Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Sichere ProgrammierungWhy Claude Code keeps writing shell commands that fail on your Mac(20.09.2026 um 21:06 Uhr)
Sichere Programmierungllms.txt v2: What the Spec Says, and What 137,000 Domains Show(20.09.2026 um 21:17 Uhr)
Sicherheitslücken (CVE)NiceTryGPT: Less pattern matching. More actual hacking.(20.09.2026 um 21:19 Uhr)
IT Security VideoActivities BoF (kde2026)(20.09.2026 um 00:00 Uhr)
IT Security Toolsirdoc-app(20.09.2026 um 20:33 Uhr)
Sichere ProgrammierungWhy Claude Code keeps writing shell commands that fail on your Mac(20.09.2026 um 21:06 Uhr)
Sichere Programmierungllms.txt v2: What the Spec Says, and What 137,000 Domains Show(20.09.2026 um 21:17 Uhr)
Sicherheitslücken (CVE)NiceTryGPT: Less pattern matching. More actual hacking.(20.09.2026 um 21:19 Uhr)
IT Security VideoActivities BoF (kde2026)(20.09.2026 um 00:00 Uhr)
IT Security Toolsirdoc-app(20.09.2026 um 20:33 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

Docker ARG vs ENV: Understanding Build-time and Runtime Variables

Reagiere als Erste:r — dein Feedback zählt!

Are you confused about when to use ARG versus ENV in your Dockerfiles? You're not alone! This comprehensive guide will help you understand the key differences, use cases, and best practices for both build arguments (ARG) and environment variables (ENV) in Docker.

Quick Reference

Feature ARG ENV
Available during build
Available in running container
Can be set in Dockerfile
Can be overridden at build time
Persists in final image
Can be used in FROM instruction

Key Differences

The fundamental difference between ARG and ENV lies in their scope and persistence:

  • ARG is only available during the build process
  • ENV sets environment variables that persist in the running container

Understanding ARG

Build arguments (ARG) are variables that you can pass to Docker during the image build process using the --build-arg flag.

Basic ARG Syntax

# Declare the argument
ARG VERSION=latest

# Use the argument
FROM ubuntu:${VERSION}

Build command:

docker build --build-arg VERSION=20.04 -t my-ubuntu .

ARG Scoping Rules

  1. ARGs declared before FROM are only available during FROM instruction
  2. To use ARG after FROM, you need to redeclare it
  3. Each FROM instruction clears all ARGs declared before it
# Global ARG
ARG BASE_IMAGE=ubuntu

# Available in FROM
FROM ${BASE_IMAGE}:latest

# Need to redeclare to use after FROM
ARG BASE_IMAGE
RUN echo "Building from ${BASE_IMAGE}"

Understanding ENV

Environment variables (ENV) are set in your image and are available both during build and when the container runs.

Basic ENV Syntax

# Set a single environment variable
ENV APP_VERSION=1.0.0

# Set multiple environment variables
ENV NODE_ENV=production \
    PORT=3000 \
    APP_HOME=/app

ENV Persistence

ENVs persist across build stages and in the final container:

# Stage 1: Build
FROM node:16 AS builder
ENV NODE_ENV=production
RUN echo "Building in ${NODE_ENV}"

# Stage 2: Runtime
FROM node:16-slim
# NODE_ENV needs to be redefined if needed in this stage
ENV NODE_ENV=production

Real-World Examples

1. Building Different Versions of an Application

# Build argument for version control
ARG NODE_VERSION=16

# Base image with specified version
FROM node:${NODE_VERSION}

# Environment variable for runtime configuration
ENV NODE_ENV=production

# Redeclare ARG if needed after FROM
ARG NODE_VERSION
RUN echo "Node.js version: ${NODE_VERSION}"

# Application setup
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .

# Runtime configuration
ENV PORT=3000 \
    APP_NAME=my-awesome-app

CMD ["npm", "start"]

2. Configurable Build Process

# Build-time configuration
ARG INSTALL_DEV_DEPS=false
ARG ENABLE_TESTING=false

FROM node:16

WORKDIR /app
COPY package*.json ./

# Redeclare ARGs after FROM
ARG INSTALL_DEV_DEPS
ARG ENABLE_TESTING

# Conditional installation of dependencies
RUN if [ "$INSTALL_DEV_DEPS" = "true" ]; then \
        npm install; \
    else \
        npm install --production; \
    fi

COPY . .

# Conditional testing
RUN if [ "$ENABLE_TESTING" = "true" ]; then \
        npm test; \
    fi

# Runtime configuration
ENV NODE_ENV=production \
    LOG_LEVEL=info

CMD ["npm", "start"]

Best Practices

  1. Use ARG for Build Flexibility

    • Version numbers
    • Base image selection
    • Build-time configuration
  2. Use ENV for Runtime Configuration

    • Application settings
    • Service endpoints
    • Feature flags
  3. Default Values

   # Provide sensible defaults for ARGs
   ARG VERSION=latest
   ARG NODE_ENV=production

   # ENVs should also have defaults
   ENV PORT=3000 \
       LOG_LEVEL=info
  1. Documentation
   # Document your build arguments
   # Required: VERSION - Specify the application version to build
   # Optional: NODE_ENV - Build environment (default: production)
   ARG VERSION
   ARG NODE_ENV=production
  1. Security Considerations
    • Never use ARG or ENV for secrets
    • Use Docker secrets or environment files for sensitive data
    • Remember that ENVs are visible in the image history

Common Pitfalls

  1. ARG Scope Confusion
# Won't work as expected
ARG VERSION
FROM ubuntu:${VERSION}

# Need to redeclare
ARG VERSION
RUN echo ${VERSION}
  1. Build-time vs Runtime Values
# Wrong: Using ARG for runtime configuration
ARG API_URL=http://api.example.com

# Correct: Use ENV for runtime configuration
ENV API_URL=http://api.example.com
  1. Missing Defaults
# Risky: No default value
ARG VERSION

# Better: Include a default
ARG VERSION=latest

Advanced Usage

Combining ARG and ENV

# Build argument with default
ARG NODE_ENV=production

# Set ENV based on ARG
ENV NODE_ENV=${NODE_ENV}

# Now NODE_ENV persists in the container
# but can be configured at build time

Multiple Build Stages

# Build stage
FROM node:16 AS builder
ARG BUILD_MODE=production
ENV NODE_ENV=${BUILD_MODE}
RUN npm install && npm run build

# Production stage
FROM node:16-slim
ARG BUILD_MODE=production
ENV NODE_ENV=${BUILD_MODE}
COPY --from=builder /app/dist ./dist

Using Docker Compose

services:
  app:
    build:
      context: .
      args:
        - NODE_VERSION=16
        - BUILD_MODE=development
    environment:
      - NODE_ENV=development
      - PORT=3000

Conclusion

Understanding the difference between ARG and ENV is crucial for building flexible and maintainable Docker images. Use ARG for build-time configuration and ENV for runtime settings. Remember that ARGs are only available during build, while ENVs persist in the running container.

By following these guidelines and best practices, you can create more maintainable and configurable Docker images while avoiding common pitfalls.

Additional Resources

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Docker ARG vs ENV: Understanding Build-time and Runtime Variables

Thematisch verwandte Begriffe: Docker, Understanding, Buildtime, Runtime · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-93956 | A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by thi…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick