render-docker

Set runtime: docker in your Blueprint to build from a Dockerfile using dockerfilePath and dockerContext, or use runtime: image to pull a prebuilt image via image.url. Render builds with BuildKit and caches layers between builds.

runtime: docker builds an image from a Dockerfile in your repo, while runtime: image pulls a prebuilt image from a registry with no build step. Prebuilt image services do not auto-deploy when a tag moves; trigger a manual redeploy or deploy hook.

Store credentials in the Render Dashboard under Registry Credentials, then reference them in your Blueprint with registryCredential.fromRegistryCreds.name. This works for Docker Hub, GHCR, ECR, and Google Artifact Registry, for both private base images and prebuilt images.

No—build args are stored in image layers and can be recovered from image history. Use runtime environment variables for application secrets, or BuildKit secret mounts (RUN --mount=type=secret) for build-time secrets like private package feeds.

Overly aggressive .dockerignore rules commonly exclude files needed by COPY instructions. Verify every COPY path exists relative to dockerContext, and confirm your artifacts target linux/amd64 since Render builds for that architecture.

Order Dockerfile instructions so dependency manifests copy and install before application source, maximizing layer cache hits. Use BuildKit cache mounts for package managers, maintain a thorough .dockerignore, and prefer slim or alpine base images.