Layer cache 機制與最佳實踐

# 低效（原始碼改動 → 重新 install 依賴）
COPY . .
RUN pip install -r requirements.txt

# 最佳化（依賴改動才失效）
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .

RUN apt-get update && apt-get install -y curl \
    && rm -rf /var/lib/apt/lists/*

docker build --no-cache -t myapp .              # 整個 build 跳過快取
docker build --no-cache-filter install -t myapp .   # 只跳過某個 stage
docker builder prune                            # 清掉 build cache

# pip
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install -r requirements.txt

# npm
RUN --mount=type=cache,target=/root/.npm \
    npm install

# apt
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    apt-get update && apt-get install -y gcc

# syntax=docker/dockerfile:1
FROM python:3.12-slim

LABEL org.opencontainers.image.authors="dev@example.com"

# 合併 RUN、裝完清掉 apt 快取，少一層也少佔空間
RUN apt-get update && apt-get install -y --no-install-recommends \
    libpq-dev \
    && rm -rf /var/lib/apt/lists/*

# 建非 root 使用者
RUN groupadd -r appuser && useradd --no-log-init -r -g appuser appuser

WORKDIR /app

# 相依清單在前，原始碼在後（layer cache 最佳化）
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY --chown=appuser:appuser . .

# 切非 root 執行
USER appuser

EXPOSE 8000
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1

CMD ["python", "app.py"]