Editing Docker (section)

== <span style="color: #FFFFFF;">Evaluating</span> ==
Signs of a mature Docker setup:

* Images are built from minimal base images and use multi-stage builds; final image size is justified.
* Dockerfile instructions are ordered to maximize cache hits (dependencies before source code).
* No secrets (API keys, passwords) appear in ENV instructions or are COPY'd into the image � they are injected at runtime via environment variables or secret management tools.
* Containers run as a non-root user (USER instruction) to limit blast radius if compromised.
* Health checks are defined so orchestrators know when a container is actually ready.
* Images are tagged with specific versions or git SHAs, not just "latest", so deployments are reproducible.

Expert trade-offs:

* '''Docker Compose vs. Kubernetes''': Compose is appropriate for local development and simple single-host production deployments. Kubernetes is necessary when you need automatic scheduling across multiple hosts, self-healing, rolling updates, and fine-grained resource management � but brings significant operational complexity.
* '''Build in CI, not locally''': developer-built images are not reproducible. Build and push images from a CI pipeline (GitHub Actions, GitLab CI, etc.) from a clean environment with pinned dependencies.
* '''Image scanning''': production images should be scanned for known CVEs before deployment (Trivy, Grype, or native registry scanning). A clean build can contain a vulnerable base image.
</div>

<div style="background-color: #2F4F4F; color: #FFFFFF; padding: 20px; border-radius: 8px; margin-bottom: 15px;">