‫All right.
‫Last one and then we're done.
‫All right Vlad.
‫Thanks for waiting so we're on PHP FPM now another PSP user.
‫We're doing PHP FPM Alpine so this is a small image to start and then they load FPM on top of it and
‫then you're setting all of your versions up here.
‫Great.
‫Your directories setting up a bunch of different environment variables that you can override.
‫And then as a whole this is exactly this is HP.
‫This is this is true production HP.
‫Good job on that.
‫That's exactly how mine would look.
‫Now yeah you're setting P2P dependencies and then you're doing a P.K. down here.
‫Now I would probably do versions I would pin versions again down here and then
‫lots and lots of dependencies.
‫I would pin the ones that your app uses in production all of the little stuff like curl and get and
‫stuff.
‫You probably need a pen and you've got your pens down your PSP three so good for that good there.
‫And then even more extensions we got people in there we got all the proper Docker PSP extension installer.
‫So that's good then you're adding a composer user.
‫Great.
‫Right here.
‫So it's important to remember for everyone else that oh look at that in Alpine we cannot pen versions
‫of Alpine packages.
‫I did not know that.
‫That seems odd but I don't have enough information to to do that.
‫So this is an interesting point.
‫And if you watch my doctor over here I mentioned earlier and oh right here on the doctor talk so you
‫can go over to Dockers Web site and watch my talk from Dockercon and I give a 10 minute argument on minimal
‫images versus Alpine.
‫So if you're an HP and you're using the HP
‫images you might consider a Debian minimal image such as a slim uh.
‫Now they just have Alpine so unfortunately they're not using a slim option but with node and some other
‫ones there are slim options and sometimes I prefer those in fact most of them I prefer those over Alpine
‫because the difference is like 50 meg overall total.
‫So it's not I don't do it for size reasons.
‫And then lately with alpine between Alpine security issues the fact that you can't see V scan it very
‫well.
‫And so it actually to me right now is a container.
‫Alpine is less secure than the most current Debian release of a base image.
‫That's my opinion.
‫But I talk more about that and my Dockercon talk.
‫So scroll up in the chat or I'll throw it back in here one more time for those of you that have just
‫joined.
‫But I'm I might consider that if I can't pin versions because I'm just so paranoid because I've had
‫production outages due to version incompatibilities that I pin everything
‫all right.
‫So yeah I got composer and you're changing chose down here.
‫Yep.
‫Change and permissions.
‫Like you need to.
‫Good.
‫Good good you're copying over some of some stuff here.
‫Now you know you can actually make this.
‫Excuse me a copy command and actually now.
‫Never mind.
‫Don't do that.
‫Keep it like it is.
‫You're echoing in a memory limit.
‫That's good.
‫You can overstep.
‫You can set that and override that.
‫You've got a lot of copy files here.
‫It doesn't look like there's a whole lot of opportunity here for consolidating but you could consolidate
‫if they were going to the same directory like right.
‫Well you got some different names on the outs so yeah if you clean it up pretty well.
‫I was just looking for some opportunity to reduce the number of copies of they were doing setup for
‫Cron.
‫Looks like and then doing some last minute shown for the incoming app files.
‫And what did we do.
‫Do we do or copy our our code worked or at folder.
‫You've got a health check in your doctor file a plus.
‫So I love seeing health checks and Doctor files.
‫Cuba daddies won't take advantage of them but doctors swarm will and that way you don't have to depend
‫on an operations person to figure those out later.
‫So yeah at some oh it's a core image.
‫OK so you wouldn't be cupping your ear code into there.
‫Great.
‫And then yeah.
‫And so it looks like what you're doing here is it's up also something that I've used in production many
‫times especially with BHP is you're using supervisor as the base process and it's acting as the unit
‫and then it's launching the various things you need to launch.
‫And I'm assuming that since you have cron and you're gonna have PPF p.m. so there's probably some other
‫stuff here you're doing with supervisor engine X is gonna need to run.
‫So you're going to have at least three processes I bet as some processes and that's the right way to
‫do it.
‫To add sub supervisor in there.
‫Now if you were trying to avoid supervisor it does get tricky on swarm.
‫Oh and this log.
‫Yeah.
‫So I'm not sure why you're running the slug.
‫And you're not using Docker drivers but I'm sure you have a good reason.
‫But if you're using this log to then get them out into Dockers logging using FTD out.
‫That's really what you should be using FTD Aristide's out for logging and ideally not using this log
‫inside the image but that's the recommended best practice.
‫There are a few cases I've seen where it's necessary to use our source log but yeah overall it's a very
‫standard.
‫I think BHP file and it's looking like you're doing a lot of good stuff here.
‫What one thing you could really do if this is a base image.
‫One thing that you could maybe optimize is figuring out a way to combine your base image with your regular
‫images or use multi-stage to reduce any of this unnecessary if you don't need all this stuff right because
‫there's a lot of stuff you're adding in here and it's I don't know whether this stuff is really needed
‫by the production app or if it's just needed to do stuff before the app starts.
‫Right.
‫So now that we have multi-stage and maybe you're using that in your other files in your files that it's
‫coming from the other Docker files but now that we have multi-stage I really like to break out the build
‫dependencies from the production dependencies and basically at the very top I only put in the production
‫and that's the image that I will use at the end and it sort of flows in that way in case of your if
‫you're looking for an example.
‫Again going back to my Docker can't talk I go through a walking example in that Docker can talk here
‫on how you might break out and I think I had four or five stages where I had an initial stage is just
‫for production and sort of the base layer and then I have a dev dependency layer but that layer is never
‫used for production.
‫It's only used for development and all that stuff and then I have a build phase and have a testing phase
‫or stage and then I have the final production stage.
‫So it certainly makes the files look more complicated but I think at the end it reduces complexity of
‫your final image it reduces to attack surface so you maybe are already doing that in your other projects
‫and oh you're saying supervisor has problems with logging so interesting other than that I think it
‫looks like a great Docker file.
‫I think you've got to stop signal in there which I see very rarely I thought cig term was a default
‫but nothing wrong with setting a default in there just to be more literal.
‫But it is pretty cool that you know about that because I rarely see in Docker files because people don't
‫realise that that stop signal option exists so good for you on that because I think a lot is something
‫that my Docker can talk.
‫I talked a lot about was shutting down apps.
‫So the importance of properly shutting down connections.
‫I'm sure it looks like something that you've already known about and learned about in our handling in
‫your app.
‫So good stuff.