Why build wheels in a separate stage?

The builder stage compiles every dependency into wheels, then the runtime stage installs them with --no-index. This keeps the C compilers and build headers out of the final image while still supporting packages that need compilation.

Why use the slim base image instead of alpine?

python:slim is Debian-based and works with the manylinux wheels that most Python packages ship, avoiding the musl-libc incompatibilities and slow source builds that alpine often triggers for packages like numpy or psycopg.

Why run as a non-root user?

The Dockerfile creates a dedicated app user and switches to it before running your code. If the app or a dependency is compromised, the attacker does not get root inside the container, which is a baseline container-security practice.

What command does it use for each framework?

FastAPI uses uvicorn binding to 0.0.0.0, while Flask and Django use gunicorn with the appropriate app or wsgi target. You can override the start command if your module path or server differs from the defaults.

What files does the build expect?

It expects a requirements.txt at the project root for dependencies. Add a .dockerignore listing __pycache__, .venv, .git and .env so caches and secrets stay out of the image.

Dockerfile Builder for Python

Email me this result

Get this tool's output sent to your inbox, plus one useful tool a week. No spam, unsubscribe any time.

A builder for a lean, multi-stage Dockerfile for Python web apps — FastAPI, Flask or Django. Choose your Python version, framework and port, and the tool emits an image that builds dependency wheels in one stage and ships a slim runtime that runs as a non-root user.

How it works

The generated Dockerfile uses two stages. The builder stage runs pip wheel to compile every dependency from requirements.txt into a /wheels directory, keeping compilers and headers out of the final image. The runtime stage installs those pre-built wheels with pip install --no-index --find-links=/wheels, sets PYTHONUNBUFFERED=1 and PYTHONDONTWRITEBYTECODE=1, creates a dedicated non-root app user, copies your code, exposes the port and defines an ENTRYPOINT.

Framework start commands

FastAPI is served with uvicorn app.main:app --host 0.0.0.0, Flask with gunicorn --bind 0.0.0.0:PORT app:app, and Django with gunicorn --bind 0.0.0.0:PORT myproject.wsgi:application. Override the start command if your module path differs. The optional HEALTHCHECK calls your /health endpoint using the standard-library urllib, so it adds no extra dependency.

Tips

Keep dependencies in a pinned requirements.txt so builds are reproducible. Add a .dockerignore so caches and secrets are not baked into the image:

__pycache__
*.pyc
.venv
.git
.env

The Debian-based slim base image is chosen deliberately: it works with the prebuilt manylinux wheels most packages ship, avoiding the slow source builds and musl-libc issues common with alpine.