Advanced builds & multi-arch

enable-buildkit.sh# Modern Docker uses BuildKit by default. If yours doesn't:
export DOCKER_BUILDKIT=1
docker build -t myapp .

# To use cache/secret mounts, the FIRST line of the Dockerfile must be a syntax directive:
#   # syntax=docker/dockerfile:1
# That line opts into the modern frontend that understands --mount=... .

Dockerfile.cachemount# syntax=docker/dockerfile:1
FROM python:3.12-slim
WORKDIR /app

# apt cache mount: downloaded .debs persist across builds (not baked into a layer).
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends build-essential

COPY requirements.txt .
# pip cache mount: wheels persist, so changing ONE dep doesn't re-download all of them.
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install -r requirements.txt

COPY . .
CMD ["python", "app.py"]
# Note: with a cache mount you can DROP --no-cache-dir — you WANT pip's cache kept.

cache_mount_model.pydef install_time(deps, changed, cache_mount):
    """Each dep costs download + build. A cache mount keeps downloads across builds."""
    dl_per, build_per = 3.0, 0.5   # seconds
    total = 0.0
    for d in deps:
        # without a cache mount, ANY change re-downloads every dep this layer
        must_download = (d in changed) or (not cache_mount and changed)
        total += (dl_per if must_download else 0.0) + build_per
    return round(total, 1)

deps = [f"pkg{i}" for i in range(20)]
changed = {"pkg7"}                       # one dependency bumped
print("no cache mount:", install_time(deps, changed, cache_mount=False), "s")
print("with cache mount:", install_time(deps, changed, cache_mount=True), "s")

Dockerfile.targets# syntax=docker/dockerfile:1
FROM python:3.12-slim AS deps
WORKDIR /app
COPY requirements.txt .
RUN --mount=type=cache,target=/root/.cache/pip pip install --target=/deps -r requirements.txt

FROM deps AS test                 # test image = deps + dev tools + tests
RUN --mount=type=cache,target=/root/.cache/pip pip install --target=/deps pytest
COPY . .
ENV PYTHONPATH=/deps
CMD ["pytest", "-q"]

FROM python:3.12-slim AS prod     # prod image = deps + code only, no test tooling
WORKDIR /app
COPY --from=deps /deps /deps
COPY . .
ENV PYTHONPATH=/deps
USER 10001
CMD ["python", "app.py"]

# Build a specific target:
#   docker build --target test -t myapp:test .
#   docker build --target prod -t myapp:1.4.2 .

buildx-multiarch.sh# One-time: create a builder that can target multiple platforms.
docker buildx create --name multi --use
docker buildx inspect --bootstrap

# Build BOTH arches and push a manifest list under ONE tag.
# --push is required for multi-arch: a manifest list can't live in the local store.
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t myrepo/myapp:1.4.2 \
  --push .

# Confirm both arches are present under the single tag:
docker buildx imagetools inspect myrepo/myapp:1.4.2
# Native builders per-arch are far faster than QEMU emulation — prefer them in CI.

build.yml# .github/workflows/build.yml  (needs docker/build-push-action + a registry)
name: build
on: [push]
jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@v6
        with:
          push: true
          tags: myrepo/myapp:${{ github.sha }}
          # Import last build's layers and export this build's — durable across runners.
          cache-from: type=registry,ref=myrepo/myapp:buildcache
          cache-to: type=registry,ref=myrepo/myapp:buildcache,mode=max
# 'mode=max' caches intermediate stage layers too, not just the final image.
# Action versions/inputs change — verify against current docs.

ci_cache_model.pyLAYERS = [("base", 5), ("apt", 40), ("pip", 60), ("copy-code", 2), ("final", 3)]

def ci_time(changed, cache_from_registry):
    total, broken = 0, False
    for name, secs in LAYERS:
        if name in changed:
            broken = True
        if broken:                       # this layer must rebuild
            total += secs
        elif not cache_from_registry:    # clean runner, no imported cache -> rebuild anyway
            total += secs
    return total

edit = {"copy-code"}                     # a normal code change
print("cold runner, no cache import:", ci_time(edit, cache_from_registry=False), "s")
print("warm cache imported from registry:", ci_time(edit, cache_from_registry=True), "s")

Dockerfile.pinned# Pin the base by immutable digest, not a mutable tag, so the build is reproducible
# and the base cannot be swapped under you (ties back to CD6 provenance).
FROM python:3.12-slim@sha256:<digest-of-the-exact-image>
# Pair with a locked requirements file (hashes) for fully pinned dependencies:
#   pip install --require-hashes -r requirements.lock
# SOURCE_DATE_EPOCH and reproducible flags can normalize timestamps — verify current support.

context_lint.pyimport fnmatch

def build_context(files, dockerignore):
    """Return files that WOULD be sent to the builder after applying .dockerignore."""
    kept = []
    for path, size in files.items():
        if any(fnmatch.fnmatch(path, pat) or path.startswith(pat.rstrip("/") + "/")
               for pat in dockerignore):
            continue
        kept.append((path, size))
    return kept

files = {".git/objects/pack": 90, ".venv/lib": 300, "tests/big_fixture.bin": 40,
         ".env": 1, "app.py": 1, "requirements.txt": 1}
ignore = [".git/", ".venv/", "tests/", ".env", "*.pyc"]
kept = build_context(files, ignore)
sent = sum(s for _, s in kept)
print("sent to builder:", sorted(p for p, _ in kept), "=", sent, "MB")
assert ".env" not in {p for p, _ in kept}, "secret leaked into context!"
print("ok: no secret, context tiny")