Write a Dockerfile for a small Python service

A container image should reproduce the application with a reviewable base, dependency layer and runtime identity.

Inspect a Dockerfile specification

The integration lab stores authored instructions.

from integration_cases import dockerfile_case

result = dockerfile_case()
assert result["pinned_digest"] is True
assert result["non_root"] is True
assert result["shell_form_cmd"] is False
assert result["image_built"] is False

No image was built, and the fixture digest is not a usable image reference.

Choose a minimal trusted base and pin/review updates. Copy dependency metadata before source for cache efficiency, install from a lock, and exclude .git, tests data and secrets with .dockerignore. Use multi-stage builds where compilation is needed.

Create a non-root user, make only required paths writable and use exec-form CMD so signals reach the process. Do not bake credentials into layers or build arguments. Scan the built artifact and run tests against the same image promoted onward.

The FDE for Freshers course uses Docker for its deployable integration service.

Exercise

Build a real local image for a small service, inspect history and user, run it read-only where possible and verify shutdown signals.

Continue learning

This article is part of the FDE integration and deployment foundations sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Build a local integration sandbox with synthetic data.
• Continue with Use Docker Compose for an app and database.

Reference: Dockerfile best practices.