LowFile-scopeDockerfile Plug & play

Optimize Docker layer caching strategy

Copy and install dependencies before application sources; ensure .dockerignore excludes node_modules and build outputs.

Why this matters

Maximizes cache hits for dependency layers, speeding up incremental builds.

Side-by-side examples engineers can pattern-match during review.

Avoid

COPY . .
RUN npm ci
RUN npm run build

Prefer

COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
RUN npm run build
# .dockerignore excludes node_modules/, dist/, .git/

Bad

COPY . . && npm ci

Good

COPY package*.json ./ && npm ci && COPY . .

From the same buckets as this rule.

Critical
Pods must run as non-root with read-only root filesystem
Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.
infra-as-codesecurity-hardening+1
High
Add explicit environment variable checks
Validate required runtime env vars at container start via an entrypoint script; exit with a clear message on missing values.
config-environmentcontainer-docker-hygiene+1
High
Implement multi-stage builds for production
Use a builder stage for toolchains/dev deps and a minimal runtime stage that contains only runtime artifacts.
container-docker-hygienesecurity-hardening