LEARN. PRACTICE. GROW.Start with effective inputs
In the fictional workshop, the pipeline runs at the repository root and selects deploy/Dockerfile with -f. The final argument still defines the context. Before changing COPY, identify that root and the exclusions actually used. A Dockerfile-specific file can take precedence over the root.dockerignore. Prepare an inventory of code source, Dockerfile, context, nonconfidential arguments and expected artifact. This inventory helps explain why two apparently equal builds may receive different files without using actual production content or credentials during the exercise.
A fast build may reuse an old result
In the closing exercise, the team sees a fast run and concludes rules were downloaded again. First request evidence of which steps executed and which were reused. Cache does not confirm remote-server freshness. Reused installation can retain earlier components; changing only an input’s mtime is also not a COPY invalidation strategy. Define the freshness requirement, expected versions and required rebuild scope. The report should distinguish process success, result identity and satisfaction of the requirement that motivated the change, with an accountable acceptance decision.
Arrange dependencies without hiding inputs
When manifest and lockfile change rarely, copy those inputs before dependency installation and place frequently changing code later. Check whether installation also uses scripts or configuration omitted from that step. An optimization that hides actual inputs may reuse inappropriate results. A cache mount accelerates repeated work; it is not a distribution channel for the only executable. Required output should be produced outside that mount. Apply the same review to build bind mounts: write permissions do not make modifications to mounted contents permanent.
Secret rotation needs its own decision
A secret value may change without invalidating its cached step. In the fictional case, this leaves two questions: does access with the new credential work, and do rules match the approved version? Validate them separately when necessary. Use an appropriate temporary input mechanism and review the consuming command: printing the value or copying it into an output file may expose it despite the mount. Do not place the secret in an ARG to force repetition. Record the authorized mechanism identity without recording its confidential value in the change sheet.
Actual lab: what the parser observed
The lab uses the official BuildKit v0.33.1 module and eight original Dockerfiles. The parser and instructions.Parse accepted five and rejected three invalid inputs. Identity expansion was applied to literal RUN mount fields without resolving environment variables. The experiment observed stages, inter-stage COPY, shell and exec forms, declared mounts and inline contents. In the example, ${BASE_IMAGE} remained unresolved. No image was downloaded or built. This distinction lets you use results to review declarations without confusing instruction reading with application behavior or a successful deployment.
Workshop: decide which evidence is missing
Complete a sheet for rotation of the closing-rules token. Identify context and exclusions, reused steps, produced file version and the result expected by the consumer. If the parser accepts the declaration, record only that check. Then plan the isolated authorized execution needed to confirm access, construction and behavior while preserving result identity. During handover use a precise statement: “The Dockerfile was parsed; credential access and artifact freshness still need validation.” Avoid presenting a cache hypothesis as a proven diagnosis without observing the relevant execution.
Actual observation: eight fixtures, five accepted and three rejected. The parser identified build and runtime while leaving ${BASE_IMAGE} and $BUILDPLATFORM unresolved. It did not execute RUN.
Common pitfalls
Taking cache as freshness; using mtime as rebuild control; leaving the executable in a temporary mount; exposing secrets through ARG; declaring runtime validated after parsing.
Related topics: Build and distribution · Compose and privileges · Data, persistence and validated recovery
Review inputs and each output destination. The parser helps read intent; controlled execution and artifact evidence remain necessary to accept the build.
Reference: Build context · Docker Engine Linux containers, BuildKit and Compose; official documentation consulted 2026-09-30; version-dependent behavior explicitly scoped