BuildBeginner

Dockerfile Reference Cheatsheet

Complete guide to Dockerfile instructions — FROM, RUN, COPY, ARG, ENV, ENTRYPOINT and more.

What it is

A Dockerfile is a text file with instructions to build a Docker image. Each instruction creates a layer in the image. Understanding these instructions lets you build lean, secure, and fast images.

Quick start

docker build -t myapp:latest .

Build an image from the Dockerfile in the current directory.

docker build --no-cache -t myapp:latest .

Force rebuild without layer cache.

Core instructions

Instruction	Example	Description
`FROM`	`FROM node:20-alpine`	Set the base image. Must be first instruction.
`RUN`	`RUN npm install`	Execute a command and create a new layer.
`COPY`	`COPY . /app`	Copy files from build context into the image.
`ADD`	`ADD app.tar.gz /app`	Like COPY but also extracts archives and supports URLs.
`WORKDIR`	`WORKDIR /app`	Set the working directory for following instructions.
`ENV`	`ENV NODE_ENV=production`	Set environment variable (persists at runtime).
`ARG`	`ARG VERSION=1.0`	Build-time variable (not available at runtime).
`EXPOSE`	`EXPOSE 3000`	Document which port the container listens on.
`CMD`	`CMD ["node", "app.js"]`	Default command to run. Overrideable at runtime.
`ENTRYPOINT`	`ENTRYPOINT ["node"]`	Defines the executable. CMD becomes default args.
`USER`	`USER node`	Set the user for following instructions and runtime.
`HEALTHCHECK`	`HEALTHCHECK CMD curl -f http://localhost/`	Define a health check command.

Real-world examples

Lean Node.js Dockerfile with multi-stage build

# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Production stage
FROM node:20-alpine AS runner
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
USER node
EXPOSE 3000
CMD ["node", "dist/index.js"]

Best practices

Use multi-stage builds to keep production images lean.
Pin base image tags (e.g. node:20.11-alpine) for reproducibility.
Combine related RUN commands with && to minimize layers.
Add a .dockerignore file to exclude node_modules, .git, etc.
Run as a non-root USER in the final stage for security.

Related cheatsheets

Last reviewed: 2026-06-15