Docker

Docker Skill

Load this skill when working with containers, Dockerfiles, or docker-compose.

---

Rule

ALWAYS FOLLOW DOCKER BEST PRACTICES!

When creating Dockerfiles or compose files:

• Use multi-stage builds
• Run as non-root user
• Minimize image size
• Leverage layer caching

---

Dockerfile Best Practices

Multi-Stage Build

# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# Production stage
FROM node:20-alpine AS production
WORKDIR /app

# Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001

# Copy only necessary files
COPY --from=builder /app/node_modules ./node_modules
COPY --chown=nodejs:nodejs . .

USER nodejs
EXPOSE 3000
CMD ["node", "dist/index.js"]

Layer Caching Order

# GOOD: Dependencies first (rarely change)
COPY package*.json ./
RUN npm ci
COPY . .

# BAD: Everything together (breaks cache)
COPY . .
RUN npm ci

Security Hardening

# Non-root user
RUN addgroup -g 1001 -S appgroup && \
    adduser -S appuser -u 1001
USER appuser

# Read-only filesystem
# Use in docker-compose: read_only: true

# No new privileges
# Use in docker-compose: security_opt: - no-new-privileges:true

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

---

Docker Compose Patterns

Development Setup

version: '3.8'

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile.dev
    volumes:
      - .:/app
      - /app/node_modules
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
    depends_on:
      db:
        condition: service_healthy

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: dev
      POSTGRES_PASSWORD: dev
      POSTGRES_DB: app_dev
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U dev -d app_dev"]
      interval: 5s
      timeout: 5s
      retries: 5

volumes:
  postgres_data: