Defining how an image is built.
WHAT IT IS
A text file of instructions, executed in order.
WHAT THE ESSENTIAL INSTRUCTIONS ARE
The base image to start from Files to copy in Commands to run during the build Environment variables The working directory The user to run as The port the application listens on The command to run when it starts
WHAT THE BASE IMAGE DETERMINES
Size, included tools, and much of your security exposure.
WHAT TO CHOOSE
An official image for your runtime, at a specific version.
WHAT TO NEVER USE
An unversioned tag.
WHY
Builds then differ over time with no change to your file.
WHAT ORDER TO PUT INSTRUCTIONS IN
Rarely changing things first, frequently changing things last.
WHY
Each instruction is cached, and a change invalidates everything after it.
WHAT THAT MEANS PRACTICALLY
Copy dependency manifests and install dependencies before copying your source.
WHAT THAT ACHIEVES
Dependency installation cached across source changes.
WHAT TO COMBINE INTO ONE INSTRUCTION
Installing packages and cleaning up afterwards.
WHY
Cleanup in a separate instruction removes nothing from the image.
WHAT TO ALWAYS SET
A non-root user.
