How do you build dev and production Docker images from one source?

WHAT THIS TESTS: This question evaluates whether you understand how to use Docker multi-stage builds to solve the classic dev-versus-production dependency split. The interviewer wants to see that you can keep production images small and secure without forcing developers to maintain two separate Dockerfiles. The core concept is using multiple FROM statements in a single Dockerfile to create distinct build stages, then selectively copying artifacts between them.

A GOOD ANSWER COVERS: First, propose a base stage that installs runtime dependencies and copies in the application source. Second, define a dev stage that inherits from the base and adds testing frameworks, linting tools, debuggers, or compilers that are only needed for development and CI. Third, define a production stage that starts from a minimal base image and uses COPY --from to pull only the built artifact from the base or an intermediate build stage. Fourth, mention that you can target specific stages with docker build --target dev or --target production so a single Dockerfile serves both workflows. Fifth, note that this keeps the production image free of build tools, reducing attack surface and image size.

COMMON WRONG ANSWERS: A major red flag is suggesting two separate Dockerfiles, one for dev and one for production, because they inevitably drift out of sync and duplicate logic. Another mistake is installing all dependencies including dev ones in the production image and simply ignoring them at runtime; this bloats the image and expands the security footprint. A third error is forgetting to mention stage targeting or artifact copying, which suggests you have not actually used multi-stage builds in practice.

LIKELY FOLLOW-UPS: The interviewer might ask how you would handle secrets or private package credentials during the build without leaking them into the final image; the answer is to mount secrets with BuildKit or use intermediate stages that do not persist in the production layer. They might also ask how to cache layers effectively across dev and production builds, where you would discuss ordering your Dockerfile from least-frequently-changed to most-frequently-changed dependencies. Another follow-up could be how to handle a language-specific package manager like pip or npm; you would explain mounting lock files in the base stage and copying only the production node_modules or site-packages into the final stage.

ONE CONCRETE EXAMPLE: Imagine a Python application. The base stage uses python:3.11-slim, copies requirements.txt, and installs both runtime and build dependencies. The dev stage adds FROM base AS dev, installs pytest, black, and mypy, and runs the test suite. The production stage uses FROM python:3.11-alpine AS production, copies the application code, and uses COPY --from=base /app /app to pull in only the installed packages, leaving gcc and pytest behind. Developers run docker build --target dev for local work, while CI builds the production target for deployment.