The layer-ordering point is the one that saves real time. Put the dependency install before the code copy and most rebuilds stop reinstalling everything after a one-line change. The .dockerignore point belongs right next to it — I've seen a stray .env or a huge local folder quietly shipped into an image more than once. And the exec-form CMD note is easy to overlook until a deploy hangs because SIGTERM never reaches the app.