Tag

Builds with the full toolchain, ships only production dependencies, and runs as a non-root user.

Reclaims disk after a week of building. The volume flag is separate because it is the one that loses data.

Falls back to sh, since slim images often have no bash.

Makes the app wait until Postgres actually answers, not merely until its container has started.

Prints the size each layer adds, which usually points straight at the offending RUN line.