BM: Baca dalam Bahasa Melayu
World D2: Recipes · Boss challenge
Shrink ray
You will learn: to pack a real site with nginx: small, non-root and reachable.
Checked with Docker Engine 29 on 31 Oct 2026
The problem
Your laptop~/diary
- No open hatches
Lunchboxes (containers)
- No containers yet
Frozen packs (images)
- nginx:1.30-alpine8 layers · 93.5MB
- nginx:latest7 layers · 243MB
0 containers (0 running), 2 images, 0 lockers.
Boss: the Shrink ray! Pack your diary site with nginx. Finish line: under 100MB, no secret notes inside, and not running as root.
Try it
Stage 1: make it work. Build diary:1.0 and serve it on laptop port 8080.
Your laptop~/diary
- No open hatches
Lunchboxes (containers)
- No containers yet
Frozen packs (images)
- nginx:1.30-alpine8 layers · 93.5MB
- nginx:latest7 layers · 243MB
0 containers (0 running), 2 images, 0 lockers.
Hint
Build first, then run with-p 8080:80.Check
docker images says diary:1.0 is 241MB. The target is under 100MB. Which move helps most?
Pick one answer.
Try it
Stage 2: plan the shrink. Get the meal pack to 70MB or less.
Shrink the meal pack under 70MB. Every button is a real trick.
Image size 186MB
Target: 70MBStart: 186MB
Base image
Recipe tricks
Dockerfile
FROM nginx:1.29 COPY . /usr/share/nginx/html
Try it
Stage 3: shrink for real. Leave notes.txt at home, and build diary:2.0 on nginx:1.30-alpine.
Your laptop~/diary
- No open hatches
Lunchboxes (containers)
- No containers yet
Frozen packs (images)
- nginx:1.30-alpine8 layers · 93.5MB
- nginx:latest7 layers · 243MB
0 containers (0 running), 2 images, 0 lockers.
Hint
The recipe starts withARG BASE. --build-arg BASE=... swaps the base.Predict
You add only USER nginx to the recipe. What happens when the box starts?
Pick one answer.
Try it
Stage 4: no root. This recipe already gives nginx its folders. Add USER nginx, build diary:3.0, run it on 8080, and knock.
Your laptop~/diary
- No open hatches
Lunchboxes (containers)
- No containers yet
Frozen packs (images)
- nginx:1.30-alpine8 layers · 93.5MB
0 containers (0 running), 1 images, 0 lockers.
Hint
Stuck?docker logs web shows why a box stopped.You did it!
You can now pack a real site: small, safe and non-root.
Go deeper (optional)
Why the chown line? nginx writes its cache to /var/cache/nginx and its process id to /run/nginx.pid. As root, it may. As nginx, only if it owns them. Some platforms block low ports for normal users. Many teams use 8080.
Real mission
docker images
0 of 4 steps done · Your ticks are saved.
Bahasa Melayu
Boss: Sinar pengecut! Bungkus laman diari anda dengan nginx. Garisan penamat: bawah 100MB, tiada nota rahsia di dalam, dan tidak berjalan sebagai root.
Peringkat 1: buat ia berfungsi. Bina diary:1.0 dan hidangkan di port laptop 8080.
-p 8080:80.docker images kata diary:1.0 ialah 241MB. Sasarannya bawah 100MB. Langkah mana paling membantu?
Peringkat 2: rancang pengecutan. Kecilkan pek makanan ke 70MB atau kurang.
Peringkat 3: kecilkan betul-betul. Tinggalkan notes.txt di rumah, dan bina diary:2.0 atas nginx:1.30-alpine.
ARG BASE. --build-arg BASE=... tukar asasnya.Anda tambah USER nginx sahaja pada resepi. Apa jadi bila bekas itu mula?
Peringkat 4: tanpa root. Resepi ini sudah serahkan folder kepada nginx. Tambah USER nginx, bina diary:3.0, jalankan di 8080, dan ketuk.
docker logs web tunjuk kenapa bekas berhenti.Kini anda boleh bungkus laman sebenar: kecil, selamat dan bukan root.
You finished this before. Practice is always welcome!
Official docs: Docker docs: Best practices · Docker docs: Build context · Dockerfile reference: USER
You've learned for 25 minutes. A short break helps your brain.
Sprint done! Great focus. Stretch for a minute?