Build a reproducible artifact
Use a multi-stage build to separate compilation from the runtime image. Pin a suitable supported base image, restore dependencies predictably and keep build tools out of the final container.
Do not bake secrets into image layers. Provide environment-specific configuration through the deployment environment.
Design the runtime contract
Decide which address the application listens on, which process owns shutdown, and how health is reported. The runtime user should have only the permissions needed by the application.
Persistent data must outlive a replaced container. Treat volumes and database backups as separate concerns from rebuilding an image.
Validate through the public path
Test the service behind the actual reverse proxy and TLS endpoint, including authentication redirects and forwarded headers. A healthy localhost endpoint does not validate the public path.
Record a small operational checklist: startup, readiness, dependency failure, rollback and log collection. Production readiness is behavior you can verify, not a Dockerfile label.
Further reading
Primary documentation & specification