How do I properly convey a layer is "later" than another layer.
Consider the following Dockerfile:
FROM ubuntu:15.10
COPY . /app
RUN make /app
CMD python /app/app.py
This Dockerfile contains four commands, each of which creates a layer.
How do I describe the RUN layer is later than the COPY layer? Context being, later layers that install patches may mitigate vulnerabilities that are introduced in earlier layers.
In Code
In code, the CMD layer is the bottom layer. Hence, in code, the lower a layer is, the later it is.
Docker overview docs
There is only a reference to a "final" layer.
About images, containers, and storage drivers | Docker Documentation,
Docker references layers that supersede other layers in the following ways:
- last
- on top
- before
Docker image shows later images as "higher"
