writing-dockerfiles

Multi-stage builds separate compilation from runtime by using multiple FROM statements in a single Dockerfile. Build dependencies and artifacts are created in an early stage, then only necessary files are copied to the final stage, significantly reducing image size without including build tools in production.

Docker layer caching works by reusing unchanged layers from previous builds. Order Dockerfile instructions from least to most frequently changing—place stable dependencies early and volatile application code late. This maximizes cache hits and accelerates rebuilds when only application code changes.

Security hardening includes running containers as non-root users, using distroless base images to minimize attack surface, scanning for vulnerabilities with linting tools, and applying principle of least privilege. These practices reduce exposure to container breakout and supply-chain attacks.

ENTRYPOINT defines the command that always runs when a container starts, while CMD provides default arguments to that command. Use ENTRYPOINT for the main process and CMD for configurable parameters, allowing flexibility when users override behavior at runtime.

Yes. Docker Compose recognizes and executes multi-stage Dockerfiles in services. When you build through Compose, it respects all stages and produces final images optimized by your staging strategy, making Compose deployments benefit from the same size and security gains.