infra-docker-best-practices

What problem does it solve?

This Skill helps you produce Docker images that are smaller, faster to build, and safer to run, reducing CI/CD time, registry costs, and exposure to common CVEs and container misconfigurations.

Core Features & Use Cases

• Multi-stage builds to separate builder and runtime dependencies, keeping production images lean.
• Layer cache optimization to speed up rebuilds by copying lockfiles/dependency manifests before source code.
• Security hardening with non-root users, reduced attack surface (slim/distroless), read-only root recommendations, and secret-safe builds via BuildKit.
• Operational best practices for data engineering containers, including examples for Python ETL, dbt adapters, and Spark submit images.
• Quality gates in CI with image vulnerability scanning (Trivy) and basic size/layer audits (dive/dockers tools).
• Anti-patterns to avoid such as cache-busting COPY order, separate apt-get layers, shell-form CMD/ENTRYPOINT, and shipping secrets/build context.

Quick Start

Use the skill to design your next production Dockerfile by asking: "Review my data engineering Dockerfile and propose a hardened multi-stage, cache-friendly, non-root build with CI image scanning."