Dockerfile COPY versus ADD

WHAT THIS TESTS It checks whether you know both instructions and follow Docker's own guidance to prefer the predictable one, plus the one narrow case where ADD earns its place.

A GOOD ANSWER COVERS COPY takes files or directories from the build context and copies them into the image filesystem, nothing more. ADD does the same but adds two behaviors: if the source is a recognized local compressed archive such as a tar.gz, it is automatically extracted into the destination; and if the source is a URL, it downloads the file. COPY is generally preferred precisely because it has no surprises, which makes Dockerfiles easier to read and audit. The justified scenario for ADD is unpacking a local tarball you already have in the context, where its auto-extraction saves a separate RUN tar step.

COMMON WRONG ANSWERS Saying they are identical. Recommending ADD with a remote URL to fetch dependencies, which is discouraged because you cannot verify checksums easily and you cannot remove the download in the same layer. Forgetting that ADD's auto-extraction can be surprising when you actually wanted the archive file itself.

LIKELY FOLLOW-UPS Why is downloading via RUN curl preferred over ADD URL? How does layer caching treat each? What about .dockerignore?

ONE CONCRETE EXAMPLE To bring a vendored tarball into the image and unpack it, ADD vendor.tar.gz /opt/app does extraction in one line. For ordinary source files you write COPY . /app, keeping behavior obvious; to fetch a remote artifact you use RUN curl -fsSL url -o file and verify its checksum, not ADD.