Docker Containerization for Node.js Applications

# Multi-stage Dockerfile for Node.js Banking Application
# Stage 1: Build stage
FROM node:20-alpine AS builder

# Set working directory
WORKDIR /app

# Copy package files
COPY package*.json ./
COPY tsconfig.json ./

# Install dependencies (including dev dependencies for build)
RUN npm ci --only=production=false

# Copy source code
COPY src/ ./src/
COPY public/ ./public/

# Build the application
RUN npm run build

# Remove dev dependencies
RUN npm prune --production

# Stage 2: Production stage
FROM node:20-alpine AS production

# Create non-root user for security
RUN addgroup -g 1001 -S nodejs
RUN adduser -S banking -u 1001

# Set working directory
WORKDIR /app

# Copy built application from builder stage
COPY --from=builder --chown=banking:nodejs /app/dist ./dist
COPY --from=builder --chown=banking:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=banking:nodejs /app/package*.json ./

# Install security updates
RUN apk update && apk upgrade && apk add --no-cache dumb-init

# Create logs directory
RUN mkdir -p /app/logs && chown banking:nodejs /app/logs

# Switch to non-root user
USER banking

# Expose port
EXPOSE 3000

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node healthcheck.js

# Use dumb-init for proper signal handling
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "dist/server.js"]

# Labels for metadata
LABEL maintainer="darshan@example.com"
LABEL version="1.0.0"
LABEL description="Banking Application API Server"
LABEL org.opencontainers.image.title="Banking API"
LABEL org.opencontainers.image.version="1.0.0"
LABEL org.opencontainers.image.created="2025-08-21"

# Banking Application Server (server.js)
// dist/server.js
const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');
const compression = require('compression');
const morgan = require('morgan');

const app = express();
const PORT = process.env.PORT || 3000;

// Security middleware
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      scriptSrc: ["'self'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'"]
    }
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true
  }
}));

// Rate limiting
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per windowMs
  message: 'Too many requests from this IP'
});
app.use('/api', limiter);

// CORS configuration
app.use(cors({
  origin: process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000'],
  credentials: true
}));

app.use(compression());
app.use(express.json({ limit: '10mb' }));
app.use(express.urlencoded({ extended: true, limit: '10mb' }));

// Request logging
app.use(morgan('combined'));

// Health check endpoint
app.get('/health', (req, res) => {
  res.status(200).json({
    status: 'healthy',
    timestamp: new Date().toISOString(),
    uptime: process.uptime(),
    memory: process.memoryUsage()
  });
});

// API routes
app.use('/api/accounts', require('./routes/accounts'));
app.use('/api/transactions', require('./routes/transactions'));
app.use('/api/users', require('./routes/users'));

// Error handling middleware
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({
    error: 'Internal Server Error',
    timestamp: new Date().toISOString()
  });
});

// 404 handler
app.use('*', (req, res) => {
  res.status(404).json({
    error: 'Route not found',
    path: req.originalUrl
  });
});

// Graceful shutdown
process.on('SIGTERM', () => {
  console.log('SIGTERM received, shutting down gracefully');
  server.close(() => {
    console.log('Process terminated');
  });
});

const server = app.listen(PORT, '0.0.0.0', () => {
  console.log(`Banking API Server running on port ${PORT}`);
});

// Health check script (healthcheck.js)
const http = require('http');

const options = {
  hostname: 'localhost',
  port: process.env.PORT || 3000,
  path: '/health',
  method: 'GET',
  timeout: 3000
};

const req = http.request(options, (res) => {
  if (res.statusCode === 200) {
    process.exit(0);
  } else {
    process.exit(1);
  }
});

req.on('timeout', () => {
  console.error('Health check timeout');
  process.exit(1);
});

req.on('error', (err) => {
  console.error('Health check failed:', err.message);
  process.exit(1);
});

req.end();

# docker-compose.yml - Development Environment
version: '3.8'

services:
  banking-api:
    build:
      context: .
      dockerfile: Dockerfile
      target: production
    container_name: banking-api
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
      - PORT=3000
      - DATABASE_URL=mongodb://mongo:27017/banking_dev
      - REDIS_URL=redis://redis:6379
      - JWT_SECRET=your-jwt-secret-key
      - ALLOWED_ORIGINS=http://localhost:3001,http://localhost:8080
    volumes:
      - ./src:/app/src:ro
      - ./logs:/app/logs
    depends_on:
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - banking-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "node", "healthcheck.js"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  mongo:
    image: mongo:7-jammy
    container_name: banking-mongo
    ports:
      - "27017:27017"
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: banking123
      MONGO_INITDB_DATABASE: banking_dev
    volumes:
      - mongo-data:/data/db
      - ./mongo-init:/docker-entrypoint-initdb.d:ro
    networks:
      - banking-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  redis:
    image: redis:7-alpine
    container_name: banking-redis
    ports:
      - "6379:6379"
    command: redis-server --appendonly yes --requirepass redis123
    volumes:
      - redis-data:/data
    networks:
      - banking-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "redis123", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3

  nginx:
    image: nginx:alpine
    container_name: banking-nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./ssl:/etc/nginx/ssl:ro
      - nginx-logs:/var/log/nginx
    depends_on:
      - banking-api
    networks:
      - banking-network
    restart: unless-stopped

  prometheus:
    image: prom/prometheus:latest
    container_name: banking-prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=200h'
      - '--web.enable-lifecycle'
    networks:
      - banking-network
    restart: unless-stopped

  grafana:
    image: grafana/grafana:latest
    container_name: banking-grafana
    ports:
      - "3001:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=grafana123
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/dashboards:/etc/grafana/provisioning/dashboards
      - ./grafana/datasources:/etc/grafana/provisioning/datasources
    networks:
      - banking-network
    restart: unless-stopped

networks:
  banking-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

volumes:
  mongo-data:
    driver: local
  redis-data:
    driver: local
  prometheus-data:
    driver: local
  grafana-data:
    driver: local
  nginx-logs:
    driver: local

# docker-compose.prod.yml - Production Configuration
version: '3.8'

services:
  banking-api:
    build:
      context: .
      dockerfile: Dockerfile
      target: production
    image: banking-api:latest
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - PORT=3000
      - DATABASE_URL=${DATABASE_URL}
      - REDIS_URL=${REDIS_URL}
      - JWT_SECRET=${JWT_SECRET}
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS}
    volumes:
      - /app/logs:/app/logs
    networks:
      - banking-network
    deploy:
      replicas: 3
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.5'
          memory: 256M
    healthcheck:
      test: ["CMD", "node", "healthcheck.js"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.prod.conf:/etc/nginx/nginx.conf:ro
      - ./ssl:/etc/nginx/ssl:ro
    depends_on:
      - banking-api
    networks:
      - banking-network
    deploy:
      replicas: 2
      restart_policy:
        condition: on-failure

networks:
  banking-network:
    external: true

# nginx.conf - Load Balancer Configuration
events {
    worker_connections 1024;
}

http {
    upstream banking_api {
        least_conn;
        server banking-api_1:3000 max_fails=3 fail_timeout=30s;
        server banking-api_2:3000 max_fails=3 fail_timeout=30s;
        server banking-api_3:3000 max_fails=3 fail_timeout=30s;
    }

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=auth:10m rate=5r/s;

    # SSL Configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    server {
        listen 80;
        server_name api.bankingapp.com;
        return 301 https://$server_name$request_uri;
    }

    server {
        listen 443 ssl http2;
        server_name api.bankingapp.com;

        ssl_certificate /etc/nginx/ssl/cert.pem;
        ssl_certificate_key /etc/nginx/ssl/key.pem;

        # Security headers
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header X-Frame-Options DENY always;
        add_header X-Content-Type-Options nosniff always;
        add_header X-XSS-Protection "1; mode=block" always;

        # API endpoints
        location /api/ {
            limit_req zone=api burst=20 nodelay;
            
            proxy_pass http://banking_api;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_cache_bypass $http_upgrade;
            
            # Timeouts
            proxy_connect_timeout 5s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
        }

        # Authentication endpoints with stricter rate limiting
        location /api/auth/ {
            limit_req zone=auth burst=10 nodelay;
            proxy_pass http://banking_api;
        }

        # Health check endpoint
        location /health {
            proxy_pass http://banking_api;
            access_log off;
        }

        # Static files (if any)
        location /static/ {
            alias /app/public/;
            expires 30d;
            add_header Cache-Control "public, immutable";
        }
    }
}

# .dockerignore - Exclude sensitive files
node_modules/
npm-debug.log*
yarn-debug.log*
yarn-error.log*
.env
.env.local
.env.development.local
.env.test.local
.env.production.local
.git/
.gitignore
README.md
Dockerfile
.dockerignore
coverage/
.coverage
.nyc_output
.cache
.parcel-cache
.DS_Store
*.swp
*.swo
*~

# Security scanning configuration
# .hadolint.yml
override:
  warning:
    - DL3008
    - DL3009
  error:
    - DL3014
  info:
    - DL3059

# Security policies (docker-security.yml)
version: '1.0'
security:
  # Container runtime security
  runtime:
    # Run as non-root user
    runAsNonRoot: true
    runAsUser: 1001
    runAsGroup: 1001
    
    # Read-only root filesystem
    readOnlyRootFilesystem: true
    
    # Drop all capabilities
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      seccompProfile:
        type: RuntimeDefault

  # Network security
  network:
    # Limit network access
    networkPolicy:
      enabled: true
      ingress:
        - from:
            - namespaceSelector:
                matchLabels:
                  name: banking-namespace
        - ports:
            - protocol: TCP
              port: 3000

  # Resource limits
  resources:
    limits:
      cpu: "1"
      memory: "512Mi"
      ephemeral-storage: "1Gi"
    requests:
      cpu: "100m"
      memory: "128Mi"
      ephemeral-storage: "100Mi"

# Advanced Dockerfile with security hardening
FROM node:20-alpine AS base

# Install security updates and tools
RUN apk update && \
    apk upgrade && \
    apk add --no-cache \
        dumb-init \
        curl \
        tini && \
    rm -rf /var/cache/apk/*

# Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S banking -u 1001 -G nodejs

# Set secure defaults
ENV NODE_ENV=production
ENV NPM_CONFIG_LOGLEVEL=warn
ENV NPM_CONFIG_PROGRESS=false

FROM base AS dependencies

WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies with security audit
RUN npm ci --only=production --no-audit && \
    npm audit --production --audit-level=moderate && \
    npm cache clean --force

FROM base AS build

WORKDIR /app

# Copy package files and source
COPY package*.json ./
COPY tsconfig.json ./
COPY src/ ./src/

# Install all dependencies and build
RUN npm ci && \
    npm run build && \
    npm prune --production

FROM base AS production

WORKDIR /app

# Copy built application and dependencies
COPY --from=build --chown=banking:nodejs /app/dist ./dist
COPY --from=dependencies --chown=banking:nodejs /app/node_modules ./node_modules
COPY --chown=banking:nodejs package*.json ./
COPY --chown=banking:nodejs healthcheck.js ./

# Create required directories with correct permissions
RUN mkdir -p /app/logs /app/tmp && \
    chown -R banking:nodejs /app/logs /app/tmp && \
    chmod 755 /app/logs /app/tmp

# Switch to non-root user
USER banking

# Remove package managers to reduce attack surface
RUN rm -rf /usr/local/bin/npm /usr/local/bin/npx

# Security labels
LABEL security.scan="enabled"
LABEL security.vendor="Banking Corp"
LABEL security.compliance="PCI-DSS"

# Health check with security timeout
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node healthcheck.js || exit 1

EXPOSE 3000

# Use tini for proper signal handling
ENTRYPOINT ["tini", "--"]
CMD ["node", "dist/server.js"]

# Security scanning script (scripts/security-scan.sh)
#!/bin/bash

echo "Running security scans..."

# Dockerfile linting
echo "Linting Dockerfile..."
hadolint Dockerfile

# Vulnerability scanning
echo "Scanning for vulnerabilities..."
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(pwd):/workspace \
  aquasec/trivy image --exit-code 1 banking-api:latest

# Container security benchmarks
echo "Running CIS Docker Benchmark..."
docker run --rm --net host --pid host --userns host --cap-add audit_control \
  -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
  -v /etc:/etc:ro \
  -v /usr/bin/containerd:/usr/bin/containerd:ro \
  -v /usr/bin/runc:/usr/bin/runc:ro \
  -v /usr/lib/systemd:/usr/lib/systemd:ro \
  -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  --label docker_bench_security \
  docker/docker-bench-security

# Image signing and verification
echo "Signing container image..."
export DOCKER_CONTENT_TRUST=1
docker trust key generate banking-key
docker trust signer add --key banking-key.pub banking-signer banking-api
docker trust sign banking-api:latest

echo "Security scan completed!"

# Container runtime security monitoring
# monitoring/security-monitor.js
const express = require('express');
const prometheus = require('prom-client');

const app = express();

// Security metrics
const securityMetrics = {
  authFailures: new prometheus.Counter({
    name: 'banking_auth_failures_total',
    help: 'Total number of authentication failures',
    labelNames: ['method', 'ip']
  }),
  
  suspiciousRequests: new prometheus.Counter({
    name: 'banking_suspicious_requests_total',
    help: 'Total number of suspicious requests detected',
    labelNames: ['type', 'severity']
  }),
  
  rateLimitHits: new prometheus.Counter({
    name: 'banking_rate_limit_hits_total',
    help: 'Total number of rate limit violations',
    labelNames: ['endpoint', 'ip']
  }),
  
  containerRestarts: new prometheus.Counter({
    name: 'banking_container_restarts_total',
    help: 'Total number of container restarts',
    labelNames: ['service', 'reason']
  })
};

// Security event logging
const logSecurityEvent = (event, metadata) => {
  const securityLog = {
    timestamp: new Date().toISOString(),
    event,
    metadata,
    severity: metadata.severity || 'INFO'
  };
  
  console.log('SECURITY_EVENT:', JSON.stringify(securityLog));
  
  // Increment relevant metrics
  switch (event) {
    case 'AUTH_FAILURE':
      securityMetrics.authFailures.inc({
        method: metadata.method,
        ip: metadata.ip
      });
      break;
    case 'SUSPICIOUS_REQUEST':
      securityMetrics.suspiciousRequests.inc({
        type: metadata.type,
        severity: metadata.severity
      });
      break;
    case 'RATE_LIMIT_HIT':
      securityMetrics.rateLimitHits.inc({
        endpoint: metadata.endpoint,
        ip: metadata.ip
      });
      break;
  }
};

// Metrics endpoint
app.get('/metrics', (req, res) => {
  res.set('Content-Type', prometheus.register.contentType);
  res.end(prometheus.register.metrics());
});

module.exports = { logSecurityEvent, securityMetrics };

# k8s/namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: banking-production
  labels:
    name: banking-production
    environment: production

---
# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: banking-api
  namespace: banking-production
  labels:
    app: banking-api
    version: v1.0.0
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: banking-api
  template:
    metadata:
      labels:
        app: banking-api
        version: v1.0.0
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "3000"
        prometheus.io/path: "/metrics"
    spec:
      serviceAccountName: banking-api-service-account
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 1001
      containers:
      - name: banking-api
        image: banking-api:1.0.0
        imagePullPolicy: Always
        ports:
        - containerPort: 3000
          name: http
        env:
        - name: NODE_ENV
          value: "production"
        - name: PORT
          value: "3000"
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: banking-secrets
              key: database-url
        - name: JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: banking-secrets
              key: jwt-secret
        - name: REDIS_URL
          valueFrom:
            secretKeyRef:
              name: banking-secrets
              key: redis-url
        resources:
          limits:
            cpu: 1000m
            memory: 512Mi
            ephemeral-storage: 1Gi
          requests:
            cpu: 100m
            memory: 128Mi
            ephemeral-storage: 100Mi
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 15
          periodSeconds: 10
          timeoutSeconds: 3
          failureThreshold: 3
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
              - ALL
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: logs
          mountPath: /app/logs
      volumes:
      - name: tmp
        emptyDir: {}
      - name: logs
        emptyDir: {}
      nodeSelector:
        node-type: api

---
# k8s/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: banking-api-service
  namespace: banking-production
  labels:
    app: banking-api
spec:
  selector:
    app: banking-api
  ports:
  - name: http
    port: 80
    targetPort: 3000
    protocol: TCP
  type: ClusterIP

---
# k8s/hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: banking-api-hpa
  namespace: banking-production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: banking-api
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 10
        periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 60
      policies:
      - type: Percent
        value: 50
        periodSeconds: 60

---
# k8s/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: banking-api-ingress
  namespace: banking-production
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rate-limit: "100"
    nginx.ingress.kubernetes.io/rate-limit-window: "1m"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - api.bankingapp.com
    secretName: banking-api-tls
  rules:
  - host: api.bankingapp.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: banking-api-service
            port:
              number: 80

---
# k8s/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: banking-secrets
  namespace: banking-production
type: Opaque
data:
  database-url: <base64-encoded-database-url>
  jwt-secret: <base64-encoded-jwt-secret>
  redis-url: <base64-encoded-redis-url>

---
# k8s/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: banking-config
  namespace: banking-production
data:
  app-config.json: |
    {
      "logging": {
        "level": "info",
        "format": "json"
      },
      "security": {
        "rateLimiting": {
          "windowMs": 900000,
          "max": 100
        }
      },
      "monitoring": {
        "enabled": true,
        "endpoint": "/metrics"
      }
    }

---
# k8s/network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: banking-api-network-policy
  namespace: banking-production
spec:
  podSelector:
    matchLabels:
      app: banking-api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 3000
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: database
    ports:
    - protocol: TCP
      port: 27017
  - to:
    - namespaceSelector:
        matchLabels:
          name: redis
    ports:
    - protocol: TCP
      port: 6379
  - to: []
    ports:
    - protocol: TCP
      port: 443
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53

# .github/workflows/docker-deploy.yml
name: Docker Build and Deploy

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  REGISTRY: docker.io
  IMAGE_NAME: banking-api

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'
    
    - name: Upload Trivy scan results
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: 'trivy-results.sarif'

  build:
    needs: security-scan
    runs-on: ubuntu-latest
    outputs:
      image-digest: ${{ steps.build.outputs.digest }}
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    
    - name: Log in to registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
    
    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=sha,prefix={{branch}}-
          type=raw,value=latest,enable={{is_default_branch}}
    
    - name: Build and push Docker image
      id: build
      uses: docker/build-push-action@v5
      with:
        context: .
        platforms: linux/amd64,linux/arm64
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        build-args: |
          NODE_ENV=production
          BUILD_DATE=${{ github.event.head_commit.timestamp }}
          VCS_REF=${{ github.sha }}
    
    - name: Sign container image
      env:
        COSIGN_EXPERIMENTAL: 1
      run: |
        cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}

  test-container:
    needs: build
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Test container functionality
      run: |
        # Pull the built image
        docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
        
        # Run container tests
        docker run --rm --name test-container \
          -e NODE_ENV=test \
          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
          npm test
        
        # Test health endpoint
        docker run -d --name health-test \
          -p 3000:3000 \
          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
        
        sleep 10
        curl -f http://localhost:3000/health || exit 1
        docker stop health-test

  security-container-scan:
    needs: build
    runs-on: ubuntu-latest
    
    steps:
    - name: Run Trivy container scan
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest'
        format: 'table'
        exit-code: '1'
        ignore-unfixed: true
        severity: 'CRITICAL,HIGH'

  deploy-staging:
    if: github.ref == 'refs/heads/develop'
    needs: [build, test-container, security-container-scan]
    runs-on: ubuntu-latest
    environment: staging
    
    steps:
    - name: Deploy to staging
      run: |
        # Update Kubernetes deployment
        kubectl set image deployment/banking-api \
          banking-api=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:develop-${{ github.sha }} \
          -n banking-staging
        
        # Wait for rollout
        kubectl rollout status deployment/banking-api -n banking-staging
        
        # Run smoke tests
        kubectl run smoke-test --rm -i --restart=Never \
          --image=curlimages/curl \
          -- curl -f http://banking-api-service.banking-staging.svc.cluster.local/health

  deploy-production:
    if: github.ref == 'refs/heads/main'
    needs: [build, test-container, security-container-scan]
    runs-on: ubuntu-latest
    environment: production
    
    steps:
    - name: Deploy to production
      run: |
        # Blue-green deployment
        kubectl patch deployment banking-api \
          -p='{"spec":{"template":{"spec":{"containers":[{"name":"banking-api","image":"${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main-${{ github.sha }}"}]}}}}' \
          -n banking-production
        
        # Wait for rollout
        kubectl rollout status deployment/banking-api -n banking-production --timeout=600s
        
        # Health check
        kubectl run production-health-check --rm -i --restart=Never \
          --image=curlimages/curl \
          -- curl -f http://banking-api-service.banking-production.svc.cluster.local/health

# Docker security scanning configuration
# .trivyignore
# Ignore known issues in base images that are patched
CVE-2023-12345
CVE-2023-67890

# Build optimization script
# scripts/optimize-build.sh
#!/bin/bash

set -e

echo "Optimizing Docker build..."

# Multi-architecture build
docker buildx create --name banking-builder --use
docker buildx build --platform linux/amd64,linux/arm64 \
  --cache-from type=registry,ref=banking-api:cache \
  --cache-to type=registry,ref=banking-api:cache,mode=max \
  --tag banking-api:optimized \
  --push .

# Image size analysis
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  wagoodman/dive banking-api:optimized --ci

echo "Build optimization completed!"

# Container resource monitoring
# monitoring/resource-monitor.js
const prometheus = require('prom-client');

const resourceMetrics = {
  memoryUsage: new prometheus.Gauge({
    name: 'container_memory_usage_bytes',
    help: 'Current memory usage in bytes',
    labelNames: ['container', 'pod']
  }),
  
  cpuUsage: new prometheus.Gauge({
    name: 'container_cpu_usage_percent',
    help: 'Current CPU usage percentage',
    labelNames: ['container', 'pod']
  }),
  
  diskUsage: new prometheus.Gauge({
    name: 'container_disk_usage_bytes',
    help: 'Current disk usage in bytes',
    labelNames: ['container', 'pod']
  })
};

// Monitor resource usage
setInterval(() => {
  const memUsage = process.memoryUsage();
  const cpuUsage = process.cpuUsage();
  
  resourceMetrics.memoryUsage.set({
    container: process.env.HOSTNAME,
    pod: process.env.POD_NAME
  }, memUsage.rss);
  
  // Log resource alerts
  if (memUsage.rss > 400 * 1024 * 1024) { // 400MB
    console.warn('High memory usage detected:', memUsage.rss);
  }
}, 30000);

module.exports = resourceMetrics;