Mahmoud Abas, Full-Stack Software Engineer & AI

Operating Systems 2 - Lab 09: Docker Advanced - Optimization, Volumes, Compose & Environment Variables

In the print dialog, choose "Save as PDF" as the destination.

Operating Systems II - Lab 09

Docker Advanced: Optimization, Volumes, Compose, and Environment Variables

Faster builds, hot reload with bind mounts, multi-container Compose, and env vars

The .dockerignore File

.dockerignore: Works like .gitignore, but for the Docker build context: it excludes files from being sent to the daemon.

Prevents secrets and bloat from leaking into images
Typical exclusions: node_modules, Dockerfile, .env, .git, *.log

text

node_modules
Dockerfile
.env
.git
*.log

A minimal .dockerignore.

Layer Caching Strategy

Docker caches each instruction's layer and reuses it if nothing above it changed
Once a layer is invalidated, every layer below it rebuilds too

Copy package.json + package-lock.json

npm install

cached unless deps change

Copy source code

doesn't bust the install cache

dockerfile

COPY package.json package-lock.json ./
RUN npm install
COPY . .

Copy dependency files first, install, then copy source, so code edits don't bust the install cache.

The Hot-Reload Problem

docker exec -it <container> bash opens a live shell inside a running container to inspect it directly
nodemon restarts the Node.js server automatically when watched files change

Bind Mounts

Bind Mount: A bind mount links a host directory directly into the container: host edits appear instantly, no rebuild needed.

Use $(pwd) for the absolute host path (%cd% on Windows); relative paths don't work

bash

docker run -d -p 4000:4000 -v $(pwd):/app my-express-app

Read-Only Bind Mounts and Anonymous Volumes

A plain bind mount is two-way: the container could also write back and delete host files, a security risk
Add :ro to make it read-only: -v $(pwd):/app:ro
A read-only mount also blocks node_modules from existing if it's missing on the host, fixed with an anonymous volume

bash

docker run -d -v $(pwd):/app:ro -v /app/node_modules my-express-app

Volume Types Summary

Type	Syntax	Use Case
Bind Mount	`-v /host:/container`	Two-way dev sync
Read-Only Bind Mount	`-v /host:/container:ro`	Safer source sync
Anonymous Volume	`-v /container`	Protect `node_modules`
Named Volume	`-v myvolume:/container`	Database persistence

Docker Compose Basics

Compose defines and runs multi-container setups from one YAML file, replacing long docker build/docker run commands
One command starts everything

bash

docker compose up -d

Becomes essential once an app needs multiple services, app, database, cache, reverse proxy, that must talk to each other

docker-compose.yml Structure

Key fields: container_name, build, ports, volumes, environment, env_file, depends_on
Unlike docker run -v, Compose accepts relative paths like ./src
YAML is indentation-sensitive; keep child keys consistently indented

yaml

services:
  node-app:
    build: .
    ports:
      - "4000:4000"
    volumes:
      - ./src:/app/src:ro

Essential Compose Commands

Command	What It Does
`docker compose up -d`	Build if needed, start all services in the background
`docker compose down`	Stop and remove containers (add `-v` to also remove volumes)
`docker compose logs -f <service>`	Follow a service's logs
`docker compose exec <service> bash`	Open a shell inside a running service

Environment Variables

Method	Where It's Set
`ENV`	Dockerfile instruction, baked into the image
`--env` / `-e`	`docker run` flag
`--env-file`	`docker run` flag, loads a whole file
`environment:`	Inline in `docker-compose.yml`
`env_file:`	In `docker-compose.yml`, recommended for secrets

yaml

services:
  node-app:
    env_file:
      - .env

Key Takeaways

.dockerignore keeps secrets and bloat out of images; ordering Dockerfile instructions correctly keeps builds fast via caching
Bind mounts enable hot reload; :ro makes them safer, and anonymous volumes protect directories like node_modules
Docker Compose replaces long manual commands with one declarative YAML file and one command to start everything
Compose supports relative paths and connects services automatically over an internal network
Environment variables should live in .env and be loaded via env_file, never hardcoded into the image
docker exec -it and docker logs are the go-to tools for inspecting a running container

Open this lesson

Mahmoud AbasLab 09: Docker Advanced - Optimization, Volumes, Compose & Environment Variables

Type

Syntax

Use Case

Bind Mount

-v /host:/container

Two-way dev sync

Read-Only Bind Mount

-v /host:/container:ro

Safer source sync

Anonymous Volume

-v /container

Protect node_modules

Named Volume

-v myvolume:/container

Database persistence

Command

What It Does

docker compose up -d

Build if needed, start all services in the background

docker compose down

Stop and remove containers (add -v to also remove volumes)

docker compose logs -f <service>

Follow a service's logs

docker compose exec <service> bash

Open a shell inside a running service

Method

Where It's Set

ENV

Dockerfile instruction, baked into the image

--env / -e

docker run flag

--env-file

docker run flag, loads a whole file

environment:

Inline in docker-compose.yml

env_file:

In docker-compose.yml, recommended for secrets