Best Practice

Base image uses ':latest' tag or no tag (defaults to latest). This makes builds non-reproducible.

MAINTAINER instruction is deprecated. Use LABEL org.opencontainers.image.authors instead.

apt-get install without --no-install-recommends. This installs unnecessary packages, increasing image size and attack surface.

Avoid apt-get upgrade in Dockerfiles. Use specific base image versions instead.

Avoid 'dnf update' in Dockerfiles. Use specific base image versions for reproducible builds.

RUN instruction uses pipes without 'set -o pipefail'. This masks failures in piped commands.

Use COPY instead of ADD for simple file operations. ADD has implicit behavior that can be surprising.

RUN instruction uses 'yum install' without 'yum clean all'. This leaves package cache and increases image size.

RUN uses 'dnf install' without 'dnf clean all'. This increases image size.

apt-get install without removing /var/lib/apt/lists/*. This wastes image space.

Use JSON notation (exec form) for CMD/ENTRYPOINT for proper signal handling.

Use WORKDIR instruction instead of 'cd' in RUN commands.

WORKDIR should use absolute paths starting with /.

Avoid 'zypper update' in Dockerfiles. Use specific base image versions for reproducible builds.

RUN uses 'zypper install' without 'zypper clean'. This increases image size.

apt-get install without -y flag. Add -y or --yes for non-interactive builds.

No HEALTHCHECK instruction. Container health cannot be monitored by orchestrators, reducing reliability and observability.

Use apt-get instead of apt for better script stability in Dockerfiles.

Installing both wget and curl wastes space. Choose one tool for downloads.

yum install without -y flag. Add -y for non-interactive builds.

dnf install without -y flag. Add -y for non-interactive builds.

FROM with --platform flag reduces portability. Let Docker handle platform selection.

Avoid 'apk upgrade' in Dockerfiles. Use specific base image versions instead for reproducible builds.

Avoid 'yum update' in Dockerfiles. Use specific base image versions for reproducible builds.

RUN command uses 'cd' which doesn't persist. Use WORKDIR instead.

apk add without --no-cache. Package cache remains in image, increasing size by 2-5 MB.

pip install without --no-cache-dir. Pip cache remains in image, adding 50-200 MB depending on dependencies.

FROM instruction uses 'latest' tag or no tag. Specify explicit versions for reproducible builds.