Every Dockerfile instruction you need day to day, what it does, and the difference between the commonly confused pairs (CMD vs ENTRYPOINT, COPY vs ADD, ARG vs ENV).
| Instruction | Purpose |
|---|---|
FROM image:tag [AS name] | Base image; starts a (new) build stage |
WORKDIR /app | Set and create the working directory |
COPY src dest | Copy files from the build context |
ADD src dest | Like COPY, plus URLs and auto-extracting tar files |
RUN cmd | Execute a command at build time, creating a layer |
ENV KEY=value | Env var at build and run time |
ARG KEY=default | Variable at build time only (--build-arg) |
EXPOSE 8080 | Documents the port; does not publish it |
USER app | Run following steps and the container as this user |
VOLUME /data | Declare a mount point |
HEALTHCHECK CMD ... | Command Docker runs to judge health |
LABEL key=value | Metadata (version, maintainer) |
CMD [..] | Default command / arguments, easy to override |
ENTRYPOINT [..] | Fixed executable; CMD becomes its arguments |
docker run img args replaces CMD but is appended to ENTRYPOINT. Use ENTRYPOINT for the executable, CMD for default flagsCMD ["node","app.js"] runs node as PID 1 and receives SIGTERM; CMD node app.js runs under /bin/sh -c and may ignore stop signals. Prefer exec formARG and ENV values are stored in the image history. Never use them for secrets; use RUN --mount=type=secret instead.