@@ -63,6 +63,12 @@ replaced by the new hardened image.
6363
6464### Step 2: Update the runtime image in your Dockerfile
6565
66+ > [ !NOTE]
67+ >
68+ > Multi-stage builds are recommended to keep your final image minimal and
69+ > secure. Single-stage builds are supported, but they include the full ` dev ` image
70+ > and therefore result in a larger image with a broader attack surface.
71+
6672To ensure that your final image is as minimal as possible, you should use a
6773[ multi-stage build] ( /manuals/build/building/multi-stage.md ) . All stages in your
6874Dockerfile should use a hardened image. While intermediary stages will typically
@@ -77,8 +83,15 @@ examples of how to update your Dockerfile.
7783
7884## Example Dockerfile migrations
7985
80- The following migration examples show a Dockerfile before the migration and
81- after the migration.
86+ The following examples show a Dockerfile before and after migration. Each
87+ example includes both a multi-stage build (recommended for minimal, secure
88+ images) and a single-stage build (supported, but results in a larger image with
89+ a broader attack surface).
90+
91+ > [ !NOTE]
92+ >
93+ > Multi-stage builds are recommended for most use cases. Single-stage builds are
94+ > supported for simplicity, but come with tradeoffs in size and security.
8295
8396### Go example
8497
@@ -98,7 +111,7 @@ ENTRYPOINT ["/app/main"]
98111```
99112
100113{{< /tab >}}
101- {{< tab name="After" >}}
114+ {{< tab name="After (multi-stage) " >}}
102115
103116``` dockerfile
104117# syntax=docker/dockerfile:1
@@ -118,6 +131,22 @@ COPY --from=builder /app/main /app/main
118131
119132ENTRYPOINT ["/app/main" ]
120133```
134+
135+ {{< /tab >}}
136+ {{< tab name="After (single-stage)" >}}
137+
138+ ``` dockerfile
139+ # syntax=docker/dockerfile:1
140+
141+ FROM <your-namespace>/dhi-golang:1-alpine3.21-dev
142+
143+ WORKDIR /app
144+ ADD . ./
145+ RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" --installsuffix cgo -o main .
146+
147+ ENTRYPOINT ["/app/main" ]
148+ ```
149+
121150{{< /tab >}}
122151{{< /tabs >}}
123152
@@ -142,7 +171,7 @@ CMD ["node", "index.js"]
142171```
143172
144173{{< /tab >}}
145- {{< tab name="After" >}}
174+ {{< tab name="After (multi-stage) " >}}
146175
147176``` dockerfile
148177# syntax=docker/dockerfile:1
@@ -167,6 +196,25 @@ WORKDIR /app
167196
168197CMD ["index.js" ]
169198```
199+
200+ {{< /tab >}}
201+ {{< tab name="After (single-stage)" >}}
202+
203+ ``` dockerfile
204+ # syntax=docker/dockerfile:1
205+
206+ FROM <your-namespace>/dhi-node:23-alpine3.21-dev
207+ WORKDIR /usr/src/app
208+
209+ COPY package*.json ./
210+ RUN npm install
211+
212+ COPY image.jpg ./image.jpg
213+ COPY . .
214+
215+ CMD ["index.js" ]
216+ ```
217+
170218{{< /tab >}}
171219{{< /tabs >}}
172220
@@ -206,7 +254,7 @@ ENTRYPOINT [ "python", "/app/image.py" ]
206254```
207255
208256{{< /tab >}}
209- {{< tab name="After" >}}
257+ {{< tab name="After (multi-stage) " >}}
210258
211259``` dockerfile
212260# syntax=docker/dockerfile:1
@@ -240,12 +288,37 @@ COPY --from=builder /app/venv /app/venv
240288ENTRYPOINT [ "python" , "/app/image.py" ]
241289```
242290
291+ {{< /tab >}}
292+ {{< tab name="After (single-stage)" >}}
293+
294+ ``` dockerfile
295+ # syntax=docker/dockerfile:1
296+
297+ FROM <your-namespace>/dhi-python:3.13-alpine3.21-dev
298+
299+ ENV LANG=C.UTF-8
300+ ENV PYTHONDONTWRITEBYTECODE=1
301+ ENV PYTHONUNBUFFERED=1
302+ ENV PATH="/app/venv/bin:$PATH"
303+
304+ WORKDIR /app
305+
306+ RUN python -m venv /app/venv
307+ COPY requirements.txt .
308+ RUN pip install --no-cache-dir -r requirements.txt
309+
310+ COPY image.py image.png ./
311+
312+ ENTRYPOINT [ "python" , "/app/image.py" ]
313+ ```
314+
243315{{< /tab >}}
244316{{< /tabs >}}
245317
246318### Use Gordon
247319
248- Alternatively, you can request assistance to
249- [ Gordon] ( /manuals/ai/gordon/_index.md ) , Docker's AI-powered assistant, to migrate your Dockerfile:
320+ Alternatively, you can request assistance to
321+ [ Gordon] ( /manuals/ai/gordon/_index.md ) , Docker's AI-powered assistant, to
322+ migrate your Dockerfile:
250323
251324{{% include "gordondhi.md" %}}
0 commit comments