Build: Build, tag, push, and scan container images

0/1 steps

✓📚 Read

✓👁 See

✓🎞 Animate

✓🎯 Test

5⚙️ Build

Build Steps

Progress

0/1

◆ Before you start

Prerequisites

Docker CLIRequired
docker --version
Registry accountRequired
Docker Hub, ACR, or GCR

📦

Step 1 of 1

Build, tag, push, and scan container images

Build optimized Docker images, push to a registry, scan for vulnerabilities, and automate via CI.

Tasks

Write a multi-stage Dockerfile for a Python app

Build the image and tag with both :latest and :<git-sha>

Scan the image with trivy for HIGH/CRITICAL CVEs

Push to a container registry with docker push

Add image scanning to GitHub Actions pipeline

🎯 What You'll Learn

▸Use multi-stage builds to minimize image size
▸Tag images with semantic versions and Git SHAs
▸Scan images with Trivy before pushing to registry

Code

DockerfileDockerfile
1 # ─── Build stage ──────────────────────────────────────────────────
2 FROM python:3.11.9-slim AS builder
3  
4 WORKDIR /build
5  
6 # Install build dependencies separately for better caching
7 COPY requirements.txt .
8 RUN pip install --no-cache-dir --user -r requirements.txt
9  
10 # ─── Runtime stage ────────────────────────────────────────────────
11 FROM python:3.11.9-slim AS runtime
12  
13 # Non-root user for security
14 RUN groupadd --gid 10001 app &&     useradd --uid 10001 --gid app --no-create-home app
15  
16 WORKDIR /app
17  
18 # Copy only installed packages from builder
19 COPY --from=builder /root/.local /home/app/.local
20 COPY --chown=app:app src/ .
21  
22 USER app
23  
24 ENV PATH=/home/app/.local/bin:$PATH     PYTHONDONTWRITEBYTECODE=1     PYTHONUNBUFFERED=1
25  
26 HEALTHCHECK --interval=30s --timeout=10s --retries=3     CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8080/health')"
27  
28 EXPOSE 8080
29  
30 CMD ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8080"]
31

💡 Pro Tips

▸Pin base image versions (python:3.11.9-slim) not just python:3.11-slim for reproducibility
▸Use .dockerignore to exclude .git, tests, and docs from build context

Discussion

1 # ─── Build stage ────────────────────────────────────────────────── 2 FROM python:3.11.9-slim AS builder 3 4 WORKDIR /build 5 6 # Install build dependencies separately for better caching 7 COPY requirements.txt . 8 RUN pip install --no-cache-dir --user -r requirements.txt 9 10 # ─── Runtime stage ──────────────────────────────────────────────── 11 FROM python:3.11.9-slim AS runtime 12 13 # Non-root user for security 14 RUN groupadd --gid 10001 app && useradd --uid 10001 --gid app --no-create-home app 15 16 WORKDIR /app 17 18 # Copy only installed packages from builder 19 COPY --from=builder /root/.local /home/app/.local 20 COPY --chown=app:app src/ . 21 22 USER app 23 24 ENV PATH=/home/app/.local/bin:$PATH PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 25 26 HEALTHCHECK --interval=30s --timeout=10s --retries=3 CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8080/health')" 27 28 EXPOSE 8080 29 30 CMD ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8080"] 31

1	# ─── Build stage ──────────────────────────────────────────────────
2	FROM python:3.11.9-slim AS builder
3
4	WORKDIR /build
5
6	# Install build dependencies separately for better caching
7	COPY requirements.txt .
8	RUN pip install --no-cache-dir --user -r requirements.txt
9
10	# ─── Runtime stage ────────────────────────────────────────────────
11	FROM python:3.11.9-slim AS runtime
12
13	# Non-root user for security
14	RUN groupadd --gid 10001 app && useradd --uid 10001 --gid app --no-create-home app
15
16	WORKDIR /app
17
18	# Copy only installed packages from builder
19	COPY --from=builder /root/.local /home/app/.local
20	COPY --chown=app:app src/ .
21
22	USER app
23
24	ENV PATH=/home/app/.local/bin:$PATH PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
25
26	HEALTHCHECK --interval=30s --timeout=10s --retries=3 CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8080/health')"
27
28	EXPOSE 8080
29
30	CMD ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8080"]
31