The solution is to use ONBUILD to register advance instructions to run later, during the next build stage.

Why is this useful? Well, it allows you to create a base image, add a ONBUILD ADD <path_to_code> and ONBUILD RUN <path_to_code>, and the ADD instruction won't occur until you build another image which inherits from this image. Thus, we circumvent having to rebuild the entire image, from the base up, every time we add new data. All instructions which depend on, say, the source code we simply prefix with ONBUILD and they will be executed in the same order, on the "child builds".

See here for the reference.

Docker creates several environment variables when you link containers. Docker automatically creates environment variables in the target container based on the --link parameters. It will also expose all environment variables originating from Docker from the source container.

Docker sets an <alias>_NAME environment variable for each target container listed in the --link parameter.

Docker also defines a set of environment variables for each port exposed by the source container. Each variable has a unique prefix in the form:

<name>_PORT_<port>_<protocol>

Check this out! Basically it goes as follows:

1. Copy secret-keys into image
2. Perform actions which require the secrets
3. Delete secrets

4. Squash the image using docker-squash with the following cmd:

   docker save <image id> | sudo docker-squash -t newtag | docker load
   

   Of course you have to install docker-squash first.