@@ -63,6 +63,12 @@ replaced by the new hardened image.
63
63
64
64
### Step 2: Update the runtime image in your Dockerfile
65
65
66
+ > [ !NOTE]
67
+ >
68
+ > Multi-stage builds are recommended to keep your final image minimal and
69
+ > secure. Single-stage builds are supported, but they include the full ` dev ` image
70
+ > and therefore result in a larger image with a broader attack surface.
71
+
66
72
To ensure that your final image is as minimal as possible, you should use a
67
73
[ multi-stage build] ( /manuals/build/building/multi-stage.md ) . All stages in your
68
74
Dockerfile should use a hardened image. While intermediary stages will typically
@@ -77,8 +83,15 @@ examples of how to update your Dockerfile.
77
83
78
84
## Example Dockerfile migrations
79
85
80
- The following migration examples show a Dockerfile before the migration and
81
- after the migration.
86
+ The following examples show a Dockerfile before and after migration. Each
87
+ example includes both a multi-stage build (recommended for minimal, secure
88
+ images) and a single-stage build (supported, but results in a larger image with
89
+ a broader attack surface).
90
+
91
+ > [ !NOTE]
92
+ >
93
+ > Multi-stage builds are recommended for most use cases. Single-stage builds are
94
+ > supported for simplicity, but come with tradeoffs in size and security.
82
95
83
96
### Go example
84
97
@@ -98,7 +111,7 @@ ENTRYPOINT ["/app/main"]
98
111
```
99
112
100
113
{{< /tab >}}
101
- {{< tab name="After" >}}
114
+ {{< tab name="After (multi-stage) " >}}
102
115
103
116
``` dockerfile
104
117
# syntax=docker/dockerfile:1
@@ -118,6 +131,22 @@ COPY --from=builder /app/main /app/main
118
131
119
132
ENTRYPOINT ["/app/main" ]
120
133
```
134
+
135
+ {{< /tab >}}
136
+ {{< tab name="After (single-stage)" >}}
137
+
138
+ ``` dockerfile
139
+ # syntax=docker/dockerfile:1
140
+
141
+ FROM <your-namespace>/dhi-golang:1-alpine3.21-dev
142
+
143
+ WORKDIR /app
144
+ ADD . ./
145
+ RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" --installsuffix cgo -o main .
146
+
147
+ ENTRYPOINT ["/app/main" ]
148
+ ```
149
+
121
150
{{< /tab >}}
122
151
{{< /tabs >}}
123
152
@@ -142,7 +171,7 @@ CMD ["node", "index.js"]
142
171
```
143
172
144
173
{{< /tab >}}
145
- {{< tab name="After" >}}
174
+ {{< tab name="After (multi-stage) " >}}
146
175
147
176
``` dockerfile
148
177
# syntax=docker/dockerfile:1
@@ -167,6 +196,25 @@ WORKDIR /app
167
196
168
197
CMD ["index.js" ]
169
198
```
199
+
200
+ {{< /tab >}}
201
+ {{< tab name="After (single-stage)" >}}
202
+
203
+ ``` dockerfile
204
+ # syntax=docker/dockerfile:1
205
+
206
+ FROM <your-namespace>/dhi-node:23-alpine3.21-dev
207
+ WORKDIR /usr/src/app
208
+
209
+ COPY package*.json ./
210
+ RUN npm install
211
+
212
+ COPY image.jpg ./image.jpg
213
+ COPY . .
214
+
215
+ CMD ["index.js" ]
216
+ ```
217
+
170
218
{{< /tab >}}
171
219
{{< /tabs >}}
172
220
@@ -206,7 +254,7 @@ ENTRYPOINT [ "python", "/app/image.py" ]
206
254
```
207
255
208
256
{{< /tab >}}
209
- {{< tab name="After" >}}
257
+ {{< tab name="After (multi-stage) " >}}
210
258
211
259
``` dockerfile
212
260
# syntax=docker/dockerfile:1
@@ -240,12 +288,37 @@ COPY --from=builder /app/venv /app/venv
240
288
ENTRYPOINT [ "python" , "/app/image.py" ]
241
289
```
242
290
291
+ {{< /tab >}}
292
+ {{< tab name="After (single-stage)" >}}
293
+
294
+ ``` dockerfile
295
+ # syntax=docker/dockerfile:1
296
+
297
+ FROM <your-namespace>/dhi-python:3.13-alpine3.21-dev
298
+
299
+ ENV LANG=C.UTF-8
300
+ ENV PYTHONDONTWRITEBYTECODE=1
301
+ ENV PYTHONUNBUFFERED=1
302
+ ENV PATH="/app/venv/bin:$PATH"
303
+
304
+ WORKDIR /app
305
+
306
+ RUN python -m venv /app/venv
307
+ COPY requirements.txt .
308
+ RUN pip install --no-cache-dir -r requirements.txt
309
+
310
+ COPY image.py image.png ./
311
+
312
+ ENTRYPOINT [ "python" , "/app/image.py" ]
313
+ ```
314
+
243
315
{{< /tab >}}
244
316
{{< /tabs >}}
245
317
246
318
### Use Gordon
247
319
248
- Alternatively, you can request assistance to
249
- [ Gordon] ( /manuals/ai/gordon/_index.md ) , Docker's AI-powered assistant, to migrate your Dockerfile:
320
+ Alternatively, you can request assistance to
321
+ [ Gordon] ( /manuals/ai/gordon/_index.md ) , Docker's AI-powered assistant, to
322
+ migrate your Dockerfile:
250
323
251
324
{{% include "gordondhi.md" %}}
0 commit comments