What is a Dockerfile?
Learn what a Dockerfile is, how FROM, RUN, COPY and CMD build image layers, and best practices for caching — with a DevOps interview answer.
Expected Interview Answer
A Dockerfile is a plain-text script of sequential instructions that tells the Docker engine exactly how to assemble a Docker image, layer by layer.
Each instruction such as FROM, RUN, COPY, WORKDIR, ENV, EXPOSE, and CMD produces one immutable image layer, and Docker caches unchanged layers so rebuilds after a small code change are fast. FROM sets the base image, RUN executes build-time commands like installing packages, COPY brings application files into the image, and CMD or ENTRYPOINT defines the default command that runs when a container starts. Ordering matters for cache efficiency — instructions that change rarely, like installing dependencies, should come before instructions that change often, like copying source code. Running `docker build -t name:tag .` reads the Dockerfile in the current build context and produces a ready-to-run image.
- Reproducible, version-controlled build instructions
- Layer caching makes iterative builds fast
- Self-documents exactly how an image is constructed
- Enables consistent images across every environment
AI Mentor Explanation
A Dockerfile is like a written net-session plan a coach hands to the support staff before a young player arrives: start with warm-up drills, add throw-downs, then bowling machine practice, finishing with a fielding drill. Each step in the plan is prepared once and reused for every player who follows it. If only the fielding drill changes next week, the earlier warm-up and throw-down steps do not need to be re-planned. Following the exact same written plan produces the exact same trained player every time.
Step-by-Step Explanation
Step 1
Set the base image
FROM declares the starting image, e.g. a specific language runtime.
Step 2
Install dependencies
RUN executes build-time commands like installing packages, cached when unchanged.
Step 3
Copy application code
COPY brings source files into the image at the desired path.
Step 4
Define the entrypoint
CMD or ENTRYPOINT sets the command that runs when a container starts.
What Interviewer Expects
- Knowledge of common instructions: FROM, RUN, COPY, CMD, EXPOSE
- Understanding that each instruction creates a cached image layer
- Awareness that instruction order affects build cache efficiency
- Ability to explain the difference between RUN and CMD
Common Mistakes
- Confusing RUN (build-time) with CMD (container start-time)
- Copying source code before installing dependencies, breaking cache
- Not pinning a specific base image tag, causing unpredictable builds
- Putting secrets directly in the Dockerfile instead of build args or secrets
Best Answer (HR Friendly)
“A Dockerfile is basically a recipe file — it lists the exact steps needed to turn our application code into a ready-to-run package. Because it is just a text file we check into version control, anyone on the team, or any server, can build the exact same image every single time.”
Code Example
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --production
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]Follow-up Questions
- What is the difference between RUN, CMD, and ENTRYPOINT?
- How does instruction ordering affect Docker build caching?
- What does a multi-stage Dockerfile achieve?
- How do you avoid leaking secrets into a Docker image?
MCQ Practice
1. What does a Dockerfile primarily define?
A Dockerfile is a text file of ordered instructions that Docker uses to build an image layer by layer.
2. Which instruction sets the command a container runs by default at startup?
CMD (or ENTRYPOINT) specifies the default command executed when a container starts, unlike RUN which executes at build time.
3. Why should dependency installation instructions usually come before copying source code?
Placing rarely-changing steps like dependency installs earlier lets Docker reuse cached layers when only source code changes.
Flash Cards
What is a Dockerfile? — A text file of ordered instructions Docker uses to build an image.
What does FROM do? — Sets the base image the new image is built on top of.
RUN vs CMD? — RUN executes at build time; CMD sets the default command at container start time.
Why does instruction order matter? — It affects Docker’s layer cache — rarely-changing steps should come first.