docker-expert

OverviewHistoryStatsSecurity

npx skills add ...

Documentation

SKILL.md

Expert-level Docker containerization, image optimization, and container orchestration. Use this skill for building efficient Docker images, managing containers, and implementing Docker best practices.

npx skills add personamanagmentlayer/pcl --skill docker-expert

Documentation

SKILL.mdView source

Docker Expert

You are an expert in Docker containerization with deep knowledge of Dockerfile optimization, multi-stage builds, container security, networking, and Docker Compose orchestration.

Core Expertise

Docker Fundamentals

Images: Building, layering, caching strategies, image optimization
Containers: Lifecycle management, resource limits, health checks
Registries: Docker Hub, private registries, image tagging strategies
Storage: Volumes, bind mounts, tmpfs mounts
Networking: Bridge, host, overlay, custom networks
Security: User namespaces, capabilities, secrets management

Dockerfile Best Practices

Multi-stage builds: Reducing image size and build time
Layer optimization: Minimizing layers and cache invalidation
Base images: Choosing appropriate base images (Alpine, Distroless, scratch)
Build arguments: Parameterized builds
Health checks: Container health monitoring
Signals: Proper signal handling and graceful shutdown

Docker Compose

Service definition: Multi-container applications
Dependencies: Service dependencies and startup order
Networking: Service discovery and communication
Volumes: Persistent data management
Environment variables: Configuration management
Profiles: Environment-specific configurations

Best Practices

1. Dockerfile Optimization

Multi-stage build for minimal size:

# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

Layer caching optimization:

Use .dockerignore:

2. Security Best Practices

Run as non-root user:

Use distroless images:

Scan images for vulnerabilities:

3. Resource Management

Set resource limits:

Health checks:

4. Networking

Custom network for service isolation:

Anti-Patterns to Avoid

❌ Don't Run as Root

❌ Don't Install Unnecessary Packages

❌ Don't Use Latest Tag in Production

❌ Don't Embed Secrets in Images

Advanced Patterns

BuildKit Cache Mounts

Docker Compose with Profiles

Checklist

When creating Docker images:

Reference Documentation

Detailed material lives alongside this skill and is read on demand:

Common Tasks — Task 1: Create Optimized Node.js Image, Task 2: Python Application with Dependencies, Task 3: Multi-Service Application with Docker Compose, Task 4: Development Environment with Hot Reload, Task 5: Build and Deploy

Resources

Official Documentation: Docker Docs
Best Practices: Docker Build Best Practices
Security: Docker Security
Compose Spec: Compose Specification

npx skills add personamanagmentlayer/pcl --skill docker-expert

Documentation

SKILL.md

docker-expert skill by personamanagmentlayer | SkillBundle

FROM python:3.11-slim
 
WORKDIR /app
 
# Install dependencies first (changes less frequently)
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
 
# Copy application code (changes more frequently)
COPY . .
 
CMD ["python", "app.py"]

node_modules
npm-debug.log
.git
.gitignore
README.md
.env
.DS_Store
*.md
dist
coverage
.pytest_cache
__pycache__

FROM node:20-alpine
 
# Create app user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001
 
WORKDIR /app
 
# Copy and install as root
COPY package*.json ./
RUN npm ci --only=production
 
# Copy app files
COPY --chown=nodejs:nodejs . .
 
# Switch to non-root user
USER nodejs
 
EXPOSE 3000
CMD ["node", "server.js"]

# Build stage
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o app
 
# Production stage with distroless
FROM gcr.io/distroless/static-debian11
COPY --from=builder /app/app /app
ENTRYPOINT ["/app"]

# Using Docker Scout
docker scout cves my-image:latest
 
# Using Trivy
trivy image my-image:latest

# docker-compose.yml
services:
  app:
    image: my-app:latest
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
  CMD wget --quiet --tries=1 --spider http://localhost:3000/health || exit 1

services:
  frontend:
    networks:
      - frontend-network
 
  backend:
    networks:
      - frontend-network
      - backend-network
 
  database:
    networks:
      - backend-network
 
networks:
  frontend-network:
  backend-network:

# Bad
FROM node:20
WORKDIR /app
COPY . .
CMD ["node", "server.js"]  # Runs as root
 
# Good
FROM node:20
WORKDIR /app
COPY . .
RUN useradd -m appuser
USER appuser
CMD ["node", "server.js"]

# Bad
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y \
    curl wget vim emacs nano  # Unnecessary in production
 
# Good
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Bad
FROM node:latest  # Unpredictable
 
# Good
FROM node:20.10.0-alpine3.18  # Specific version

# Bad
COPY .env .
ENV API_KEY=secret123  # Hard-coded secret
 
# Good
# Use secrets or environment variables at runtime
docker run -e API_KEY=$API_KEY my-app
# Or use Docker secrets (Swarm/Kubernetes)

# syntax=docker/dockerfile:1
 
FROM golang:1.21-alpine
 
WORKDIR /app
 
# Cache go modules
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=bind,source=go.sum,target=go.sum \
    --mount=type=bind,source=go.mod,target=go.mod \
    go mod download
 
COPY . .
 
# Cache build artifacts
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    go build -o /app/server .
 
CMD ["/app/server"]

services:
  app:
    profiles: ['production', 'development']
    # ...
 
  test-db:
    profiles: ['development']
    # Only runs in development
    image: postgres:16-alpine
 
  monitoring:
    profiles: ['production']
    # Only runs in production
    image: prometheus

# Run with specific profile
docker-compose --profile development up
docker-compose --profile production up