check-docker-production-readiness

Docker Production Readiness Checker

Evaluate Docker configuration for production deployment of PHP applications using a scored checklist.

Production Readiness Checklist

1. HEALTHCHECK Instruction (10 pts)

HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=3 \
    CMD php-fpm-healthcheck || exit 1

2. STOPSIGNAL for Graceful Shutdown (10 pts)

# PHP-FPM needs SIGQUIT for graceful stop
STOPSIGNAL SIGQUIT

3. Logging to stdout/stderr (10 pts)

# BAD: Logging to files
RUN echo "error_log = /var/log/php/error.log" >> php.ini

# GOOD: Logging to stderr for Docker log driver
RUN echo "error_log = /proc/self/fd/2" >> php.ini

4. OPcache with validate_timestamps=0 (10 pts)

RUN echo "opcache.validate_timestamps=0" >> /usr/local/etc/php/conf.d/opcache.ini && \
    echo "opcache.enable=1" >> /usr/local/etc/php/conf.d/opcache.ini && \
    echo "opcache.memory_consumption=256" >> /usr/local/etc/php/conf.d/opcache.ini

5. PHP-FPM Dynamic pm Mode (10 pts)

pm = dynamic
pm.max_children = 50
pm.start_servers = 10
pm.min_spare_servers = 5
pm.max_spare_servers = 20
pm.max_requests = 1000

6. Non-Root User (10 pts)

RUN groupadd -r appuser && useradd -r -g appuser appuser
COPY --chown=appuser:appuser . /var/www/html
USER appuser

7. Resource Limits in Compose (10 pts)

services:
  php-fpm:
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 1G

8. Restart Policy (5 pts)

services:
  app:
    restart: unless-stopped

9. .dockerignore Present (5 pts)

.git
.env
node_modules
vendor
tests
docs

10. No Dev Dependencies (10 pts)

RUN composer install --no-dev --optimize-autoloader --classmap-authoritative

11. Signal Handling Entrypoint (10 pts)

COPY docker-entrypoint.sh /usr/local/bin/
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["php-fpm"]

Grep Patterns

Grep: "HEALTHCHECK" --glob "**/Dockerfile*"
Grep: "STOPSIGNAL" --glob "**/Dockerfile*"
Grep: "error_log.*=.*/var/log" --glob "**/Dockerfile*"
Grep: "validate_timestamps" --glob "**/Dockerfile*"
Grep: "^USER" --glob "**/Dockerfile*"
Grep: "composer install" --glob "**/Dockerfile*"
Grep: "^(CMD|ENTRYPOINT)" --glob "**/Dockerfile*"
Glob: "**/.dockerignore"

Score Calculation

Check	Points	Weight
HEALTHCHECK present	10	Required
STOPSIGNAL SIGQUIT	10	Required
Logging to stdout/stderr	10	Required
OPcache validate_timestamps=0	10	Required
PHP-FPM dynamic pm	10	Recommended
Non-root USER	10	Required
Resource limits	10	Recommended
Restart policy	5	Recommended
.dockerignore present	5	Recommended
No dev dependencies	10	Required
Signal handling entrypoint	10	Recommended
Total	100

Rating: 90-100 Production Ready | 70-89 Needs Improvement | Below 70 Not Ready

Output Format

## Production Readiness Report

**Score:** X/100 — [Production Ready / Needs Improvement / Not Ready]

| # | Check | Status | Points |
|---|-------|--------|--------|
| 1 | HEALTHCHECK | Pass/Fail | 10/0 |

### Findings

#### [Check Name] — FAIL
**File:** `Dockerfile:line`
**Issue:** [What is missing]
**Fix:** [How to fix it]

### Recommendations
- [Prioritized list of improvements]