Generate a Dockerfile

A multi-stage, non-root, minimal-surface container image with reproducible builds.

Beginner20 minCOMMUNITY ANALYSISDockerBuildx

Prompt

Write a multi-stage Dockerfile for a {language} application.
Requirements: pinned base image digests, dependency layer cached separately from source, non-root user, no build tooling in the final stage, HEALTHCHECK, and a .dockerignore.
Explain the layer caching strategy in three sentences.

Problem

Images are large, root-owned and rebuild slowly.

Goal

A hardened multi-stage image under review-friendly size.

Context

Any application with a standard dependency manifest.

Expected Output

Dockerfile, .dockerignore, caching explanation.

Steps

Generate
Build and measure size and cold/warm build times
Scan the image
Pin digests before merging

Validation

`docker build` cold and warm
`trivy image` scan
Run as non-root and confirm the app starts

Security Considerations

Never bake secrets into layers — use build secrets or runtime configuration
Pin digests, not tags

Lessons Learned

Models default to `latest` tags; always correct this
Ask for the caching explanation to catch bad layer ordering

Related prompts

/prompts/dockerfile-hardening