Dockerfile ADD vs COPY

Use COPY for the ordinary case of moving files from the build context into an image:

COPY package*.json ./
COPY src/ ./src/

ADD has extra behavior, including automatic extraction of certain local tar archives and support for remote sources. Those implicit behaviors can make a build less obvious and remote downloads harder to verify. Docker's guidance is to prefer COPY unless you specifically need an ADD feature.

Neither instruction can copy an arbitrary file outside the build context. Keep the context small with .dockerignore, and do not put secrets in files that become image layers. For a remote artifact, download it in a controlled build step, verify a checksum/signature, and understand that build arguments and layers may still expose data. A clear Dockerfile is usually safer than a shorter one.

Sources

• Docker documentation
• Docker CLI reference