Apa iku multi-stage builds lan napa nggunakake?

Question

Accepted Answer

**Multi-stage builds** nggunakake pirang-pirang tahapan `FROM` ing siji Dockerfile — nglakokake aplikasi ing siji tahapan (karo kabeh alat-alate bangun) lan nggawa saka sawijining artefak pungkasan mung menyang tahapan pungkasan sing resik lan minimal. Iki ngasilake gambar produksi sing **luwih cilik lan aman**.

## Masalah: alat bangun bikin gambar akeh

```text
Building an app needs build tools (compilers, dev dependencies, SDKs), but the
FINAL image shouldn't include them:
  → they bloat the image (larger size, slower deploys)
  → they increase the attack surface (more software = more vulnerabilities)
→ You want only the built artifact + its runtime in the final image.
```

## Multi-stage build

```dockerfile
# STAGE 1: "build" — has all the build tools (compile/bundle the app)
FROM node:20 AS build
WORKDIR /app
COPY package*.json ./
RUN npm install              # includes dev dependencies, build tools
COPY . .
RUN npm run build            # produces /app/dist

# STAGE 2: final — a clean, minimal image with ONLY the built artifact
FROM nginx:alpine
COPY --from=build /app/dist /usr/share/nginx/html   # copy ONLY the build output
# → the final image has NO build tools, no dev dependencies — just nginx + the built files
```

`--from=build` nggawa artefak saka tahapan bangun menyang gambar pungkasan. Gambar pungkasan **ngilangi kabeh saka tahapan bangun kejaba apa sing kowe gawa kanthi eksplisit** — dadi alat bangun, dependensi pangembang, lan sumber ora mungkasi ing produksi.

## Manfaat

```text
✓ SMALLER images — only the runtime + artifacts (often 10x+ smaller)
✓ More SECURE — fewer packages = smaller attack surface (no compilers/build tools)
✓ Faster deploys/pulls (smaller images transfer faster)
✓ One Dockerfile — build and final image together (no separate build scripts)
→ Common for compiled languages (Go, Rust, Java) and Node/frontend builds.
```

## Napa penting

Ngerti multi-stage builds iku berharga kanggo **nglakokake gambar produksi sing cilik lan aman**, dadi iku pengetahuan praktis penting kanggo nglakokake gambar Docker berkualitas produksi.

Masalahe sing digatekake nyata lan umum: nglakokake aplikasi merlokake **alat bangun** (kompiler, SDK, dependensi pangembang) sing **gambar produksi pungkasan ora kudu klebu** — kalebu wong-wong iki bikin gambar gedhe (ukuran luwih gedhe, deployment lan pulls luwih alon) lan nambah **permukaan serangan** (software sing dipasang luwih akeh terang kemungkinan rawan). **Multi-stage builds** ngatasi iki kanthi elegan nggunakake pirang-pirang tahapan `FROM`: nglakokake aplikasi ing tahapan karo kabeh alat, banjur **nggawa mung artefak pungkasan** (`--from=build`) menyang tahapan pungkasan sing resik lan minimal sing ngilangi kabeh liyane.

Iki ngasilake gambar sing **luwih cilik banget** (asring 10x+ luwih cilik — mung runtime lan artefak) lan **luwih aman** (ora ana alat bangun utawa paket ora perlu kanggo manfaatake), nalika nag-isi kabeh ing siji Dockerfile (ora ana script bangun terpisah).

Pola iki standar kanggo basa sing dikompilasi (Go, Rust, Java, ing endi kompiler ora perlu nalika runtime) lan kanggo frontend/Node builds (ing endi alat bangun lan sumber ora perlu ing produksi).

Samegane gambar produksi sing cilik lan aman penting kanggo kacepetan deployment, panyimpenan, lan keamanan, lan samegane multi-stage builds iku teknik standar lan efektif kanggo ngasilikake (misahin lingkungan bangun saka gambar runtime sing ringkes), ngerti multi-stage builds — masalah bloat/keamanan sing digatekake, cara kerjane, lan manfaate — iku berharga, pengetahuan sing asring digunakake kanggo nglakokake gambar Docker berkualitas produksi, praktik terbaik sing akeh digunakake ing Dockerfiles nyata lan katrampilan kunci kanggo ngasilake aplikasi containerized sing efisien lan aman.