5.4Production checklist and certifications
The essentials in 30 seconds
- Eight yes or no prod: immutable tags, scanned and non-root images, restart + healthchecks, backed-up volumes with tested restore, secrets out of git, a single published port, logs with rotation, CI as the only factory.
- You only operate what you see: live metrics, alerts before clients, disk space monitored — a full disk stops everything.
- After this guide: generic Docker certification first (it crowns this guide), Kubernetes certification next if heading to Kubernetes — through hands-on labs, with senior/IT validation before any real prod.
Running mini-case — Idir audits before prod
Final episode: Idir, junior DevOps in Algiers, must put his company's stack into production. Instead of deploying fast, he prints the checklist and audits: a moving tag in prod, a secret in the repo, no tested backup, no disk monitoring. He fixes one point after another, tests the restore, takes secrets out of the repo, enables log rotation — then has the whole validated by his senior mentor before opening prod. Final episode of cases 5.1-5.3 — Idir closes orchestration and production with the audit.
Final episode of cases 5.1-5.3 — Idir fixes then has validated before prod.
1. The pre-prod checklist
Immutable tags (never a moving tag in prod), scanned and non-root images, restart + healthchecks on each long-lived service, backed-up volumes with tested restore, secrets out of git (versioned example file, real values elsewhere), a single published port (the proxy), logs with rotation, versioned Compose, CI as the only factory of images. Idir ticks each box: a single “no” = no prod.
The checklist is a gate, not decoration: you fix each “no” one by one, with testing, before opening. Idir prints his and has it ticked in pairs.
2. Monitor the vital minimum
Live container metrics, alert probes (availability, disk), disk space monitored: accumulated images, rotation-less logs and orphan volumes fill disks — a full disk stops everything. You only operate well what you see: alerts before clients.
Automated backups and scans (not manual), tested restore (an untested backup is not a backup), log rotation set from the Compose. Idir schedules the disk alert before the first prod.
3. And next? Certifications and validation
Generically: a Docker certification validates this guide (images, networks, volumes, Compose, Swarm, security), a Kubernetes certification certifies the next step. Both are prepared through labs: replay each level blind, never by cramming.
And above all: a junior does not put into production alone — Idir has his audit validated by his senior mentor / IT before opening prod, with backups, secrets and monitoring verified. Supervised practice beats lonely rote learning.
🔎 Concrete example — Idir's express audit of the stack
Eight boxes, zero excuse.
[ ] tags immuables, pas de mouvant en prod
[ ] non-root + scan sans critique
[ ] restart + healthcheck sur chaque durable
[ ] volumes : sauvegarde + restauration testee
[ ] secrets hors git, exemple versionne
[ ] seul le proxy publie les ports
[ ] logs avec rotation, disque alerte
[ ] CI seule usine, compose versionneReading: Idir ticks each box with proof (test, log, restore).
Lesson: print it: it is your gate to prod.
Section vocabulary
- Prod checklist
- The eight yes required before any production release.
Simple example: Idir refuses prod while one box is a no.
What it is not: a “we will see” deployment with no audit.
Reflex: do I have eight proven yes before opening?
- Log rotation
- The size and growth limit of container logs.
Simple example: Idir sets max size and max files in his Compose.
What it is not: logs growing until the disk is full.
Reflex: are my logs bounded and monitored?
- Monitoring
- See and alert: metrics, availability probes, disk space.
Simple example: Idir is alerted before clients when the disk fills up.
What it is not: discovering the outage through client calls.
Reflex: am I alerted before my users?
- Tested backup
- A backup whose restore has been replayed successfully.
Simple example: Idir restores his volumes on a sandbox before prod.
What it is not: an archive never replayed.
Reflex: have I replayed my restore this month?
- Senior validation
- The audit review by a mentor before opening prod.
Simple example: Idir has checklist, secrets and monitoring validated by his senior.
What it is not: a lonely junior production release.
Reflex: who has reviewed and validated my audit?
In practice — Audit your stack
- Print the checklist and audit your current stack.
- Fix each “no” one by one, with testing.
- Test backup + restore, take secrets out of the repo.
- Have validated by your senior mentor / IT, then plan certification through labs.
Ready-to-say script — asking for validation before prod
“Before opening prod in Algiers, here is my audit: frozen tags, scanned non-root images, healthchecks, backups with tested restore, secrets out of the repo, logs with rotation and disk monitoring. Two boxes remain to fix — I suggest we review them together and approve the opening once the eight yes are reached.”
Say to the senior mentor / IT to have the audit validated before any production release.
Copy-paste template — prod audit card
FICHE AUDIT PROD — stack : ___ · date : ___
[ ] tags immuables (mouvant interdit) · [ ] scan OK + non-root
[ ] restart + healthcheck par durable · [ ] seul proxy publie
[ ] sauvegarde OK + restauration testee le : ___
[ ] secrets hors git (exemple versionne) · [ ] logs rotation + disque alerte
[ ] CI seule usine · compose versionne
VALIDE PAR (senior/DSI) : ___ · date : ___ · GO PROD ? OUI / NONSolo / small budget
Idir alone: the printed checklist + one tested restore beat no audit.
Small company / small team
Audit in pairs: one ticks, the other checks proof before validation.
SME in Algiers
Idir books a prod review in Algiers: audit on screen, each no planned before opening.
Starting team
Pair: one fixes the nos, the other replays restore and alerts.
✓ Best practices
- Print the checklist, tick in pairs with proof.
- Automate backups + scans, test the restore.
- Prepare certifications through repeated labs, not by heart.
✗ Common pitfalls
- “We will see in prod” with boxes at no.
- Monitoring after the outage instead of alerting before.
- Preparing certifications by cramming.
Key takeaways
- Eight yes = prod, one no = fix and re-test.
- You see (monitoring, alerts, disk) before operating.
- Tested backup + secrets out of git + CI as the only factory.
- Certifications through labs, prod validated by the senior/IT.
48h challenge — apply tomorrow
Fill in the prod audit card (template above) for your real stack: each no becomes a planned fix, then have it reviewed before any prod.
- I can cite the eight boxes of the checklist.
- My stack is audited, fixed and validated.
- I know how to prepare certification through labs, not by heart.
Frequently asked questions
What rotation for logs?
By default logs grow endlessly: limit size and file count (rotation options in the Compose / logging config) and centralise early. A full disk stops everything — combine rotation, image and orphan-volume cleanup, and disk alerts.
Which certification to start with?
Generically: first the one crowning exactly this guide (Docker: images, networks, volumes, Compose, Swarm, security), then the Kubernetes one only if Kubernetes is your target. Both require regular hands-on labs — replay each level blind — and supervised validation before any real production.
One checklist point is a “no”. What to do?