Docker Foundations·Ship the environment with the app

A Dockerfile with good layers

Layer order determines cache reuse; small runtime images reduce risk.

Beginner 15 min read Lesson 7 of 300 Challenge included

What you will be able to do

Use a specific base image and multi-stage builds.
Copy package files and install dependencies before copying source.
Create and switch to an unprivileged user.

In plain English

Copy dependency manifests before source so dependency installs stay cached when only code changes. Use multi-stage builds to keep compilers and dev dependencies out of the final image. Run as a non-root user.

DockerfileDockerfile

FROM node:22-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:22-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY --from=build /app/.output ./.output
USER node
EXPOSE 3000
CMD ["node", ".output/server/index.mjs"]

Your turn

Run as a non-root user

Easy

Add a USER node line to a Node runtime stage and explain why it matters.

DOCKERFILE · starter

FROM node:22-alpine
CMD ["node", "server.js"]

Check your understanding before moving on.

Knowledge checkQuestion 1

Why copy package.json before the rest of the source?

Select an answer to continue

Study tools

Make it yours.

Keep a private note for this lesson, then turn the key ideas into flashcards you can revisit.

Sign in to save notes and flashcards.Both are private to your account and stay with your progress.

Finished reading?

Lock in what you just learned.

Mark this lesson complete to save your place and move one step closer to the certificate.

Next: Volumes, ports and networks

Lesson 7 of 300 · 0% of course