docker

Optimize Dockerfiles and Compose configurations for smaller, secure images.

Updated Mar 31, 2026
One-click install
npx skills add https://github.com/dotBeeps/hoard --skill docker-dotbeeps
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: docker
Source: https://github.com/dotBeeps/hoard/tree/main/morsels/skills/docker
Command: npx skills add https://github.com/dotBeeps/hoard --skill docker-dotbeeps

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides practical, opinionated patterns to build smaller, more secure, and maintainable container images while making Dockerfiles and Compose setups easier to debug and operate.

Core Features & Use Cases

  • Layer-order guidance to maximize cache hits when installing dependencies before copying application code.
  • Multi-stage build patterns to separate build tooling from runtime artifacts and reduce final image size.
  • Security and hardening advice: non-root users, minimal base images, read-only filesystems, and BuildKit secrets to avoid leaking credentials.
  • Compose best practices: healthchecks, named volumes versus bind mounts, profiles for environment-specific services, and restart policies.
  • Debugging and maintenance: image inspection, logs, exec shells, layer analysis, and integration with scanners like Trivy and Docker Scout.
  • Use case: optimize a Node.js, Python, or Go service for production by converting a development Dockerfile into a multi-stage, cache-efficient, non-root runtime image with healthchecks and CI-friendly build args.

Quick Start

Convert your existing Dockerfile to a multi-stage build, reorder layers so dependencies are installed before source, enable BuildKit cache mounts, and add a HEALTHCHECK and non-root user for production readiness.

Frequently Asked Questions about docker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I make my Dockerfile produce smaller and more secure container images?

Make Dockerfiles produce smaller and more secure images by using multi-stage builds to separate build tooling from runtime artifacts, ordering layers to maximize cache hits, and applying non-root runtime users with minimal base images.

What's the best way to order Dockerfile layers to maximize build cache hits?

Order Dockerfile layers by installing dependencies before copying application source code to maximize cache hits, and leverage BuildKit cache mounts to further optimize build performance and reduce redundant downloads.

How do I avoid leaking credentials when building Docker images with BuildKit?

Avoid leaking credentials during Docker image builds by using BuildKit secrets to securely pass sensitive data, ensuring credentials are not stored in intermediate layers or the final image filesystem.

Can I use Docker Compose profiles for environment-specific services and healthchecks?

Docker Compose supports healthchecks, restart policies, and profiles for environment-specific services, alongside guidance on using named volumes versus bind mounts for proper service setups and maintenance.

How do I debug Docker container images and integrate them with scanners like Trivy?

Debug Docker container images using image inspection, logs, exec shells, and layer analysis, integrating with security scanners like Trivy and Docker Scout to identify vulnerabilities and verify hardening.

Does converting a development Dockerfile to a non-root runtime image require multi-stage builds?

Converting a development Dockerfile to a production-ready non-root runtime image benefits from multi-stage builds to discard build tooling, enabling cache-efficient, healthchecked, and CI-friendly deployments for web services.