Use multi-stage Dockerfiles to separate building from the runtime image so you ship only the compiled artifact and a minimal runtime. Smaller images mean faster pulls, smaller attack surface, and fewer vulnerable layers.
Do the compile and install work in an early named stage, then COPY only the artifact into a smaller final stage.
Keep dependency install before copying full source so Docker cache survives small code changes.
Pick the smallest suitable base (slim or distroless) and run as a non-root user to reduce size and attack surface.
# Why change your Dockerfile Most single-stage Node Dockerfiles keep the entire build shop in the final image: the Debian base, full Node toolchain, compilers, dev dependencies, npm cache, and your full source tree. That often turns a tiny app into a 1+ GB image. The consequences: slower pulls during deploys and autoscaling, more layers for scanners, larger attack surface, and longer time between push and running.
# What multi-stage builds do A multi-stage Dockerfile uses multiple FROM instructions. Do the heavy work in an early stage (install, compile), then start a fresh final stage and copy only what you actually need to run. The build-stage layers never make it into the final image.
This pattern keeps compilers, dev packages, npm cache, and full source out of the runtime image.
# Four implementation details that matter
2) Don't copy node_modules between stages
3) Order instructions to maximize cache reuse Docker caches layers top to bottom. Copy lockfiles and install dependencies before copying the rest of your source. That way a code change invalidates only the later layers and doesn't force a full reinstall.
If you reverse that, every small change triggers a full dependency reinstall.
4) Choose a smaller final base and drop root
# Other useful patterns
# What you get in practice Measured on an Express + TypeScript example in the article:
# Practical checklist before you change a Dockerfile
A small, ten-line change yields smaller images, faster deploys, and fewer runtime liabilities.
Every Java developer who runs services on Kubernetes has watched this scene play out. Traffic spikes, the autoscaler adds a pod, and then everyone waits. The container is running in two seconds. The application is not ready for another twelve seconds. During those ten seconds, your existing pods absorb the extra load,
You cloned a repo, read the README, and your fingers are already typing docker compose up . Stop. A third-party repository is untrusted input — and the build/run pipeline executes it. Most "it's just a demo repo" incidents I've audited started with a skipped two-minute review. Here are seven checks, in the order that c
Most Docker content targets web developers shipping stateless services. However, data engineers, who represent a huge and growing population of Dockers users, are mostly left to figure things out alone, and it shows. The get pipelines that pass locally, but explode on clusters. They pit notebook-only development agains
Everything we run ships continuously. The engine behind the apps, the back office our customers build in, the web products around them — code moves to production at the rhythm of engineering: when it's ready, it goes. Features don't work that way. A feature has a launch: a name, documentation, support people who know i
I've used Docker several times. The funny part? I didn't really understand Docker. My first encounter with it was back in March 2026, when I was exploring different automations and customizations. One of the things I wanted to try was running Ollama with WebUI locally. I wanted a local AI model with a nice interface, a
The Minimus registry goes offline on October 22. Here is the migration path, the free help Docker is offering, and where to start.
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.