skills.rest
jeje-it
jeje-itCOMMUNITY
Explore all skills by this author →
GitHub

docker-best-practices

Applies Docker best practices for Dockerfiles, images, containers, and Compose deployments.

Updated Aug 2, 2026
Search Tags:#devops#docker#container security#containers#dockerfile#docker-compose#multi-stage build
One-click install
npx skills add https://github.com/jeje-it/template-projet --skill docker-best-practices-jeje-it
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: docker-best-practices
Source: https://github.com/jeje-it/template-projet/tree/main/.agents/skills/docker-best-practices
Command: npx skills add https://github.com/jeje-it/template-projet --skill docker-best-practices-jeje-it

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Writing Dockerfiles and Compose configurations that are secure, small, and reproducible requires knowing many scattered rules about base images, layer caching, secrets, and runtime hardening. This Skill consolidates current Docker best practices so containers are built and run correctly the first time. ## Core Features & Use Cases - Dockerfile Authoring: Guides base image selection (Wolfi, Alpine, distroless, slim), multi-stage builds, layer ordering for cache efficiency, and .dockerignore hygiene. - Runtime Hardening: Covers non-root users, dropped capabilities, read-only filesystems, resource limits, health checks, logging rotation, and restart policies. - Compose & Production: Provides Compose patterns for network isolation, env files, dependency health conditions, secrets management, image tagging, backups, and rolling updates. - Use Case: When containerizing a Node.js API for production, use this Skill to produce a multi-stage Dockerfile with a pinned Alpine base, non-root user, HEALTHCHECK, and a Compose stack with resource limits and isolated networks. ## Quick Start Ask the assistant to write a production-ready Dockerfile and docker-compose.yml for your application following Docker best practices.

Frequently Asked Questions about docker-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a production-ready Dockerfile?▼

Use a pinned minimal base image like node:20-alpine, order layers from least to most frequently changing, and use multi-stage builds to exclude build tools. Run as a non-root user, add a HEALTHCHECK, and never store secrets in layers.

What is the best base image for Docker containers?▼

The recommended hierarchy is Wolfi/Chainguard images for zero-CVE goals, Alpine for minimal size around 7MB, distroless for no shell, and slim variants for balance. Always pin exact versions and avoid the latest tag.

How do multi-stage builds reduce Docker image size?▼

Multi-stage builds separate build dependencies from runtime by compiling in a builder stage and copying only artifacts into the final stage. This removes compilers and dev tools, producing smaller images with fewer attack vectors.

How do I handle secrets in Docker containers?▼

Never put secrets in ENV instructions or image layers since they persist in history. Use Docker secrets in Swarm mode, mount secret files at runtime as read-only volumes, or pass environment files with --env-file kept out of version control.

Why is my Docker build slow and how do I fix it?▼

Slow builds usually come from poor layer ordering that invalidates cache. Copy dependency manifests before source code, enable BuildKit, and use cache mounts for package managers so unchanged dependencies are reused.

Should I run Docker containers as root?▼

No, containers should run as a non-root user to limit damage from compromise. Combine this with dropped capabilities, a read-only filesystem, no-new-privileges, and resource limits for defense in depth.

Related Skills

Explore More Software Engineering Skills→
fedickinsonfedickinson

full-stack-setup

Set up a local development environment with Python, Node.js, and SQLite database initialization.

Community
Advanced
MaelwalserMaelwalser

deployment-patterns

Orchestrate deployment workflows and rollback procedures for production applications.

Community
Advanced
xalgordxalgord
954

scanning-containers-with-trivy-in-cicd

Integrates Trivy container vulnerability scanning into CI/CD pipelines with severity-based quality gates.

Community
Intermediate
AI-Strategy-LLCAI-Strategy-LLC

Container App Deploy

Build and push container images to registries with preflight validation and vulnerability scanning.

Official
Intermediate