Advanced image building: multi-stage, BuildKit and registries
You make small, fast-building, reproducible images, run your own registry and version and sign your images.
Level 301 · 17 lessons · 15 practice labs
Lessons
A good Dockerfile
- The layer cache and instruction order
- Multi-stage builds
- Choosing a base image: distroless, alpine, slim
- .dockerignore and the build context
- ENTRYPOINT, CMD and signals
- Short task: bring a 1 GB image under 100 MB
BuildKit
- buildx and BuildKit features
- Cache mounts and build secrets
- Multi-architecture images
- Reproducible builds and pinned versions
- Short task: build from a private package source without leaking the secret
Registries
- Running your own registry: TLS and passwords
- Tags, digests and versioning
- Image signing and software bills of materials
- Clean-up and retention in a registry
- Short task: promote a tested image to production by digest
Wrap-up
- Capstone: build a local image pipeline for three services
Practice labs
- Dependencies reinstalled on every build: Fix the instruction order in a Dockerfile that reinstalls every dependency after a one-line code change, and show the install step comes from cache on the second build.
- A gigabyte build context: Write a .dockerignore for the project that sends repository history, dependency folders and secret files into the build context, and report the context size before and after.
- Three things breaking the cache: Find from the build output the three things that break the cache every time in Brightfield Labs’ slow image, fix them and prove a no-change rebuild comes entirely from cache.
- A final image with no compiler: Split a single-stage Dockerfile into build and runtime stages and show the final image has no compiler and is smaller.
- An app that breaks on a small base: Find the library mismatch that makes the app fail with ‘not found’ after moving to a smaller base image, choose a suitable base and run the image under the size budget.
- A health check in a shell-less image: Move a service with native dependencies onto a base image with no shell or package manager, add a health check that needs no shell and show the image is healthy and under budget.
- A container that takes ten seconds to stop: Change the start instruction of a container that gets killed on timeout because it never receives the stop signal to exec form, and show by measuring that docker stop is now quick.
- A start script that swallows arguments: In an image where arguments given to docker run never reach the app, split ENTRYPOINT and CMD correctly, fix the wrapper script and show both the default and a custom argument work.
- Zombie processes and a cut-off shutdown: Fix the image whose start script runs a prep job then the app, piles up zombie processes and cuts work off at shutdown; show the signal reaches the app and the clean shutdown log line.
- Faster builds with a package cache: Add a BuildKit cache mount for the package manager’s download folder and measure that builds are faster than before when the dependency list changes.
- A token left in the layers: Find the private package source token left in the lab image’s history and layer archives, fix the Dockerfile to use a build secret and prove the new image holds no trace.
- Two architectures, one tag: Build the service for two CPU architectures with buildx, push it to the lab registry under one tag and show both platforms in the manifest list.
- Pin the base image by digest: Pin a Dockerfile that uses a floating tag to the base image’s digest, and show with docker inspect that two separate builds start from the same base.
- A registry whose certificate isn’t trusted: Solve the certificate error when pulling from Pinecrest Bank’s internal registry without resorting to the insecure-registry setting, by giving Docker the root certificate, then log in and pull.
- A retention rule for a full registry: Use the registry API to delete every tag except the last three releases in each repository, run garbage collection and report the space gained and the tags kept.
About this course
You make small, fast-building, reproducible images, run your own registry and version and sign your images.
What you will learn
- A good Dockerfile
- BuildKit
- Registries
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.