Docker-best-practices

Docker Best Practices

Base Images

• Use official base images from Docker Hub
• Use specific version tags, never latest
• Prefer slim or alpine variants for smaller images
• Choose appropriate base image for your language/framework
• Update base images regularly for security patches

Image Optimization

• Minimize layer count by combining RUN commands
• Order Dockerfile commands by change frequency (rarely changing first)
• Use multi-stage builds to reduce final image size
• Remove package manager caches after installation
• Delete temporary files and build artifacts
• Keep images under 500MB when possible

.dockerignore

• Exclude .git and .gitignore
• Exclude node_modules/, __pycache__/, venv/
• Exclude .env, .env.local, and other secrets
• Exclude build artifacts: dist/, build/, *.log
• Exclude IDE files: .vscode/, .idea/, *.swp
• Exclude documentation and test files if not needed
• Exclude .dockerignore itself

Security

• Run containers as non-root user
• Create dedicated user with specific UID/GID
• Use USER instruction to switch user
• Drop unnecessary capabilities with cap_drop: ALL
• Add only required capabilities with cap_add
• Make filesystem read-only when possible
• Set security_opt: no-new-privileges:true
• Never store secrets in Dockerfile or environment variables
• Use build arguments for non-sensitive configuration

Dockerfile Structure

• Place frequently changing commands at the end
• Copy requirements.txt or package.json before source code
• Install dependencies before copying application code
• Use explicit WORKDIR instruction
• Set proper EXPOSE ports for documentation
• Define ENTRYPOINT and CMD clearly
• Use HEALTHCHECK for production containers

Multi-Stage Builds

• Use builder stage for compilation and dependencies
• Copy only necessary artifacts to final stage
• Reduce final image size by excluding build tools
• Use --from=builder syntax to copy between stages
• Name stages descriptively (builder, runtime, etc.)