A Dockerfile is a text document containing instructions to build a Docker image. It defines your application's environment, dependencies, and runtime configuration. Using a Dockerfile ensures consistent deployments across development, staging, and production environments, eliminating "it works on my machine" issues.

Multi-stage builds use multiple FROM statements in a single Dockerfile. The first stage compiles/builds your application with all necessary tooling, and the final stage copies only the compiled artifacts. This dramatically reduces image size — a Go binary can run in a ~12MB scratch image instead of an 800MB+ full SDK image. It also improves security by excluding build tools from the production image.

Alpine (~5-7MB base) is the smallest, using musl libc and BusyBox. Great for Go and simple Node apps, but may cause issues with native modules (Python C extensions, some npm packages). Slim (~50-80MB) strips documentation and unnecessary files while keeping glibc — a solid balance for Python and Node.js. Default (full) images include everything; use only when you need specific system libraries. For most web apps, Slim or Alpine are recommended.

Use a .dockerignore file to exclude node_modules and logs. Copy package.json and lock files first before copying source code — this leverages Docker layer caching. Use npm ci instead of npm install in CI/production for reproducible builds. Run as the built-in node user instead of root. For production, use multi-stage builds to exclude devDependencies. Set NODE_ENV=production for optimized runtime behavior.

Use python:3.x-slim for a good balance of size and compatibility. Always use --no-cache-dir with pip to avoid storing package caches in the image. Set PYTHONUNBUFFERED=1 to see logs in real-time. Consider using poetry for deterministic dependency management. For production WSGI/ASGI apps, use gunicorn or uvicorn as the entrypoint rather than the development server. Run as a non-root user for security.

Always use multi-stage builds — compile in the golang image, then copy the binary to a minimal alpine or scratch image. Use CGO_ENABLED=0 for fully static binaries that can run in scratch. Add -ldflags="-s -w" to strip debug info and reduce binary size by ~30%. Use go mod download in a separate layer to cache dependencies. Include ca-certificates in the final stage if your app makes HTTPS requests. Set GIN_MODE=release for Gin framework apps.

Key strategies: (1) Use multi-stage builds to separate build and runtime environments. (2) Choose minimal base images like Alpine or Slim. (3) Combine RUN commands to reduce layers: RUN apt-get update && apt-get install -y pkg && rm -rf /var/lib/apt/lists/*. (4) Use .dockerignore to exclude unnecessary files. (5) Clean up package caches and temp files in the same layer. (6) For Go, use scratch as the final base image when possible. (7) Avoid installing debugging tools in production images.

CMD provides default arguments for the container's entrypoint and can be overridden by command-line arguments. ENTRYPOINT defines the main executable that always runs. Use ENTRYPOINT for the main binary and CMD for default flags. Example: ENTRYPOINT ["python", "app.py"] with CMD ["--port", "8000"] — the --port can be overridden at runtime while python app.py always executes.

No. Running as root is a security risk — if an attacker compromises your application, they gain root access to the container. Always switch to a non-root user with the USER instruction. Official Node images include a node user; Python and Go images can use nobody or a custom user. For Kubernetes, you can also enforce this with securityContext.runAsNonRoot: true. Our generator enables non-root by default.

A .dockerignore file works like .gitignore — it tells Docker which files to exclude from the build context. This speeds up builds and prevents sensitive files from being copied. Common entries: node_modules, .git, .env, *.log, __pycache__, *.pyc, dist/, coverage/, .DS_Store, and IDE folders like .vscode/. Always create a .dockerignore alongside your Dockerfile for security and performance.