Multi-stage hardened Dockerfile
Pinned digests, cached dependency layer, non-root user, no build tooling in the final image.
BeginnerCOMMUNITY ANALYSISDocker
Write a multi-stage Dockerfile for a {language} application.
Require pinned base image digests, a dependency layer cached separately from source, a non-root user, no build tooling in the final stage, a HEALTHCHECK and a matching .dockerignore.
Then explain the layer caching strategy in three sentences.Use Case
Replacing a bloated single-stage image.
Expected Result
A smaller image that scans clean and builds fast on warm cache.
Related recipe