تصغير الصور باستخدام عمليات البناء متعددة المراحل

A bloated image is slow to push, pull, and start, and it carries more to patch. Multi-stage builds ship only what you actually need.

You use one stage to build and a second clean stage to run. Build tools stay behind, so the final image stays small.

Add AS builder to a FROM line to name a stage. You can reference that name later to pull files out of it.

In the builder, install dependencies to a known prefix. The --user flag drops everything neatly under one copyable folder.

Open a fresh, slim stage for what actually runs. It has none of the compilers or caches the builder needed.

Use COPY --from=builder to lift just the installed packages into the runtime stage. The heavy build layer is left behind.

Copy your application source into the slim stage too. Now the final image holds your code plus only its runtime dependencies.

User-installed packages live under .local, so add that to PATH. Otherwise the runtime cannot find your installed commands.

Docker keeps only the final stage in your image. Everything in earlier stages is discarded unless you explicitly copy it.

For the smallest, safest result, run on a distroless base with no shell or package manager. Less surface means fewer things to exploit.

Check the size drop with docker images. Slimming from over a gigabyte to a couple hundred megabytes is common and worth it.

Let us check what a multi-stage build keeps.

You split build from runtime, copied just the artifacts with COPY --from, fixed PATH, and shrank the image. Lean and fast. ✅