Best Practice

apt-get install without --no-install-recommends. This installs unnecessary packages, increasing image size and attack surface.

Avoid 'apk upgrade' in Dockerfiles. Use specific base image versions instead for reproducible builds.

Avoid apt-get upgrade in Dockerfiles. Use specific base image versions instead.

Avoid 'dnf update' in Dockerfiles. Use specific base image versions for reproducible builds.

FROM with --platform flag reduces portability. Let Docker handle platform selection.

Avoid 'yum update' in Dockerfiles. Use specific base image versions for reproducible builds.

Avoid 'zypper update' in Dockerfiles. Use specific base image versions for reproducible builds.

MAINTAINER instruction is deprecated. Use LABEL org.opencontainers.image.authors instead.

apt-get install without -y flag. Add -y or --yes for non-interactive builds.

dnf install without -y flag. Add -y for non-interactive builds.

RUN uses 'dnf install' without 'dnf clean all'. This increases image size.

No HEALTHCHECK instruction. Container health cannot be monitored by orchestrators, reducing reliability and observability.

yum install without -y flag. Add -y for non-interactive builds.

RUN instruction uses 'yum install' without 'yum clean all'. This leaves package cache and increases image size.

RUN uses 'zypper install' without 'zypper clean'. This increases image size.

RUN command uses 'cd' which doesn't persist. Use WORKDIR instead.

Use apt-get instead of apt for better script stability in Dockerfiles.

Use COPY instead of ADD for simple file operations. ADD has implicit behavior that can be surprising.

Use JSON notation (exec form) for CMD/ENTRYPOINT for proper signal handling.

apt-get install without removing /var/lib/apt/lists/*. This wastes image space.

RUN instruction uses pipes without 'set -o pipefail'. This masks failures in piped commands.

WORKDIR should use absolute paths starting with /.

Installing both wget and curl wastes space. Choose one tool for downloads.

Use WORKDIR instruction instead of 'cd' in RUN commands.

Base image uses ':latest' tag or no tag (defaults to latest). This makes builds non-reproducible.

apk add without --no-cache. Package cache remains in image, increasing size by 2-5 MB.

pip install without --no-cache-dir. Pip cache remains in image, adding 50-200 MB depending on dependencies.

FROM instruction uses 'latest' tag or no tag. Specify explicit versions for reproducible builds.