That’s your app serve-able over a (free) fly.dev subdomain. That is, your Fly app would be accessible over the *.fly.dev subdomain assigned to it, if it uses Fly’s built-in HTTP and TLS handlers (which most Fly apps do).
# if Fly is setup to terminate TLS and handle HTTP, then
curl <subdomain-assigned-to-my-app>.fly.dev -I
# should output the same as
curl my.fly.app.domain.tld -I
Not really. You’d have to build the docker image each time. Fly does cache deps in its remote builders, so I take you’re covered if you’re pulling in dependencies via Docker itself (as opposed to, say, downloading deps via package managers like apt/apk/npm etc from within Docker).
You don’t have to sweat about it though; other than making sure the final stage of your multi-stage dockerfile is lean. Fly doesn’t yet charge for its docker builders and docker registry.
Just a guess: Is your main app process running as root? If not, try that.
Re: Surprise bills: See this thread: How concerned should I be about a surprise bill?