containerize-and-ship-a-servicelisted

# Containerize & ship a service How a backend service is **built into an image** and **shipped through CI/CD**. Examples are Docker + GitLab CI with a Node/pnpm service; the principles port to any stack/CI. principle → **▸ Example** → **▸ Other stacks**. Branch→release flow itself is `git-flow`; DB migration rules are `database-migrations`; release backward-compat is `release-safety` — this skill is the *build + pipeline* mechanics. ## Core principle **A small, reproducible image with NO secrets baked in, shipped by a thin per-repo pipeline that includes one shared template, gated by branch.** Build creds live only in a throwaway build stage; runtime secrets come from the environment at deploy; the pipeline is maintained once, not per service. ## 1. Multi-stage build — heavy builder → slim runner Compile in a builder stage; copy only the build output + production deps into a clean runtime stage, so toolchains/dev-deps never ship. ```dockerfile FROM <registry>/node:22-alpine AS builder WORKDIR /app RUN corepack enable && corepack prepare pnpm@<ver> --activate COPY package.json pnpm-lock.yaml ./ # manifest first (cache) — see §4 RUN pnpm install --frozen-lockfile COPY . . RUN pnpm run build && pnpm store prune FROM <registry>/node:22-alpine AS runner # clean runtime base WORKDIR /app COPY package.json pnpm-lock.yaml ./ COPY --from=builder /app/dist ./ # only the build output RUN corepack enable && pnpm install --prod --frozen-lockfile && pnpm stor