Images

A Docker image is an immutable artifact: ordered filesystem layers, metadata, default command, exposed ports, and runtime assumptions. For Node.js services it should pin the base image, install from a lockfile, exclude dev-only files, and build reproducibly from source.

| Concept | Meaning | |---------|---------| | Tag | Human label such as `1.2.3` — mutable if reused | | Digest | Content hash such as `sha256:…` — immutable identity | | Layer | Cached filesystem delta produced by each build step |

					FROM node:20-bookworm-slim@sha256:…
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY dist ./dist
USER node
CMD ["node", "dist/server.js"]
				

Promote the same digest between environments instead of rebuilding per stage. Scan images for CVEs and keep runtime images small.

On interviews: tag versus digest, slim images, SBOMs, vulnerability scanning, and why rebuilding per environment creates drift.

Common pitfalls: the `latest` tag is mutable; huge images slow deploy and widen attack surface; baking secrets or local `node_modules` into layers.

The trade-off is image convenience (mutable tags) versus reproducibility, auditability, and deploy safety.

Checklist:

• Pin base image by digest when risk warrants it.
• Build from a committed lockfile.
• Promote immutable images across environments.
• Scan and measure image size regularly.