TechAtelier
DEVOPS

10 common errors in a Dockerfile

One Dockerfile can produce a functional image while maintaining secrets, excessive privileges or dependencies impossible to reproduce.

Start by removing secrets and reducing privileges. Then work on reproducibility, image surface and behavior of the main process.

Basic image and dependencies

1. Use tag only latest

The recovered content can change between two constructions. Choose a precise version and, for strict reproducibility, consider freezing the digest as well as planning its renewal.

2. Install without cleaning the cache

Consolidate index update, installation and cleaning into one instruction RUN. For Python, use for example pip install --no-cache-dir.

3. Download and run without checking

Avoid remote commands sent directly to a shell. Download the artifact, check its sum or signature, and execute it only if the control succeeds.

Secrets and construction context

4. Store a secret with ARG or ENV

A secret can remain visible in layers, history or image metadata. Use the manufacturer's secret mechanisms and inject the application secrets at the time of execution.

5. Copy all repository with COPY . .

No file .dockerignoreThis instruction may include Git repository, local files, backups or secrets. Copy the dependency files first and then only the necessary sources.

Privileges and permissions

6. Run root application

Create or select an unprivileged user, prepare the necessary permissions and then finish with an instruction USER.

7. Use chmod 777

Only grant the required rights. Prefer an explicit owner with COPY --chown and targeted permissions.

Construction and implementation

8. Keep the compilation tools in the final image

A multi-step construction allows you to compile in a first image and then copy only the necessary artifacts into a smaller final image.

9. Use shell form for main process

CMD ["python", "-m", "app"]

The JSON form limits the ambiguities of the shell and facilitates the correct transmission of signals to the main process.

10. Add HEALTHCHECK unnecessary or absent

Add a check only if it actually measures the availability of the service. A simple presence of the process can mask a blocked application, while too heavy a test unnecessarily degrades the container.

Analyze Dockerfile without building image

ConfigCheck detects risky choices and proposes correction priorities without downloading or executing content.

Analyze my Dockerfile

In what order correct?

  1. Remove unverified secrets and downloads immediately.
  2. Drop root and excessive permissions.
  3. Reduce the construction context with .dockerignore.
  4. Fig versions and reproducible installations.
  5. Optimize layers and adopt a multi-step construction so useful.
  6. Build the image, analyze its vulnerabilities and test its execution.

See also Good official construction practices Docker and, for associated services, frequent errors in Docker Compose.

Published on 1 August 2026.