What an image is
An image is a stack of read-only filesystem layers plus metadata. A container is a running instance with a thin writable layer on top. Layers are content-addressed and cached, so ordering instructions from least to most frequently changed makes rebuilds fast.
Writing a good Dockerfile
Use multi-stage builds so compilers and dev dependencies never reach the runtime image. Pin base image digests, run as a non-root user, add a .dockerignore, and keep the final image minimal (distroless or Alpine) to shrink both pull time and attack surface.
FROM node:22-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
FROM node:22-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
USER node
EXPOSE 8080
CMD ["node", "dist/server.js"]Registries and supply chain
Images are pushed to a registry and pulled by tag or, better, by immutable digest. Scan for CVEs in CI, generate an SBOM, and sign images so clusters can verify provenance before admitting them.