Reviews Dockerfiles for best practices, security issues, and image size optimizations including multi-stage builds and layer caching. Use when working with Docker, containers, or deployment.
Analyzes and optimizes Dockerfiles for performance, security, and best practices.
Search for: Dockerfile, Dockerfile.*, *.dockerfile
Use specific base image versions:
# Bad
FROM node:latest
# Good
FROM node:18-alpine
Minimize layers:
# Bad
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get install -y git
# Good
RUN apt-get update && \
apt-get install -y curl git && \
rm -rf /var/lib/apt/lists/*
Order instructions by change frequency:
# Dependencies change less than code
COPY package*.json ./
RUN npm install
COPY . .
Use .dockerignore:
node_modules
.git
.env
*.md
Reduce final image size:
# Build stage
FROM node:18 AS build
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build
# Production stage
FROM node:18-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
CMD ["node", "dist/index.js"]
Don't run as root:
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
No secrets in image:
# Bad: Hardcoded secret
ENV API_KEY=secret123
# Good: Use build args or runtime env
ARG BUILD_ENV
ENV NODE_ENV=${BUILD_ENV}
Scan for vulnerabilities:
docker scan image:tag
trivy image image:tag
Use Alpine images:
node:18-alpine vs node:18 (900MB → 170MB)python:3.11-alpine vs python:3.11 (900MB → 50MB)Remove unnecessary files:
RUN npm install --production && \
npm cache clean --force
Use specific COPY:
# Bad: Copies everything
COPY . .
# Good: Copy only what's needed
COPY package*.json ./
COPY src ./src
Layer caching optimization:
# Install dependencies first (cached if package.json unchanged)
COPY package*.json ./
RUN npm install
# Copy source (changes more frequently)
COPY . .
RUN npm run build
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
CMD node healthcheck.js
Provide improved version with:
Efficient build:
# Use BuildKit
DOCKER_BUILDKIT=1 docker build -t app:latest .
# Build with cache from registry
docker build --cache-from myregistry/app:latest -t app:latest .
latest)templates/Dockerfile.optimized: Optimized multi-stage Dockerfile exampletemplates/.dockerignore: Common .dockerignore patterns