Containerization

A container image is a build artifact meant to be byte-identical everywhere it runs. Most Dockerfile trouble comes from treating it like a virtual machine — installing a shell's worth of tools, running as root, and rebuilding the world on every code change.

Aim for three properties: small, reproducible, and least-privileged. A change that does not move one of those is not worth making.

For language-specific multi-stage templates, distroless runtimes, and BuildKit cache and secret mounts, read references/dockerfile-patterns.md.

1. Order layers by how often they change

Docker caches per layer and invalidates every layer after the first change. Put the stable things first so a one-line edit does not re-download the internet: