All tools / DevOps & infrastructure
Dockerfile generator
Pick a runtime and get a small, multi-stage, non-root Dockerfile with a matching .dockerignore.
Common questions
Why use a multi-stage build?
The first stage has compilers, dev dependencies and caches. The final stage copies only what the app needs to run, so images are smaller, faster to pull and have fewer packages with vulnerabilities.
Why run as a non-root user?
If someone breaks into the app, a non-root process cannot change system files in the container, and container escapes are much harder. Kubernetes can enforce it with runAsNonRoot: true.
Why does the Go image have no health check?
Distroless images have no shell, wget or curl, which is part of what makes them small and secure. Use a Kubernetes liveness and readiness probe, or your load balancer's health check, instead.
Why copy the lock file before the rest of the code?
Docker caches each step. Copying package.json and the lock file first means dependencies are only reinstalled when they change, not on every code edit.
Is my input sent anywhere?
No. The Dockerfile is generated in your browser.