Read on Twitter
Dockerfile Best Practices.
Writing a good Dockerfile is important when you containerize your application.
Dockerfile: is a text document that contains all the commands a user could call on the command line to assemble an image.
Below, a Thread of best practices per KEYWORD.
Writing a good Dockerfile is important when you containerize your application.
Dockerfile: is a text document that contains all the commands a user could call on the command line to assemble an image.Below, a Thread of best practices per KEYWORD.
FROMYou should ALWAYS use official images as the base image.
The good rule is to never use random things on the internet (it also works for GitHub, npm, ...)
RUNHere is a matter of readability.
Dockerfiles are read by humans, so you should split long or complex RUN statements into multiple lines separated by backslashes
CMDThe CMD instruction should be used to run the software contained in your image, along with any arguments.
This keyword should be used in the form of
CMD ["executable", "param1", "param2"…]
LABELFor each label, add a line beginning with LABEL,
followed by one or more key-value pairs.
EXPOSEThe EXPOSE instruction indicates the ports on which a container listens for connections.
Use the common port for your application.
ENVIt can be used in a good way to:
-set commonly used version numbers so that version bumps are easier to maintain
-update the PATH env variable for the software your container installs.
-provide required environment variables specific to services you wish to containerize
ADD or COPYFor being more transparent, COPY is preferred.
If you have multiple Dockerfile steps that use different files from your context, COPY them individually, rather than all at once.
use curl or wget instead of ADD
ENTRYPOINTThe best use for ENTRYPOINT is to set the image’s main command, allowing that image to be run as though it was that command (and then use CMD as the default flags).
VOLUMEUse it to expose any:
- database storage area
- configuration storage
- files/folders
created by your docker container.
USERDon't switch Users too often.
If a service can run without privileges, use USER to change to a non-root user.
Avoid installing or using sudo
WORKDIRuse absolute paths for your WORKDIR
use WORKDIR instead of RUN cd … && do-something
ONBUILDImages built with ONBUILD should get a separate tag.
It is also useful for images that are going to be built FROM a given image.
