Docker từ Cơ bản đến Nâng cao

Phần 4: Security, Monitoring và CI/CD

xdev.asia

1. Tối ưu Build Performance

1.1. BuildKit

# Enable BuildKit
export DOCKER_BUILDKIT=1
Hoặc permanent trong daemon.json
{ "features": { "buildkit": true } }
BuildKit features:
- Parallel build stages
- Better caching
- Cache mount
- Secret mount
- SSH forwarding

1.2. Layer Caching nâng cao

# Cache package manager downloads
FROM node:20-alpine
WORKDIR /app
Cache npm packages
RUN --mount=type=cache,target=/root/.npm 

--mount=type=bind,source=package.json,target=package.json 

--mount=type=bind,source=package-lock.json,target=package-lock.json 

npm ci --only=production
COPY . .
CMD ["node", "server.js"]

# Python - Cache pip downloads
FROM python:3.12-slim
WORKDIR /app
RUN --mount=type=cache,target=/root/.cache/pip \
    --mount=type=bind,source=requirements.txt,target=requirements.txt \
    pip install -r requirements.txt
COPY . .

1.3. Build Context Optimization

# Kiểm tra build context size
docker build --no-cache . 2>&1 | head -5
Sử dụng .dockerignore hiệu quả
Chỉ include files cần thiết

# .dockerignore
*
!src/
!package*.json
!tsconfig.json

1.4. Remote Cache

# Export cache vào registry
docker buildx build \
    --cache-to type=registry,ref=myregistry/myapp:cache \
    --cache-from type=registry,ref=myregistry/myapp:cache \
    -t myapp:latest .
GitHub Actions cache
docker buildx build 

--cache-from type=gha 

--cache-to type=gha,mode=max 

-t myapp:latest .

2. Container Runtime Performance

2.1. Resource Management (cgroups v2)

# CPU limits
docker run -d \
    --cpus=2.0 \                    # Giới hạn 2 CPU cores
    --cpu-shares=1024 \              # Relative weight
    --cpuset-cpus="0-3" \            # Pin to specific CPUs
    myapp
Memory limits
docker run -d 

--memory=1g \                    # Hard limit
--memory-reservation=512m \      # Soft limit
--memory-swap=2g \               # Swap limit
--oom-kill-disable=false \       # Cho phép OOM killer
myapp
I/O limits
docker run -d 

--device-read-bps /dev/sda:100mb 

--device-write-bps /dev/sda:50mb 

--device-read-iops /dev/sda:1000 

myapp

2.2. Kernel Parameters

# Tối ưu sysctl cho containers
docker run -d \
    --sysctl net.core.somaxconn=65535 \
    --sysctl net.ipv4.tcp_max_syn_backlog=65535 \
    nginx
Ulimits
docker run -d 

--ulimit nofile=65535:65535 

--ulimit nproc=65535:65535 

myapp

3. Storage Driver Optimization

// daemon.json - overlay2 (recommended)
{
  "storage-driver": "overlay2",
  "storage-opts": [
    "overlay2.override_kernel_check=true"
  ]
}

# Kiểm tra storage driver
docker info | grep "Storage Driver"

# Disk usage
docker system df
docker system df -v

# Cleanup unused data
docker system prune -a --volumes

# Xem layer sizes
docker history --no-trunc myapp:latest

4. Network Performance Tuning

# Host network - best performance (no NAT overhead)
docker run -d --network host myapp
Disable userland proxy
daemon.json: { "userland-proxy": false }
MTU optimization
docker network create --opt com.docker.network.driver.mtu=9000 my-network

5. Image Size Optimization

# Analyze image layers
docker history myapp:latest
dive myapp:latest  # Interactive layer analysis tool
Slim images
docker-slim build myapp:latest

Size comparison example:

# Node.js app
node:20          → 1.1 GB
node:20-slim     → 240 MB
node:20-alpine   → 130 MB
distroless/nodejs → 120 MB
Với multi-stage build
myapp (full)     → 1.1 GB
myapp (optimized) → 80 MB  (giảm 93%)

6. Benchmarking Tools

# Container benchmark
docker run --rm \
    -v /var/run/docker.sock:/var/run/docker.sock \
    docker/docker-bench-security
Network benchmark
docker run -it --rm networkstatic/iperf3 -s  # Server
docker run -it --rm networkstatic/iperf3 -c host_ip  # Client
Disk I/O benchmark
docker run --rm -v test-vol:/data 

alpine sh -c "dd if=/dev/zero of=/data/test bs=1M count=1024 conv=fdatasync"
HTTP benchmark
docker run --rm williamyeh/wrk -t4 -c100 -d30s http://api:3000/

7. Performance Monitoring

# Real-time stats
docker stats --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.MemPerc}}\t{{.NetIO}}\t{{.BlockIO}}"
Top processes trong container
docker top my-app
Detailed resource usage
docker exec my-app cat /proc/1/status
docker exec my-app cat /sys/fs/cgroup/memory.current

8. Performance Checklist

• ☐ BuildKit enabled

• ☐ .dockerignore optimized

• ☐ Multi-stage builds

• ☐ Layer caching maximized

• ☐ Minimal base images

• ☐ Resource limits set

• ☐ Storage driver: overlay2

• ☐ Regular cleanup (prune)

• ☐ Monitoring in place

9. Tổng kết

Trong bài này, bạn đã nắm được:

• BuildKit và layer caching optimization

• Container runtime resource management

• Storage driver và disk optimization

• Network performance tuning

• Image size optimization

• Benchmarking và monitoring tools

Bài tiếp theo sẽ hướng dẫn Docker Swarm - Container Orchestration.