Docker builds are incremental by default — but only if you structure your Dockerfile to let the cache work. This lesson teaches you to cut build times from minutes to seconds and shrink images from gigabytes to megabytes.

1. How Docker Build Cache Works

Every instruction in a Dockerfile produces a layer. Docker hashes the instruction text plus the content of any files involved. If the hash matches a previously built layer, Docker skips execution and reuses the cached result — a cache hit.

The critical rule: once a layer misses the cache, every subsequent layer is rebuilt from scratch. The cache is a chain — one break invalidates everything downstream.

2. The Order Matters

The golden rule: put things that change least at the top, things that change most at the bottom.

FROM node:20
WORKDIR /app
COPY . .
RUN npm install
RUN npm run build
CMD ["node", "dist/app.js"]

FROM node:20
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build
CMD ["node", "dist/app.js"]

3. Cache Busting

The cache is invalidated (busted) when:

• COPY/ADD — any file in the source has changed (content hash, not timestamp)
• RUN — the command string itself changed
• ARG — the argument value changed
• Parent layer — any upstream layer was rebuilt

Sometimes you want to bust the cache intentionally — e.g., to force a fresh apt-get update:

# Force cache bust with a changing ARG
ARG CACHEBUST=1
RUN apt-get update && apt-get install -y curl

# Build with: docker build --build-arg CACHEBUST=$(date +%s) .

4. Multi-Stage Builds

The single most impactful optimisation. You build in one stage (with compilers, dev tools, everything), then copy only the final artifact into a minimal runtime image. Build tools never ship to production.

Full multi-stage Dockerfile for a Go application:

# ---- Build Stage ----
FROM golang:1.22-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /app ./cmd/server

# ---- Runtime Stage ----
FROM alpine:3.19
RUN apk --no-cache add ca-certificates
COPY --from=build /app /app
EXPOSE 8080
USER 1000
CMD ["/app"]

5. .dockerignore

Before building, Docker sends the entire build context (usually your project directory) to the daemon. Without a .dockerignore, this includes massive irrelevant files.

# .dockerignore
.git
node_modules
dist
*.log
.env
.env.*
__pycache__
*.pyc
.DS_Store
coverage
.idea
.vscode

6. BuildKit Features

BuildKit is Docker's modern build backend (default since Docker 23.0). It adds significant improvements:

• Parallel execution — independent stages build concurrently
• Better caching — mount caches survive between builds
• Secret mounts — inject secrets without baking them into layers
• SSH forwarding — access private repos during build without copying keys

# Enable BuildKit (if not default)
export DOCKER_BUILDKIT=1

# Secret mount — never stored in a layer
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm ci

# Build command:
docker build --secret id=npmrc,src=$HOME/.npmrc .

# Cache mount — persists package manager cache between builds
RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt

# SSH mount — clone private repos
RUN --mount=type=ssh git clone git@github.com:company/private-lib.git

7. Measuring Build Performance

You can't optimise what you don't measure. Key tools:

# See every step's timing with plain output
docker build --progress=plain -t myapp .

# Inspect layer sizes in the final image
docker history myapp

# Example output:
IMAGE        CREATED BY                          SIZE
a1b2c3d4     CMD ["/app"]                        0B
e5f6g7h8     COPY --from=build /app /app         12.4MB
i9j0k1l2     RUN apk --no-cache add ca-certs     0.5MB
m3n4o5p6     /bin/sh (alpine base)               7.8MB

# Dive — interactive image layer explorer
# Install: https://github.com/wagoodman/dive
dive myapp

# Shows: layer contents, wasted space, efficiency score

Interactive Quizzes

Hands-On Tasks

# Bad order — fix this!
FROM node:20-alpine
WORKDIR /app
COPY . .
RUN npm ci
RUN npm run build
EXPOSE 3000
CMD ["node", "dist/index.js"]

# Single-stage (builds AND ships everything)
FROM golang:1.22
WORKDIR /src
COPY . .
RUN go build -o /app ./cmd/server
EXPOSE 8080
CMD ["/app"]

Key Takeaways