>_DevCheatsheetsRUN

DOCKER FIELD GUIDE // 01

Build and publish a traceable Docker image

Create an explicitly tagged image, inspect its metadata and layers, then publish that exact artifact.

Scenario

A release must become a reproducible image and move safely through the registry.

Practice this worldBrowse all Docker commands

BEFORE YOU START

Prerequisites and boundaries

  • Review the Dockerfile and .dockerignore for credentials and unnecessary build context.
  • Choose an immutable version tag in addition to any moving convenience tag.
  • Authenticate to the intended registry without embedding credentials in shell history.

OPERATIONAL REASONING

Why this sequence matters

The goal is not merely to memorize commands. Each inspection, change, and verification step reduces a different failure mode.

01

Name the artifact at build time

A deliberate local tag prevents later commands from selecting an ambiguous image.

02

Inspect before publishing

Configuration, labels, architecture, and layer history should match the release intent.

03

Push a registry-qualified tag

The registry hostname and repository path define the actual remote destination.

STANDARD PROCEDURE

Build, inspect, tag, and publish a versioned application image.

Build locally, inspect the artifact, apply the registry-qualified tag, authenticate, then publish that exact tag.

  1. 01
    docker build -t myapp:1.0 .Docker build -t reference ↗
  2. 02
    docker image inspect myapp:1.0Docker image inspect reference ↗
  3. 03
    docker tag myapp:1.0 registry.example.com/myapp:1.0Docker tag myapp:1.0 reference ↗
  4. 04
    docker login registry.example.comDocker login registry.example.com reference ↗
  5. 05
    docker push registry.example.com/myapp:1.0Docker push registry.example.com/myapp:1.0 reference ↗

INCIDENT RESPONSE

Rebuild a production image from an explicit Dockerfile and verify it before release.

The explicit production build is inspected and its layers reviewed before tagging and publishing it.

  1. 01
    docker build -f Dockerfile.prod -t myapp:prod .Docker build -f reference ↗
  2. 02
    docker image inspect myapp:prodDocker image inspect reference ↗
  3. 03
  4. 04
    docker tag myapp:prod registry.example.com/myapp:prodDocker tag myapp:prod reference ↗
  5. 05
    docker push registry.example.com/myapp:prodDocker push registry.example.com/myapp:prod reference ↗

COMMON FAILURE MODES

What usually goes wrong

  • Secrets entered the image through copied files, build arguments, or cached layers.
  • A mutable latest tag made the deployed artifact impossible to identify later.
  • The image architecture did not match the production runtime.

VERIFICATION

Evidence to collect

  • docker image inspect reports the expected labels, entrypoint, and architecture.
  • docker history does not reveal credentials or unexpected large layers.
  • The registry digest recorded after push matches the artifact selected for deployment.