What is the difference between COPY and ADD in a Dockerfile?
COPY vs ADD in a Dockerfile: COPY copies files plainly while ADD also extracts tar archives and fetches URLs. Learn which to use and why COPY wins.
Expected Interview Answer
COPY simply copies files and directories from the build context into the image, while ADD does the same but additionally auto-extracts local tar archives and can fetch files from remote URLs.
Because ADD has extra, sometimes surprising behavior — silently unpacking tarballs and downloading URLs — the Docker best practice is to use COPY for ordinary file copies and reserve ADD only when you specifically want tar auto-extraction. Fetching remote files is better done with RUN and curl or wget so you can verify checksums and clean up in the same layer. Both respect .dockerignore and the build context, but COPY's predictability makes it the default choice.
- COPY is explicit and predictable for plain file transfers
- ADD auto-extracts local tar archives when that is desired
- Best practice: prefer COPY, reserve ADD for tarballs
- Avoids surprising downloads or unpacking
- Keeps Dockerfiles easier to read and audit
AI Mentor Explanation
COPY is a straightforward single into the gap — the ball goes exactly where you placed it, no surprises. ADD is an aggressive shot that might also trigger overthrows and extra runs you didn't plan for. Both advance the score, but COPY does precisely one predictable thing while ADD bundles in extra behavior, which is why coaches favor the simple, controlled stroke unless the situation truly calls for more.
Step-by-Step Explanation
Step 1
Copy plain files with COPY
Use COPY <src> <dest> to move files and directories from the build context into the image with no side effects.
Step 2
Know ADD's extras
ADD does everything COPY does, plus auto-extracts local .tar/.tar.gz archives and can download from remote URLs.
Step 3
Prefer COPY by default
Docker recommends COPY for ordinary copies because its behavior is explicit and predictable.
Step 4
Use ADD only for tarballs
Reserve ADD for when you actually want a local tar archive automatically unpacked into the image.
Step 5
Fetch URLs with RUN instead
For remote files, use RUN curl/wget so you can verify checksums and clean up within the same layer.
What Interviewer Expects
- COPY is a plain copy; ADD adds tar extraction and URL fetching
- Knowing the best practice to prefer COPY
- Why ADD's extra behavior can be surprising
- That remote files are better fetched with RUN and a checksum
- Both respect the build context and .dockerignore
Common Mistakes
- Believing COPY and ADD are identical
- Using ADD to download URLs instead of RUN with checksum verification
- Relying on ADD's silent tar extraction without documenting it
- Thinking COPY can auto-extract archives
- Copying files that should be excluded via .dockerignore
Best Answer (HR Friendly)
“COPY just moves files into the image exactly as they are, while ADD does the same but with extra tricks like unzipping archives and downloading from web links. The recommended habit is to use COPY for normal copying and only reach for ADD when you specifically need a tar file unpacked.”
Code Example
FROM debian:bookworm-slim
WORKDIR /app
# Preferred: explicit, predictable file copy
COPY ./src ./src
COPY requirements.txt .
# ADD auto-extracts a local tar archive into /app/data
ADD data.tar.gz /app/data/
# For remote files, use RUN so you can verify a checksum
RUN curl -fsSL https://example.com/tool.bin -o tool.bin \
&& echo "<sha256> tool.bin" | sha256sum -c -Follow-up Questions
- Why is COPY preferred over ADD in most cases?
- How does ADD handle a remote URL?
- Why fetch remote files with RUN and curl instead of ADD?
- Does COPY extract tar archives automatically?
- How does .dockerignore affect COPY and ADD?
MCQ Practice
1. Which instruction can automatically extract a local tar archive?
ADD auto-extracts recognized local tar archives into the destination; COPY never extracts, it copies files verbatim.
2. What is the recommended default for copying plain files?
Docker best practice is to use COPY for ordinary file copies because its behavior is explicit and predictable.
3. What is the recommended way to fetch a remote file in a build?
Using RUN with curl or wget lets you verify a checksum and clean up in the same layer, unlike ADD's opaque download.
Flash Cards
What does COPY do? — Copies files and directories from the build context into the image, with no extra behavior.
What extra things does ADD do? — Auto-extracts local tar archives and can download files from remote URLs.
Which should you prefer? — COPY, for its predictability; reserve ADD for when you want tar auto-extraction.
Best way to fetch remote files? — Use RUN with curl/wget and verify a checksum, not ADD with a URL.