Docker

Overview

Production-grade containers: Dockerfiles, compose, multi-stage builds, layer/cache optimization, security hardening, registries, debugging. The Expert Practices section below is the highest-value part — it states the mechanism behind each rule, which is what separates correct-but-naive Dockerfiles from production ones. Read it before writing anything non-trivial.

Writing Dockerfiles

Base image: official images; -alpine/-slim/distroless/scratch for runtime; pin by tag AND digest (python:3.12-slim@sha256:..., see Currency), never latest; multi-stage to drop build toolchains.

Layer ordering (cache): least-changing first (base → system deps → dependency manifests → source). Copy dependency manifests and install BEFORE copying source so a code edit doesn't bust the dependency layer — this single ordering rule is the biggest cache win.

Layer hygiene:

• Keep apt-get update and apt-get install in the SAME RUN — in separate layers Docker reuses a stale cached update index when only the install list changes, silently installing outdated/vulnerable packages (docs call this "cache busting"). Details in Anti-Patterns.
• --no-install-recommends, clean caches in the same layer (rm -rf /var/lib/apt/lists/*).
• .dockerignore to keep context small (excludes .git, node_modules, build artifacts) — bloated context slows builds and busts cache.

Runtime & security: non-root numeric USER uid:gid (see Gotchas); --read-only root fs where possible; secrets via RUN --mount=type=secret, never ENV/ARG/COPY (see below); HEALTHCHECK; exec-form CMD/ENTRYPOINT (shell form breaks signals — see Anti-Patterns).