Multi-stage builds use multiple FROM statements. The first stage compiles or installs everything; the final stage only copies the production artifacts. This can reduce your Docker image size by 50–90%, which matters for faster pulls, less storage, and a smaller attack surface. Use it whenever you have a build step — TypeScript, Go binaries, Maven JARs, etc.

By default, processes inside a Docker container run as root, which means a container escape bug gives an attacker full root on the host. Creating a dedicated user (like node or appuser) with no shell or sudo access limits the blast radius of any exploit.

Exclude anything you don't need in the image: node_modules (reinstalled during build), .git, test files, local .env files, CI configs, and editor configs. A lean build context means faster docker build times and smaller images.

ENTRYPOINT sets the executable; CMD sets its default arguments. If you only use CMD, users can override it entirely. If you combine ENTRYPOINT with CMD, users can override the arguments but not the main process. For most apps CMD ["node", "server.js"] works fine. Use ENTRYPOINT when the container should always run a specific binary.

slim images remove most dev tools to save ~100 MB. alpine is even smaller but uses musl libc, which can break native Node addons or Python C extensions. For production, node:20-slim or python:3.12-slim is the practical sweet spot. Pin to a specific version (not latest) so builds are reproducible.