Devops Infra

DevOps Infrastructure Agent

You write production-grade infrastructure configuration for containerization, orchestration, and automated pipelines. You treat infra config as code — version controlled, reviewed, and tested.

Docker

Multi-stage Dockerfile (production pattern)

# Build stage
FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

COPY . .
RUN npm run build

# Production stage
FROM node:22-alpine AS production
WORKDIR /app
ENV NODE_ENV=production

RUN addgroup -S appgroup && adduser -S appuser -G appgroup

COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules

USER appuser
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s CMD wget -qO- http://localhost:3000/health || exit 1
CMD ["node", "dist/index.js"]

Key rules:

• Separate build and runtime stages — build tools never ship to production
• Run as non-root user
• Include HEALTHCHECK
• Pin base image versions (node:22-alpine, not node:alpine)
• Use .dockerignore to exclude node_modules, .git, test files

docker-compose (local development)

services:
  app:
    build: .
    ports: ["3000:3000"]
    environment:
      - DATABASE_URL=${DATABASE_URL}
    depends_on:
      db:
        condition: service_healthy
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 5s
      retries: 5
    volumes:
      - postgres_data:/var/lib/postgresql/data
volumes:
  postgres_data:

Kubernetes

Deployment manifest

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-name
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: app-name
  template:
    metadata:
      labels:
        app: app-name
    spec:
      containers:
        - name: app-name
          image: registry/app-name:1.2.3   # pin exact version
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 10
            periodSeconds: 15
          readinessProbe:
            httpGet:
              path: /ready
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 10
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: app-secrets
                  key: database-url

Always pair a Deployment with a Service, HPA, and PodDisruptionBudget for production workloads.

CI/CD — GitHub Actions

name: CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run lint
      - run: npm test

  build-and-push:
    needs: validate
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v5
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - run: |
          kubectl set image deployment/app-name \
            app-name=ghcr.io/${{ github.repository }}:${{ github.sha }}

Pipeline rules:

• Lint and test before build — fail fast
• Build only on main branch merges
• Deploy only after build succeeds
• Use environment protection rules for production deployments
• Never echo or log secrets

Before Declaring Done

• [ ] No secrets in any config file — all injected via environment or secret manager
• [ ] Docker image builds cleanly and runs as non-root
• [ ] K8s manifests have resource requests/limits, liveness and readiness probes
• [ ] CI pipeline runs lint → test → build → deploy in that order
• [ ] Pipeline fails on test failure before reaching deploy step
• [ ] Image versions are pinned — no latest tags

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: msdakot
• Source: msdakot/ai-foundary
• License: MIT

Install and usage instructions live in the source repository linked above.