$ dockergen
Multi-stage Dockerfile for your stack. Minimal final image, non-root user.
parameters
Why it's built this way
Multi-stage — the compiler and build deps stay in the build layer; only the artifact ships. For Go that's 800 MB vs 15.
Non-root — a container process under UID 0 becomes root on the node after a container escape. USER nonroot closes a whole class of problems for free.
Dependency cache — manifests (go.mod, package.json, requirements.txt) are copied before sources: while deps are unchanged, their layer comes from cache.