Container Image Doctor: Smaller, Faster, Safer Builds

I checked the bundled demo: an invented Node.js app's Dockerfile and .dockerignore.

Step 1: check the Dockerfile as written

Dockerfile check: 1 stage(s), 9 instruction(s)

check          result
-------------  -----------
pin            warn
multi-stage    note
cache-order    warn
copy-early     ok
package-cache  warn
user           warn
healthcheck    note
dockerignore   warn
arg-env        warn

7 warning(s), 2 note(s)
- .dockerignore  [warn]  dockerignore  .dockerignore does not exclude .git and the whole context is copied
- .dockerignore  [warn]  dockerignore  .dockerignore does not exclude .env and the whole context is copied
- line 1  [warn]  pin  base image has no tag or digest, so it pulls whatever the latest tag is
- line 1  [warn]  user  no USER in the final image, so it runs as the base image's user, which is root unless the base image sets another
- line 1  [note]  healthcheck  no HEALTHCHECK in the Dockerfile (the base image may set one); add one unless your platform runs its own health checks
- line 2  [note]  multi-stage  one stage compiles or builds and also ships; a build stage plus a small final stage keeps compilers and sources out of the image
- line 2  [warn]  package-cache  apt-get or apt install without removing /var/lib/apt/lists in the same RUN
- line 4  [warn]  cache-order  the whole build context is copied before the dependency install, so any file change reinstalls every dependency; copy the manifest and lock file first, install, then copy the rest
- line 7  [warn]  arg-env  ENV name says it holds a credential; build arguments and environment values stay readable in the image history or config, so pass it as a build secret or at run time

For the demo I take these as your answers: the app runs on Node.js 22 and a slim image is fine, it runs under a plain container runtime, and at run time it reads package.json, node_modules and the built dist/, where dist/healthcheck.js exits 0 when the app answers.

Step 2: improved Dockerfile, as a diff

--- Dockerfile.before
+++ Dockerfile.after
@@ -1,9 +1,25 @@
-FROM node
-RUN apt-get update && apt-get install -y python3 make g++
+# syntax=docker/dockerfile:1
+
+# Build stage: compilers and dev dependencies stay here.
+FROM node:22-bookworm-slim AS build
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends python3 make g++ \
+ && rm -r /var/lib/apt/lists/*
 WORKDIR /app
-COPY . .
+COPY package.json package-lock.json ./
 RUN npm ci
-RUN npm run build
-ENV SESSION_SECRET=... (value not shown)
+COPY . .
+RUN npm run build && npm prune --omit=dev
+
+# Final stage: only what the app reads at run time (package.json, node_modules, dist).
+# Assumed for the demo: Node.js 22 and a slim image are fine, and dist/healthcheck.js exits 0 when the app answers.
+FROM node:22-bookworm-slim
+ENV NODE_ENV=production
+WORKDIR /app
+COPY --from=build --chown=node:node /app/package.json ./package.json
+COPY --from=build --chown=node:node /app/node_modules ./node_modules
+COPY --from=build --chown=node:node /app/dist ./dist
+USER node
 EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=3s CMD ["node", "dist/healthcheck.js"]
 CMD ["node", "dist/server.js"]
--- dockerignore.before
+++ dockerignore.after
@@ -1,2 +1,5 @@
+.git
+.env
 node_modules
+dist
 npm-debug.log

Step 3: check the rewrite

Dockerfile check: 2 stage(s), 17 instruction(s)

check          result
-------------  -----------
pin            ok
multi-stage    ok
cache-order    ok
copy-early     ok
package-cache  ok
user           ok
healthcheck    ok
dockerignore   ok
arg-env        ok

0 warning(s), 0 note(s)

Size

Nothing was built, so no size gain is claimed. To measure it, build both versions on the same machine and save docker image inspect (or docker history --format json) for each, then run compare_history.py on the two files. It prints the bytes before and after and the change in percent.

Want me to review your own Dockerfile?