Docker Layer Optimizer

Docker caches each layer. If you COPY your entire project before running npm install, any code change invalidates the install layer, forcing a full dependency re-download. The fix: COPY package*.json first, run npm install (this layer is cached), then COPY the rest of your source code.

Multi-stage builds use multiple FROM instructions. The first stage (builder) compiles your code with all build tools. The second stage (runtime) copies only the compiled artifacts — no build tools, no dev dependencies. Result: images that are 3-10x smaller and more secure.

Prefer specific paths when possible: COPY src/ ./src/ or COPY package*.json ./. This gives Docker better granularity for cache invalidation. Always use a .dockerignore file to exclude node_modules, .git, .env, and build artifacts from COPY . . to avoid bloating the context.

Each RUN instruction creates a separate layer. Combining commands in one RUN (e.g., RUN apt-get update && apt-get install -y curl && apt-get clean) keeps related changes atomic, reduces layer count, and prevents apt-get cache from being baked into the image.

1) Use slim or alpine base images (node:20-alpine vs node:20). 2) Use multi-stage builds. 3) Run apt-get clean && rm -rf /var/lib/apt/lists/* after installs. 4) Add .dockerignore. 5) Avoid installing debugging tools in production images.

If an attacker escapes the container, they would have root access on the host. Create a dedicated user: RUN addgroup -S app && adduser -S app -G app and then USER app. Most modern base images (distroless, etc.) default to non-root users.