A Docker image is composed of read-only layers. Each Dockerfile instruction can create a layer, and the build cache reuses unchanged layers. Put stable dependency installation before frequently changing application source so edits do not invalidate expensive steps.
Use a precise .dockerignore file to keep secrets, build output, and large local directories out of the build context. Pin base image versions or digests when reproducibility matters.