@@ -22,10 +22,10 @@ Patterns for building, testing, and deploying Docker containers.
2222
2323## Core Principles
2424
25- 1 . ** Minimal images ** -- Alpine/distroless, multi-stage builds
26- 2 . ** Security first ** -- Non-root USER, no secrets in layers , pin versions
27- 3 . ** Testable** -- Verifiable in CI with entrypoint bypass and DNS mocking
28- 4 . ** Cache-efficient** -- Copy dependency files first, clean in same layer
25+ 1 . ** Minimal** -- Alpine/distroless, multi-stage
26+ 2 . ** Secure ** -- Non-root USER, no layer secrets , pin versions
27+ 3 . ** Testable** -- CI-verifiable: entrypoint bypass, DNS mocking
28+ 4 . ** Cache-efficient** -- deps first, clean in same layer
2929
3030## Quick Reference
3131
@@ -78,15 +78,15 @@ RUN npm ci
7878COPY . .
7979```
8080
81- Dependency manifests before source so install layers stay cached on source-only changes.
81+ Manifests before source keeps install layers cached on source-only changes.
8282
8383### BuildKit Secrets
8484
8585``` dockerfile
8686RUN --mount=type=secret,id=ssh_key,dst=/root/.ssh/id_rsa git clone git@github.com:org/repo.git
8787```
8888
89- Secrets in ` ENV ` /` ARG ` /` COPY ` persist in layer history ( ` docker history ` ) . Use ` --mount=type=secret ` .
89+ ` ENV ` /` ARG ` /` COPY ` secrets persist in ` docker history ` . Use ` --mount=type=secret ` .
9090
9191### Docker Bake (Multi-Platform)
9292
@@ -129,4 +129,5 @@ Exclude: `.git`, `node_modules`/`vendor`, `.env*`, `*.pem`, `*.key`
129129
130130## References
131131
132- - ` references/ci-testing.md ` -- Comprehensive CI testing patterns for Docker images
132+ - ` references/ci-testing.md ` -- CI testing patterns for Docker images
133+ - ` references/dind-testing-patterns.md ` -- Docker-in-Docker (DinD) testing patterns
0 commit comments