Docker multi-stage builds: smaller and safer images
Why it matters
A multi-stage build leaves compilers, package managers and build secrets in a stage that is thrown away, so the shipped image carries only what runs.
How to fix it
Split the build:
FROM python:3.11 AS builder
RUN pip install --prefix=/install -r requirements.txt
FROM python:3.11-slim
COPY --from=builder /install /usr/local
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.