docker

Name: docker
Author: sordi-ai

17stars3forks

How to install docker?

sordi-ai/skill-everything/docker

$npx -y skills add sordi-ai/skill-everything --skill docker

Installs into the current project.

Summary

Apply when writing or reviewing Dockerfiles, docker compose files, or container build pipelines. Covers layer caching, multi-stage builds, security hardening, and compose conventions.

Files · 1

View on GitHub

SKILL.md

1	# Sub-Skill: Docker / Container Conventions
2
3	Purpose: Prevent common container mistakes — busted layer caches, bloated images, insecure defaults, and compose misconfigurations — before they reach CI or production.
4
5	---
6
7	## Rules
8
9	### Layer Ordering & Cache
10
11	1. Dependency layer first. Always install dependencies in a separate layer before copying application source, so a source change does not invalidate the package cache. Reference: ERR-2026-020
12	2. Copy only what's needed early. Before copying the full source tree, copy only the dependency manifest files (e.g., `requirements.txt`, `package.json`, `pyproject.toml`) so the install layer is cached independently.
13	3. Minimise layer count. Prefer chaining related `RUN` commands with `&&` and `\` continuations rather than issuing one `RUN` per command; each `RUN` creates a new layer.
14	4. Order by change frequency. Always place instructions that change rarely (OS packages, global tools) before instructions that change often (app source, config files).
15
16	### Multi-Stage Builds
17
18	5. Use multi-stage for compiled artefacts. Always use a builder stage to compile or bundle, then copy only the final artefact into a minimal runtime stage; never ship build toolchains in the production image.
19	6. Name every stage. Use `AS <name>` on every `FROM` line so later stages and `docker build --target` calls are readable and stable.
20	7. Pin the runtime base image. Always pin base images to a specific digest or immutable tag (e.g., `python:3.12.3-slim`) in the runtime stage; never use `latest` in production Dockerfiles.
21
22	### Security
23
24	8. Run as non-root. Always create a dedicated non-root user and switch to it with `USER` before the final `CMD`/`ENTRYPOINT`; never run application processes as `root` inside a container.
25	9. Never embed secrets in image layers. Never pass secrets via `ARG` or `ENV` in a Dockerfile; use Docker BuildKit `--secret` mounts or runtime environment injection instead.
26	10. Scan images before push. Before pushing any image to a registry, run an image vulnerability scanner (e.g., `trivy image`, `docker scout`) and fail the pipeline on critical CVEs.
27	11. Prefix docker run -v from Git Bash with MSYS_NO_PATHCONV=1. Always prefix `docker run -v` calls issued from Git Bash or MSYS on Windows with `MSYS_NO_PATHCONV=1` to prevent path mangling. Reference: ERR-2026-013
28
29	### .dockerignore & Context
30
31	12. Maintain a .dockerignore. Always keep a `.dockerignore` at the repo root that excludes `.git`, test fixtures, local env files, and build artefacts; a large build context slows every build and may leak secrets.
32
33	### Health Checks & Signal Handling
34
35	13. Declare a HEALTHCHECK. Always add a `HEALTHCHECK` instruction so orchestrators (Compose, Kubernetes) can detect unhealthy containers without external probes.
36	14. Use exec-form ENTRYPOINT. Always write `ENTRYPOINT` in exec form (`["executable", "arg"]`) rather than shell form so the process receives OS signals directly and `docker stop` terminates it cleanly.
37
38	### Compose Conventions
39
40	15. Set resource limits in compose. Always declare `deploy.resources.limits` (CPU and memory) for every service in `docker-compose.yml` to prevent a runaway container from starving the host.
41	16. Use compose profiles for optional services. Prefer assigning optional services (e.g., observability stacks, seed jobs) to named `profiles` so `docker compose up` starts only the core services by default.
42	17. Isolate networks per stack. Avoid using the default bridge network across unrelated stacks; define explicit named networks and attach only the services that need to communicate.
43
44	---
45
46	## See also
47
48	- `skills/code-quality/SKILL.md` — general layering and change-frequency ordering principles
49	- `skills/review-deployment/SKILL.md` — deployment checklist that includes image scanning and migration ordering
50
51	---
52
53	## Notes
54
55	- ERR-2026-020 is the canonical reference for layer-cache busting caused by copying source before installing dependencies.
56	- ERR-2026-013 covers MSYS path mangling on Windows when using `docker run -v`.

People who liked this also viewed

6 picks

Type

microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026476k1.3k
azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026472k1.3k
azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026471k1.3k
azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026471k1.3k
azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026470k1.3k
azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026424k1.3k

docker

17stars3forks

View on GitHub

How to install docker?

sordi-ai/skill-everything/docker

$npx -y skills add sordi-ai/skill-everything --skill docker

Installs into the current project.

Summary

Apply when writing or reviewing Dockerfiles, docker compose files, or container build pipelines. Covers layer caching, multi-stage builds, security hardening, and compose conventions.

Files · 1

View on GitHub

SKILL.md

1	# Sub-Skill: Docker / Container Conventions
2
3	Purpose: Prevent common container mistakes — busted layer caches, bloated images, insecure defaults, and compose misconfigurations — before they reach CI or production.
4
5	---
6
7	## Rules
8
9	### Layer Ordering & Cache
10
11	1. Dependency layer first. Always install dependencies in a separate layer before copying application source, so a source change does not invalidate the package cache. Reference: ERR-2026-020
12	2. Copy only what's needed early. Before copying the full source tree, copy only the dependency manifest files (e.g., `requirements.txt`, `package.json`, `pyproject.toml`) so the install layer is cached independently.
13	3. Minimise layer count. Prefer chaining related `RUN` commands with `&&` and `\` continuations rather than issuing one `RUN` per command; each `RUN` creates a new layer.
14	4. Order by change frequency. Always place instructions that change rarely (OS packages, global tools) before instructions that change often (app source, config files).
15
16	### Multi-Stage Builds
17
18	5. Use multi-stage for compiled artefacts. Always use a builder stage to compile or bundle, then copy only the final artefact into a minimal runtime stage; never ship build toolchains in the production image.
19	6. Name every stage. Use `AS <name>` on every `FROM` line so later stages and `docker build --target` calls are readable and stable.
20	7. Pin the runtime base image. Always pin base images to a specific digest or immutable tag (e.g., `python:3.12.3-slim`) in the runtime stage; never use `latest` in production Dockerfiles.
21
22	### Security
23
24	8. Run as non-root. Always create a dedicated non-root user and switch to it with `USER` before the final `CMD`/`ENTRYPOINT`; never run application processes as `root` inside a container.
25	9. Never embed secrets in image layers. Never pass secrets via `ARG` or `ENV` in a Dockerfile; use Docker BuildKit `--secret` mounts or runtime environment injection instead.
26	10. Scan images before push. Before pushing any image to a registry, run an image vulnerability scanner (e.g., `trivy image`, `docker scout`) and fail the pipeline on critical CVEs.
27	11. Prefix docker run -v from Git Bash with MSYS_NO_PATHCONV=1. Always prefix `docker run -v` calls issued from Git Bash or MSYS on Windows with `MSYS_NO_PATHCONV=1` to prevent path mangling. Reference: ERR-2026-013
28
29	### .dockerignore & Context
30
31	12. Maintain a .dockerignore. Always keep a `.dockerignore` at the repo root that excludes `.git`, test fixtures, local env files, and build artefacts; a large build context slows every build and may leak secrets.
32
33	### Health Checks & Signal Handling
34
35	13. Declare a HEALTHCHECK. Always add a `HEALTHCHECK` instruction so orchestrators (Compose, Kubernetes) can detect unhealthy containers without external probes.
36	14. Use exec-form ENTRYPOINT. Always write `ENTRYPOINT` in exec form (`["executable", "arg"]`) rather than shell form so the process receives OS signals directly and `docker stop` terminates it cleanly.
37
38	### Compose Conventions
39
40	15. Set resource limits in compose. Always declare `deploy.resources.limits` (CPU and memory) for every service in `docker-compose.yml` to prevent a runaway container from starving the host.
41	16. Use compose profiles for optional services. Prefer assigning optional services (e.g., observability stacks, seed jobs) to named `profiles` so `docker compose up` starts only the core services by default.
42	17. Isolate networks per stack. Avoid using the default bridge network across unrelated stacks; define explicit named networks and attach only the services that need to communicate.
43
44	---
45
46	## See also
47
48	- `skills/code-quality/SKILL.md` — general layering and change-frequency ordering principles
49	- `skills/review-deployment/SKILL.md` — deployment checklist that includes image scanning and migration ordering
50
51	---
52
53	## Notes
54
55	- ERR-2026-020 is the canonical reference for layer-cache busting caused by copying source before installing dependencies.
56	- ERR-2026-013 covers MSYS path mangling on Windows when using `docker run -v`.

People who liked this also viewed

6 picks

Type