Skip to content

Ravi Sir's Cards › DevOps

Chapter 52: Dockerfile Instructions Explained: FROM, RUN, CMD vs ENTRYPOINT, COPY vs ADD, Multi-Stage and BuildKit: Cards

मराठी cards · Open the chapter

Revision cards

FROM and ARG. Every image starts from a base. — Revision card 1 of 10: FROM and ARG · Download PNG · Open card page

Lesson: 52.1 FROM and ARG: choose the base image

RUN. Each RUN makes a layer, so style affects size. — Revision card 2 of 10: RUN · Download PNG · Open card page

Lesson: 52.2 RUN: shell form, exec form, layers and cache cleanup

CMD vs ENTRYPOINT. You want the program fixed but arguments easy to change. — Revision card 3 of 10: CMD vs ENTRYPOINT · Download PNG · Open card page

Lesson: 52.3 CMD vs ENTRYPOINT

COPY vs ADD. Hidden magic in ADD surprises reviewers. — Revision card 4 of 10: COPY vs ADD · Download PNG · Open card page

Lesson: 52.4 COPY vs ADD

ENV vs ARG. Wrong choice leaks values or loses them. — Revision card 5 of 10: ENV vs ARG · Download PNG · Open card page

Lesson: 52.5 ENV vs ARG

WORKDIR, EXPOSE and USER. Running as root makes a breakout far worse. — Revision card 6 of 10: WORKDIR, EXPOSE and USER · Download PNG · Open card page

Lesson: 52.6 WORKDIR, EXPOSE and USER

HEALTHCHECK, VOLUME, LABEL and more. Running is not the same as healthy. — Revision card 7 of 10: HEALTHCHECK, VOLUME, LABEL and more · Download PNG · Open card page

Lesson: 52.7 HEALTHCHECK, VOLUME, LABEL, STOPSIGNAL, ONBUILD and SHELL

Build cache and .dockerignore. Slow builds waste CI minutes. — Revision card 8 of 10: Build cache and .dockerignore · Download PNG · Open card page

Lesson: 52.8 Build cache and .dockerignore

Multi-stage builds and build secrets. Build tools and tokens must not ship to production. — Revision card 9 of 10: Multi-stage builds and build secrets · Download PNG · Open card page

Lesson: 52.9 Multi-stage builds and BuildKit secrets

docker build and buildx options. Knowing flags fixes most build problems. — Revision card 10 of 10: docker build and buildx options · Download PNG · Open card page

Lesson: 52.10 docker build and buildx commands: full reference

Interview cards

Can ARG be used before FROM? Yes, to choose the base. But it is out of scope after FROM; redeclare ARG NAME inside the stage to use it. — Interview card 1 of 10: Can ARG be used before FROM? · Download PNG · Open card page

Lesson: 52.1 FROM and ARG: choose the base image

Why combine apt-get update and install? Separate layers cache an old update, so later installs fail or get stale packages. One RUN keeps them in sync and lets you clean lists. — Interview card 2 of 10: Why combine apt-get update and install? · Download PNG · Open card page

Lesson: 52.2 RUN: shell form, exec form, layers and cache cleanup

CMD vs ENTRYPOINT? CMD is replaced by args after the image name. ENTRYPOINT stays (override with --entrypoint). Together, CMD becomes ENTRYPOINT's args. — Interview card 3 of 10: CMD vs ENTRYPOINT? · Download PNG · Open card page

Lesson: 52.3 CMD vs ENTRYPOINT

COPY vs ADD? Both copy from the context. ADD also auto-extracts local tar files and can download URLs. Prefer COPY for clarity. — Interview card 4 of 10: COPY vs ADD? · Download PNG · Open card page

Lesson: 52.4 COPY vs ADD

Why not pass secrets with ARG or ENV? Both are visible: ARG in docker history, ENV in docker inspect. Use RUN --mount=type=secret at build and runtime secrets at run. — Interview card 5 of 10: Why not pass secrets with ARG or ENV? · Download PNG · Open card page

Lesson: 52.5 ENV vs ARG

Why set USER in a Dockerfile? Containers run as root by default. A non-root USER limits damage if the app is hacked. Use ports above 1024. — Interview card 6 of 10: Why set USER in a Dockerfile? · Download PNG · Open card page

Lesson: 52.6 WORKDIR, EXPOSE and USER

How does HEALTHCHECK work? Docker runs the command every interval; after retries failures the status is unhealthy. Compose can wait for healthy. — Interview card 7 of 10: How does HEALTHCHECK work? · Download PNG · Open card page

Lesson: 52.7 HEALTHCHECK, VOLUME, LABEL, STOPSIGNAL, ONBUILD and SHELL

How do you speed up Docker builds? Order steps by change rate, copy package files first, use .dockerignore, BuildKit cache mounts and registry cache in CI. — Interview card 8 of 10: How do you speed up Docker builds? · Download PNG · Open card page

Lesson: 52.8 Build cache and .dockerignore

How do you use a private token during build safely? RUN --mount=type=secret,id=npm reads it from /run/secrets only during that step; build with --secret id=npm,env=NPM_TOKEN. It never enters a layer. — Interview card 9 of 10: How do you use a private token during build safely? · Download PNG · Open card page

Lesson: 52.9 Multi-stage builds and BuildKit secrets

What is the build context? The folder (last argument) sent to the builder. COPY can only see files in it, minus .dockerignore. — Interview card 10 of 10: What is the build context? · Download PNG · Open card page

Lesson: 52.10 docker build and buildx commands: full reference

Comparison cards

CMD vs ENTRYPOINT. CMD: default command or args.ENTRYPOINT: the fixed executable. — Comparison card 1 of 3: CMD vs ENTRYPOINT · Download PNG · Open card page

Lesson: 52.3 CMD vs ENTRYPOINT

COPY vs ADD. COPY: copies files.ADD: copies plus extract and URL. — Comparison card 2 of 3: COPY vs ADD · Download PNG · Open card page

Lesson: 52.4 COPY vs ADD

ENV vs ARG. ARG: build-time variable.ENV: variable in the image. — Comparison card 3 of 3: ENV vs ARG · Download PNG · Open card page

Lesson: 52.5 ENV vs ARG