Deploy with a Dockerfile

What we detect

A file named Dockerfile at the root of the repository. Nothing else is detected yet: there are no framework presets, and a repository without a Dockerfile is refused before the build starts.

What your app must do

• Listen on the port in the PORT environment variable, on all interfaces (0.0.0.0).
• Read settings from environment variables. Secrets arrive the same way and are never written into the image.
• Keep secrets out of the repository. The build runs a secret scan, and any finding fails it, whatever your ignore files say.
• Avoid CRITICAL vulnerabilities in the image. They fail the build unless a time-limited waiver covers them.

Example: a Node.js server

FROM node:24-slim
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
ENV NODE_ENV=production
USER node
CMD ["node", "server.js"]

import { createServer } from 'node:http';

const port = Number(process.env.PORT ?? 3000);
createServer((req, res) => res.end('ok')).listen(port, '0.0.0.0');

Example: a Python app

FROM python:3.13-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["sh", "-c", "uvicorn main:app --host 0.0.0.0 --port ${PORT}"]

What happens next

The build is signed and gets a bill of materials. Deploying it is a change in a plan; see Deploys and the build pipeline and Plans and approvals.