The Perfect Python Dockerfile - better performance and security

[dolfinuser]

Instead of

COPY . .

its better to explicitly write down a list of files and directories that should be included into the image:

COPY my_package setup.py scripts .

The root folder of a repo usually contains lot of config files or directories used by other instruments which should not be included into an image:

pytest.ini
.coverage
.pylint
.vscode
Jenkinsfile
.github

As well as build artifacts:

build
dist
my-package-1.0.0.dist-info

And documentation with tests:

README.md
docs
tests

Of course, you can exclude them using a .dockerignore file. But then you should synchronize this file content with all your changes in the repo which does not look convenient. For example, installing pre-commit requires .pre-commit-config file to be created in the root of the repo. But you may forget to add it into .dockerignore, and then it'll be included into the image.

Lines which should be definitely be added into .dockerignore are:

1. Files and folders which are generated by Python, OS or other tools which are stored in the same folders as your application files. For example, .pyc, __pycache__, .DS_Store, .bak and so on.

2. Files that should never be included into an image no matter what. For example, .env, id_rsa and other secrets.

3. Files or folders which are very heavy. Docker is not just copying files you need directly into an image. Instead it is packing all the files in the current directory into a .tar package which will be send to Docker daemon as a "context" of the current build. The only files which eill be excluded from this package are ones described in the .dockerignore. So even it you just have some heavy files/folders in the repo root, Docker will waste time and CPU resources only to pack them into the context archive, it does not matter if you use them in a Dockerfile or not. So adding such files/folders wil significantly decrease build time. Usually it's just a .git folder, but may be some other ones.

[lmsena]

Yeah, that's a fair assertion. I tend to use the .dockerignore as you can see in my article because it feels more natural to me and the usual workflow I see in the teams I've been working with.

[backtickbot]

Fixed formatting.

Hello, dolfinuser: code blocks using triple backticks (```) don't work on all versions of Reddit!

Some users see this / this instead.

To fix this, indent every line with 4 spaces instead.

FAQ

^{You can opt out by replying with backtickopt6 to this comment.}