Docker Production Readiness

Take a container from "works on my machine" to production-safe: build errors, runtime failures, Compose, and a hardening pass with the auditor.

0 of 4 modules complete

Who it’s for: Engineers shipping containers who want fewer 2am surprises.
Prerequisites: You can build and run a basic container.

Skills you’ll build

✓Debug build/image failures
✓Diagnose container runtime crashes
✓Write safer Compose
✓Run a production-readiness audit

4 modules · self-paced

Module 1

Build and image errors

Fix the common build and image failures and understand layer caching.

Docker build & image errors hub
Module 2

Container and runtime errors

Diagnose crash loops, exit codes, and resource limits.

Docker container & runtime errors hub
Diagnostic commands run in order — each one narrows the fault
1. Find containers that are restarting
```
docker ps -a --filter "status=restarting" --format "{{.Names}}\\t{{.Status}}"
```
  A restart loop means the process exits immediately. The exit code in `docker inspect` tells you why.
2. Read the exit code and OOM flag
```
docker inspect --format "{{.Name}} exit={{.State.ExitCode}} oom={{.State.OOMKilled}} err={{.State.Error}}" $(docker ps -aq)
```
  exit=137 with oom=true is a memory limit, not a crash. exit=125/126/127 are Docker, permission and PATH problems respectively.
3. Check health check status
```
docker inspect --format "{{.Name}} {{if .State.Health}}{{.State.Health.Status}}{{else}}no-healthcheck{{end}}" $(docker ps -q)
```
  "no-healthcheck" is itself a production-readiness finding: nothing can tell whether the container is actually serving.
4. Read the last logs before the exit
```
docker logs --tail 100 --timestamps <CONTAINER>
```
  Read from the bottom up to the FIRST error — the last line is usually just the process giving up.
Exercise

A container exits immediately with code 1. Work through image, entrypoint, config, and resource limits to find why.
Open in Workspace →
Module 3

Compose you can trust

Structure a multi-service Compose file and catch security issues before they ship.

Docker Compose core guide Docker Compose Generator
Diagnostic commands run in order — each one narrows the fault
1. Validate the resolved configuration
```
docker compose config --quiet && echo "compose file is valid"
```
  Resolves variables, extends and overrides. Catches the mistakes that only appear once the file is merged.
2. Check restart policies
```
docker compose config | grep -A1 -E "^\\s+restart:" || echo "NO restart policy set"
```
  A production service with no restart policy will stay down after a host reboot.
3. Check resource limits
```
docker compose config | grep -B2 -A6 "deploy:" | grep -A4 "resources:" || echo "NO resource limits set"
```
  Without limits, one container can starve every other service on the host.
4. Look for secrets committed as environment values
```
docker compose config | grep -iE "(password|secret|token|key)\\s*[:=]" | grep -v "_FILE"
```
  Any literal value here is baked into the config and visible to anyone who can run `docker inspect`. Use secrets or *_FILE.
Module 4

Run a production-readiness audit

Score an image/Compose against 50 production rules and fix the findings.

Docker Production Readiness Auditor Open the Troubleshooting Workspace

Docker Production Readiness Auditor Docker Compose Generator

Build and image errors

Container and runtime errors

Compose you can trust

Run a production-readiness audit