Docker + Pipenv + multi-stage builds

Dockerfile

FROM alpine:3.9 AS build
WORKDIR /opt/app

# Install Python and external dependencies, including headers and GCC
RUN apk add --no-cache python3 python3-dev py3-pip libffi libffi-dev musl-dev gcc

# Install Pipenv
RUN pip3 install pipenv

# Create a virtual environment and activate it
RUN python3 -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH" VIRTUAL_ENV="/opt/venv"

# Install dependencies into the virtual environment with Pipenv
COPY Pipfile Pipfile.lock /opt/app/
RUN pipenv install --deploy

FROM alpine:3.9
WORKDIR /opt/app

# Install Python and external runtime dependencies only
RUN apk add --no-cache python3 libffi

# Copy the virtual environment from the previous image
COPY --from=build /opt/venv /opt/venv

# Activate the virtual environment
ENV PATH="/opt/venv/bin:$PATH" VIRTUAL_ENV="/opt/venv"

# Copy your application
COPY . /opt/app/

Why don't you copy the app from build at the end?

The app is never copied into the build image; only the Pipfile and Pipfile.lock are, which is enough to install the dependencies. This has a benefit to the layer cache, as it means if you change only your app (e.g. app.py) and not the Pipfile(.lock) only the very last statement needs to be run and you avoid reinstalling all the dependencies in the runtime image.

This makes sense. I guess if your "app" was a click application then app.py might just be a shell script invoking your CLI?