Containers Avançado
Internals, Build & Otimização

/var/lib/docker/overlay2/
├── <layer-sha>/
│   ├── diff/        ← conteúdo real da camada
│   ├── link         ← symlink curto (otimização de kernel)
│   └── lower        ← referência à camada inferior
└── <container-id>/
    ├── diff/        ← upperdir (writes do container)
    ├── merged/      ← mount point final
    └── work/        ← workdir do OverlayFS

# 3 containers rodando a mesma imagem nginx (200MB)
# Uso real em disco: ~200MB + delta de cada container
# SEM CoW seria: 3 × 200MB = 600MB

# Nunca confie no upperdir para dados persistentes
# Logs, uploads, checkpoints LangGraph → sempre em volume
VOLUME ["/app/checkpoints"]

# Inspecionar os namespaces de um processo
ls -la /proc/<pid>/ns/

# Entrar no namespace de um container manualmente
nsenter -t <pid> --net --pid -- bash

docker run --memory=512m --cpus=0.5 minha-app

# O Docker cria cgroups em:
/sys/fs/cgroup/memory/docker/<container-id>/memory.limit_in_bytes
/sys/fs/cgroup/cpu/docker/<container-id>/cpu.cfs_quota_us

{
  "containerDefinitions": [{
    "memory": 512,            // hard limit via cgroup → OOM kill se ultrapassar
    "memoryReservation": 256, // soft limit para o scheduler do ECS
    "cpu": 512                // 512 units = 0.5 vCPU
  }]
}

# ❌ Ruim: shell vira PID 1, não repassa SIGTERM
CMD python app.py

# ✅ Bom: python vira PID 1 diretamente (exec form)
CMD ["python", "app.py"]

# ✅ Melhor: tini como init mínimo
RUN apk add --no-cache tini
ENTRYPOINT ["/sbin/tini", "--"]
CMD ["python", "app.py"]

# ── Stage 1: Builder ──────────────────────────────────
FROM python:3.12 AS builder
WORKDIR /build
RUN pip install poetry
COPY pyproject.toml poetry.lock ./
RUN poetry export -f requirements.txt --without dev -o requirements.txt

# ── Stage 2: Runtime ──────────────────────────────────
FROM python:3.12-slim AS runtime
WORKDIR /app
COPY --from=builder /build/requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY src/ ./src/
RUN useradd -r -u 1001 appuser
USER appuser
CMD ["python", "-m", "uvicorn", "src.main:app", "--host", "0.0.0.0"]

FROM golang:1.22 AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
# CGO_ENABLED=0 → binário estático, sem dependência de libc
RUN CGO_ENABLED=0 GOOS=linux go build -o /app ./cmd/server

# Imagem final: SCRATCH — literalmente vazia
FROM scratch
COPY --from=builder /app /app
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
ENTRYPOINT ["/app"]

FROM python:3.12-slim AS base
RUN pip install -r requirements.txt

FROM base AS dev
RUN pip install pytest pytest-asyncio
CMD ["pytest"]

FROM base AS production
COPY src/ ./src/
CMD ["uvicorn", "src.main:app"]

# CI roda testes
docker build --target dev -t app:test .
docker run app:test

# Deploy usa produção
docker build --target production -t app:prod .

# Habilitar em versões antigas do Docker
DOCKER_BUILDKIT=1 docker build .

# syntax=docker/dockerfile:1

# ❌ pip baixa tudo do zero a cada build
RUN pip install -r requirements.txt

# ✅ cache mount: pip cache persiste no host entre builds
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install -r requirements.txt

# npm
RUN --mount=type=cache,target=/root/.npm \
    npm ci --prefer-offline

# cargo (Rust)
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    cargo build --release

# ❌ NUNCA — o token fica gravado na layer para sempre
RUN pip install git+https://token@github.com/org/pkg.git

# ✅ Secret mount: disponível só durante o RUN, nunca gravado
RUN --mount=type=secret,id=gh_token \
    pip install git+https://$(cat /run/secrets/gh_token)@github.com/org/pkg.git

docker build --secret id=gh_token,src=~/.github_token .

docker buildx build \
  --cache-to   type=registry,ref=<account>.dkr.ecr.<region>.amazonaws.com/cache:buildcache,mode=max \
  --cache-from type=registry,ref=<account>.dkr.ecr.<region>.amazonaws.com/cache:buildcache \
  --push -t <account>.dkr.ecr.<region>.amazonaws.com/app:latest .

.git
.github
**/__pycache__
**/*.pyc
**/.pytest_cache
.env*
tests/
docs/
.venv
node_modules

Host:
  ├── eth0     (interface física,  IP: 192.168.1.10)
  ├── docker0  (bridge virtual,   IP: 172.17.0.1)
  │   ├── veth3a4f → container1  (eth0: 172.17.0.2)
  │   └── veth8b2c → container2  (eth0: 172.17.0.3)
  └── iptables rules (NAT: container → internet)

docker network create minha-rede
docker run --name redis --network minha-rede redis
docker run --network minha-rede app  # usa "redis" como hostname — DNS interno

{
  "networkMode": "awsvpc",
  "networkConfiguration": {
    "awsvpcConfiguration": {
      "subnets": ["subnet-xxx"],
      "securityGroups": ["sg-xxx"],
      "assignPublicIp": "DISABLED"
    }
  }
}

Request → [Envoy sidecar] → [App container]
               ↓
         xDS control plane (App Mesh / Istio)
         (rotas, retries, timeouts, mTLS)

{
  "serviceConnectConfiguration": {
    "enabled": true,
    "namespace": "meu-cluster.local",
    "services": [{
      "portName": "http",
      "clientAliases": [{
        "port": 8080,
        "dnsName": "agente-orchestrator"
      }]
    }]
  }
}

# Agente A chama agente B — sem descoberta de IP manual
import httpx

# "agente-orchestrator" resolve via Envoy local
response = httpx.post(
    "http://agente-orchestrator:8080/invoke",
    json=payload,
    timeout=30.0
)

{
  "portMappings": [{
    "name": "grpc",
    "containerPort": 50051,
    "protocol": "tcp",
    "appProtocol": "grpc"  // request-level LB para HTTP/2 — crítico
  }]
}

# Rollback imediato para revisão anterior
aws ecs update-service \
  --cluster prod \
  --service agente-orchestrator \
  --task-definition agente-orchestrator:42

{
  "family": "agente-orchestrator",
  "taskRoleArn":      "arn:aws:iam::xxx:role/AgentTaskRole",
  "executionRoleArn": "arn:aws:iam::xxx:role/ECSExecutionRole",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "1024", "memory": "2048",
  "containerDefinitions": [{
    "name": "orchestrator",
    "image": "xxx.dkr.ecr.region.amazonaws.com/orchestrator:sha-abc123",
    "essential": true,
    "portMappings": [{ "name": "http", "containerPort": 8080, "appProtocol": "http" }],
    "environment": [
      { "name": "ENVIRONMENT", "value": "production" }
    ],
    "secrets": [
      { "name": "ANTHROPIC_API_KEY", "valueFrom": "arn:aws:secretsmanager:...:anthropic-key" },
      { "name": "REDIS_URL",         "valueFrom": "arn:aws:secretsmanager:...:redis-url" }
    ],
    "logConfiguration": {
      "logDriver": "awslogs",
      "options": {
        "awslogs-group":         "/ecs/agente-orchestrator",
        "awslogs-region":        "us-east-1",
        "awslogs-stream-prefix": "ecs"
      }
    },
    "healthCheck": {
      "command":     ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"],
      "interval": 30, "timeout": 5, "retries": 3, "startPeriod": 60
    },
    "stopTimeout": 120,
    "linuxParameters": { "initProcessEnabled": true }
  }]
}

ECS Agent → executionRole → [pull ECR, fetch secrets] → container inicia
Container → taskRole    → [S3.getObject, sqs.sendMessage, bedrock.invoke]

{
  "capacityProviderStrategy": [
    {
      "capacityProvider": "FARGATE",      // on-demand
      "weight": 1,
      "base": 2                           // mínimo 2 tasks garantidas aqui
    },
    {
      "capacityProvider": "FARGATE_SPOT", // até 70% mais barato
      "weight": 4,
      "base": 0
    }
  ]
}

{
  "autoScalingGroupProvider": {
    "autoScalingGroupArn": "arn:aws:autoscaling:...",
    "managedScaling": {
      "status": "ENABLED",
      "targetCapacity": 80,         // 80% utilizado, 20% de folga para novas tasks
      "minimumScalingStepSize": 1,
      "maximumScalingStepSize": 10
    },
    "managedTerminationProtection": "ENABLED" // nunca mata instância com task rodando
  }
}

aws application-autoscaling put-scaling-policy \
  --service-namespace ecs \
  --resource-id service/prod/agente-orchestrator \
  --scalable-dimension ecs:service:DesiredCount \
  --policy-type TargetTrackingScaling \
  --target-tracking-scaling-policy-configuration '{
    "TargetValue": 60.0,
    "PredefinedMetricSpecification": {
      "PredefinedMetricType": "ECSServiceAverageCPUUtilization"
    },
    "ScaleInCooldown": 300,
    "ScaleOutCooldown": 60
  }'

{
  "CustomizedMetricSpecification": {
    "MetricName": "ApproximateNumberOfMessagesVisible",
    "Namespace": "AWS/SQS",
    "Dimensions": [{ "Name": "QueueName", "Value": "agent-tasks" }],
    "Statistic": "Average"
  },
  "TargetValue": 10  // ~10 mensagens por task rodando
}

# ❌ Alpine + numpy = dor de cabeça
FROM python:3.12-alpine
RUN pip install numpy  # pode falhar ou demorar muito (compila C)

# ✅ slim é o melhor custo-benefício para Python
FROM python:3.12-slim
RUN pip install numpy  # wheels pré-compilados, funciona sempre

FROM python:3.12-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --prefix=/install -r requirements.txt
COPY src/ ./src/

FROM gcr.io/distroless/python3-debian12
COPY --from=builder /install /usr/local
COPY --from=builder /app/src /app/src
WORKDIR /app
CMD ["src/main.py"]

# ❌ Cada RUN cria uma camada — apt cache fica gravado
RUN apt-get update
RUN apt-get install -y curl
RUN rm -rf /var/lib/apt/lists/*

# ✅ Uma camada, cache limpo
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --no-cache-dir -r requirements.txt

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Manter últimas 10 imagens tagged com sha-",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["sha-"],
        "countType": "imageCountMoreThan",
        "countNumber": 10
      },
      "action": { "type": "expire" }
    },
    {
      "rulePriority": 2,
      "description": "Manter latest, main, staging",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["latest", "main", "staging"],
        "countType": "imageCountMoreThan",
        "countNumber": 3
      },
      "action": { "type": "expire" }
    },
    {
      "rulePriority": 3,
      "description": "Remover untagged após 7 dias",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 7
      },
      "action": { "type": "expire" }
    }
  ]
}

# ❌ :latest é ambíguo — qual versão exatamente?
docker push myrepo/app:latest

# ✅ Tag imutável com SHA do commit
GIT_SHA=$(git rev-parse --short HEAD)
docker build -t myrepo/app:sha-${GIT_SHA} .
docker push myrepo/app:sha-${GIT_SHA}

# Atualiza :latest também (para referência humana)
docker tag myrepo/app:sha-${GIT_SHA} myrepo/app:latest
docker push myrepo/app:latest

# Scan automático no push
aws ecr put-image-scanning-configuration \
  --repository-name minha-app \
  --image-scanning-configuration scanOnPush=true

# Consultar resultados
aws ecr describe-image-scan-findings \
  --repository-name minha-app \
  --image-id imageTag=sha-abc123