Docker COPY vs ADD -- use COPY unless you need extraction

Docker ADD has implicit behaviors: it auto-extracts tar archives and can download URLs. This surprises developers and can introduce security issues.

Use COPY for all file copying in Dockerfiles. COPY is explicit and predictable -- it only copies files. Only use ADD when you specifically need tar extraction (ADD archive.tar.gz /app/ extracts automatically). Never use ADD for downloading URLs -- use RUN curl or RUN wget instead for better caching and error handling.

ADD was the original instruction and does too many things. COPY was added later as the simpler, predictable alternative. Docker best practices recommend COPY.