Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jenreh/appkit/docker-multi-stagenpx skills add jenreh/appkit --skill docker-multi-stagegit clone --depth 1 https://github.com/jenreh/appkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00056 | $0.02071 |
| Opus 5 | $0.00028 | $0.01035 |
| Sonnet 5 | $0.00011 | $0.00414 |
| Haiku 4.5 | $0.00006 | $0.00207 |
Grade B, and why
docker-multi-stage scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
&& rm -rf /var/lib/apt/lists/* Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
&& apt-get install -y --no-install-recommends curl ca-certificates \ Copies of this mod
1 near-identical copy found in the catalogue:
- multi-stage-dockerfile — 100% identical, 10 lines differ
How it starts
The opening of the file, as written. The whole thing — 263 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Multi-Stage Dockerfiles
Quick reference
- Multi-stage builds — separate builder from runtime; copy only artifacts.
- Pin versions — use exact image tags (
python:3.13-slim-bookworm, notpython). - Minimize layers — combine
RUNcommands with&&; order from least→most changing. - Non-root user — always set
USERin the final stage. - Cache mounts — use
--mount=type=cachefor package manager caches. - Healthchecks — add
HEALTHCHECKfor production readiness.
Stage structure
dependencies → build → (test) → runtime
Use meaningful stage names with the AS keyword.
# ── Stage 1: Builder ──
FROM python:3.13-slim-bookworm AS builder
# install build deps, compile, fetch packages
# ── Stage 2: Runtime ──
FROM python:3.13-slim-bookworm AS runtime
# copy only runtime artifacts from builder
COPY --from=builder /app /app
Key rules
- Builder stage — install compilers, dev headers, build tools. Run
pip install,npm ci,cargo build, etc. - Runtime stage — start from a minimal base; copy only the built output, virtual env, or binary.
- Never install build-only tools (
gcc,make,node-gyp) in the runtime stage.
Base image selection
| Goal | Recommended base | Notes |
|---|---|---|
| Smallest possible | distroless / alpine |
No shell; harder to debug |
| Balance size + compat | *-slim variants |
Good default for Python, Node |
| Full tooling needed | *-bookworm / *-bullseye |
Use only in builder stage |
- Always pin to a specific tag:
python:3.13-slim-bookworm,node:22-alpine3.20. - Match builder and runtime base OS family when possible to avoid glibc mismatches.
Layer optimization
Order: stable → volatile
# 1. System deps (rarely change)
RUN apt-get update && apt-get install -y --no-install-recommends \
libpq-dev \
&& rm -rf /var/lib/apt/lists/*
# 2. Dependency manifests (change occasionally)
COPY pyproject.toml uv.lock ./
# 3. Install deps (cached unless manifests change)
RUN --mount=type=cache,target=/root/.cache/uv \
uv sync --frozen --no-install-project
# 4. Application code (changes frequently)
COPY . .
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 263 lines · 56 tokens per session scan B eaccaca35369
docker-multi-stage is a skill published in the GitHub repository jenreh/appkit (4 stars, last pushed 7d ago), licensed MIT. It adds 56 tokens to every session and 2,071 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tt-studio-overview
Project map for TT-Studio — what the platform is, where its docs live, its key components (React frontend, Django backend, FastAPI inference server, Docker), and the AI model types it supports. Use when you need a high-level orientation of the repo, want to know which doc covers a topic, or are trying to locate where…
lumina-infra-deploy
Work on Lumina deployment and infrastructure assets. Use when editing terraform/, aws/, docker-compose.yml, DEPLOYMENT.md, ADVANCEDDEPLOYMENTS.md, agenticai/deployments/, or other files related to Docker, Terraform, AWS or Azure rollout behavior, environment wiring, and release automation.
deployment-patterns
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications.
v8-jit
V8 JIT optimization patterns for writing high-performance JavaScript in Next.js server internals. Use when writing or reviewing hot-path code in app-render, stream-utils, routing, caching, or any per-request code path. Covers hidden classes / shapes, monomorphic call sites, inline caches, megamorphic deopt, closure…
deploy-docker-compose
Run the Omnigent server as a Docker compose stack (server + Postgres) on any Docker host — your laptop, a VPS, EC2 by hand, or as the base layer of any container-platform deploy. Invoke when the user wants to build the image, bring up the compose stack, debug the stack on a host they already have, or extend the stack…
reproduce-issue
The single skill for reproducing an nx issue. Given a GitHub issue number (human entry) OR explicit repro parameters (agent entry), it runs the reproduction ENTIRELY inside an isolated Docker sandbox — gVisor on Linux, the Docker VM on macOS — so the untrusted repro's install scripts and commands never execute on the…