30s           # jak často testovat
  timeout: 10s            # max čekání na výsledek
  retries: 3              # po kolika selháních = unhealthy
  start_period: 40s       # grace period po startu
  start_interval: 5s     # interval v start_period (V2.23+)

user: "1000:1000"
user: nobody

read_only: true

privileged: true

cap_add:
  - NET_ADMIN
  - SYS_PTRACE
cap_drop:
  - ALL

security_opt:
  - no-new-privileges:true
  - seccomp:./seccomp.json
  - apparmor:docker-default

secrets:
  - db_password
  - source: server_cert
    target: /run/secrets/cert.pem
    mode: 0440

deploy:
  resources:
    limits:
      cpus: "0.50"
      memory: 512M
      pids: 100
    reservations:
      cpus: "0.25"
      memory: 128M

mem_limit: 512m
cpus: "0.5"

stdin_open: true

tty: true

init: true

labels:
  app: myapp
  version: "1.2"
  traefik.enable: "true"

profiles: ["debug", "tools"]

scale: 3

devices:
  - "/dev/ttyUSB0:/dev/ttyUSB0"
  - "/dev/snd:/dev/snd"

shm_size: "256m"

ipc: host
pid: host

sysctls:
  net.core.somaxconn: 1024
  net.ipv4.tcp_syncookies: 0

ulimits:
  nofile:
    soft: 1024
    hard: 4096
  nproc: 65535

logging:
  driver: json-file   # json-file/syslog/none/fluentd
  options:
    max-size: "10m"
    max-file: "3"

configs:
  - source: nginx_conf
    target: /etc/nginx/nginx.conf
    mode: 0440

extends:
  file: common.yml
  service: webapp

driver: bridge    # výchozí – izolovaná bridge síť
driver: host      # sdílí síťový stack hostu
driver: overlay   # Swarm – multi-host komunikace
driver: none      # bez sítě
driver: macvlan   # vlastní MAC adresa
driver: ipvlan    # sdílí MAC, vlastní IP

driver_opts:
  com.docker.network.bridge.name: my_bridge
  com.docker.network.driver.mtu: "1450"

networks:
  existing-net:
    external: true

name: shared-network

internal: true

attachable: true

enable_ipv6: true

networks:
  mynet:
    ipam:
      driver: default
      config:
        - subnet: 172.20.0.0/16
          gateway: 172.20.0.1
          ip_range: 172.20.1.0/24
          aux_addresses:
            reserved: 172.20.0.10

networks:
  backend:
    aliases:
      - database
      - db-primary

networks:
  mynet:
    ipv4_address: 172.20.0.10
    ipv6_address: 2001:db8::10

networks:
  frontend:
    priority: 100
  backend:
    priority: 10

driver: local       # výchozí
driver: nfs
driver: cifs
driver: azure-file

volumes:
  nfs_data:
    driver: local
    driver_opts:
      type: nfs
      o: addr=192.168.1.1,rw,nfsvers=4
      device: ":/exports/data"

volumes:
  pgdata:
    external: true

name: my-pgdata

labels:
  backup: daily
  project: myapp

volumes:
  - pgdata:/var/lib/postgresql/data
  - redisdata:/data

volumes:
  - ./app:/app                # relativní cesta
  - /etc/localtime:/etc/localtime:ro
  - ~/config:/config

volumes:
  - /var/cache/nginx
  - /tmp/app

volumes:
  - type: volume
    source: pgdata
    target: /var/lib/pg
    read_only: false
    volume:
      nocopy: true      # nekopírovat obsah kontejneru
  - type: bind
    source: ./config
    target: /app/config
    read_only: true
    bind:
      create_host_path: true
      propagation: shared  # shared/slave/private
  - type: tmpfs
    target: /tmp
    tmpfs:
      size: 104857600      # 100MB v bajtech
      mode: 1777

build:
  context: .
  context: ./backend
  context: https://github.com/user/repo.git
  context: https://github.com/user/repo.git#branch

dockerfile: Dockerfile.prod
dockerfile: docker/Dockerfile

dockerfile_inline: |
  FROM alpine:3.19
  RUN apk add --no-cache curl
  COPY . /app

args:
  - NODE_VERSION=20
  - ENV=production
  # nebo mapa:
  NODE_VERSION: "20"

target: production
target: builder

cache_from:
  - myapp:latest
  - type=registry,ref=myregistry/myapp
  - type=gha              # GitHub Actions cache
cache_to:
  - type=inline
  - type=gha,mode=max

platforms:
  - linux/amd64
  - linux/arm64
  - linux/arm/v7

secrets:
  - server-certificate
  - id: mysecret
    src: ./mysecret.txt

ssh:
  - default
  - mykey=~/.ssh/deploy_key

network: host
network: none

tags:
  - myapp:latest
  - myapp:1.2.3
  - myregistry.io/myapp:latest

labels:
  org.opencontainers.image.version: "1.2.3"
  org.opencontainers.image.source: https://...

shm_size: "128m"

no_cache: true
pull: true

additional_contexts:
  mylib: ../mylib
  node-base: docker-image://node:20

# syntax=docker/dockerfile:1
# syntax=docker/dockerfile:1.10

# escape=\
# escape=`

# check=skip=JSONArgsRecommended
# check=error=true

# syntax=docker/dockerfile:1
# comment
FROM alpine

RUN apk add --no-cache curl
RUN ["apk", "add", "--no-cache", "curl"]

CMD node server.js
CMD ["node", "server.js"]

FROM alpine:3.20
FROM node:20-alpine AS build
FROM --platform=$TARGETPLATFORM nginx:alpine

ARG NODE_VERSION=20
FROM node:${NODE_VERSION}-alpine

FROM golang:1.24 AS builder
FROM scratch
COPY --from=builder /app/server /server

FROM python:3.12 AS build
RUN pip install --prefix=/install -r requirements.txt

FROM python:3.12-slim
COPY --from=build /install /usr/local

COPY package.json package-lock.json ./
COPY src/ ./src/
COPY --from=build /app/bin/myapp /usr/local/bin/myapp
COPY --chown=node:node --chmod=755 docker-entrypoint.sh /usr/local/bin/

ADD app.tar.gz /opt/app/
ADD https://example.com/archive.tgz /tmp/

node_modules
dist
.git
*.log
.env

VOLUME ["/var/lib/postgresql/data"]
VOLUME /data

EXPOSE 80
EXPOSE 3000/tcp
EXPOSE 53/udp

RUN apk add --no-cache curl git
RUN <<EOF
apt-get update
apt-get install -y curl
EOF

RUN --mount=type=cache,target=/root/.npm npm ci
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm ci
RUN --mount=type=ssh git clone git@github.com:org/private-repo.git

RUN --network=none npm test
RUN --network=host apk add --no-cache curl

SHELL ["/bin/bash", "-o", "pipefail", "-c"]
SHELL ["powershell", "-Command"]

ARG NODE_VERSION=20
ARG TARGETPLATFORM
RUN echo $TARGETPLATFORM

ENV NODE_ENV=production
ENV APP_HOME=/app
ENV PATH=/app/bin:$PATH

ARG APP_ENV=production
ENV APP_ENV=${APP_ENV}

LABEL org.opencontainers.image.title="myapp"
LABEL org.opencontainers.image.source="https://github.com/acme/myapp"

WORKDIR /app
WORKDIR src          # výsledkem je /app/src

USER node
USER 1000:1000

CMD ["nginx", "-g", "daemon off;"]
CMD ["--port", "3000"]

ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
CMD ["nginx", "-g", "daemon off;"]

HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD curl -f http://localhost/health || exit 1
HEALTHCHECK NONE

STOPSIGNAL SIGTERM
STOPSIGNAL SIGQUIT

ONBUILD COPY . /src
ONBUILD RUN npm ci

COPY package*.json ./
RUN npm ci
COPY . .

RUN --mount=type=secret,id=token,target=/run/secrets/token some-command

docker search nginx
docker pull nginx:1.27-alpine
docker pull ghcr.io/org/app:1.2.0

docker build -t myapp:1.0 .
docker tag myapp:1.0 registry.example.com/team/myapp:1.0

docker run --rm -p 8080:80 nginx:alpine
docker run -d --name app myapp:1.0

docker image ls
docker image history myapp:1.0
docker image inspect myapp:1.0
docker system df

nginx:alpine
library/ubuntu:24.04
ghcr.io/acme/api:1.4.2
registry.example.com/platform/web:prod

docker pull nginx@sha256:...

Docker Hub
GHCR
Harbor
ECR / GCR / ACR
privátní registry:2

docker image save myapp:1.0 > myapp.tar
docker image save -o myapp.tar myapp:1.0
docker image save myapp:1.0 | gzip > myapp.tar.gz

docker image load < myapp.tar.gz
docker image load -i myapp.tar

scp myapp.tar.gz user@server:/tmp/
split -b 500m myapp.tar.gz myapp.part.

docker export mycontainer > rootfs.tar
cat rootfs.tar | docker import - myimage:flat

docker container commit mycontainer myimage:debug

docker system df
docker image prune
docker system prune

docker container create --name web nginx:alpine

docker run --name web -p 8080:80 nginx:alpine
docker run -d --name app myapp:1.0

docker container start web
docker container stop web
docker container restart web
docker container rm web

docker run ubuntu echo hello

docker run -d --name web nginx:alpine
docker logs -f web

docker run -it alpine sh

docker ps
docker ps -a

docker exec -it web sh
docker exec app printenv

docker logs web
docker logs -f --tail 100 web

docker inspect web

docker stats
docker stats web app db

docker run --restart=no nginx
docker run --restart=always nginx
docker run --restart=unless-stopped nginx
docker run --restart=on-failure:3 myjob

docker run --stop-timeout=30 nginx
docker stop -t 30 web

docker run --stop-signal=SIGQUIT nginx

docker run --no-healthcheck nginx
docker run --health-cmd="curl -f http://localhost || exit 1" --health-interval=30s nginx

docker run -v pgdata:/var/lib/postgresql/data postgres

docker run --mount type=bind,src=$PWD,target=/app nginx

docker run --tmpfs /run nginx

docker run --mount source=pgdata,target=/data postgres
docker run --mount type=bind,src=$PWD,target=/app alpine

docker run -v pgdata:/data postgres
docker run -v $PWD:/app alpine

docker run --mount type=bind,src=/etc/config,target=/config,readonly app

docker run --rm --volumes-from dbstore -v $PWD:/backup ubuntu tar cvf /backup/backup.tar /dbdata

docker run --rm --volumes-from dbstore -v $PWD:/backup ubuntu bash -c "cd /dbdata && tar xvf /backup/backup.tar --strip 1"

docker run --network host nginx

docker run --network none alpine

docker run -p 8080:80 nginx
docker run -p 127.0.0.1:8080:80 nginx

docker run -P nginx

docker network connect backend web

docker network create appnet
docker run -d --network appnet --name db postgres
docker run -d --network appnet --name app myapp

COPY package*.json ./
RUN npm ci
COPY . .

docker build --no-cache -t myapp .

RUN --mount=type=cache,target=/root/.npm npm ci
RUN --mount=type=cache,target=/var/cache/apt apt-get update

RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm ci

RUN --mount=type=ssh git clone git@github.com:org/private.git

docker buildx build --cache-to type=inline --cache-from type=registry,ref=myorg/myapp .

docker buildx build --platform linux/amd64,linux/arm64 -t myapp:latest .

nginx:alpine
ghcr.io/acme/api:1.4.2
registry.example.com/team/web:prod

docker login
docker login ghcr.io

docker tag myapp:1.0 registry.example.com/team/myapp:1.0

docker push registry.example.com/team/myapp:1.0

docker pull nginx:alpine
docker pull nginx@sha256:...

docker image save -o myapp.tar myapp:1.0
docker image load -i myapp.tar

USER 1000:1000

docker run --read-only nginx

docker run --cap-drop ALL --cap-add NET_BIND_SERVICE nginx

docker run --security-opt no-new-privileges nginx

RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm ci

docker scout cves myapp:1.0

deploy:
  replicas: 3

mode: replicated  # výchozí – N instancí
mode: global      # 1 na každém Swarm uzlu

update_config:
  parallelism: 2           # aktualizovat po 2
  delay: 10s               # pauza mezi dávkami
  order: start-first       # nebo stop-first
  failure_action: rollback # nebo pause/continue
  max_failure_ratio: 0.1
  monitor: 60s             # čas sledování po update

rollback_config:
  parallelism: 1
  delay: 5s
  failure_action: pause
  order: stop-first

resources:
  limits:
    cpus: "0.50"
    memory: 512M
    pids: 100
  reservations:
    cpus: "0.25"
    memory: 128M
    devices:                # GPU
      - capabilities: [gpu]
        count: 1
        driver: nvidia

restart_policy:
  condition: on-failure  # any/none/on-failure
  delay: 5s
  max_attempts: 3
  window: 120s

placement:
  constraints:
    - node.role == manager
    - node.labels.region == eu-west
    - engine.labels.os == linux
  preferences:
    - spread: node.labels.zone
  max_replicas_per_node: 2

endpoint_mode: vip     # virtual IP (výchozí)
endpoint_mode: dnsrr   # DNS round-robin
labels:
  traefik.enable: "true"