CodePark/ questions / Environment, config & secrets
START PRACTICINGPRACTICE
Backend question · Docker › Environment, config & secrets

Why should the same Docker image be promoted from staging to production instead of building a separate image per environment?

Because the image is the thing you tested. If you rebuild for production, some things can change:

  • the base image patches
  • how dependencies resolve
  • the build steps

Then what runs in production is no longer exactly what you tested.

The Twelve-Factor approach (a well-known set of rules for building apps) keeps the build separate from the config:

  • Build one image.
  • Tag it with a version or a commit SHA.
  • Give it everything environment-specific at runtime, through environment variables or mounted config files.

Database URLs, API keys, log levels and feature flags change between environments. The code does not change.

This has two requirements. The image must not contain environment-specific files or secrets. The app must read its config from the environment when it starts.

  • The image you tested is the image that ships.
  • Rebuilding can change dependencies and base layers.
  • Config comes from the environment at runtime.
  • Tag images with a value that never changes, such as the commit SHA.