We have a Dockerfile that looks like this:
FROM python:3.9.2-buster as base
ENV PIP_DISABLE_PIP_VERSION_CHECK=1
RUN pip install pipenv
WORKDIR /app
COPY Pipfile .
COPY Pipfile.lock .
FROM base as dep
ARG CODEARTIFACT_AUTH_TOKEN
# For normal apps, the "--dev" param should be skipped.
# We only use it to test that we can install pips from nomono's private codeartifact feed
RUN pipenv install --system --deploy --dev
FROM base as final
COPY . .
COPY --from=dep /usr/local/lib/python3.9/site-packages /usr/local/lib/python3.9/site-packages
COPY --from=dep /usr/local/bin /usr/local/bin
basically the base image is the default the "dep" image takes a token which makes it possible to install packages (including packages from our private package feed) the "final" image copies from the "dep" image, so that the final image doesn't have the token.
THe token is re-generated on every CI/CD run. This causes the docker layer cache to be invalidated from ARG CODEARTIFACT_AUTH_TOKEN and down, which again causes the build to "physically" install packages on every build, instead of just loading them from the cache.
I'm trying to figure out how to best utilize the docker cache so that we get fast builds