DevOps Tools
Dockerfile Best Practices
Create small, secure, efficient Docker images with multi-stage builds and layer caching.
A well-written Dockerfile produces small, secure, fast-building images.
Use Small Base Images
node:20-alpine (~50MB) vs node:20 (~350MB). For compiled languages, use scratch or distroless.
Multi-Stage Builds
Separate build and runtime environments. Build stage installs dev deps and compiles. Final stage copies only artifacts. Dramatically reduces image size.
Layer Caching
Docker caches each instruction. Order from least to most changed: system packages → dependencies → source code. Maximizes cache hits.
Security
- Don't run as root
- Don't include secrets
- Use .dockerignore
- Pin versions
- Use COPY not ADD
Frequently Asked Questions
COPY vs ADD?
COPY just copies files. ADD can download URLs and extract tars. COPY is more transparent and secure.
How to reduce image size?
Alpine images, multi-stage builds, .dockerignore, combine RUN commands, remove package caches.
CMD vs ENTRYPOINT?
ENTRYPOINT for the main executable. CMD for default arguments that can be overridden.