Image Creation
Image Creation
An image is an ordered stack of immutable, content-addressed layers plus metadata. Each Dockerfile instruction that changes the filesystem creates a layer; metadata instructions such as CMD, ENTRYPOINT, EXPOSE, and LABEL do not. Candidates must know the build cache: a layer is reused only if the instruction and all parent layers are unchanged, so ordering matters. Copy dependency manifests and install dependencies before copying application source to preserve cache hits.
Important instructions: FROM (use small, pinned base images), RUN (combine commands and clean package caches in the same layer), COPY versus ADD (prefer COPY; ADD also handles URLs and local tar extraction), ENTRYPOINT (exec form preferred so signals reach PID 1) versus CMD (default arguments), USER (drop root), WORKDIR, and multi-stage builds using COPY --from= to ship only artifacts into a minimal runtime image. Also understand .dockerignore, which keeps build context small, and docker build --no-cache / --pull for reproducibility.
Traps: believing deleting a file in a later layer shrinks the image (the earlier layer still contains it); assuming CMD overrides ENTRYPOINT (it supplies arguments unless the user overrides the entrypoint); and thinking shell-form CMD receives signals properly (it runs under /bin/sh -c, so the shell is PID 1).
Worked example: a Node.js image that runs COPY . . then RUN npm install rebuilds dependencies on every source change. Reordering to copy package.json and package-lock.json, run npm ci, then copy source, keeps the dependency layer cached until the lockfile changes.