Containerization

A container image is a build artifact that should be identical everywhere it runs. Most Dockerfile problems come from treating it as a virtual machine — installing a shell's worth of tooling, running as root, and rebuilding the world on every code change.

Three properties to aim for: small, reproducible, and least-privileged.

1. Order layers by how often they change

Docker caches per layer and invalidates everything after the first change. Put the stable things first:

COPY package.json package-lock.json ./
RUN npm ci                      # cached until dependencies change
COPY . .                        # invalidated on every code change
RUN npm run build