dockerfile

Enforce Dockerfile best practices for secure, reproducible container images.

1|Updated Mar 17, 2026

Search Tags:#security #containerization #docker #dockerfile #buildkit #multistage-build

Ready to run

npx skills add https://github.com/iceflower/agent-skills --skill dockerfile-iceflower

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dockerfile
Source: https://github.com/iceflower/agent-skills/tree/main/dockerfile
Command: npx skills add https://github.com/iceflower/agent-skills --skill dockerfile-iceflower

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Dockerfiles often suffer from bloated images, insecure defaults, and unstable builds. This skill provides a structured set of best practices to produce lean, secure, and reproducible container images.

Core Features & Use Cases

Multi-stage builds to minimize runtime image size while separating build-time dependencies.
BuildKit features like cache mounts and secret mounts to accelerate and secure builds.
Security hardening guidance, such as running as a non-root user, proper HEALTHCHECK, and image provenance.
Guidance for base image selection, layer caching, and multi-architecture builds to improve reliability and performance.

Quick Start

Follow these guidelines to audit and improve your Dockerfiles, then run the lint tool on your repo to enforce compliance.

Frequently Asked Questions about dockerfile

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write a secure Dockerfile with non-root user and health checks?▼

To write a secure Dockerfile, enforce non-root USER deployment, add HEALTHCHECK instructions, and apply proper FROM image tagging. These practices harden container images by eliminating insecure default runtime privileges and ensuring service availability is monitored.

What is the best way to minimize Docker image size using multi-stage builds?▼

The best way to minimize Docker image size is using multi-stage builds. This technique separates build-time dependencies from the runtime environment, discarding compilers and intermediate files to produce lean and reproducible container images.

How do I use BuildKit cache mounts and secret mounts in a Dockerfile?▼

Use BuildKit cache mounts and secret mounts in a Dockerfile to accelerate and secure builds. Cache mounts persist package manager downloads across builds, while secret mounts securely pass credentials without exposing them in intermediate image layers.

Does this Dockerfile guidance support Java Spring Boot and multi-arch deployments?▼

Yes, this Dockerfile guidance applies to Java Spring Boot and multi-arch deployments. It provides specific best practices for base image selection, layer caching strategies, and BuildKit configurations tailored for these frameworks and architectures.

How do I configure .dockerignore and layer caching for reproducible builds?▼

Configure a .dockerignore file to exclude local artifacts and secrets, and order Dockerfile instructions from least to most frequently changing to optimize layer caching. This combination ensures reproducible builds and maximizes cache hits during CI pipelines.