Amaliy loyiha - to'liq yetkazish

loyiha/
├── compose.yaml
├── .dockerignore
└── ilova/
    ├── Dockerfile
    ├── boshla.sh      # ilova
    └── sinov.sh       # testlar

#!/bin/sh
trap 'echo "SIGTERM - toza toxtaymiz"; exit 0' TERM

echo "dokon: ishga tushdi, versiya ${DOKON_VERSIYA}"

psql "$BAZA_URL" -q -c "
  CREATE TABLE IF NOT EXISTS buyurtma (id serial PRIMARY KEY, nomi text);
  INSERT INTO buyurtma (nomi) SELECT 'Olma'
    WHERE NOT EXISTS (SELECT 1 FROM buyurtma);"

while true; do
  printf 'HTTP/1.1 200 OK\r\n\r\nOK\n' \
    | nc -l -p 8080 >/dev/null 2>&1 || sleep 1
done &
wait

#!/bin/sh
test -x /boshla.sh || { echo "TEST XATO: boshla.sh bajarilmaydi"; exit 1; }
grep -q 'trap' /boshla.sh \
    || { echo "TEST XATO: SIGTERM ishlovchisi yo'q"; exit 1; }
echo "TEST OK: barcha tekshiruv o'tdi"

FROM alpine:3.21 AS asos
RUN apk add --no-cache postgresql-client netcat-openbsd \
    && adduser -D -u 10001 dokon
COPY --chmod=755 boshla.sh /boshla.sh
ENV DOKON_VERSIYA=1.0

FROM asos AS sinov
COPY --chmod=755 sinov.sh /sinov.sh
RUN /sinov.sh

FROM asos AS yakuniy
USER dokon
EXPOSE 8080
CMD ["/boshla.sh"]

docker build -q --target sinov -t dokon-sinov:1 ./ilova >/dev/null \
    && echo "testlar o'tdi"

docker images 127.0.0.1:5001/dokon/ilova:1.0 --format '{{.Size}}'
docker inspect 127.0.0.1:5001/dokon/ilova:1.0 \
    -f 'Foydalanuvchi: {{.Config.User}}'

docker run --rm -v /tmp/trivy-cache:/root/.cache aquasec/trivy:latest \
    image --quiet --severity CRITICAL --format json \
    127.0.0.1:5001/dokon/ilova:1.0 2>/dev/null \
    | grep -c '"VulnerabilityID"' || true

name: dokon

services:
  ilova:
    image: 127.0.0.1:5001/dokon/ilova:1.0
    environment:
      BAZA_URL: postgres://postgres:sinov@baza:5432/dokon
    depends_on:
      baza: { condition: service_healthy }
    networks: [old, orqa]
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }
    deploy:
      resources:
        limits: { cpus: "0.5", memory: 128M, pids: 100 }

  baza:
    image: postgres:17-alpine
    environment:
      POSTGRES_PASSWORD: sinov
      POSTGRES_DB: dokon
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d dokon"]
      interval: 2s
      retries: 20
    volumes: [dokon-ma:/var/lib/postgresql/data]
    networks: [orqa]
    restart: unless-stopped
    logging:
      driver: json-file
      options: { max-size: "10m", max-file: "3" }

networks:
  old:
  orqa:

volumes:
  dokon-ma:

docker compose ps --format '{{.Service}} {{.State}}' | sort
docker compose logs ilova --no-log-prefix | head -2

for f in ReadonlyRootfs CapDrop PidsLimit Memory SecurityOpt; do
    printf '%-16s %s\n' "$f" \
        "$(docker inspect dokon-ilova-1 -f "{{.HostConfig.$f}}")"
done
docker inspect dokon-ilova-1 -f 'Foydalanuvchi    {{.Config.User}}'

docker network inspect dokon_orqa \
    -f '{{range .Containers}}{{.Name}}
{{end}}' | sort | grep .

docker compose down >/dev/null 2>&1
docker compose up -d --wait >/dev/null 2>&1
sleep 2
docker compose exec -T baza psql -U postgres -d dokon -t -A -c \
    'SELECT count(*) FROM buyurtma'

docker run --rm -v dokon_dokon-ma:/ma -v /tmp/loyiha:/zaxira \
    alpine:3.21 tar czf /zaxira/dokon-ma.tar.gz -C /ma . 2>/dev/null
test -s /tmp/loyiha/dokon-ma.tar.gz && echo "zaxira yaratildi"

docker compose stop ilova >/dev/null 2>&1
docker inspect dokon-ilova-1 -f 'Chiqish kodi: {{.State.ExitCode}}'