Images, Containers and Multi-Stage Builds

MODULE 19 · LESSON 19.1

Separate build and runtime concerns while running as a non-root user.

Practice-firstBeginner-friendlyProduction-aware

From mental model to working change

A developer can know the syntax behind Images, Containers and Multi-Stage Builds and still make the wrong production decision. This lesson closes that gap. This lesson controls how a working change survives machines, environments, traffic and failure after it leaves a developer laptop.

Here, that decision supports a specific checkpoint: Containerize the API and PostgreSQL development stack. A reviewable result should include a command transcript, CI result, deployment check and rollback note rather than a claim that the feature simply works.

Images, Containers and Multi-Stage Builds workflowA four-step visual showing layers, build context, multi-stage builds, non-root runtime.Images, Containers and Multi-Stage Builds workflow1Layers2Build Context3Multi-stage Builds4Non-root Runtime

Images, Containers and Multi-Stage Builds workflow

  1. 1Layers
  2. 2Build Context
  3. 3Multi-stage Builds
  4. 4Non-root Runtime
Images, Containers and Multi-Stage Builds workflow: a practical sequence used in this lesson.

A practical model for images, containers and multi-stage builds

Separate build and runtime concerns while running as a non-root user. The useful unit of understanding is the boundary: who owns the decision, which input crosses it, what result is visible and how a failure is reported.

  • Layers: Connect this concept to the module checkpoint and identify the evidence a reviewer should expect.
  • Build Context: Explain the concept without framework jargon, then point to it in the working example.
  • Multi-stage Builds: Decide what belongs in code, configuration, data or documentation and explain why.
  • Non-root Runtime: Name its input, observable result and most likely failure in this lesson.

Follow the data through the example

Before running the sample, predict how changing build context will alter the result. The prediction is part of the exercise.

DOCKERFILE
FROM node:24-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:24-alpine
USER node
Trace cause before effect

Follow build context from input to output. If the result surprises you, stop at the first boundary where reality differs from your prediction.

Ship a reviewable increment

  1. 1
    Layers

    Describe the behavior in one sentence, then choose the smallest input that can prove it.

  2. 2
    Build Context

    Add this responsibility at the narrowest sensible boundary; do not pull an unrelated layer into the change.

  3. 3
    Multi-stage Builds

    Run the focused example and save the output, trace, query or screenshot that confirms the result.

  4. 4
    Non-root Runtime

    Break one assumption on purpose, make recovery clear and record the trade-off you accepted.

Risks to catch during review

  • Treating layers as vocabulary instead of defining the behavior it must produce.
  • Testing the expected path while ignoring an empty, invalid, repeated or unauthorized case around build context.
  • Allowing multi-stage builds to cross a boundary without an explicit contract or useful error.
  • Changing several layers before capturing the first piece of evidence, which makes the original cause harder to see.

A repeatable investigation sequence

  1. Reduce the problem to the smallest failing Images, Containers and Multi-Stage Builds case.
  2. Capture the actual input and output at the layers boundary.
  3. Read the first relevant error, request, trace or query rather than the loudest downstream symptom.
  4. Test one explanation for the failure in build context; avoid changing two variables together.
  5. Keep a regression check that would expose the same defect if it returned.

Security decision

Use least privilege, protected secrets, reviewed dependencies and reversible changes. A deployment shortcut must never weaken the application boundary.

Performance decision

Establish a baseline, observe resource use and latency, and keep a rollback signal. Capacity changes without measurement are guesses.

PRACTICE

Build something you can inspect

Create a multi-stage image, add a .dockerignore and compare image sizes.

Stretch challenge

Introduce a realistic failure involving layers, keep recovery understandable, and document why your response is proportionate.

Definition of done

  • The behavior around layers works with realistic input.
  • A failure involving build context is handled clearly and without leaking sensitive detail.
  • The implementation remains keyboard-usable when it produces an interface.
  • Your evidence directly supports the claim made in the exercise.
  • The README records the important trade-off without pretending the solution is universal.

Check your reasoning

Why should dependency lockfiles be copied before changing source files in a Docker build?

Answer by naming the expected layers behavior, the layer responsible for it and the evidence that would confirm your explanation.

Where would you investigate the first failure?

Start where build context crosses a boundary. Compare the actual input and output there before following downstream symptoms.

What would make this work reviewable?

Show the focused change, repeatable steps, the result of your check and one honest trade-off connected to multi-stage builds.

What to carry into the next lesson

  • Separate build and runtime concerns while running as a non-root user.
  • Keep layers visible at the boundary where it can be tested.
  • Use evidence from build context before widening the implementation.

References and related reading

Progress is stored only in this browser.

Share this page

Share this page with the people who will use it next.

X Facebook LinkedIn WhatsApp Email

Discussion

No comments yet. Add the first useful question or observation.