Write a Dockerfile that chooses an explicit base, performs reproducible build work, copies bounded files, and defines a clear runtime command.

What you will be able to do

Distinguish base stage from build instruction in a realistic write a dockerfile case.
Interpret the operational evidence and boundary associated with copied input.
Choose an appropriate action involving runtime command without exceeding the named workload scope.
Verify built artifact through an observable runtime result and reproducible handoff.

Frame Write a Dockerfile

Write a Dockerfile that chooses an explicit base, performs reproducible build work, copies bounded files, and defines a clear runtime command.

A Python service currently builds from manual shell notes. The team needs a reviewable Dockerfile whose resulting container starts the intended server.

Keep declared state, runtime state, observable evidence, access boundaries, and recovery outcomes separate. Begin with the smallest read-only inspection that identifies the exact image, container, Pod, controller, network, storage object, or policy in scope.

Base stage

A FROM instruction starts a build stage from a named base image. Within write a dockerfile, this role answers one specific container or orchestration question and keeps its own evidence.

Choose a supported base and pin the identity required by the release policy. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not inherit an unknown floating base without review. The observable result is specific: the first stage records the approved base reference.

Build instruction

Dockerfile instructions describe ordered build operations that contribute files or configuration. Within write a dockerfile, this role answers one specific container or orchestration question and keeps its own evidence.

Group related deterministic build work and make failures visible. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not hide unreviewed downloads inside an opaque command chain. The observable result is specific: each build step has a clear purpose and reproducible result.

Copied input

COPY transfers selected files from an allowed build context into an image stage. Within write a dockerfile, this role answers one specific container or orchestration question and keeps its own evidence.

Copy dependency metadata before changing application source when useful for caching. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not copy credentials or the entire workstation by convenience. The observable result is specific: only required service files exist in the image stage.

Runtime command

ENTRYPOINT and CMD define the executable and default arguments used when a container starts. Within write a dockerfile, this role answers one specific container or orchestration question and keeps its own evidence.

Use an exec-form startup that forwards signals to the service process. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not rely on a shell wrapper that swallows termination signals. The observable result is specific: the intended server becomes the observable main process.

Built artifact

A successful build produces an image whose configuration and layers reflect the Dockerfile and context. Within write a dockerfile, this role answers one specific container or orchestration question and keeps its own evidence.

Build with a meaningful local tag and inspect the resulting configuration. Apply that action to the named workload before expanding scope, changing another resource, or discarding the current state.

Respect this boundary: do not call the build complete when the container cannot start independently. The observable result is specific: a test container starts the packaged server successfully.

Apply Write a Dockerfile to One Workload

Use one bounded workload decision: A Python service currently builds from manual shell notes. The team needs a reviewable Dockerfile whose resulting container starts the intended server.

First, choose a supported base and pin the identity required by the release policy. Then, group related deterministic build work and make failures visible. Preserve both observations with the exact resource identity before changing runtime state.

Next, copy dependency metadata before changing application source when useful for caching. After that, use an exec-form startup that forwards signals to the service process. Close the task only after you build with a meaningful local tag and inspect the resulting configuration.

Recap Before Practice and Prove

Base stage: A FROM instruction starts a build stage from a named base image. In this workload, choose a supported base and pin the identity required by the release policy. Preserve the boundary: do not inherit an unknown floating base without review.

Build instruction: Dockerfile instructions describe ordered build operations that contribute files or configuration. In this workload, group related deterministic build work and make failures visible. Preserve the boundary: do not hide unreviewed downloads inside an opaque command chain.

Copied input: COPY transfers selected files from an allowed build context into an image stage. In this workload, copy dependency metadata before changing application source when useful for caching. Preserve the boundary: do not copy credentials or the entire workstation by convenience.

Runtime command: ENTRYPOINT and CMD define the executable and default arguments used when a container starts. In this workload, use an exec-form startup that forwards signals to the service process. Preserve the boundary: do not rely on a shell wrapper that swallows termination signals.

Built artifact: A successful build produces an image whose configuration and layers reflect the Dockerfile and context. In this workload, build with a meaningful local tag and inspect the resulting configuration. Preserve the boundary: do not call the build complete when the container cannot start independently.