Multi-stage builds ni nini na kwa nini uzitumie?

Question

Accepted Answer

**Multi-stage builds** hutumia stages nyingi za `FROM` katika Dockerfile moja — kujenga programu katika stage moja (na zana zote za ujenzi) na kunakili tu artifacts za mwisho katika stage ya mwisho safi na ndogo. Hii hutoa images za uzalishaji **ndogo zaidi na salama zaidi**.

## Tatizo: zana za ujenzi huvimbisha image

```text
Building an app needs build tools (compilers, dev dependencies, SDKs), but the
FINAL image shouldn't include them:
  → they bloat the image (larger size, slower deploys)
  → they increase the attack surface (more software = more vulnerabilities)
→ You want only the built artifact + its runtime in the final image.
```

## Multi-stage build

```dockerfile
# STAGE 1: "build" — has all the build tools (compile/bundle the app)
FROM node:20 AS build
WORKDIR /app
COPY package*.json ./
RUN npm install              # includes dev dependencies, build tools
COPY . .
RUN npm run build            # produces /app/dist

# STAGE 2: final — a clean, minimal image with ONLY the built artifact
FROM nginx:alpine
COPY --from=build /app/dist /usr/share/nginx/html   # copy ONLY the build output
# → the final image has NO build tools, no dev dependencies — just nginx + the built files
```

`--from=build` hunakili artifacts kutoka build stage hadi image ya mwisho. Image ya mwisho **inaondoa kila kitu kutoka build stage isipokuwa kile unachokinakili waziwazi** — hivyo zana za ujenzi, dev dependencies, na source haziishii katika uzalishaji.

## Faida

```text
✓ SMALLER images — only the runtime + artifacts (often 10x+ smaller)
✓ More SECURE — fewer packages = smaller attack surface (no compilers/build tools)
✓ Faster deploys/pulls (smaller images transfer faster)
✓ One Dockerfile — build and final image together (no separate build scripts)
→ Common for compiled languages (Go, Rust, Java) and Node/frontend builds.
```

## Kwa nini ni muhimu

Kuelewa multi-stage builds ni la thamani kwa **kutoa images za uzalishaji ndogo na salama**, hivyo ni maarifa muhimu ya kivitendo kwa kujenga images za Docker za ubora wa uzalishaji.

Tatizo inalosuluhisha ni halisi na la kawaida: kujenga programu kunahitaji **zana za ujenzi** (compilers, SDKs, dev dependencies) ambazo **image ya mwisho ya uzalishaji haipaswi kuwa nazo** — kuziingiza huvimbisha image (ukubwa mkubwa zaidi, upelekaji na pulls za polepole) na huongeza **attack surface** (programu zaidi zilizosakinishwa zinamaanisha udhaifu zaidi unaowezekana). **Multi-stage builds** husuluhisha hili kwa busara kwa kutumia stages nyingi za `FROM`: kujenga programu katika stage yenye zana zote, kisha **kunakili tu artifacts za mwisho** (`--from=build`) katika stage ya mwisho safi na ndogo inayoondoa kila kitu kingine.

Hii hutoa images ambazo ni **ndogo kwa kiasi kikubwa** (mara nyingi ndogo mara 10+ — runtime na artifacts tu) na **salama zaidi** (hakuna zana za ujenzi au packages zisizo za lazima za kutumia), huku zikiweka kila kitu katika Dockerfile moja (hakuna build scripts tofauti).

Mfumo huu ni wa kawaida kwa lugha zilizo-compile (Go, Rust, Java, ambapo compiler haihitajiki wakati wa runtime) na kwa frontend/Node builds (ambapo build tooling na source hazihitajiki katika uzalishaji).

Kwa kuwa images za uzalishaji ndogo na salama ni muhimu kwa kasi ya upelekaji, uhifadhi, na usalama, na kwa kuwa multi-stage builds ni mbinu ya kawaida na yenye ufanisi ya kuzipata (kutenganisha mazingira ya ujenzi na image nyepesi ya runtime), kuelewa multi-stage builds — tatizo la uvimbe/usalama inalosuluhisha, jinsi zinavyofanya kazi, na faida zake — ni maarifa ya thamani yanayotumika mara kwa mara kwa kujenga images za Docker za ubora wa uzalishaji, mbinu bora inayotumika sana katika Dockerfiles za ulimwengu halisi na ujuzi muhimu wa kutoa programu zenye ufanisi na salama zilizowekwa katika containers.