A Node.js API image had grown to 1.1 GB, slowing every deploy and autoscaling event. Step by step, we measured where the size came from, moved to a multi-stage build, chose a base image deliberately and cleaned the build context, ending at 96 MB, with the trade-offs of each step.
We swapped Docker for rootless Podman on a small RHEL host and the stack failed twice: rootlessport refused port 80, then PostgreSQL could not write its bind-mounted data directory. Both come from running without root: unprivileged ports, user namespaces and SELinux labels.
Why does deleting a file in a later Dockerfile step not shrink the image? Why is the first write to a large file inside a container slow? A hands-on explanation of image layers and overlayfs, built with mount commands you can run yourself, and what it means for images and databases.