- [Instructor] And now it's story time.
Long long ago at a tech company right near you,
Carol learned about Docker
and created a Docker file for their new service.
It ran fine in production until one day
the site was down, it was an emergency.
Alice updated that image, saved it right over the old image
and everybody got on with their day.
She was a hero.
Nobody worried about how that image
no longer matched the Docker file.
And then Alice and Carol both moved on to new jobs
and bigger and better places.
And nobody was ever able to maintain that Docker file again.
They just kept using exactly as it was
like a golden image that nobody dares touch.
Here's a couple lessons I've learned
from extracting golden images out of enterprises.
Step one, include the installer in your project.
Five years from now the installer for version 0.18
of your project will not still be available.
Include it.
If you depend on a piece of software to build your image,
check it into your image, gets good for that.
Have a canonical build system
that builds your images from scratch.
That means starting from a base image
with that has not been touched
by anyone in your organization.
Running a Docker file, build it up to the thing
that you actually run in production.
Really really avoid the temptation
to log in one day, fix the config file,
save the image over the same name,
and get it back in production.
The first time you do that,
you no longer have a canonical build,
and you have created the golden image.
Docker makes it very very easy to do that
and very very difficult to resist.
Use small images.
If you start with a very large operating system
as the base for your system,
that large operating system takes large maintenances
and you're gonna be shuffling around
a lot of bits back and forth over the network
that really aren't being used.
When you're building images
that you're gonna share publicly,
say you ship your product as a Docker image,
build it from Dockerfiles, always.
There's nothing like going back to an old version
of the software that someone is complaining about bugs
and having no idea how it was built or how it got that way.
And just a little note, don't ever leave passwords
hidden in the deep layers of your Dockerfiles.
It's trivial for someone to dig through and find them.