Docker Multistage Builds mit Claude Code 2026

# ── Stage 1: Abhängigkeiten installieren ──────────────────────
FROM node:20-alpine AS deps

WORKDIR /app

# Nur package-Dateien kopieren → Cache-Layer stabil halten
COPY package.json package-lock.json ./
RUN npm ci --only=production

# ── Stage 2: Build ────────────────────────────────────────────
FROM node:20-alpine AS builder

WORKDIR /app

COPY package.json package-lock.json ./
RUN npm ci

COPY . .
RUN npm run build

# ── Stage 3: Minimales Production-Image ───────────────────────
FROM node:20-alpine AS runner

ENV NODE_ENV=production
WORKDIR /app

# Non-Root User für Sicherheit
RUN addgroup --system --gid 1001 nodejs \
    && adduser --system --uid 1001 nextjs

# Nur Build-Artefakte + Prod-Deps aus vorherigen Stages
COPY --from=deps /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/public ./public

USER nextjs
EXPOSE 3000
CMD ["node", "dist/server.js"]

# ── Stage 1: Python Build-Umgebung ────────────────────────────
FROM python:3.12-slim AS builder

WORKDIR /app

# Build-Dependencies nur in dieser Stage
RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc libpq-dev \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --user --no-cache-dir -r requirements.txt

# ── Stage 2: Schlankes Production-Image ───────────────────────
FROM python:3.12-slim AS production

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH=/home/appuser/.local/bin:$PATH

WORKDIR /app

RUN adduser --disabled-password --gecos '' appuser

# Nur installierte Packages aus Builder kopieren
COPY --from=builder /root/.local /home/appuser/.local
COPY --chown=appuser:appuser . .

USER appuser
EXPOSE 8000
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

# ❌ SCHLECHT: Jede Code-Änderung invalidiert npm install
COPY . .
RUN npm ci

# ✅ GUT: package.json-Layer bleibt im Cache solange sich Dependencies nicht ändern
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build

# Node.js
node_modules
npm-debug.log*
.npm

# Build-Outputs
dist
build
.next
out

# Dev-Tools
.git
.gitignore
.github
*.md
.env*

# Test-Artefakte
coverage
.nyc_output
*.test.ts
__tests__

# IDE
.vscode
.idea
*.log

# syntax=docker/dockerfile:1.5 muss erste Zeile sein für BuildKit-Features
# syntax=docker/dockerfile:1.5
FROM node:20-alpine AS deps

WORKDIR /app
COPY package.json package-lock.json ./

# npm-Cache bleibt zwischen Builds erhalten — kein Re-Download
RUN --mount=type=cache,target=/root/.npm \
    npm ci --only=production

---
# Python-Variante mit pip-Cache
FROM python:3.12-slim AS builder

COPY requirements.txt .
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install --user -r requirements.txt

# syntax=docker/dockerfile:1.5
FROM node:20-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci --only=production && npm cache clean --force

FROM node:20-alpine AS builder
WORKDIR /app
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci
COPY . .
RUN npm run build

# ── Production Stage ───────────────────────────────────────────
FROM node:20-alpine AS runner

# dumb-init: PID-1-Problem lösen, Signals korrekt weiterleiten
RUN apk add --no-cache dumb-init

ENV NODE_ENV=production \
    PORT=3000

# Non-Root User anlegen
RUN addgroup -g 1001 -S nodejs \
    && adduser -S nextjs -u 1001 -G nodejs

WORKDIR /app

# Artefakte aus vorherigen Stages übernehmen
COPY --from=deps --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist
COPY --from=builder --chown=nextjs:nodejs /app/public ./public

USER nextjs

EXPOSE 3000

# dumb-init als Entrypoint → korrekte Signal-Behandlung (SIGTERM, SIGINT)
ENTRYPOINT ["/usr/bin/dumb-init", "--"]
CMD ["node", "dist/server.js"]

FROM node:20-alpine AS builder
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build && npm prune --production

# Distroless: kein shell, kein apt, minimal CVE-Fläche
FROM gcr.io/distroless/nodejs20-debian12 AS runner

WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist

# Distroless hat built-in non-root user (uid 65532)
USER 65532

EXPOSE 3000
CMD ["dist/server.js"]

version: '3.9'

services:
  api:
    build:
      context: .
      dockerfile: Dockerfile
      target: runner
      cache_from:
        - ghcr.io/myorg/myapp:cache
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - DATABASE_URL=postgresql://app:${DB_PASSWORD}@postgres:5432/appdb
      - REDIS_URL=redis://redis:6379
    ports:
      - "3000:3000"
    networks:
      - backend
      - frontend
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    profiles: ["app", "full"]

  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: appdb
      POSTGRES_USER: app
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app -d appdb"]
      interval: 10s
      timeout: 5s
      retries: 5
    profiles: ["db", "full"]

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    volumes:
      - redisdata:/data
    networks:
      - backend
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 3
    profiles: ["cache", "full"]

  nginx:
    image: nginx:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certs:/etc/nginx/certs:ro
    networks:
      - frontend
    depends_on:
      api:
        condition: service_healthy
    profiles: ["proxy", "full"]

volumes:
  pgdata:
  redisdata:

networks:
  backend:
    driver: bridge
  frontend:
    driver: bridge

# Node.js HTTP-Endpoint prüfen (wget ist in alpine verfügbar)
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
    CMD wget -qO- http://localhost:3000/health || exit 1

# Alternativ mit curl (wenn installiert)
HEALTHCHECK --interval=15s --timeout=5s --retries=3 \
    CMD curl -f http://localhost:3000/health || exit 1

# Python FastAPI
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1

# Postgres direkt
HEALTHCHECK --interval=10s --timeout=5s --retries=5 \
    CMD pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB} || exit 1

# syntax=docker/dockerfile:1.5
FROM node:20-alpine AS builder

WORKDIR /app
COPY package.json package-lock.json ./

# NPM_TOKEN nur während RUN verfügbar, landet NICHT im Layer
RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) \
    npm config set //registry.npmjs.org/:_authToken=${NPM_TOKEN} \
    && npm ci \
    && npm config delete //registry.npmjs.org/:_authToken

COPY . .
RUN npm run build

---
# Build-Aufruf mit Secret:
# docker build --secret id=npm_token,src=.npmrc .
# ODER aus Umgebungsvariable:
# echo "$NPM_TOKEN" | docker build --secret id=npm_token,src=- .

# Multistage mit Secret-Injection zur Laufzeit (nicht zur Build-Zeit)
FROM node:20-alpine AS runner

ENV NODE_ENV=production

# Secret wird als Datei gemountet (Docker Swarm oder k8s Secret)
# /run/secrets/db_password → process.env wird NICHT verwendet
RUN mkdir -p /run/secrets && chown -R node:node /run/secrets

COPY --from=builder /app/dist ./dist
COPY scripts/read-secrets.js ./scripts/

# Startup-Script liest /run/secrets/* und setzt env vars
USER node
CMD ["node", "scripts/read-secrets.js", "dist/server.js"]

name: Docker Build & Push

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # QEMU für Multi-Platform (arm64 emulation auf amd64 Runner)
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: image=moby/buildkit:latest

      - name: Log in to GitHub Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker Metadata (Tags & Labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-

      - name: Build and Push
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          target: runner
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # Layer-Cache aus ghcr.io — kein separater Cache-Service nötig
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cache,mode=max
          secrets: |
            npm_token=${{ secrets.NPM_TOKEN }}

# Ergänzung zum Build-Job: Vulnerability-Scan nach dem Build
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: '1'

      - name: Upload Trivy results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif