What You Learned

A Dockerfile is read top to bottom, each instruction changing the filesystem the one above it left.
RUN happens at build time, CMD at start time.
docker build -t name:tag . names the result; the . is the context COPY reads from.
A tag is a label on an image id, not a version and not a promise.
latest means whatever was pushed without a tag, which is why it is worth naming one.