All bites
The whole library, newest first. Filter by what you are here for, or pick a topic if you already know.
8668 bites
Page 37
Distroless images: benefits and trade-offs
Distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell.
Pass build-time secrets securely with BuildKit
Use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time.
Run a container as a non-root user
Create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs.
What is a dangling image and how to prune it
A dangling image is an untagged layer (<none>:<none>) orphaned when a tag moves to a rebuilt image; list with docker images -f dangling=true, remove with docker image prune.
Debug a running container with the Docker CLI
Docker inspect for full state and config, docker logs -f to follow output live, docker exec -it <id> sh or bash for an interactive shell.
Multi-stage builds for compiled languages
Build in a stage with the full toolchain, then COPY --from only the artifact into a tiny final base, shrinking image size and attack surface.
Optimize Dockerfile layer caching for npm install
Copying all source first invalidates the npm install layer on any code change; instead copy package.json and lockfile, run npm install, then copy the rest.
Dockerfile CMD versus ENTRYPOINT
ENTRYPOINT sets the fixed executable; CMD sets default args or the default command; run-time args override CMD but append to ENTRYPOINT. Use together to make a fixed binary with overridable defaults.
Dockerfile COPY versus ADD
COPY just copies local files; ADD also auto-extracts local tarballs and can fetch remote URLs; prefer COPY for predictability, use ADD for local archive extraction.
Build, tag, and run a container with port mapping
Docker build -t my-app:1.0 . to build and tag; docker run -d -p 8080:80 my-app:1.0 to run detached with host:container port mapping.
Trace a container process's syscalls from the host
Find the host PID via docker inspect or ps, then strace -p that PID from the host, since the container shares the host kernel.
What is the OCI and why do its specs matter?
OCI defines vendor-neutral specs for image format and runtime so any compliant tool interoperates; runc implements the runtime spec; this prevents lock-in.
What is a container vs a VM?
Containers share the host kernel and isolate via namespaces and cgroups; VMs run a full guest OS on a hypervisor; containers are lighter and faster.
Cross-platform Button API and implementation
Shared semantic props like variant, size, disabled, loading, onPress; web renders a button element with focus and CSS, native maps to platform touchables and accessibility traits.
A brand-only component consuming core tokens
Keep the unique component in a brand-specific package that depends on core tokens and primitives; do not add it to core.
Architecting density themes with tokens
Components reference semantic spacing tokens; a density theme repoints those tokens via CSS variables on a wrapper, so one stylesheet adapts.
Breaking token changes across multiple themes
A change is safe if every theme still satisfies the token's contract and contrast; dangerous if it breaks one theme, like a value that fails contrast in high-contrast mode.
Automating a breaking design token rename
Ship a codemod to rewrite old token references, add a deprecation alias mapping old to new during a transition window, document the change.
Backporting a critical fix to an older major
Backport the fix to the supported older major as a patch, leveraging a documented support window and maintenance branches.
Contribution model for a multi-framework system
Web Components core with thin React and Vue wrappers, shared tokens and spec, contribution rules requiring core-plus-wrapper changes, conformance tests.