How to Write an Earthly Earthfile Multi-Stage from a Service Brief

Earthfiles fail when they invent debian:latest and a private registry. Lock every FROM to a version in Inputs. If a tag is missing, write TAG UNKNOWN.

The matching generator is the Earthly Earthfile Multi-Stage from a Service Brief (Version-Locked Images, No Invented Bases) (Earthly Earthfile Multi Stage From Service Brief Version Locked Images) prompt. Browse related cards in the PromptDig library (Browse more prompts). When a filled run survives, share the version you actually use (Share a prompt).

Quote every base image and version from Inputs

Write a multi-stage Earthfile from a service brief. Lock base images and versions in Inputs. Do not invent tags or registries. Start by filling Inputs, not by asking the model to remember last week's run. If a field is blank, write NONE or NOT IN INPUTS and leave it blank through Generate. The card is built so the model cannot honestly invent a number, owner, URL, or command that you did not paste.

Paste these fields before you hit run:

Service brief (language, entrypoint, ports I allow): [Brief]
Base images I lock with exact tags: [Images]
Earthly VERSION I lock (or UNKNOWN): [Earthly]
Build targets I allow: [Targets]
Words I must not use: [Banned]
What I must never invent (tags, registries, ports): [Never]
Output format: [Format]
Language for comments: [Lang]
Package versions I lock (or NONE): [Packages]

That inventory is the honesty ledger. Anything that does not appear there is forbidden in the draft. If you catch yourself adding a nice-to-have after the run, you are no longer using the card. You are ghostwriting. Put the extra fact in Inputs and run again.

Name only the targets listed in the brief

Generate is numbered on purpose. Do not skip a step because the first paragraph looked done. The early steps exist to stop later prose from smuggling claims.

Walk the Generate list in order:

1. Honesty ledger: Brief nouns, Images, Earthly, Targets, Packages, Lang. Forbidden: invented tags, invented registries, extra ports.
2. Image lock table: each Images line quoted. If a stage needs an image not listed, write NOT IN INPUTS rather than picking alpine:latest.
3. Earthfile body: VERSION from Earthly or VERSION UNKNOWN. Targets only. Copy only paths named in Brief.
4. Runtime: EXPOSE only ports in Brief. USER only if Brief names a user. HEALTHCHECK only if Brief names one.
5. Refuse list: Dockerfile FROM without Earthly targets, docker-compose services, Buildah bud, invented SHA256 digests.
6. Packages: quote Packages or write NONE. Do not add a pinned apk add line that is not locked.
7. Never: do not write :latest. Do not invent ghcr.io or ecr URLs.
8. Compliance pass: quote Banned and Never hits. Cut them. Format as Format.

If a step asks for a version lock, quote the version from Inputs in the output. If a step asks for a refuse list, keep the refuse list in the published artifact, not in a sidebar you delete. Reviewers should see what the model was not allowed to do.

Refuse invented registries and latest tags

Most failures are the same shape: a missing field gets a confident fill. A conversion rate appears. A Gradle task appears. A flash point appears. A caption appears on a job that asked for slide text only. Your review is to search the draft for numbers, names, and commands, then grep Inputs. No match means cut.

Honor the constraints as hard stops, not vibes:

• Earthfile from Brief and Images only. Not a Dockerfile-only dump and not compose.
• Never invent base image names, tags, or registries.
• Only Targets named in Inputs.
• No emojis.

When the card says not legal advice, not certification, not an exam dump, or not a caption engine, that sentence belongs at the top of the output. Deleting it to look more finished is how you inherit risk.

Print target count against the max

Finish with the compliance pass the prompt already asks for. Quote the banned-word hits. Cut them. Print character counts when the job has a cap. Print word counts when the job has a budget. List gaps as gaps. Five missing facts are more useful than one smooth paragraph.

Tags on the card (earthly earthfile multi-stage, version-locked base images, no invented docker tags) are a reminder of the job shape, not an invitation to wander into a neighboring cluster. If you need a different surface, open a different PromptDig card rather than stretching this one.

Fill the card, then run

Replace every bracket. Run on ChatGPT, Claude, or Gemini. Read the ledger first, then the artifact. If the model invents a commit, KPI, DOI, PEL, bid, or logo, discard the run. Tighten Inputs. Run again. Share the filled card that survived, not the first draft that sounded done.