Dockerfiles and Builds
Image build recipes and docker build patterns. Results appear in the same fence: same-line # comments when short, multiline # blocks below the sample when not. Fences are bash, dockerfile, or yaml as appropriate.
//
Search across all documentation pages
Image build recipes and docker build patterns. Results appear in the same fence: same-line # comments when short, multiline # blocks below the sample when not. Fences are bash, dockerfile, or yaml as appropriate.
Start from a base image and pin tags.
FROM node:22-alpine
# base layer for app buildsSet working directory (creates if missing).
WORKDIR /app
# subsequent RUN/CMD relative to /appPrefer COPY; ADD has extra magic (URLs/tar).
COPY package.json package-lock.json ./
# copies lockfiles into WORKDIRCombine RUN and order stable layers first.
RUN npm ci --omit=dev
# installs production deps; cached if lockfile unchangedBuild-time ARG vs runtime ENV.
ARG NODE_ENV=production
ENV NODE_ENV=$NODE_ENV
# image env NODE_ENV=productionDocument listening ports (does not publish).
EXPOSE 3000
# metadata only; still need -p at runDrop root after package installs.
USER node
# process runs as node userDefault command; ENTRYPOINT for fixed binary.
CMD ["node", "server.js"]
# default process argsBuild in one stage, copy artifacts to slim runtime.
FROM golang:1.23 AS build
WORKDIR /src
COPY . .
RUN CGO_ENABLED=0 go build -o /out/app
FROM gcr.io/distroless/static
COPY --from=build /out/app /app
ENTRYPOINT ["/app"]
# final image has only the binaryBuild and tag from a Dockerfile.
# bash
docker build -t myapp:1.0 .
# Successfully tagged myapp:1.0Mount BuildKit secrets without baking them in.
# syntax=docker/dockerfile:1
RUN --mount=type=secret,id=npmrc cp /run/secrets/npmrc ~/.npmrc && npm ci
# secret not stored as a layer when used correctlyExclude context files from build upload.
# .dockerignore
node_modules
.git
# smaller build contextImage-defined health command.
HEALTHCHECK --interval=30s CMD wget -qO- http://127.0.0.1:3000/health || exit 1
# docker ps shows health statusMetadata for org/version/source.
LABEL org.opencontainers.image.source="https://example.com/app"
# inspect Config.LabelsMulti-arch with buildx.
# bash
docker buildx build --platform linux/amd64,linux/arm64 -t myapp:1.0 --push .
# multi-arch index pushedStack versions: Kubernetes 1.36.2 · Docker Engine 29.6.1 · Helm 3 · Compose v2 · containerd via CRI
Reviewed by Chris St. John·Last updated Jul 19, 2026