Docker Images

Docker Images: Build, Tag, and Push

A Dockerfile is an ordered build recipe. BuildKit processes instructions, copies files from the build context, reuses eligible cached layers, and creates an image configuration plus content-addressed filesystem layers.

Core ideas

• The build context is the directory or remote source available to COPY and ADD.
• Layer cache reuse depends on the instruction and its inputs; copy lockfiles before source to preserve dependency cache.
• A tag is a convenient mutable name, while a digest identifies exact content.
• Pushing uploads missing blobs and a manifest to a registry repository.

How it works

Choose a trusted base, declare a working directory, copy dependency manifests, install reproducibly, then copy source and build. Tag with a release identifier and optionally a channel tag. Authenticate securely, push, and record the resulting digest for deployment.

Command or configuration example

FROM node:22-alpine
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY . .
ENV NODE_ENV=production
USER node
CMD ["node", "server.js"]

Run examples first in a disposable environment. Replace image names, versions, credentials, ports, paths, and resource values with reviewed settings appropriate to your system.

Production guidance

• Add a .dockerignore so secrets, VCS history, dependencies, and build output do not enter the context.
• Avoid unpinned package installs and mutable base assumptions where reproducibility matters.
• Attach provenance, scan the image, and deploy by digest for high-assurance releases.

The chapter quiz follows this lesson and checks the concepts as well as the operational tradeoffs.