inno-containerize

Writes Dockerfiles that satisfy the Innovation Platform's container CI gates for any stack.

Updated Jul 18, 2026
One-click install
npx skills add https://github.com/dlaporte/claude-plugins --skill inno-containerize-dlaporte
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: inno-containerize
Source: https://github.com/dlaporte/claude-plugins/tree/main/plugins/innovation-platform/skills/inno-containerize
Command: npx skills add https://github.com/dlaporte/claude-plugins --skill inno-containerize-dlaporte

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Container apps on the davidlaporte.org Innovation Platform must pass strict CI gates — non-root user, port 8080 exposure, CVE-clean image, and a working /healthz endpoint — before deploy is allowed. This Skill encodes that exact contract so your Dockerfile passes the gates on the first push instead of failing CI repeatedly. ## Core Features & Use Cases - Gate-compliant Dockerfile authoring: Encodes the platform's exact rules for non-root USER validation (numeric uid or /etc/passwd name resolution), EXPOSE 8080, base-image patching, and the /healthz smoke test. - Stack-specific recipes: Provides tested reference Dockerfiles for Python, Node, and multi-stage Go builds, with digest-pinned base images fetched live from the get_app_contract MCP tool. - Local pre-push verification: Ships a copy-paste bash block that replicates the CI gate's non-root decision logic, port check, and /healthz smoke test against a locally built image. - Use Case: You are adding a Dockerfile to a new inno-{app} container repo. The Skill guides you to the pinned base image, the correct USER directive, and a local check that mirrors CI, so the container gate passes on the first tag run. ## Quick Start Ask the AI to write or review the Dockerfile for your inno-{app} container app so it passes the platform's container CI gates.

Frequently Asked Questions about inno-containerize

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a Dockerfile that passes the Innovation Platform container gate?

Bind the app to 0.0.0.0:8080 with EXPOSE 8080, set a non-root USER before CMD, patch base OS packages, and serve GET /healthz returning 200. Fetch the digest-pinned base image from the get_app_contract MCP tool rather than hard-coding one.

What non-root USER values does the container gate accept?

The gate accepts a plain decimal uid from 1 to 2147483647, or a user name of letters, digits, dot, underscore, and dash that resolves to exactly one /etc/passwd line with a valid uid. Root, uid 0, unset USER, and ambiguous names are refused.

Does this Dockerfile contract apply to function-type apps?

No. Function and mcp-function apps run as Cloudflare Workers behind the gateway with entry app/index.ts and have no Dockerfile, so the container CI gates are skipped. The contract applies to container and mcp-container types only.

Why does the container gate fail even though my app works locally?

Common causes are binding to 127.0.0.1 instead of 0.0.0.0, a missing or root USER directive, unpatched base-image CVEs failing the Trivy scan, or /healthz not returning 200 within the roughly 90-second poll window.

Can I hard-code a base image digest in the Dockerfile?

No. The Skill requires calling the get_app_contract MCP tool for the platform's current digest-pinned recommended bases for Python, Node, and Go. Hard-coded digests from docs or memory may be stale and unscannable against current policy.

How do I test the container gate locally before pushing?

Build the image with docker build, then run the Skill's provided bash block, which replicates the gate's non-root user resolution, checks ExposedPorts for 8080/tcp, and curls /healthz on a running container. Optionally run trivy image --severity HIGH,CRITICAL --ignore-unfixed.