Optimize Docker Images for Size, Speed, and Security

# Instead of this (900MB+)
FROM ubuntu:22.04

# Use this (5MB)
FROM alpine:3.19

# Or for specific languages (slim variants)
FROM python:3.12-slim
FROM node:20-alpine

FROM gcr.io/distroless/python3-debian12
COPY --from=builder /app /app
CMD ["/app/main.py"]

# Build stage
FROM golang:1.22-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o main .

# Runtime stage
FROM scratch
COPY --from=builder /app/main /main
ENTRYPOINT ["/main"]

# Good: Dependencies cached separately
FROM node:20-alpine

WORKDIR /app

# These change less frequently
COPY package*.json ./
RUN npm ci --only=production

# This changes more frequently
COPY . .

CMD ["node", "server.js"]

# Bad: Creates multiple layers
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get clean

# Good: Single layer, smaller size
RUN apt-get update && \
    apt-get install -y --no-install-recommends curl && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

FROM node:20-alpine

RUN addgroup -g 1001 appgroup && \
    adduser -u 1001 -G appgroup -D appuser

WORKDIR /app
COPY --chown=appuser:appgroup . .

USER appuser

CMD ["node", "server.js"]

# In docker-compose.yml or docker run
security_opt:
  - no-new-privileges:true
read_only: true
tmpfs:
  - /tmp

# Using Trivy
trivy image myapp:latest

# Using Docker Scout
docker scout cves myapp:latest

# Using Snyk
snyk container test myapp:latest

# .dockerignore
.git
.gitignore
node_modules
npm-debug.log
Dockerfile*
docker-compose*
.env*
*.md
tests/
coverage/
.cache/

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential \
        libpq-dev && \
    pip install --no-cache-dir -r requirements.txt && \
    apt-get purge -y --auto-remove build-essential && \
    rm -rf /var/lib/apt/lists/* /root/.cache

# Install UPX and compress binary
RUN apk add --no-cache upx && \
    upx --best --lzma /app/binary

# Enable BuildKit
export DOCKER_BUILDKIT=1

# Or in daemon.json
{
  "features": {
    "buildkit": true
  }
}

# syntax=docker/dockerfile:1.4
FROM python:3.12-slim

RUN --mount=type=cache,target=/root/.cache/pip \
    pip install -r requirements.txt

# For Python
RUN python -m compileall -q /app

# For Node.js
RUN npm run build && npm prune --production