Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/alivirgo/Major-AI-Skillsnpx agentmods add skills/alivirgo/major-ai-skills/dockerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alivirgo/major-ai-skills/docker)<a href="https://agentmods.dev/skills/alivirgo/major-ai-skills/docker"><img src="https://agentmods.dev/badge/skills/alivirgo/major-ai-skills/docker/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alivirgo/major-ai-skills/docker"><img src="https://agentmods.dev/badge/skills/alivirgo/major-ai-skills/docker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.02281 |
| Opus 5.5 | $0.00014 | $0.00912 |
| Sonnet 5.5 | $0.00007 | $0.00456 |
| Haiku 4.5 | $0.00003 | $0.00228 |
Grade A, and why
docker scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
CMD wget -qO- http://127.0.0.1:3000/health || exit 1 How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Docker Containers & Compose AI Skill Guide (Claude)
Overview & Engine Architecture
Docker packages apps as immutable images and runs them as ephemeral containers on a host engine (containerd/Moby). BuildKit builds images with cache mounts and multi-stage targets; Compose declares multi-container graphs on a single host. Agents should treat images as versioned artifacts (digest-pinned bases), Compose as startup-order contracts (not “wait forever”), and secrets as runtime mounts—never committed layers.
┌─────────────────────────────────────────────────────────────┐
│ Docker build → run loop │
│ │
│ Build (BuildKit / buildx) │
│ ├── Multi-stage: deps → build → runner (non-root) │
│ ├── Cache: lockfiles first; RUN --mount=type=cache │
│ └── SBOM/scan gate before push (pair with @trivy) │
│ │
│ Runtime │
│ ├── Namespaces: net / pid / mnt; USER in final stage │
│ ├── Volumes: named > bind (UID/GID traps on bind) │
│ └── HEALTHCHECK + Compose condition: service_healthy │
│ │
│ Compose orchestration (single host) │
│ ├── depends_on + healthcheck (startup only, not runtime) │
│ └── Internal DNS: <service> on user-defined network │
└─────────────────────────────────────────────────────────────┘
When to use / when not to
Use when
- Authoring Dockerfiles,
.dockerignore, andcompose.yamlfor local/staging parity. - Debugging “works on my machine” via container logs, healthchecks, and network aliases.
- Optimizing image size, layer cache, and non-root runtime hardening.
Do not use when
- You need multi-node scheduling, rolling updates, or cluster RBAC →
@kubernetes/@helm. - The task is host-level syslog/logging-driver plugins that must exist before any container starts on daemon reboot (Compose cannot order daemon-wide plugins) → host OS service instead.
- Someone asks to bake API keys into
ENVorARGdefaults → refuse; use secrets mounts or external secret stores (@vault).
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 21d ago Changed · +56 lines · +8 tokens per session e6c69fb9a15e
- 1mo ago Changed · -3 tokens per session d0a6a194127f
- 1mo ago First seen · 148 lines · 29 tokens per session scan A 86f4f00bbe32
docker is a skill published in the GitHub repository alivirgo/Major-AI-Skills (2 stars, last pushed today), licensed MIT. It adds 34 tokens to every session and 2,281 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
docker-expert
Build optimized, secure Docker images with multi-stage builds. Configure Docker Compose for full development and production stacks.
docker
Use when authoring or auditing a Dockerfile, shrinking a bloated image, hardening a container that runs as root, picking a base image, or wiring a Compose dev loop with hot reload. NOT CI builds or deploy-to-host (that is deployment), NOT k8s autoscaling (that is scaling), NOT app-level injection or secrets-in-code…
implementing-container-image-minimal-base-with-distroless
Reduce container attack surface by building application images on Google distroless base images that contain only the application runtime with no shell, package manager, or unnecessary OS utilities.
performing-container-security-scanning-with-trivy
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.
docker-compose
Containerização com Docker e Docker Compose: configuração para desenvolvimento com hot reload, produção com health checks, multi-stage builds, Docker networks e gestão de secrets e variáveis de ambiente.
docker-compose
Use when orchestrating multi-container Docker applications from a single declarative compose.yaml — defining services, networks, and volumes, then building, starting, and stopping them as one unit. Covers image/build, ports, volumes, environment, dependson, healthcheck, profiles, and the docker compose CLI.