RahulRachhoya Docker Best Practices
Image Size
- Use slim/base images (
python:3.12-slim, notpython:3.12) - Multi-stage builds — build in one stage, copy artifacts to final stage
- Combine RUN commands (
&&) to reduce layers - Remove package manager caches in the same layer
.dockerignoreto exclude unnecessary files
Dockerfile
FROM python:3.12-slim AS builder
WORKDIR /app
COPY pyproject.toml .
RUN pip install --user --no-cache-dir -e .
FROM python:3.12-slim
WORKDIR /app
COPY --from=builder /root/.local /root/.local
COPY src/ src/
COPY skill_data/ skill_data/
ENV PATH=/root/.local/bin:$PATH
CMD ["python", "-m", "auto_skill_mcp"]
Security
- Don't run as root — use
USER appuser - Don't store secrets in images — use build args or mount secrets
- Scan images with
docker scanortrivy - Pin base image versions (don't use
:latest) - Use read-only root filesystem where possible