Add documentation for intermediate Docker layers in a workspace (#16787)

docs/guides/integration/docker.md

@@ -424,10 +424,39 @@ _contents_ are not copied into the image until the final `uv sync` command.
 
 !!! tip
 
-    If you're using a [workspace](../../concepts/projects/workspaces.md), then use the
+    If you want to remove additional, specific packages from the sync,
-    `--no-install-workspace` flag which excludes the project _and_ any workspace members.
+    use `--no-install-package <name>`.
 
-    If you want to remove specific packages from the sync, use `--no-install-package <name>`.
+#### Intermediate layers in workspaces
+
+If you're using a [workspace](../../concepts/projects/workspaces.md), then a couple changes are
+needed:
+
+- Use `--frozen` instead of `--locked` during the initially sync.
+- Use the `--no-install-workspace` flag which excludes the project _and_ any workspace members.
+
+```dockerfile title="Dockerfile"
+# Install uv
+FROM python:3.12-slim
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+WORKDIR /app
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    uv sync --frozen --no-install-workspace
+
+ADD . /app
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --locked
+```
+
+uv cannot assert that the `uv.lock` file is up-to-date without each of the workspace member
+`pyproject.toml` files, so we use `--frozen` instead of `--locked` to skip the check during the
+initial sync. The next sync, after all the workspace members have been copied, can still use
+`--locked` and will validate that the lockfile is correct for all workspace members.
 
 ### Non-editable installs