docker-composer

docker-composer is a skill for Claude Code, Codex from eddiebelaval/squire. It costs 37 tokens per session (4,032 once invoked), scanned C, original, MIT.

A guide for writing Dockerfiles and Docker Compose configurations. Docker packages an application and its dependencies into containers, while Compose coordinates several containers together.

In plain words
What is it for?
Use it to containerise applications, define services, configure networking and storage, create multi-stage builds, and prepare development or production setups.
Why use it?
It helps set up repeatable development environments and multi-container deployments while avoiding common configuration and security mistakes.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static.

Good fit Use it to containerise applications, define services, configure networking and storage, create multi-stage builds, and prepare development or production setups.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/eddiebelaval/squire
agentmods
npx agentmods add skills/eddiebelaval/squire/docker-composer

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for docker-composer

README.md
[![agentmods](https://agentmods.dev/badge/skills/eddiebelaval/squire/docker-composer/github.svg)](https://agentmods.dev/skills/eddiebelaval/squire/docker-composer)
Your own site
<a href="https://agentmods.dev/skills/eddiebelaval/squire/docker-composer"><img src="https://agentmods.dev/badge/skills/eddiebelaval/squire/docker-composer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for docker-composer

Your own site · 80×15
<a href="https://agentmods.dev/skills/eddiebelaval/squire/docker-composer"><img src="https://agentmods.dev/badge/skills/eddiebelaval/squire/docker-composer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 37 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,032 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00037 $0.04032
Opus 5 $0.00018 $0.02016
Sonnet 5 $0.00007 $0.00806
Haiku 4.5 $0.00004 $0.00403

Measured 8d ago against content hash 64df9dcbe862, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade C, and why

docker-composer scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

&& rm -rf /var/lib/apt/lists/*

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
skills/docker-composer/SKILL.md · 784 lines

How it starts

The opening of the file, as written. The whole thing — 784 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Docker Composer Skill

Core Workflows

Workflow 1: Primary Action

  1. Analyze the input and context
  2. Validate prerequisites are met
  3. Execute the core operation
  4. Verify the output meets expectations
  5. Report results

Overview

This skill helps you create efficient Docker configurations for development and production. Covers Dockerfiles, Docker Compose, multi-stage builds, networking, volumes, and container orchestration best practices.

Docker Philosophy

Container Principles

  1. One process per container: Keep containers focused
  2. Immutable infrastructure: Don't modify running containers
  3. Stateless containers: Store state in volumes or external services
  4. Minimal images: Smaller = faster + more secure

Best Practices

  • DO: Use multi-stage builds for production
  • DO: Pin specific versions for dependencies
  • DO: Use .dockerignore to exclude unnecessary files
  • DO: Run as non-root user
  • DON'T: Store secrets in images or Dockerfiles
  • DON'T: Use latest tag in production
  • DON'T: Install unnecessary packages

Dockerfile Patterns

Node.js Production Dockerfile

# Dockerfile
# ============================================
# Stage 1: Dependencies
# ============================================
FROM node:20-alpine AS deps
WORKDIR /app

# Install dependencies only when needed
COPY package.json package-lock.json ./
RUN npm ci --only=production

# ============================================
# Stage 2: Builder
# ============================================
FROM node:20-alpine AS builder
WORKDIR /app

COPY package.json package-lock.json ./
RUN npm ci

COPY . .

# Build application
ENV NEXT_TELEMETRY_DISABLED 1
RUN npm run build

# ============================================
# Stage 3: Runner (Production)
# ============================================
FROM node:20-alpine AS runner
WORKDIR /app

ENV NODE_ENV production
ENV NEXT_TELEMETRY_DISABLED 1

# Create non-root user
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs

# Copy built assets
COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static

USER nextjs

EXPOSE 3000

ENV PORT 3000
ENV HOSTNAME "0.0.0.0"

CMD ["node", "server.js"]

Read the full file on GitHub · 784 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 784 lines · 37 tokens per session scan C 64df9dcbe862

Subscribe to this mod's changes

docker-composer is a skill published in the GitHub repository eddiebelaval/squire (21 stars, last pushed 27d ago), licensed MIT. It adds 37 tokens to every session and 4,032 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.