Dockerfiles

A Dockerfile is a text document that contains a sequence of instructions used to build a Docker image. It is processed by the docker build command, which reads the file from the build context and executes each instruction in order to produce a filesystem snapshot called an image. Each instruction creates a new image layer, and layers are cached to speed up subsequent builds. The resulting image can be used to run containers.

Core structure: The FROM instruction specifies the base image. Subsequent instructions modify the image, such as RUN to execute shell commands, COPY and ADD to bring in files, ENV to set environment variables, and WORKDIR to set the working directory. CMD and ENTRYPOINT define default or fixed startup commands, while USER runs the container as a specific user. Others include EXPOSE, VOLUME, LABEL, and ARG for build-time variables.

Build considerations: Multistage builds allow separating build and runtime environments to minimize final image size. Pin base image tags for reproducibility, and use a .dockerignore file to exclude unnecessary files from the build context. Chain commands with && to reduce the number of layers, and remove build-time tools from the final image when possible. Security concerns include avoiding running as root and keeping images small.

Other features: ARG supports parameters at build time; ONBUILD triggers can run in child images; ADD supports remote URLs and tar extraction, while COPY is more predictable for local files. A well-formed Dockerfile emphasizes clarity and maintainability.