Docker Layer Audit — Image Slimming Strategy

Description
Docker layer audit, base image comparison, multi-stage build with per-line annotations.

---

Every RUN instruction creates a permanent layer. Files deleted in later layers still occupy space in the layer that wrote them. This is why naive Dockerfiles produce 2GB images for 50MB applications. STEP 1 — LAYER HYGIENE - Un-chained RUNs: each creates a snapshot. Chain with && to prevent layer freeze of intermediate artifacts. - COPY placement: COPY package.json first, then RUN npm install, then COPY source. Wrong order invalidates cache on every source change. - apt-get without --no-install-recommends: pulls 100-300MB of docs and translations. - ADD vs COPY: ADD does implicit tar extraction. Use COPY unless you need those features. STEP 2 — BASE IMAGE COMPARISON | Base | Size | Notes | | ubuntu:24.04 | ~80MB | Full userspace | | alpine | ~5MB | musl libc (C extensions may need rebuild) | | distroless/base | ~15MB | glibc + certs, no shell/package manager | | scratch | 0B | Static binary only (Go/Rust/Zig ideal) | STEP 3 — MULTI-STAGE BUILD with annotations: ```dockerfile # Stage 1: builder FROM node:20-alpine AS builder COPY package*.json ./ && npm ci --only=production COPY . . && npm run build # Stage 2: production deps FROM node:20-alpine AS deps COPY package*.json ./ && npm ci --only=production && rm -rf ~/.npm # Stage 3: runner FROM gcr.io/distroless/nodejs22-debian12 COPY --from=deps /app/node_modules ./node_modules COPY --from=builder /app/dist ./dist USER nobody HEALTHCHECK CMD ["node","dist/health.js"] ``` STEP 4 — SIZE ESTIMATE: Current 1.2GB → ~180MB (85% saving). Next: tree-shaking. OUTPUT: Layer breakdown, annotated Dockerfile, size estimate.

Copy Optimize