multi-stage-dockerfile

Define a builder stage with FROM ... AS builder for compilation and dependency installation, then a separate runtime stage that copies only the built artifacts using COPY --from=builder. Order stages as dependencies, build, test, then runtime.

Use multi-stage builds so the final image contains only runtime artifacts, choose minimal base images like slim, Alpine, or distroless variants, combine related RUN commands with &&, and add a .dockerignore file to exclude unnecessary files from the build context.

Use official minimal images with exact version tags such as python:3.11-slim for reproducibility. Consider distroless images for runtime stages or Alpine-based images when compatible with your application for a smaller footprint.

Order instructions from least to most frequently changing: install dependencies before copying application code. This lets Docker reuse cached layers for dependency installation when only source code changes between builds.

Add a USER instruction in the runtime stage specifying a non-root user, and use COPY --chown to set file ownership in one step. Also remove build tools and unnecessary packages from the final image to reduce the attack surface.