Best Practices

Detects FROM instructions using :latest tag which makes builds non-reproducible

Container without HEALTHCHECK instruction cannot be monitored for health status

MAINTAINER instruction deprecated since Docker 1.13, use LABEL with OCI metadata keys instead

apt-get install without --no-install-recommends bloats images by 30-50% with unnecessary packages

apt-get upgrade creates non-reproducible builds. Use specific base image versions instead

Alpine apk without --no-cache leaves package cache in image, adding 2-5 MB unnecessary data

pip without --no-cache-dir leaves cache in ~/.cache/pip/, adding 50-200 MB to images

Shell pipes without pipefail mask failures in earlier commands, only returning last command exit code

ADD has implicit behavior (tar extraction, URL download) that can be surprising. Use COPY unless you need ADD features

yum install without yum clean all leaves package cache, unnecessarily increasing image size

dnf install without dnf clean all leaves package cache, unnecessarily increasing image size

apt-get without removing /var/lib/apt/lists/* wastes space with package metadata not needed at runtime

Using latest or untagged images creates non-reproducible builds that can break unexpectedly

Shell form wraps commands in /bin/sh -c which does not pass signals correctly. Use exec form (JSON) for proper signal handling

Using cd in RUN commands is error-prone and does not persist. WORKDIR is explicit and affects all subsequent instructions

WORKDIR should use absolute paths starting with /. Relative paths can be confusing and error-prone

zypper update in Dockerfiles creates non-reproducible builds. Use specific base image versions instead

zypper install without zypper clean increases image size with unnecessary cache

apt-get install without -y flag may hang in non-interactive builds waiting for user input

Use apt-get instead of apt for better script stability in Dockerfiles. apt output format may change

Installing both wget and curl wastes space. Choose one tool for HTTP operations

yum install without -y flag may hang in non-interactive builds

dnf install without -y flag may hang in non-interactive builds

FROM with --platform flag reduces portability. Let Docker handle platform selection automatically

apk upgrade in Dockerfiles creates non-reproducible builds. Use specific base image versions

yum update creates non-reproducible builds. Use specific base image versions instead

dnf update creates non-reproducible builds. Use specific base image versions instead

RUN command uses cd which does not persist across layers. Use WORKDIR instead