Docker Images in Production: Multi-stage Builds, BuildKit Caching, Distroless and Reproducible Builds

A practical guide to stop treating the Dockerfile as an afterthought: how layer caching actually works and why copying source before manifests invalidates your dependency install on every commit, complete multi-stage builds for Python (with uv), Node (with pnpm and pruning) and Go, BuildKit cache mounts that turn ninety seconds of installing into three, build secrets with --mount=type=secret instead of ARG (which is written into docker history forever), registry caching in CI and the mode=max flag almost everyone forgets that leaves the expensive stages uncached, COPY --link and when not to use it, the four base image families (Debian slim, Alpine and the musl trap with Python, distroless, and hardened images such as Wolfi/Chainguard) with real selection criteria, operational practices (numeric UID for runAsNonRoot, exec form so SIGTERM arrives, read-only root filesystem, OCI labels), and provenance, SBOM, digest pinning and SOURCE_DATE_EPOCH for reproducible builds. With eight recurring mistakes, a production checklist and an FAQ. Expanded September 2026 edition: multi-platform builds (QEMU versus cross-compilation with TARGETPLATFORM and native runners, and the index you break by pushing one architecture separately), docker buildx bake for describing the build as configuration with target inheritance and test stages that export artifacts, how to measure size properly (compressed versus uncompressed, shared layers and a CI size budget), vulnerability scanning without noise by separating base from dependencies with --ignore-unfixed, VEX and daily rescans of what is already deployed, keyless Sigstore signing and identity verification at admission with Kyverno and mutateDigest, debugging shell-less images with ephemeral containers and /proc/1/root, the three CI cache backends with the four real causes of a cache miss, the start and stop contract with the orchestrator (exec form, PID 1, STOPSIGNAL, HEALTHCHECK versus probes and GOMEMLIMIT), the registry as infrastructure with retention policies, pull-through caching and the trap of expiring untagged images that belong to an index, a full case study from 14 minutes and 1.4 GB to 95 seconds and 180 MB with per-step numbers, four more mistakes you only see in production, an expanded FAQ and a glossary. Second September 2026 expansion: building without a daemon in CI (Kaniko archived in June 2025, rootless BuildKit with the Kubernetes driver, Buildah, and long-lived remote builders that keep the cache warm), when not to write a Dockerfile with buildpacks, ko and jib — and why pack rebase changes the cost of patching a fleet of hundreds of images —, private dependencies without leaking credentials (mounted secrets versus ARG, the GOPRIVATE=* trap, and RUN --network=none to prove a step is hermetic), mutable tags versus promotion by digest with immutable tags and automated base-image digest advancement via Renovate, and cold start in depth: the 76% of startup spent pulling, parallel kubelet pulls, PromQL to measure it, lazy pulling with eStargz and SOCI, and the pre-pull DaemonSet that is usually the boring, correct answer.