The operational blueprint for multi-architecture image compilation, automated security hardening, and resilient fleet orchestration behind reverse proxies.
Never push secrets, active database files, or auth sessions to public registries. Add this mandatory rule file in root.
node_modules/ .env *.db *.sqlite .wwebjs_auth/ data/ *.log
Create the universal compiler instance, then build locally with --load to inspect contents before publication.
$ docker buildx create --use $ docker buildx build --load -t app:check . $ docker run -it --rm app:check ls -la
Compile both linux/amd64 (servers/NAS) and linux/arm64 (Apple Silicon / Pi) in a single unified push.
$ docker buildx build \ --platform linux/amd64,linux/arm64 \ -t username/app:latest \ --push .
version: '3.8'
services:
service-core:
image: username/app:latest
container_name: production-service
restart: unless-stopped
user: "1000:1000" # Run as non-root user
read_only: true # Immutable root filesystem
security_opt:
- no-new-privileges:true # Prevent privilege escalation
networks:
- internal-bridge
volumes:
- ./data:/app/data:rw
- /tmp:/tmp:rw
environment:
- NODE_ENV=production
networks:
internal-bridge:
driver: bridge
Never run containers as root (0:0). If compromised, an escaped process inherits root privileges on your host machine.
read_only)
Blocks malware or attackers from injecting malicious binaries into container paths. Only mounted persistent volumes remain writeable.
Containers must only expose ports to a local reverse proxy (like Nginx), never directly binding 0.0.0.0 on public host interfaces.
Always inspect actual reclaimable space before executing cleanups.
docker system df
Deletes anonymous intermediate images (<none>) created during rebuilds. Completely safe, zero data loss risk.
$ docker image prune -f
Multi-arch compilers accumulate hidden gigabytes in layer caches. Frees substantial disk space on CI servers and local dev machines.
$ docker buildx prune -a -f
Purges all stopped containers, all unused networks, and all images not actively used by a running container.
$ docker system prune -a \ --volumes -f
A single resilient Nginx gateway routes secure HTTPS traffic directly to isolated Docker internal container bridges.
Media and workflow synchronization engine.
Multi-device casting and presentation hub.
Main pavilion atrium, museum retrospective & laboratory.
server {
listen 443 ssl http2;
server_name jlstudio.redpandaium.com;
ssl_certificate /etc/letsencrypt/live/redpandaium.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/redpandaium.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:4000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
Master system prompts, standing rules, and multi-turn refactoring.