Buenas prácticas para imágenes de producción

A production image should be small and secure. A leaner image ships faster, starts quicker, and offers attackers less to target. 🛡️

A multi-stage build compiles deps in one stage and copies only the results into a clean final image.

From the builder stage, COPY --from just the installed packages, leaving compilers and build junk behind.

Create a non-root USER so a compromised process cannot freely modify the container or host.

Pin exact versions in requirements.txt so builds are reproducible and never break from a surprise update.

Pass secrets via environment variables at runtime, never bake keys or passwords into the image itself.

A HEALTHCHECK lets the orchestrator know if your container is truly alive and serving requests.

Always run production with DEBUG=False, so error pages never leak code, settings, or stack traces to users.

Tag images with a real version, not just latest, so you always know exactly what is deployed and can roll back.

Run a scan on your built image to catch known vulnerabilities in your base and dependencies early.

Put rarely changing steps first and your code last, so most rebuilds reuse cached layers and finish fast.

Which practice most directly shrinks your final production image?

You hardened your image: multi-stage builds, a non-root user, pinned versions, runtime secrets, healthchecks, and DEBUG off. Production-ready! 🏁