Docker
Docker is the tool that turns an application and its dependencies into a container image, an immutable filesystem that runs the same way on a laptop, on EKS and in Lambda. Both application blueprints ship as images built from a Dockerfile in their code repository.
What it does
A Dockerfile lists the steps that produce an image: a base image, packages to install, files to copy, the user to run as and the command to start. Multi-stage builds use one stage to fetch or compile and a second, smaller stage for runtime. An image is pushed to a registry under a tag; a Kubernetes pod or a Lambda function references the registry, repository and tag.
How BuiltForProd uses it
The web API (acme-aws-blueprint-webapp-code/Dockerfile) is a two-stage build on python:3.12-slim. The first stage installs curl only to download the RDS certificate bundle that DocumentDB TLS needs; the runtime stage copies that file, installs the Python requirements and the source, and never contains curl. It creates a fixed user and group with id 10001 and switches to it, exposes port 8080, declares a HEALTHCHECK against /health using Python rather than an extra binary, and starts Gunicorn with four workers and two threads, logging to standard output. The Helm chart pins runAsUser to the same 10001, so the image and the pod security context agree.
The ETL trigger (acme-aws-blueprint-etl-code/src/functions/etl_trigger/Dockerfile) starts from the AWS Lambda Python 3.12 base image, applies operating-system updates, installs the requirements and the handler, and sets main.handler as the command.
Build, scan, push. On a pull request, ci.yml builds the image and runs a Trivy scan that fails on fixable CRITICAL and HIGH vulnerabilities. On merge to main, cd-integration.yml logs in to ECR with OIDC credentials and pushes with the docker/build-push-action under the single tag main-<short sha>. The ECR repositories in the artifacts account are immutable, so a tag can never be moved; a GitHub Release adds a vX.Y.Z tag to the same image rather than rebuilding it. There is no latest. The immutable artifacts page explains why.
Where images run. EKS nodes in the platform accounts pull from ECR through the repository's cross-account read policy; the ETL Lambda pulls through the Lambda-specific read policy. Optional self-hosted runners install Docker at startup so they can build images too.
Terms you will see
| Term | Meaning |
|---|---|
| Base image | The image a Dockerfile starts from, such as python:3.12-slim. |
| Multi-stage build | Separate build and runtime stages so tools never ship in the final image. |
| Tag | A name for one image version; immutable in the platform's registries. |
| Digest | The content hash that identifies an image regardless of tags. |
| Non-root user | The fixed uid 10001 the web image runs as. |
Where to read more
- ECR for the registries
- Immutable artifacts
- Checkov, Trivy and tflint for the image scan
- Web App Blueprint overview