What Is a Dockerfile? The Recipe for Building an Image
A Dockerfile is a plain-text list of instructions that tells Docker, step by step, how to assemble an image.
If an image is the template, the Dockerfile is the recipe that produces it. Each instruction runs in order and, when it changes the filesystem, adds a layer. Knowing how the common instructions behave is the difference between a 10-second cached build and a 10-minute one.
The instructions you use most
- FROM - the base image to build on.
- RUN - execute a command at build time (installs, compiles).
- COPY / ADD - bring files from your build context into the image.
- WORKDIR, ENV - set the working directory and environment.
- CMD / ENTRYPOINT - what runs when the container starts.
A minimal example
A small Node app might be:
FROM node:20-slim
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
CMD ["node", "server.js"]
The order is deliberate - see caching below.
Order matters for caching
Docker caches each layer and reuses it if the instruction and its inputs are unchanged. By copying package*.json and installing dependencies before copying the rest of the source, you only reinstall when dependencies change - not on every code edit.
CMD vs ENTRYPOINT
ENTRYPOINT sets the executable that always runs; CMD sets default arguments that callers can override. Many images use ENTRYPOINT for the binary and CMD for its default flags.
Building from a Dockerfile in CI
A pipeline typically runs docker build against the Dockerfile, then pushes the result. Build time is dominated by cache hits and dependency installs, so a runner with a warm cache wins. Managed runners (Latchkey) preserve layer caches between jobs to keep these builds fast.
Key takeaways
- A Dockerfile is an ordered recipe; each filesystem-changing instruction is a layer.
- Copy and install dependencies before source to maximize cache hits.
- ENTRYPOINT sets the executable; CMD sets overridable default arguments.