Dockerfile Generator

What This Prompt Does

This prompt generates a production-hardened, multi-stage Dockerfile by combining security best practices (non-root user, read-only filesystem, minimal base image) with build performance optimizations (layer caching via dependency installation before source copy, .dockerignore recommendations). It takes a plain-English project description and produces a Dockerfile that’s genuinely suitable for deployment, not just a tutorial example.

System Prompt

You are a Docker expert specializing in production container security and build optimization.

When generating a Dockerfile, always:

1. Use multi-stage builds: a "builder" stage for compilation/dependency installation and a 
   minimal "runtime" stage for execution.
2. Choose the smallest appropriate base image:
   - Node.js → node:{version}-alpine
   - Python → python:{version}-slim
   - Go → scratch or gcr.io/distroless/static for the runtime stage
   - Java → eclipse-temurin:{version}-jre-alpine for runtime
3. Security hardening (mandatory):
   - Create and switch to a non-root user (uid 1000) in the runtime stage
   - Do NOT run as root
   - Use COPY --chown=<user>:<user> when copying files to the runtime stage
4. Layer caching optimization:
   - Copy dependency manifests (package.json, requirements.txt, go.mod) BEFORE source code
   - Install dependencies in a separate layer from copying source
5. Use ENTRYPOINT for the main process; use CMD for default arguments.
6. Add HEALTHCHECK instruction with an appropriate check.
7. After the Dockerfile, output a minimal .dockerignore file as a comment block.
8. Add inline comments explaining non-obvious decisions.

User Prompt Template

Generate a production-ready, multi-stage Dockerfile for the following project.

Project description: {PROJECT_DESCRIPTION}
Primary language / runtime: {RUNTIME} (e.g., "Node.js 20", "Python 3.12", "Go 1.22")
Build tool / package manager: {BUILD_TOOL} (e.g., "npm", "poetry", "go build")
Application listens on port: {PORT}
Special requirements: {SPECIAL_REQUIREMENTS} (e.g., "needs ffmpeg", "requires GPU drivers", "must read from /data volume")

Output:
1. The complete Dockerfile
2. A recommended .dockerignore content (as a comment block at the bottom)

Example Output

Input: Node.js 20 Express API, npm, port 3000

Model output:

# ============================================================
# Stage 1: Builder — install dependencies and build the app
# ============================================================
FROM node:20-alpine AS builder

WORKDIR /app

# Copy dependency manifests first to maximize layer cache reuse.
# Source changes won't invalidate the npm install layer.
COPY package.json package-lock.json ./
RUN npm ci --only=production

# ============================================================
# Stage 2: Runtime — minimal production image
# ============================================================
FROM node:20-alpine AS runtime

# Create a non-root user to limit the container's attack surface.
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app

# Copy only production node_modules and app source from builder
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --chown=appuser:appgroup . .

USER appuser

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget -qO- http://localhost:3000/health || exit 1

ENTRYPOINT ["node"]
CMD ["src/server.js"]

# ============================================================
# Recommended .dockerignore
# ============================================================
# node_modules
# npm-debug.log
# .git
# .env
# .env.*
# dist
# coverage
# *.test.js
# Dockerfile
# .dockerignore

Tips & Variations

• Secrets at build time: Never use ENV or ARG for secrets — they appear in docker history. Instead, note in {SPECIAL_REQUIREMENTS}: “Use Docker BuildKit --secret mount for API keys”. The model will generate RUN --mount=type=secret,id=api_key syntax.
• GPU workloads: Specify {RUNTIME} as "Python 3.11 + CUDA 12.2" and {SPECIAL_REQUIREMENTS} as "requires NVIDIA GPU for PyTorch inference". The model will use nvidia/cuda:12.2.0-runtime-ubuntu22.04 as the base.
• Distroless for Go: For Go binaries, specify {RUNTIME} as "Go 1.22" with {SPECIAL_REQUIREMENTS} as "compile to a static binary". The model will produce a scratch or distroless runtime stage with zero shell access.
• Docker Compose companion: Add "Also generate a docker-compose.yml for local development with volume mounts and env_file" to get a complete local dev setup alongside the production Dockerfile.