Packaging an application.
WHAT AN IMAGE IS
The packaged filesystem and configuration a container runs from.
WHAT TO BASE IT ON
An official image for your runtime, at a pinned version.
WHY PINNED
An unpinned base changes without warning.
WHAT TO INCLUDE
Only what the application needs to run.
WHAT TO EXCLUDE
Build tools, in the final image Development dependencies Source not needed at runtime Secrets
THE SECRETS POINT
Anything included during a build remains in the image, even if later removed.
Never pass secrets in at build time.
WHAT TO USE FOR SMALLER IMAGES
A build stage producing artefacts, and a separate runtime stage containing only them.
WHY SIZE MATTERS
Transfer time, storage, and attack surface.
WHAT TO ORDER CAREFULLY
Steps, so cached layers are reused when only code changes.
WHAT TO RUN AS
A non-administrative user inside the container.
WHAT TO TAG
Every image, with a version traceable to a commit.
WHAT TO SCAN
Images, for known vulnerabilities.
