Containerized Microservices with Full Automation

Source: Dev.to

The Big Picture

What we’re building

A production‑ready TODO application with:

• Multiple microservices (5 different programming languages)
• Automated infrastructure provisioning (Terraform)
• Automated configuration management (Ansible)
• CI/CD pipelines with drift detection
• Automatic HTTPS with Traefik
• Zero‑trust security model

Architecture

graph TD
    A[Traefik (HTTPS/Proxy)] --> B[Frontend (Vue.js)]
    A --> C[Auth API (Go)]
    A --> D[Todos API (Node.js)]
    C --> E[Users API (Java Spring)]
    C --> F[Redis Queue]
    C --> G[Log Processor (Python)]

Understanding the Application

The Services

1. Frontend (Vue.js)

• User interface, login page → TODO dashboard
• Communicates with backend APIs
• Exposed on ports 80/443 via Traefik

2. Auth API (Go)

• Handles user authentication and issues JWT tokens
• Endpoint: /api/auth

3. Todos API (Node.js)

• Manages TODO items (CRUD)
• Requires a valid JWT token
• Endpoint: /api/todos

4. Users API (Java Spring Boot)

• User management and profile operations
• Endpoint: /api/users

5. Log Processor (Python)

• Processes background tasks, consumes from Redis queue, writes audit logs

6. Redis Queue

• Message broker for async operations

Phase 1: Containerization

Frontend Dockerfile (Vue.js)

# Multi‑stage build for optimized production image

# Stage 1 – build the application
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# Stage 2 – serve with nginx
FROM nginx:alpine
COPY --from=builder /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/conf.d/default.conf

HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget --quiet --tries=1 --spider http://localhost/ || exit 1

EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

Why multi‑stage builds?
The builder stage is ~800 MB (includes build tools); the final stage is ~25 MB (only nginx + static files), a 97 % size reduction.

Frontend nginx config

server {
    listen 80;
    root /usr/share/nginx/html;
    index index.html;

    # SPA routing – send all requests to index.html
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Cache static assets
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
}

Auth API Dockerfile (Go)

# Multi‑stage build for Go

# Stage 1 – build the binary
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main .

# Stage 2 – minimal runtime image
FROM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /root/
COPY --from=builder /app/main .
HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget --quiet --tries=1 --spider http://localhost:8080/health || exit 1

EXPOSE 8080
CMD ["./main"]

Why this approach?
Builder stage ~400 MB; final stage ~15 MB (static binary, no runtime dependencies). Faster startup and a smaller attack surface.

Todos API Dockerfile (Node.js)

FROM node:18-alpine
WORKDIR /app

# Install dependencies first (better caching)
COPY package*.json ./
RUN npm ci --only=production

# Copy application code
COPY . .

# Create non‑root user for security
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001 && \
    chown -R nodejs:nodejs /app

USER nodejs

HEALTHCHECK --interval=30s --timeout=3s \
  CMD node healthcheck.js || exit 1

EXPOSE 3000
CMD ["node", "server.js"]

Security note: Running as a non‑root user limits damage if the container is compromised.

Users API Dockerfile (Java Spring Boot)

# Multi‑stage build for Java

# Stage 1 – build with Maven
FROM maven:3.9-eclipse-temurin-17 AS builder
WORKDIR /app
COPY pom.xml ./
RUN mvn dependency:go-offline
COPY src ./src
RUN mvn clean package -DskipTests

# Stage 2 – runtime
FROM eclipse-temurin:17-jre-alpine
WORKDIR /app
COPY --from=builder /app/target/*.jar app.jar

HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget --quiet --tries=1 --spider http://localhost:8080/actuator/health || exit 1

EXPOSE 8080
ENTRYPOINT ["java", "-jar", "/app/app.jar"]

Java‑specific optimizations

ENTRYPOINT ["java",
  "-XX:+UseContainerSupport",
  "-XX:MaxRAMPercentage=75.0",
  "-XX:+ExitOnOutOfMemoryError",
  "-jar", "/app/app.jar"]

Log Processor Dockerfile (Python)

FROM python:3.11-slim
WORKDIR /app

# Install dependencies
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy application
COPY . .

# Create non‑root user
RUN useradd -m -u 1001 processor && \
    chown -R processor:processor /app

USER processor

HEALTHCHECK --interval=30s --timeout=3s \
  CMD ps aux | grep processor.py || exit 1

CMD ["python", "processor.py"]

Docker Compose – Orchestrating Everything

version: '3.8'

services:
  # Traefik reverse proxy
  traefik:
    image: traefik:v2.10
    container_name: traefik
    command:
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      # Let's Encrypt (example configuration)
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=you@example.com"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "letsencrypt:/letsencrypt"

  # Frontend (Vue.js)
  frontend:
    build: ./frontend
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=Host(`todo.example.com`)"
      - "traefik.http.routers.frontend.entrypoints=websecure"
      - "traefik.http.routers.frontend.tls.certresolver=myresolver"

  # Auth API (Go)
  auth:
    build: ./auth
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.auth.rule=Host(`auth.todo.example.com`)"
      - "traefik.http.routers.auth.entrypoints=websecure"
      - "traefik.http.routers.auth.tls.certresolver=myresolver"

  # Todos API (Node.js)
  todos:
    build: ./todos
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.todos.rule=Host(`api.todo.example.com`)"
      - "traefik.http.routers.todos.entrypoints=websecure"
      - "traefik.http.routers.todos.tls.certresolver=myresolver"

  # Users API (Java Spring Boot)
  users:
    build: ./users
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.users.rule=Host(`users.todo.example.com`)"
      - "traefik.http.routers.users.entrypoints=websecure"
      - "traefik.http.routers.users.tls.certresolver=myresolver"

  # Log Processor (Python)
  logprocessor:
    build: ./logprocessor

  # Redis Queue
  redis:
    image: redis:7-alpine
    command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - "redis-data:/data"

volumes:
  letsencrypt:
  redis-data: