Docker in CI/CD Pipelines: GitLab, Jenkins, Build, Scan and Push Images

Docker in CI/CD Pipelines#

Docker is commonly used in CI/CD to create repeatable build environments, package applications as images, push images to registries, scan vulnerabilities, and deploy the same artifact to different environments.

CI/CD Docker flow#

1. Developer pushes code.
2. Pipeline runs tests.
3. Pipeline builds Docker image.
4. Image is tagged with commit SHA or version.
5. Image is scanned.
6. Image is pushed to a registry.
7. Deployment pulls the approved image.

Generic Docker pipeline commands#

docker build -t myapp:$COMMIT_SHA . docker run --rm myapp:$COMMIT_SHA npm test docker tag myapp:$COMMIT_SHA registry.example.com/team/myapp:$COMMIT_SHA docker push registry.example.com/team/myapp:$COMMIT_SHA

GitLab CI/CD example#

stages: - test - build run_tests: image: node:20 stage: test script: - npm ci - npm test build_image: image: docker:27 services: - docker:27-dind stage: build variables: DOCKER_TLS_CERTDIR: "/certs" IMAGE_TAG: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" script: - echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin - docker build -t "$IMAGE_TAG" . - docker push "$IMAGE_TAG"

Jenkins pipeline idea#

pipeline { agent any stages { stage('Build Image') { steps { sh 'docker build -t myapp:${BUILD_NUMBER} .' } } stage('Push Image') { steps { sh 'docker push myregistry/myapp:${BUILD_NUMBER}' } } } }

Tagging best practices#

• Use commit SHA for traceability.
• Use semantic version tags for releases.
• Avoid depending only on latest .
• Keep environment tags as pointers, not the only release record.

Security checks#

• Scan images before deployment.
• Use trusted base images.
• Do not pass production secrets to untrusted builds.
• Use protected runners for production jobs.
• Review Dockerfile changes carefully.

Common mistakes#

• Building image before tests run.
• Pushing every branch to production registry without rules.
• Using the same registry credentials everywhere.
• Not scanning images.
• Using untrusted Docker-in-Docker setups without understanding risk.

Best practices#

• Build once, deploy the same image.
• Use immutable tags.
• Scan image before deployment.
• Keep CI logs free of secrets.
• Use registry cleanup policies carefully.

Related Melochip guides#

• Docker Learning Path
• GitLab Docker Build Pipeline
• Jenkins MCP Server Guide

Official references#

• Docker Build CI documentation