Dockerfile

Learn how Dockerfiles define container images, including base images, layers, copy steps, commands, ports, and build hygiene.

Last reviewed: June 2026

·Docker Engine 24+Docker Desktop 4+Docker Compose v2
✅
Quick Understanding: A Dockerfile is a text file containing instructions to build a Docker image. It defines the base runtime, files, dependencies, metadata, exposed ports, and default command.

🔍 What Is It?

A Dockerfile is the build recipe for a Docker image.

Common instructions:

  • →FROM chooses the base image
  • →WORKDIR sets the working directory
  • →COPY adds files from the build context
  • →RUN executes build-time commands
  • →ENV defines environment defaults
  • →EXPOSE documents the port
  • →CMD defines the default runtime command

🎯 Why Do We Need It?

The Dockerfile makes runtime setup repeatable and reviewable.

Instead of installing packages manually on a server, the team can version the runtime alongside application code. Code reviewers can see exactly what goes into the image.

🏗️ What Happens in Real Projects?

A production Dockerfile usually evolves beyond the first tutorial version.

Teams add .dockerignore, non-root users, dependency caching, multi-stage builds, health checks, pinned base images, and minimal runtime images. CI then uses the Dockerfile as the single build contract.

⚙️ How It Works

Docker sends a build context to the builder, reads the Dockerfile instructions, and creates image layers.

Layer order matters. Put rarely changing dependency files before frequently changing source files so Docker can reuse cached layers.

For example, copy package.json first, install dependencies, then copy source code. A source-only change should not reinstall all dependencies.

💻 Example

Production-Friendly Dockerfile — A Node service Dockerfile with cache-aware ordering and a non-root runtime user.

dockerfile
FROM node:22-alpine
WORKDIR /app

COPY package*.json ./
RUN npm ci --omit=dev && npm cache clean --force

COPY . .

USER node
EXPOSE 3000
CMD ["node", "server.js"]

🤔 Common Confusions

❓ What is the difference between `RUN` and `CMD`?

`RUN` executes during image build and creates a layer. `CMD` defines what runs when a container starts.

❓ Does `EXPOSE` publish the port?

No. `EXPOSE` documents the intended port. You still publish ports with `-p` or platform configuration.

❓ Why does Docker rebuild too much?

Layer cache was invalidated. Reorder instructions so stable dependency files are copied before frequently changing source files.

🚨 Common Production Issues

**Secrets copied into image** - `.env`, keys, or credentials enter the build context and image layers.

**Root runtime** - containers run as root even when the app does not need elevated privileges.

**Poor cache order** - every code change reinstalls dependencies and slows CI.

**Unpinned base image** - builds change unexpectedly when base tags move.

✅ Best Practices

Use `.dockerignore` in every project

Order layers for build cache efficiency

Run applications as a non-root user

Keep runtime images small

Avoid secrets in `ARG`, `ENV`, or copied files

Prefer exec-form `CMD` for signal handling

🏛️ Architect's Note

Senior Architect's Perspective

A Dockerfile is application infrastructure code. Treat it with the same review discipline as production code.

The best Dockerfiles are boring: predictable base image, clear dependency installation, no secrets, non-root runtime, small final image, and fast rebuilds.

💬 Frequently Asked Questions

Should I use Alpine images?

Alpine is small, but not always best. Some libraries expect glibc behavior. Choose based on compatibility, security posture, and operational familiarity.

What is build context?

The files Docker can access during build. `.dockerignore` controls what is excluded from that context.

Can a Dockerfile have multiple `FROM` lines?

Yes. That is how multi-stage builds work.

🎯 Key Takeaways

1Dockerfiles define how images are built
2`RUN` is build time; `CMD` is runtime
3Layer ordering affects build speed
4Use `.dockerignore` to protect and speed up builds
5Production images should avoid root and secrets

🎯 Practice this topic in interviews

↗ Where this topic fits

Sources

Sources / References

Use these Docker references to verify the concept in official docs and continue into the most relevant SplashRide pages.