Crafting the Perfect Dockerfile: A Step-by-Step Guide for Microservice

A Dockerfile is the recipe Docker follows to build an image: which base image to start from, which files to copy, what to install and which command starts your service. A good one builds fast, produces a small image, runs as a non-root user and keeps secrets out. This page gives you the current pattern for a microservice and links to the full walkthrough.

1. What changed since older Dockerfile guides

Many older tutorials start with FROM node:14, COPY . . and RUN npm install. That pattern still builds, but it is out of date:

• Node.js 14, 16, 18 and 20 are past end of life and get no security fixes. Use a current LTS line: Node.js 24 or 22.
• npm install can change versions between builds. npm ci installs exactly what package-lock.json says.
• Copying everything before installing throws away Docker's build cache every time any file changes, so every build reinstalls all dependencies.
• Running as root inside the container gives an attacker more to work with if the service is compromised.

2. A current Dockerfile for a Node.js microservice

# syntax=docker/dockerfile:1
FROM node:24-slim

ENV NODE_ENV=production
WORKDIR /app

# Dependencies first, so this layer is cached until they change
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

# Then the code, owned by the image's unprivileged user
COPY --chown=node:node . .
USER node

ENV PORT=8080
EXPOSE 8080

CMD ["node", "server.js"]

Next to it, a .dockerignore keeps local clutter and secrets out of the build:

node_modules
.git
.env
*.env
npm-debug.log
coverage

If your service needs a build step, such as TypeScript, use a multi-stage build: install everything and compile in a first stage, then copy only the compiled output and production dependencies into a clean final stage. The same ideas apply to other languages: for Python, start from python:3.12-slim or newer and install from a pinned requirements.txt with pip install --no-cache-dir.

3. The rules that matter most

4. Build and run it

docker build -t my-service:1.0 .
docker run -d --name my-service -p 8080:8080 --env-file .env my-service:1.0
docker logs -f my-service

-p 8080:8080 maps port 8080 on the host to port 8080 in the container. On a public server, put a reverse proxy such as nginx or Caddy with HTTPS in front of the service rather than exposing application ports directly. Rebuild regularly to pick up security fixes in the base image, and scan images with a tool such as Docker Scout or Trivy.

5. Where to run your image on Domain India

• App Platform: deploy from GitHub or with a deploy token, and the platform builds your Dockerfile, runs the container and serves it over HTTPS. Your service must read PORT and bind to 0.0.0.0. There is no SSH access. See Getting started with the App Platform.
• VPS: full root access to install Docker and Docker Compose yourself. You look after updates, the firewall and backups.
• Shared hosting: see Docker on cPanel and DirectAdmin for why it isn't possible and what to do instead.

The cards show live Domain India prices, excluding 18% GST.

Ready to ship your service? Compare App Platform plans and VPS plans, or open a support ticket if you're not sure which fits.