TLDR of the video: My Production Dockerfile Rules: How I Build Docker Images
Transcript from the author: My Production Dockerfile Rules: How I Build Docker Images

---

🔐 Complete Production-Ready Dockerfile Rules

🧱 1. Base Image Selection

• Use minimal base images — containers are not full VMs; only include needed runtime deps.
• Prefer Alpine/slim/distroless/scratch when possible.
• Derive the version from your project, don’t guess (e.g., use node:20-alpine if package.json says Node 20).

---

🧠 2. Build Optimization & Layer Caching

• Use multi-stage builds so build tools and source don’t end up in runtime image.

• Structure Dockerfile for cache friendliness:

  • Put rare-changing files (e.g., manifests) first.
  • Copy code later so changes don’t bust earlier cache.

• Combine related RUN commands to reduce layers.

• Clean caches in the same RUN layer where they’re created or you save nothing.

---

📁 3. Copying Files Intentionally

• Avoid COPY . . — it brings in unwanted files, including secrets.
• Be explicit: e.g., COPY src/ ./src/, COPY static/ ./static/.

---

📦 4. Dependencies

• Install only production dependencies; e.g., npm ci --omit=dev.
• Dev/test deps belong in build stage only.

---

🔒 5. Security Hardening

• Never run as root — create and switch to a non-root user.
• Pin base image versions — avoid :latest so builds are reproducible.
• Prefer Official or Verified images; avoid random ones.
• No secrets in images — environment vars or build args are safer.
• No sudo in containers.
• Install only necessary packages (e.g., use --no-install-recommends when using apt).
• No debugging tools in production images — attackers love them.
• If debugging is needed, use ephemeral debug containers instead.
• Ensure runtime binaries are owned by root but executed by non-root so attackers can’t modify them.

---

🚀 6. Runtime CMD & Execution

• Always use the exec (JSON) form for CMD so signals (e.g., SIGTERM) are delivered correctly.

---

📊 7. Maintainability Best Practices

• Sort multi-line arguments alphabetically (e.g., package lists) to reduce diffs and merge conflicts.
• Use WORKDIR instead of RUN cd …; WORKDIR persists across instructions.
• Comment non-obvious decisions, not the obvious commands.
• Add OCI labels like org.opencontainers.image.source, version, description for better image management.