Docker in production: smaller images, fewer surprises

A Dockerfile usually starts as a local convenience and quietly becomes a production dependency. Once it ships, every line matters: the base image, the build steps, what gets copied in, which user the process runs as, and whether a secret ended up baked into a layer.

This section covers image size and build speed, multi-stage builds, pinning and updating base images, scanning for known vulnerabilities, health checks, logging to stdout, and Docker Compose for local and small production setups. We'll also look at when Compose on a single host is enough and when it isn't.

One rule runs through all of it. A container that runs on your laptop has proven that it runs on your laptop. Production has different networks, limits, data and traffic. We write about closing that gap with checks, not hope.