docker_optimization

Use a builder stage with full tooling to compile dependencies, then copy only the artifacts into a minimal runtime stage like python:3.11-slim or node:20-alpine. This typically reduces images by 70-90%, for example from 800MB to 120MB for a Python app.

Order Dockerfile instructions from least to most frequently changing: copy dependency files like requirements.txt before application code so dependency layers stay cached. Enable BuildKit and use cache mounts such as --mount=type=cache for package manager downloads.

Slim images like python:3.11-slim are the default choice with good compatibility at around 130MB. Alpine images are smaller at roughly 50MB but can cause glibc-related issues with some compiled dependencies.

Create a dedicated user with useradd or adduser in the Dockerfile, set ownership of app files, and switch with the USER instruction before CMD. This prevents processes inside the container from running with root privileges.

This happens when COPY . . appears before the dependency install step, invalidating the cache on any file change. Copy only dependency manifests first, run the install, then copy source code afterward.

Run docker scout cves, trivy image, or snyk container test against your built image to list known CVEs. Fix critical findings by updating base images and pinned package versions before deployment.