docker-conventions

Enforce proper Dockerfile instruction ordering and multi-stage builds to optimize layer caching. This approach minimizes rebuild times by structuring instructions from least to most frequently changing layers, ensuring faster and more efficient container builds.

The safest approach to base image selection is choosing minimal images and configuring a secure runtime. This reduces the attack surface by including only essential dependencies, promoting safe runtime configurations and consistent deployments across your projects.

Audit existing Dockerfiles by checking instruction ordering, COPY versus ADD usage, and CMD/ENTRYPOINT syntax. Use this standard reference to identify deviations from best practices, ensuring your images maintain security, performance, and long-term maintainability.

Yes, these Docker conventions provide specific guidance for Node, Python, Go, and other stacks. The standardized practices cover stack-specific instruction ordering, metadata usage, and multi-stage build configurations to ensure consistent and safe deployments.

Use COPY instead of ADD in Dockerfiles for simple file transfers to ensure transparency and predictable builds. ADD should be avoided unless you specifically need its automatic tar extraction or remote URL fetching capabilities, which can introduce security risks.

Minimal base images reduce attack surface but may lack necessary system utilities or shared libraries required by your application. You must manually ensure all runtime dependencies are explicitly installed to prevent runtime execution failures in your secure containers.