wsl --install
# Reinicia el sistema después de la instalación
wsl --set-default-version 2
wsl --status

docker --version
Docker version 28.1.0, build abc1234

docker info
Client: Docker Engine - Community
 Version: 28.1.0
 Server Version: 28.1.0
 ...

docker run hello-world
Hello from Docker!
This message shows that your installation appears to be working correctly.

# 1. Remover versiones antiguas
sudo apt remove docker docker-engine docker.io containerd runc

# 2. Instalar dependencias
sudo apt update && sudo apt install -y \
  ca-certificates curl gnupg lsb-release

# 3. Agregar GPG key oficial de Docker
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

# 4. Agregar repositorio
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# 5. Instalar Docker Engine
sudo apt update && sudo apt install -y \
  docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin

# 6. Agregar usuario al grupo docker (no usar sudo)
sudo usermod -aG docker $USER
newgrp docker

# 7. Verificar
docker run hello-world

# Opción 1: Homebrew (recomendado)
brew install --cask docker

# Opción 2: Alternativa sin Docker Desktop (más ligera)
brew install colima docker
colima start --cpu 4 --memory 8

# Verificar
docker version
docker context ls

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "default-address-pools": [
    {"base": "172.17.0.0/16", "size": 24}
  ],
  "live-restore": true,
  "metrics-addr": "0.0.0.0:9323",
  "storage-driver": "overlay2"
}

# Agregar repositorio Docker
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager \
  --add-repo https://download.docker.com/linux/fedora/docker-ce.repo

# Instalar Docker Engine
sudo dnf install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin

# Habilitar y arrancar el servicio
sudo systemctl enable --now docker

# Agregar usuario al grupo docker
sudo usermod -aG docker $USER && newgrp docker

# ── CREAR Y EJECUTAR ─────────────────────────────
docker run nginx                  # Corre en primer plano
docker run -d nginx               # -d: modo detached (background)
docker run -it ubuntu bash        # -i: interactivo, -t: terminal
docker run --name mi-app -d nginx # Nombre personalizado
docker run -p 8080:80 -d nginx    # -p host:container port mapping
docker run -P -d nginx            # -P: mapear todos los puertos automáticamente
docker run --rm -it alpine sh     # --rm: eliminar al terminar

# ── LISTAR ───────────────────────────────────────
docker ps                          # Contenedores en ejecución
docker ps -a                       # Todos (incluyendo detenidos)
docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

# ── INSPECCIONAR ────────────────────────────────
docker inspect mi-app             # JSON completo del contenedor
docker inspect -f '{{.NetworkSettings.IPAddress}}' mi-app
docker logs mi-app                # Ver logs
docker logs -f mi-app             # -f: follow (en tiempo real)
docker logs --tail 50 mi-app      # Últimas 50 líneas
docker stats                       # Uso de CPU/RAM en tiempo real
docker top mi-app                 # Procesos dentro del contenedor

# ── INTERACTUAR ─────────────────────────────────
docker exec -it mi-app bash       # Shell dentro del contenedor
docker exec mi-app env            # Ver variables de entorno
docker exec mi-app cat /etc/os-release
docker cp mi-app:/app/config.json ./config.json  # Copiar archivos

# ── CICLO DE VIDA ───────────────────────────────
docker start mi-app
docker stop mi-app                # SIGTERM + espera 10s + SIGKILL
docker restart mi-app
docker kill mi-app                # SIGKILL inmediato
docker pause mi-app               # Congelar (SIGSTOP)
docker unpause mi-app

# ── LIMPIAR ─────────────────────────────────────
docker rm mi-app                  # Eliminar contenedor detenido
docker rm -f mi-app               # Forzar eliminación (en ejecución)
docker container prune            # Eliminar TODOS los detenidos
docker system prune -a           # Limpiar TODO lo no usado

docker images                     # Listar imágenes locales
docker images -a                  # Incluir capas intermedias
docker pull nginx:alpine          # Descargar imagen
docker pull nginx:1.27            # Versión específica
docker push usuario/mi-imagen:v1  # Subir a registry
docker tag nginx:alpine mi-nginx:prod  # Crear alias/tag
docker rmi nginx:alpine           # Eliminar imagen
docker image prune -a             # Eliminar imágenes sin uso
docker history nginx:alpine       # Ver capas de la imagen
docker image inspect nginx:alpine # Detalles completos
docker save nginx:alpine > nginx.tar     # Exportar a archivo
docker load < nginx.tar           # Importar desde archivo

docker info                       # Información completa del daemon
docker version                    # Versión cliente y servidor
docker system df                  # Uso de disco por tipo
docker system events              # Stream de eventos en tiempo real
docker system prune --volumes     # Limpieza completa incluyendo volúmenes

# Formatear salida con Go templates
docker ps --format "{{.Names}} → {{.Status}} ({{.Ports}})"

# Filtrar contenedores
docker ps --filter "status=exited"
docker ps --filter "name=web"
docker ps --filter "ancestor=nginx"

docker history python:3.12-slim
IMAGE          CREATED        CREATED BY                         SIZE
a1b2c3d4e5f6   2 days ago     CMD ["python3"]                    0B
<missing>      2 days ago     ENV PYTHON_VERSION=3.12.0          0B
<missing>      2 days ago     RUN apt-get update && apt-get...   52.3MB
<missing>      2 days ago     ENV LANG=C.UTF-8                   0B
<missing>      2 days ago     /bin/sh -c #(nop) ADD file:...    74.8MB

docker image inspect python:3.12-slim --format '{{.RootFS.Layers}}'
[sha256:a1b2... sha256:c3d4... sha256:e5f6...]

# Autenticarse en Docker Hub
docker login
docker login -u miusuario -p mitoken  # Con token (mejor práctica)

# Buscar imágenes
docker search nginx
docker search --filter is-official=true python

# Descargar con digest específico (reproducible)
docker pull nginx@sha256:abc123...

# Publicar imagen propia
docker tag mi-app:v1.0 miusuario/mi-app:v1.0
docker push miusuario/mi-app:v1.0
docker push miusuario/mi-app:latest

# Cerrar sesión
docker logout

# Analizar vulnerabilidades de una imagen
docker scout cves nginx:alpine
✓ Image stored for indexing
✓ Indexed 82 packages
✗ Detected 2 vulnerabilities
  CVE-2024-xxxxx [MEDIUM] - libssl3

# Comparar dos versiones
docker scout compare nginx:1.25 nginx:1.27

# Recomendaciones de actualización
docker scout recommendations mi-app:latest

# Ver SBOM (Software Bill of Materials)
docker scout sbom nginx:alpine

# Comentario — ignorado por el builder
FROM        python:3.12-slim     # Imagen base
LABEL       maintainer="team@empresa.com"  # Metadatos
ARG         APP_VERSION="1.0"   # Variable de build
ENV         PYTHONDONTWRITEBYTECODE=1  # Variable de entorno
WORKDIR     /app                 # Directorio de trabajo
COPY        requirements.txt .   # Copiar archivo
RUN         pip install -r requirements.txt  # Ejecutar comando
COPY        . .                  # Copiar resto del código
EXPOSE      8000                 # Documentar puerto
HEALTHCHECK CMD curl -f http://localhost:8000/health || exit 1
USER        appuser              # Cambiar usuario
CMD         ["python", "main.py"]  # Comando por defecto

FROM ubuntu:24.04
FROM python:3.12-slim AS builder
FROM scratch                    # Imagen vacía, para binarios estáticos
FROM ubuntu:24.04 AS base
FROM base AS development
FROM base AS production

# ❌ Mal: múltiples RUN = múltiples capas
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get clean

# ✅ Bien: una sola capa, cache limpio
RUN apt-get update && apt-get install -y \
    curl wget git \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Exec form (sin shell, para evitar interpretación)
RUN ["/bin/sh", "-c", "echo hello"]

# RUN con heredoc (BuildKit, 2024+)
RUN <<EOF
  set -e
  pip install --upgrade pip
  pip install -r requirements.txt
EOF

COPY src/ /app/src/
COPY --chown=appuser:appgroup . /app  # Con propietario
COPY --from=builder /app/dist /app    # Multi-stage
ADD  app.tar.gz /app/                 # Extrae automáticamente

# ARG: solo disponible durante build
ARG NODE_VERSION="20"
ARG BUILD_DATE
FROM node:${NODE_VERSION}-alpine

# ENV: disponible en build Y en runtime
ENV NODE_ENV=production
ENV PORT=3000 \
    APP_HOME=/app

# Pasar ARG al build:
docker build --build-arg NODE_VERSION=22 .

# WORKDIR: establece directorio de trabajo
WORKDIR /app  # Crea el dir si no existe

# USER: evita correr como root
RUN groupadd -r appgroup && useradd -r -g appgroup appuser
USER appuser
# O con UID/GID directo (más portable)
USER 1001:1001

# EXPOSE: documentar puertos (no los abre realmente)
EXPOSE 80/tcp
EXPOSE 443/tcp
EXPOSE 9090/udp

# VOLUME: punto de montaje para datos persistentes
VOLUME ["/data", "/logs"]

# Solo CMD (reemplazable)
CMD ["nginx", "-g", "daemon off;"]

# Solo ENTRYPOINT (fijo)
ENTRYPOINT ["/docker-entrypoint.sh"]

# ENTRYPOINT + CMD combinados (patrón profesional)
ENTRYPOINT ["python", "manage.py"]
CMD ["runserver", "0.0.0.0:8000"]
# docker run django-app migrate  ← CMD se reemplaza

HEALTHCHECK --interval=30s --timeout=10s --retries=3 --start-period=40s \
  CMD curl -f http://localhost:8000/health || exit 1

# Para apps sin curl (usar wget o nc)
HEALTHCHECK CMD wget -qO- http://localhost/ || exit 1

# Deshabilitar healthcheck heredado
HEALTHCHECK NONE

# ── STAGE 1: Build ────────────────────────────────────
FROM golang:1.23-alpine AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /app/server ./cmd/server

# ── STAGE 2: Producción mínima ────────────────────────
FROM scratch AS production
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /app/server /server
EXPOSE 8080
USER 65534:65534  # nobody:nogroup
ENTRYPOINT ["/server"]

# Build: docker build --target production -t mi-go-app .
# Resultado: imagen de ~8MB vs ~350MB con Go completo

# ── STAGE 1: Dependencias ────────────────────────────
FROM node:22-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# ── STAGE 2: Builder ─────────────────────────────────
FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# ── STAGE 3: Producción Nginx ────────────────────────
FROM nginx:1.27-alpine AS production
COPY --from=builder /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

# Node
node_modules/
npm-debug.log

# Python
__pycache__/
*.pyc
.venv/
.env
*.egg-info/

# Control de versiones
.git/
.gitignore

# IDE
.vscode/
.idea/

# Tests y docs
tests/
docs/
README.md

# Build artifacts
dist/
build/
*.log

# syntax=docker/dockerfile:1.7
FROM python:3.12-slim

# Cache mount para pip (no reinstala si no cambia)
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install -r requirements.txt

# Secret mount (nunca queda en la imagen)
RUN --mount=type=secret,id=mysecret \
    cat /run/secrets/mysecret

# SSH mount para paquetes privados
RUN --mount=type=ssh \
    pip install git+ssh://git@github.com/miorg/paquete-privado.git

# Build con secreto:
# docker build --secret id=mysecret,src=./secreto.txt .

# Listar redes
docker network ls
NETWORK ID     NAME      DRIVER    SCOPE
abc123         bridge    bridge    local
def456         host      host      local
ghi789         none      null      local

# Crear red personalizada
docker network create mi-red
docker network create --driver bridge --subnet 172.20.0.0/16 mi-red

# Conectar contenedor a red
docker run -d --name web --network mi-red nginx
docker run -d --name db --network mi-red postgres:16

# Desde 'web', el contenedor 'db' es alcanzable por nombre
docker exec web ping db
PING db (172.20.0.3): 56 data bytes
64 bytes from 172.20.0.3: icmp_seq=0 ttl=64 time=0.082 ms

# Inspeccionar red
docker network inspect mi-red

# Conectar/desconectar contenedor existente
docker network connect mi-red contenedor-existente
docker network disconnect mi-red contenedor-existente

# Eliminar red
docker network rm mi-red
docker network prune  # Eliminar redes sin uso

# Alias de red (múltiples nombres para un contenedor)
docker run -d --name postgres-primary \
  --network mi-red \
  --network-alias db \
  --network-alias database \
  postgres:16

# Ahora desde otro contenedor en mi-red puedes usar:
# psql -h db -U user mydb
# psql -h database -U user mydb
# psql -h postgres-primary -U user mydb

# -p hostPort:containerPort
docker run -p 8080:80 nginx           # localhost:8080 → container:80
docker run -p 127.0.0.1:8080:80 nginx # Solo desde localhost
docker run -p 80 nginx                 # Puerto host aleatorio
docker run -P nginx                    # Todos los EXPOSE en puertos aleatorios

# Ver puertos mapeados
docker port mi-contenedor
80/tcp -> 0.0.0.0:8080

# Crear volumen
docker volume create mi-datos
docker volume create --driver local mi-datos

# Listar e inspeccionar
docker volume ls
docker volume inspect mi-datos
[{
  "Name": "mi-datos",
  "Driver": "local",
  "Mountpoint": "/var/lib/docker/volumes/mi-datos/_data",
  "Labels": {}
}]

# Usar volumen con contenedor
docker run -d \
  -v mi-datos:/var/lib/postgresql/data \
  --name postgres \
  postgres:16-alpine

# Sintaxis --mount (más explícita, recomendada)
docker run -d \
  --mount type=volume,source=mi-datos,target=/var/lib/postgresql/data \
  --name postgres \
  postgres:16-alpine

# Backup de volumen
docker run --rm \
  -v mi-datos:/data \
  -v $(pwd):/backup \
  alpine tar czf /backup/backup.tar.gz -C /data .

# Restaurar backup
docker run --rm \
  -v mi-datos:/data \
  -v $(pwd):/backup \
  alpine tar xzf /backup/backup.tar.gz -C /data

# Eliminar volúmenes
docker volume rm mi-datos
docker volume prune  # Eliminar todos sin uso

# Montar código fuente (hot reload)
docker run -d \
  -v $(pwd)/src:/app/src \
  -p 3000:3000 \
  node:22-alpine node server.js

# Sintaxis --mount
docker run -d \
  --mount type=bind,source=$(pwd)/src,target=/app/src,readonly \
  mi-app

# En Windows (con WSL2)
docker run -v C:/Users/mi/proyecto:/app mi-app
# O desde WSL:
docker run -v /mnt/c/Users/mi/proyecto:/app mi-app

# tmpfs: datos solo en RAM, no en disco ni en imagen
docker run -d \
  --tmpfs /tmp:rw,size=100m,mode=1777 \
  mi-app

# Ideal para: sesiones, archivos temporales, datos sensibles
docker run -d \
  --mount type=tmpfs,target=/run/secrets,tmpfs-size=10m \
  mi-app

# compose.yaml — Docker Compose V2 (2026)
name: mi-aplicacion

services:

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: appdb
      POSTGRES_USER: appuser
      POSTGRES_PASSWORD: ${DB_PASSWORD}   # desde .env
    volumes:
      - pg_data:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U appuser -d appdb"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7.2-alpine
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD}
    networks:
      - backend

  api:
    build:
      context: ./api
      dockerfile: Dockerfile
      target: production
      args:
        - APP_VERSION=${APP_VERSION:-1.0}
    restart: unless-stopped
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql://appuser:${DB_PASSWORD}@db:5432/appdb
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    volumes:
      - media_files:/app/media
    networks:
      - frontend
      - backend
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M

  nginx:
    image: nginx:1.27-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./certs:/etc/nginx/certs:ro
      - media_files:/app/media:ro
    depends_on:
      - api
    networks:
      - frontend

volumes:
  pg_data:
    driver: local
  media_files:
    driver: local

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge
    internal: true  # Sin acceso a internet

# Levantar todos los servicios
docker compose up
docker compose up -d            # En background
docker compose up --build         # Reconstruir imágenes
docker compose up api nginx       # Solo servicios específicos

# Estado
docker compose ps
docker compose logs
docker compose logs -f api        # Follow logs de un servicio
docker compose top               # Procesos en cada servicio

# Escalar servicio
docker compose up -d --scale api=3

# Ejecutar comando en servicio
docker compose exec api bash
docker compose exec db psql -U appuser -d appdb
docker compose run --rm api python manage.py migrate

# Parar y eliminar
docker compose stop              # Parar (preserva contenedores)
docker compose down              # Parar y eliminar contenedores + redes
docker compose down -v           # También eliminar volúmenes
docker compose down --rmi all    # También eliminar imágenes

# Validar configuración
docker compose config            # Ver configuración final
docker compose config --quiet    # Solo validar sin output

# Override para desarrollo: bind mounts + hot reload
services:
  api:
    build:
      target: development
    volumes:
      - ./api:/app              # Bind mount para hot reload
    environment:
      - DEBUG=true
      - LOG_LEVEL=debug
    ports:
      - "5678:5678"            # Puerto debugger

  db:
    ports:
      - "5432:5432"            # Exponer DB localmente para DBeaver

# Desarrollo
docker compose -f compose.yaml -f compose.dev.yaml up

# Producción
docker compose -f compose.yaml -f compose.prod.yaml up -d

# Con variable de entorno COMPOSE_FILE
export COMPOSE_FILE=compose.yaml:compose.dev.yaml
docker compose up

# include (incluir otros compose files)
include:
  - path: ./database/compose.yaml
  - path: ./monitoring/compose.yaml

# x-common-env: YAML anchors para reutilizar config
x-common-env: &common-env
  LOG_LEVEL: info
  TZ: America/Mexico_City

services:
  api:
    environment:
      <<: *common-env
      DATABASE_URL: postgres://...

  worker:
    environment:
      <<: *common-env
      QUEUE: celery

# secrets nativos de Compose
secrets:
  db_password:
    file: ./secrets/db_password.txt

services:
  api:
    secrets:
      - db_password  # disponible en /run/secrets/db_password

# Desarrollo con hot-reload
FROM python:3.12-slim AS dev
WORKDIR /app
RUN pip install uvicorn[standard] fastapi python-multipart
ENV PYTHONPATH=/app
CMD ["uvicorn", "main:app", "--reload", "--host", "0.0.0.0"]

# compose.dev.yaml para hot reload

services:
  api:
    build: .
    volumes:
      - .:/app          # Bind mount para hot reload
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql://user:pass@db:5432/mydb
      - REDIS_URL=redis://redis:6379
    depends_on:
      db:
        condition: service_healthy

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: mydb
    healthcheck:
      test: ["CMD", "pg_isready"]
      interval: 5s

  redis:
    image: redis:7-alpine

FROM node:22-alpine AS base
WORKDIR /app
COPY package*.json ./

FROM base AS development
RUN npm install
COPY . .
CMD ["npm", "run", "dev"]

FROM base AS production
RUN npm ci --only=production
COPY . .
USER node
CMD ["node", "server.js"]

# syntax=docker/dockerfile:1.7
FROM eclipse-temurin:21-jdk-alpine AS builder
WORKDIR /build
COPY pom.xml .
RUN --mount=type=cache,target=/root/.m2 \
    mvn dependency:go-offline -q
COPY src ./src
RUN --mount=type=cache,target=/root/.m2 \
    mvn package -DskipTests -q

FROM eclipse-temurin:21-jre-alpine AS production
WORKDIR /app
COPY --from=builder /build/target/*.jar app.jar
EXPOSE 8080
ENTRYPOINT ["java", "--enable-preview", "--add-opens=java.base/java.lang=ALL-UNNAMED", "-jar", "app.jar"]

FROM mcr.microsoft.com/dotnet/sdk:9.0 AS builder
WORKDIR /src
COPY *.csproj .
RUN dotnet restore
COPY . .
RUN dotnet publish -c Release -o /publish --no-restore

FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS production
WORKDIR /app
COPY --from=builder /publish .
USER 1001
EXPOSE 8080
ENTRYPOINT ["dotnet", "MyApi.dll"]

FROM golang:1.23-alpine AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -ldflags="-s -w" -o /bin/server .

FROM gcr.io/distroless/static-debian12 AS production
COPY --from=builder /bin/server /server
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/server"]
# Imagen final: ~8MB!

{
  "name": "Mi App Dev",
  "dockerComposeFile": "../compose.dev.yaml",
  "service": "api",
  "workspaceFolder": "/app",
  "features": {
    "ghcr.io/devcontainers/features/git:1": {},
    "ghcr.io/devcontainers/features/github-cli:1": {}
  },
  "extensions": [
    "ms-python.python",
    "ms-python.vscode-pylance",
    "eamodio.gitlens"
  ],
  "postCreateCommand": "pip install -r requirements-dev.txt",
  "remoteUser": "vscode"
}

name: data-stack
services:
  jupyter:
    image: jupyter/pyspark-notebook:spark-3.5.0
    ports:
      - "8888:8888"
    volumes:
      - ./notebooks:/home/jovyan/work
      - ./data:/home/jovyan/data
    environment:
      - JUPYTER_ENABLE_LAB=yes
      - SPARK_HOME=/usr/local/spark
    networks:
      - data-net

  spark-master:
    image: bitnami/spark:3.5
    environment:
      - SPARK_MODE=master
    ports:
      - "8080:8080"
      - "7077:7077"
    networks:
      - data-net

  spark-worker:
    image: bitnami/spark:3.5
    environment:
      - SPARK_MODE=worker
      - SPARK_MASTER_URL=spark://spark-master:7077
      - SPARK_WORKER_MEMORY=2G
    depends_on:
      - spark-master
    networks:
      - data-net

networks:
  data-net:

name: airflow-stack
x-airflow-common: &airflow-common
  image: apache/airflow:2.9.0
  environment:
    AIRFLOW__CORE__EXECUTOR: LocalExecutor
    AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:airflow@postgres/airflow
    AIRFLOW__CORE__FERNET_KEY: 'your-fernet-key'
    AIRFLOW__WEBSERVER__SECRET_KEY: 'your-secret'
  volumes:
    - ./dags:/opt/airflow/dags
    - ./logs:/opt/airflow/logs
  depends_on:
    postgres:
      condition: service_healthy

services:
  postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: airflow
      POSTGRES_PASSWORD: airflow
      POSTGRES_DB: airflow
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "airflow"]
      interval: 5s

  airflow-webserver:
    <<: *airflow-common
    command: webserver
    ports:
      - "8080:8080"

  airflow-scheduler:
    <<: *airflow-common
    command: scheduler

services:
  # Kafka sin Zookeeper (KRaft mode - 2026 estándar)
  kafka:
    image: apache/kafka:3.7.0
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_LISTENERS: PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
      KAFKA_LOG_DIRS: /var/lib/kafka/data
      CLUSTER_ID: MkU3OEVBNTcwNTJENDM2Qk
    ports:
      - "9092:9092"
    volumes:
      - kafka_data:/var/lib/kafka/data

  kafka-ui:
    image: provectuslabs/kafka-ui:latest
    ports:
      - "9000:8080"
    environment:
      KAFKA_CLUSTERS_0_NAME: local
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka:9092
    depends_on:
      - kafka

volumes:
  kafka_data:

services:
  minio:
    image: minio/minio:latest
    command: server /data --console-address :9001
    ports:
      - "9000:9000"    # API S3
      - "9001:9001"    # Web UI
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    volumes:
      - minio_data:/data

  mlflow:
    image: ghcr.io/mlflow/mlflow:v2.11.0
    command: mlflow server
      --backend-store-uri postgresql://mlflow:mlflow@postgres/mlflow
      --default-artifact-root s3://mlflow/
      --host 0.0.0.0
    ports:
      - "5000:5000"
    environment:
      MLFLOW_S3_ENDPOINT_URL: http://minio:9000
      AWS_ACCESS_KEY_ID: minioadmin
      AWS_SECRET_ACCESS_KEY: minioadmin
    depends_on:
      - postgres
      - minio

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: mlflow
      POSTGRES_PASSWORD: mlflow
      POSTGRES_DB: mlflow

volumes:
  minio_data:

services:
  postgres:
    image: postgres:16-alpine
    ports: ["5432:5432"]
    environment:
      POSTGRES_PASSWORD: secret
      POSTGRES_DB: appdb
    volumes:
      - pg_data:/var/lib/postgresql/data

  mongodb:
    image: mongo:7.0
    ports: ["27017:27017"]
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: secret
    volumes:
      - mongo_data:/data/db

  redis:
    image: redis:7.2-alpine
    ports: ["6379:6379"]
    command: redis-server --requirepass secret
    volumes:
      - redis_data:/data

  mongo-express:
    image: mongo-express:1.0
    ports: ["8081:8081"]
    environment:
      ME_CONFIG_MONGODB_ADMINUSERNAME: admin
      ME_CONFIG_MONGODB_ADMINPASSWORD: secret
      ME_CONFIG_MONGODB_URL: mongodb://admin:secret@mongodb:27017/
    depends_on:
      - mongodb

volumes:
  pg_data:
  mongo_data:
  redis_data:

# Instalar minikube
curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube

# Iniciar cluster con Docker driver
minikube start --driver=docker --cpus=4 --memory=8g

# Verificar
kubectl get nodes
NAME       STATUS   ROLES           AGE   VERSION
minikube   Ready    control-plane   60s   v1.30.0

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mi-app
  labels:
    app: mi-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: mi-app
  template:
    metadata:
      labels:
        app: mi-app
    spec:
      containers:
        - name: app
          image: mi-app:v1.0
          ports:
            - containerPort: 8000
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          livenessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 30
          readinessProbe:
            httpGet:
              path: /ready
              port: 8000
---
apiVersion: v1
kind: Service
metadata:
  name: mi-app-svc
spec:
  selector:
    app: mi-app
  ports:
    - port: 80
      targetPort: 8000
  type: LoadBalancer

kubectl apply -f deployment.yaml
kubectl get pods
kubectl get services
kubectl describe pod mi-app-xxxx
kubectl logs mi-app-xxxx -f
kubectl exec -it mi-app-xxxx -- bash
kubectl scale deployment mi-app --replicas=5
kubectl rollout history deployment mi-app
kubectl rollout undo deployment mi-app
kubectl delete -f deployment.yaml

docker run \
  --read-only \
  --tmpfs /tmp:rw,size=50m \
  --tmpfs /var/run:rw,size=10m \
  --user 1001:1001 \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  --security-opt no-new-privileges:true \
  --security-opt seccomp=/etc/docker/seccomp.json \
  --memory="256m" \
  --cpus="0.5" \
  --network mi-red \
  --pids-limit 100 \
  mi-app:v1.0

# Instalar Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

# Escanear imagen
trivy image nginx:alpine
2024-01-15T10:00:00 INFO Detected OS: alpine 3.19
nginx:alpine (alpine 3.19)
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

# Escanear Dockerfile
trivy config Dockerfile

# Escanear en CI/CD (falla con CRITICAL)
trivy image --exit-code 1 --severity CRITICAL mi-app:latest

# Docker Scout (integrado en Docker CLI)
docker scout cves mi-app:latest
docker scout quickview mi-app:latest

# Instalar docker-ce sin daemon root
curl -fsSL https://get.docker.com/rootless | sh

# Configurar PATH y DOCKER_HOST
export PATH=/home/$USER/bin:$PATH
export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock

# Iniciar servicio de usuario
systemctl --user start docker
systemctl --user enable docker

# Verificar
docker info | grep rootless
  rootless: true

# Estadísticas en tiempo real
docker stats --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.NetIO}}"

# Analizar tamaño de imagen por capas
docker history --human=true --format "{{.Size}}\t{{.CreatedBy}}" mi-app | sort -rh | head -10

# dive: herramienta de análisis de capas
dive mi-app:latest  # Instalar: https://github.com/wagoodman/dive

name: Docker CI/CD Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build-test-push:
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta (tags automáticos)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha

      - name: Scan con Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/${{ github.repository }}:latest
          severity: CRITICAL,HIGH
          exit-code: 1

      - name: Build and Push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: ${{ github.event_name == 'push' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64

name: monitoring
services:
  prometheus:
    image: prom/prometheus:v2.51.0
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.retention.time=15d

  grafana:
    image: grafana/grafana:10.4.0
    ports:
      - "3000:3000"
    environment:
      GF_SECURITY_ADMIN_PASSWORD: admin
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana/dashboards:/etc/grafana/provisioning/dashboards
    depends_on:
      - prometheus

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.49.0
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    ports:
      - "8080:8080"

volumes:
  prometheus_data:
  grafana_data:

services:
  elasticsearch:
    image: elasticsearch:8.13.0
    environment:
      discovery.type: single-node
      xpack.security.enabled: "false"
      ES_JAVA_OPTS: "-Xms512m -Xmx512m"
    ports: ["9200:9200"]
    volumes:
      - es_data:/usr/share/elasticsearch/data

  kibana:
    image: kibana:8.13.0
    ports: ["5601:5601"]
    environment:
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200
    depends_on:
      - elasticsearch

  fluentd:
    build: ./fluentd
    volumes:
      - ./fluentd/fluent.conf:/fluentd/etc/fluent.conf
    ports:
      - "24224:24224"
      - "24224:24224/udp"
    depends_on:
      - elasticsearch

volumes:
  es_data:

docker run -d \
  --log-driver=fluentd \
  --log-opt fluentd-address=localhost:24224 \
  --log-opt tag=mi-app.{{.Name}} \
  mi-app:v1.0

name: fullstack-api
services:
  db:
    image: postgres:16-alpine
    volumes:
      - pg_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASS}
    healthcheck:
      test: ["CMD", "pg_isready"]
      interval: 5s

  redis:
    image: redis:7-alpine
    command: redis-server --requirepass ${REDIS_PASS}

  api:
    build:
      context: ./api
      target: production
    environment:
      DATABASE_URL: postgresql://${DB_USER}:${DB_PASS}@db/${DB_NAME}
      REDIS_URL: redis://:${REDIS_PASS}@redis:6379
      SECRET_KEY: ${SECRET_KEY}
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - media:/app/media

  worker:
    build:
      context: ./api
      target: production
    command: celery -A app.worker worker --loglevel=info
    environment:
      REDIS_URL: redis://:${REDIS_PASS}@redis:6379
    depends_on:
      - redis

  nginx:
    image: nginx:1.27-alpine
    ports:
      - "80:80"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - media:/app/media:ro
    depends_on:
      - api

volumes:
  pg_data:
  media:

# dags/etl_pipeline.py
from airflow.decorators import dag, task
from airflow.providers.docker.operators.docker import DockerOperator
from datetime import datetime

@dag(schedule="@daily", start_date=datetime(2026, 1, 1))
def etl_pipeline():

    extract = DockerOperator(
        task_id="extract_data",
        image="mi-extractor:latest",
        command="python extract.py --date {{ ds }}",
        docker_url="unix://var/run/docker.sock",
        network_mode="data-stack_data-net",
    )

    transform = DockerOperator(
        task_id="transform_spark",
        image="apache/spark:3.5",
        command="spark-submit /jobs/transform.py",
        environment={"S3_ENDPOINT": "http://minio:9000"},
    )

    extract >> transform

etl_pipeline()

name: microservices
services:
  traefik:
    image: traefik:v3.0
    command:
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
    ports:
      - "80:80"
      - "8080:8080"   # Traefik dashboard
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  users-service:
    build: ./services/users
    labels:
      - traefik.enable=true
      - traefik.http.routers.users.rule=PathPrefix(`/api/users`)
      - traefik.http.services.users.loadbalancer.server.port=3000

  products-service:
    build: ./services/products
    labels:
      - traefik.enable=true
      - traefik.http.routers.products.rule=PathPrefix(`/api/products`)
    scale: 3  # 3 réplicas con load balancing automático

  orders-service:
    build: ./services/orders
    labels:
      - traefik.enable=true
      - traefik.http.routers.orders.rule=PathPrefix(`/api/orders`)