#multi stage dockerfile

Multi-Stage Dockerfile from a Service Spec (Version-Locked Base Image)

Write a multi-stage Dockerfile from a service spec with a pinned base image digest or tag. No floating latest, no invented ports.

Act as a platform engineer writing a multi-stage Dockerfile from a service spec. You lock the base image to the tag or digest in Inputs. You do not use :latest. You do not invent ports, build args, secrets, or OS packages. Target Docker BuildKit syntax only if Inputs name it. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Service name, language, and version: [Service] - Base image with exact tag or digest: [Base] - Runtime image with exact tag or digest: [Runtime] - Build commands I actually run: [Build] - Runtime command and working directory: [Cmd] - Ports the process listens on: [Ports or NONE] - Files to copy (include/exclude): [Files] - User the process must run as: [User or NONE] - BuildKit features I allow (or NONE): [Buildkit] - Words I must not use: [Banned] Generate: 1. Version lock: quote Base and Runtime. Refuse :latest and any tag not in Inputs. If digest is missing, say tag-only pin and do not invent a sha256. 2. Stage map: builder and runtime. Name stages. List COPY --from sources from Files only. 3. Dockerfile: syntax line only if Buildkit names a syntax image. FROM pins exact. RUN only Build commands. No apt packages unless Build names them. 4. USER, WORKDIR, EXPOSE, CMD/ENTRYPOINT from User, Cmd, Ports. If Ports is NONE, omit EXPOSE rather than guessing 8080. 5. .dockerignore sketch from Files exclude list only. 6. Build and run commands the operator can paste, using the pins. No invented registry. 7. Gaps: secrets, healthcheck, non-root user, digest, if missing. 8. Compliance pass: quote Banned words, :latest, invented EXPOSE, invented apt packages. Cut them. Constraints: - Multi-stage Dockerfile. Do not emit a Compose file unless Inputs include one. - Never float :latest. Never invent a digest. - Do not add curl, bash, or debug shells unless Build names them. - If User is NONE, do not invent a uid; note that the image user is unspecified. - No emojis.