docker-guidelineslisted

# Docker and Container Guidelines > **Baseline**: Target Docker Engine **29.x**; BuildKit is the default builder; **`docker compose`** > (the V2 CLI plugin, written with a space) is the standard. The legacy `docker-compose` (V1, > hyphen) reached end-of-life in June 2023. Do not use it. > > This guide covers Dockerfile authoring, Compose, image hygiene, and supply-chain security for the > supported baseline. Verify installed versions with `docker version` and `docker compose version`. ## Core Principles 1. **Multi-stage builds:** build in a fat stage with the SDK/compilers, then ship a minimal runtime stage. This is the single biggest lever for both image size and attack surface. 2. **Run as non-root:** create a dedicated user and `USER` down before the entrypoint. 3. **Pin base images:** use digests for reproducibility and supply-chain integrity. 4. **Order for cache:** put rarely changing steps (dependency installs) before frequently changing ones (`COPY . .`). 5. **Read config at runtime:** keep secrets and environment-specific config out of the image (see `12-factor-guidelines`). 6. **Make images auditable:** attach an SBOM and provenance at build time, and scan before you ship. ## Dockerfile Start every Dockerfile with the syntax directive on line 1, then use a multi-stage build. ```dockerfile # syntax=docker/dockerfile:1 # The floating :1 tag pulls the latest 1.x frontend (bug/feature updates, no breaking changes). # It is REQUIRED for RUN --mount, --secret, --ssh