skills.rest
DeepSpaceCartel
DeepSpaceCartelOFFICIAL
Explore all skills by this author →
WebsiteGitHub

container-images

Write and review Dockerfiles and OCI container image builds following Docker best practices.

Updated Sep 9, 2026
Search Tags:#docker#dockerfile#oci#buildkit#container images#multi-stage build#image security
One-click install
npx skills add https://github.com/DeepSpaceCartel/skills --skill container-images-deepspacecartel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: container-images
Source: https://github.com/DeepSpaceCartel/skills/tree/main/skills/container-images
Command: npx skills add https://github.com/DeepSpaceCartel/skills --skill container-images-deepspacecartel

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Dockerfiles often produce bloated, insecure, or non-reproducible images because of poor layer ordering, leaked build secrets, root processes, and unpinned base images. This Skill provides the rules and reference material to write and review Dockerfiles that are correct, secure, and small. ## Core Features & Use Cases - Dockerfile authoring guidance: Covers instruction ordering for build-cache efficiency, multi-stage builds, exec-form ENTRYPOINT/CMD for signal handling, .dockerignore, and OCI labels. - Security hardening: Enforces non-root users, minimal base images (distroless/alpine/scratch), digest pinning, BuildKit secret mounts instead of ARG/ENV/COPY, and SBOM/provenance attestations. - Use Case: When reviewing a pull request that adds a Dockerfile, use this Skill to catch secrets baked into layers, shell-form entrypoints that break graceful shutdown in Kubernetes, and missing digest pins on base images. ## Quick Start Review my Dockerfile and tell me how to make the image smaller, more secure, and reproducible.

Frequently Asked Questions about container-images

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a Dockerfile with multi-stage builds?▼

Define multiple FROM stages, build artifacts in an early stage, and COPY --from=<stage> only the artifacts into a minimal final stage. Only the final stage ships, keeping compilers and package managers out of the runtime image.

How do I pass secrets to a Docker build safely?▼

Use BuildKit secret mounts: RUN --mount=type=secret,id=npmrc,target=/root/.npmrc with docker build --secret id=npmrc,src=$HOME/.npmrc. ARG, ENV, and COPY all persist the value in layers or image config and must never hold secrets.

Should I use ENTRYPOINT exec form or shell form?▼

Use the exec form, e.g. ENTRYPOINT ["node", "dist/index.js"]. The shell form wraps the process in /bin/sh -c, which does not forward SIGTERM, breaking graceful shutdown in Docker and Kubernetes.

What base image should I use for a smaller container?▼

Pick the smallest base that runs your app: scratch for static binaries, distroless for compiled apps, alpine for a tiny shell, or -slim Debian variants for glibc-dependent runtimes. Pin the version tag and digest for reproducibility.

Why is my Docker build cache not being reused?▼

A changed layer invalidates every later layer, so copy dependency manifests and install dependencies before copying source code. Use BuildKit cache mounts for package manager caches and --progress=plain to see where cache misses occur.

Does Docker HEALTHCHECK work in Kubernetes?▼

No, Kubernetes ignores Dockerfile HEALTHCHECK and uses its own liveness and readiness probes. Configure probes in the pod spec and keep health endpoints cheap and dependency-free.

Related Skills

Explore More Software Engineering Skills→
cyberpunk042cyberpunk042

foundation-deps

Install and pin dependencies across Python, Node, Rust, and Go projects.

Community
Intermediate
maruakshaymaruakshay
4

container-ai-workload-security

Audit Kubernetes AI workload deployments for container security risks and misconfigurations.

Community
Advanced
xalgordxalgord
954

securing-container-registry-images

Secures container registry images with vulnerability scanning, signing, and CI/CD enforcement gates.

Community
Intermediate
JylhisJylhis
1

nix-containers

Build reproducible OCI and NixOS container images with Nix.

Community
Advanced