dockerfile-best-practiceslisted

# Dockerfile Best Practices Comprehensive guide for creating optimized, secure, and fast Docker images using modern BuildKit features. ## Workflow 1. **Identify language/framework** → Pick a template from [Language Templates](#language-templates) 2. **Apply essential rules** → Every Dockerfile must follow [Essential Rules](#essential-rules-always-apply) 3. **Security hardening** → Non-root user, secret mounts, provenance and SBOM attestations (see [references/supply_chain.md](references/supply_chain.md)) 4. **Optimize for cache** → Separate deps from code, use cache mounts 5. **Multi-stage if needed** → Compiled languages or distroless runtime 6. **Add metadata** → OCI labels, HEALTHCHECK, STOPSIGNAL (see [PID 1 and Signals](#pid-1-and-signals)) 7. **Review** → Run [scripts/analyze_dockerfile.py](scripts/analyze_dockerfile.py), then `docker build --check` (see [references/build_checks.md](references/build_checks.md)) ## Essential Rules (Always Apply) ### 1. BuildKit syntax directive (first line, always) ```dockerfile # syntax=docker/dockerfile:1 ``` ### 2. Pin a readable tag you are willing to maintain "Receives security patches" and "reproducible" are properties of a **process**, not of a tag string. A floating tag patches nothing by itself: it patches when someone rebuilds. - **Pin a tag as specific as you are willing to maintain.** `python:3.12-slim` is fine. `python:3.12-slim-bookworm` is equally fine: pinning the OS is a legitimate stability choice, not a mistak