Dockerfile fundamentals

# Use a specific minor version, not "latest"
FROM python:3.12-slim

# Set working directory
WORKDIR /app

# Copy dependency manifest first (better caching)
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy application code
COPY . .

# Drop privileges
RUN useradd -m appuser
USER appuser

# Document the port (doesn't actually expose)
EXPOSE 8000

# Default command
CMD ["python", "app.py"]

Best practices to mention in interviews:

• Use specific image tags, not latest
• Multi-stage builds to reduce final image size (build in one stage, copy artifacts to a slim runtime stage)
• Use .dockerignore to keep build context small
• Run as non-root user
• Use slim or distroless base images for security
• Order layers from least-changing to most-changing for cache efficiency
• One process per container (sidecars are separate containers)
• Health checks via HEALTHCHECK
• Don't bake secrets into images