Comment optimiser des images Docker en production 2026

{
  "name": "docker-advanced-api",
  "version": "1.0.0",
  "main": "dist/server.js",
  "scripts": {
    "build": "tsc",
    "start": "node dist/server.js",
    "dev": "tsx watch src/server.ts"
  },
  "dependencies": {
    "express": "^4.19.2",
    "zod": "^3.23.8"
  },
  "devDependencies": {
    "@types/express": "^4.17.21",
    "@types/node": "^22.5.5",
    "tsx": "^4.19.1",
    "typescript": "^5.6.3"
  }
}

import express from 'express';
import { z } from 'zod';

const app = express();
app.use(express.json());

const userSchema = z.object({
  name: z.string().min(2),
  email: z.string().email()
});

app.get('/health', (req, res) => res.status(200).json({ status: 'ok' }));

app.post('/users', (req, res) => {
  try {
    const user = userSchema.parse(req.body);
    res.json({ id: Date.now(), ...user });
  } catch (error) {
    res.status(400).json({ error: 'Invalid input' });
  }
});

const port = process.env.PORT || 3000;
app.listen(port, () => console.log(`Server on port ${port}`));

{
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "outDir": "./dist",
    "rootDir": "./src",
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "forceConsistentCasingInFileNames": true
  },
  "include": ["src/**/*"],
  "exclude": ["node_modules", "dist"]
}

node_modules
npm-debug.log
.git
.gitignore
README.md
.nyc_output
coverage
*.tsbuildinfo
dist
.env
*.log

FROM --platform=$BUILDPLATFORM node:22-alpine AS base

# Install deps only when needed
FROM base AS deps
WORKDIR /app
COPY package.json package-lock.json* .
RUN npm ci --only=production --no-optional && npm cache clean --force

# Build stage
FROM base AS builder
WORKDIR /app
COPY package.json package-lock.json* tsconfig.json .
COPY src/ ./src/
RUN npm ci && npm run build && npm prune --production

# Production scanner
FROM deps AS scanner
RUN apk add --no-cache curl && \
    curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin && \
    trivy image --exit-code 1 --no-progress --severity HIGH,CRITICAL node:22-alpine

# Runtime
FROM node:22-alpine AS runner
WORKDIR /app

ENV NODE_ENV=production
ENV PORT=3000

RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nextjs

COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./package.json

USER nextjs
EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node -e "require('http').request({host:'localhost',port:3000,path:'/health'},r=>{r.on('data',d=>process.exit(0));r.on('error',()=>process.exit(1))}).end()" || exit 1

CMD [ "node", "dist/server.js" ]

services:
  api:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - PORT=3000
    networks:
      - app-net
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          memory: 256M
    secrets:
      - db_password

  db:
    image: postgres:17-alpine
    environment:
      POSTGRES_DB: appdb
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - app-net

networks:
  app-net:
    driver: bridge

volumes:
  postgres_data:

secrets:
  db_password:
    file: ./secrets/db_password.txt

#!/bin/bash
set -euo pipefail

APP_NAME=docker-api-prod
TAG=latest

# Build multi-platform
docker buildx create --use
docker buildx build --platform linux/amd64,linux/arm64 -t ${APP_NAME}:${TAG} --push . || docker buildx build --platform linux/amd64,linux/arm64 -t ${APP_NAME}:${TAG} .

# Scan
trivy image --severity HIGH,CRITICAL --exit-code 1 ${APP_NAME}:${TAG}

# Local test
docker compose up -d && sleep 10 && docker compose ps && curl -f http://localhost:3000/health

# Deploy prod (exemple)
# docker compose -f docker-compose.prod.yml up -d --scale api=3

echo "Deploy ready!"