Docker

Diagnose and harden Docker containers, images, Compose stacks, networking, and volumes.

39|1|Updated Jul 2, 2026
One-click install
npx skills add https://github.com/HKU-MMLab/UniClawBench --skill docker-hku-mmlab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Docker
Source: https://github.com/HKU-MMLab/UniClawBench/tree/main/injection/101_skill_usage/task_101_10_docker_audit/skills/docker
Command: npx skills add https://github.com/HKU-MMLab/UniClawBench --skill docker-hku-mmlab

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Docker work is full of silent traps: unpinned image tags break reproducible builds, depends_on starts containers before services are ready, secrets baked into layers leak through image history, and unbounded logs fill host disks. This Skill provides operational guidance and trap catalogs so agents handle containers, images, Compose stacks, networking, and volumes correctly by default. ## Core Features & Use Cases - Container & Image Operations: Essential commands for lifecycle management, builds, publishing, and cleanup, plus Dockerfile patterns covering layer caching, multi-stage builds, and COPY vs ADD pitfalls. - Compose Orchestration: Guidance on healthcheck-based dependencies, .env file placement, volume mount behavior, and network DNS between services. - Security & Production Hardening: Non-root users, BuildKit secret mounts, resource limits, log rotation, and supply-chain verification for base images. - Use Case: When a container exits with code 137, consult the debugging guidance to identify an OOM kill, then apply memory limits and log rotation to prevent recurrence. ## Quick Start Use the Docker skill to review my docker-compose.yml and Dockerfile for common traps before I deploy to production.

Frequently Asked Questions about Docker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I debug a Docker container that keeps exiting?▼

Check the exit code with `docker inspect --format='{{.State.ExitCode}}'` and read logs even from stopped containers via `docker logs <container>`. Exit code 137 indicates an OOM kill and 139 indicates a segfault.

How do I make Docker Compose wait for a service to be ready?▼

Use `depends_on` with `condition: service_healthy` and define a healthcheck for the dependency. Plain `depends_on` only waits for the container to start, not for the service inside to accept connections.

Why is my Docker build cache invalidated on every code change?▼

Running `COPY . .` before dependency installation invalidates the cache whenever any file changes. Copy requirement files first, install dependencies, then copy application code to preserve cached layers.

Can I pass secrets to a Docker build with ARG or ENV?▼

No. ARG and ENV values remain visible in `docker history` and `docker inspect`. Use BuildKit secret mounts with `RUN --mount=type=secret` so secrets never persist in image layers.

Why can't my containers resolve each other by name?▼

Container name resolution only works on user-defined networks, not the default bridge. Attach containers to a custom network and use Compose service names as DNS hostnames.