---
name: infrastructure
source: botcore
description: >
  Docker, CI/CD pipelines, and deployment best practices.
  Use when containerizing apps, setting up pipelines, or preparing for production deployment.
version: "1.0.0"
triggers:
  - infrastructure
  - Docker
  - CI/CD
  - deployment
  - Kubernetes
  - pipeline
  - container
  - GitHub Actions
---

# Infrastructure

Best practices for containerization, CI/CD, and deployment.

## When to Use

- Containerizing an application
- Setting up CI/CD pipelines
- Preparing for production deployment
- Reviewing infrastructure code
- Debugging deployment issues

## Dockerfile Best Practices

```dockerfile
# ✅ Good: Multi-stage build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY . .
USER node
EXPOSE 3000
CMD ["node", "server.js"]
```

### Dockerfile Checklist

- [ ] Multi-stage builds (smaller images)
- [ ] Non-root user (`USER node`)
- [ ] `.dockerignore` configured
- [ ] Specific base image tags (not `latest`)
- [ ] Health check defined
- [ ] Minimal layers (combine RUN commands)

## CI/CD Pipeline Essentials

```yaml
# GitHub Actions example
name: CI
on: [push, pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - run: npm ci
      - run: npm test
      - run: npm run build
```

### Pipeline Stages

| Stage | Purpose | Fail Fast |
|-------|---------|-----------|
| Lint | Code style | ✅ Yes |
| Test | Unit/integration | ✅ Yes |
| Build | Compile/bundle | ✅ Yes |
| Security | Dependency scan | ⚠️ Warn |
| Deploy | Ship to env | ❌ Manual gate |

## Environment Parity

Keep dev, staging, and production as similar as possible:

| Aspect | Requirement |
|--------|-------------|
| Base images | Same versions |
| Environment vars | Same names, different values |
| Dependencies | Exact versions (lockfiles) |
| Database | Same engine version |

## Secret Management

```yaml
# ❌ Bad: Secrets in code
DATABASE_URL: postgres://user:password@host/db

# ✅ Good: Reference secrets
DATABASE_URL: ${{ secrets.DATABASE_URL }}
```

### Secret Storage Options

| Tool | Use Case |
|------|----------|
| GitHub Secrets | CI/CD pipelines |
| AWS Secrets Manager | Production apps |
| HashiCorp Vault | Enterprise, multi-cloud |
| Doppler | Cross-platform sync |

## Health Checks

```typescript
// Liveness - is the process running?
app.get('/health/live', (req, res) => res.send('OK'));

// Readiness - can it accept traffic?
app.get('/health/ready', async (req, res) => {
  const dbOk = await checkDatabase();
  const cacheOk = await checkCache();
  if (dbOk && cacheOk) return res.send('OK');
  res.status(503).send('Not Ready');
});
```

## Resource Limits

```yaml
# Kubernetes example
resources:
  requests:
    memory: "128Mi"
    cpu: "100m"
  limits:
    memory: "256Mi"
    cpu: "500m"
```

## Rollback Capability

- [ ] Blue-green or canary deployments
- [ ] Database migrations are backward-compatible
- [ ] Feature flags for risky changes
- [ ] Quick rollback mechanism (< 5 min)

## Anti-Patterns

| Avoid | Instead |
|-------|---------|
| `latest` tags | Specific version tags |
| Root user in containers | Non-root user |
| Secrets in env files committed | Secret manager |
| Manual deployments | Automated pipelines |
| No health checks | Liveness + readiness probes |

## Checklist

- [ ] Dockerfile follows best practices
- [ ] CI pipeline runs lint, test, build
- [ ] Secrets not in code or git
- [ ] Health check endpoints
- [ ] Resource limits defined
- [ ] Rollback tested
- [ ] Environment parity verified
