Docker · Module 9 of 10

Smaller and safer images

Small, non-root images are faster to ship and harder to attack.

📖 Key ideas

Start from slim or alpine base images when possible.
Multi-stage builds compile in one stage and copy only the result to a small final image.
Use .dockerignore to keep node_modules, .git and secrets out of the build.
Run as a non-root user with USER.
Rebuild regularly to pick up security fixes in the base image.

💡 Real-life example: Packing for a trip: take only what you need, and lock the suitcase.

Multi-stage buildBuild in one image, ship from a small one

.dockerignoreFiles left out of the build context

USERSets the user the app runs as

AlpineA very small Linux base image