dockerfile

A good Dockerfile is judged on three axes at once, and this skill optimizes all three without trading one for another:

• Fast rebuilds — order layers so a source edit never re-runs dependency installation. Copy the dependency manifest and resolve it before the source.
• Small, secure final image — a multi-stage build keeps the compiler, SDK, and dev dependencies in a build stage; the final stage carries only the artifact and its runtime. Aim the final FROM at scratch, and step down the ladder only as far as the runtime forces you.
• Correct and safe — non-root, exec-form entrypoint, no secret ever written into a layer, pinned bases, and a linter as the gate.