Why might WORKDIR be safer than using RUN cd?

Each RUN instruction executes in its own subshell/layer; a cd inside one RUN does not persist to the next RUN instruction. WORKDIR, by contrast, is a Dockerfile-level setting that persists across all subsequent instructions (RUN, CMD, ENTRYPOINT, COPY, ADD) for the rest of that build stage, and it also creates the directory if it doesn't already exist.