docker-best-practices

Use a multi-stage build with a pinned minimal base image like node:20-alpine or python:3.12-slim, order layers from least to most frequently changing, run as a non-root user, and add a HEALTHCHECK instruction. Never use the latest tag or embed secrets in layers.

Choose based on needs: Chainguard or Wolfi images for minimal CVEs, Alpine for small size around 7MB, distroless for no shell and maximum hardening, or slim variants for a balance of compatibility and size. Always pin exact version tags.

Multi-stage builds separate build dependencies from runtime by compiling in a builder stage and copying only the artifacts into a clean final stage. This excludes compilers, dev dependencies, and build tools from the shipped image.

Never put secrets in ENV instructions or image layers since they persist in history. Use Docker secrets in Swarm mode, mount secret files at runtime as read-only volumes, or pass environment files with --env-file that are excluded from version control.

Slow builds usually come from poor layer ordering that invalidates the cache. Copy dependency manifests before application code, enable BuildKit, and use cache mounts for package managers so dependency layers are reused across builds.

No, the version field is obsolete in Compose v2 and should be omitted. Modern Compose files start directly with the services key and support features like healthcheck-based depends_on conditions and internal networks.