docker-patterns

What it does and when to use it

Container build, security, and caching conventions. Use when editing Dockerfiles, Compose files, build contexts, or .dockerignore.

How it works

1. Multi-Stage Builds
2. Layer Caching
3. .dockerignore
4. Security
5. Health Checks
6. Compose Best Practices

---
name: docker-patterns
description: Container build, security, and caching conventions. Use when editing Dockerfiles, Compose files, build contexts, or .dockerignore.
---

# Docker Patterns

## Multi-Stage Builds

- Use multi-stage builds to separate build dependencies from runtime
- Name stages for clarity: `FROM node:20 AS builder`
- Copy only build artifacts into the final stage
- Keep the final image as small as possible (use `slim` or `alpine` base images)

## Layer Caching

- Order instructions from least to most frequently changing
- Copy dependency files (`package.json`, `requirements.txt`) before source code
- Group related `RUN` commands with `&&` to reduce layers
- Use `.dockerignore` to exclude unnecessary files from build context

## .dockerignore

- Always include: `.git`, `node_modules`, `__pycache__`, `.env`, `*.log`
- Mirror `.gitignore` patterns plus build artifacts
- Exclude test files and documentation from production images

## Security

- Never run as root -- use `USER nonroot` or create a dedicated user
- Don't store secrets in images -- use environment variables or secrets managers
- Pin base image versions: `python:3.12-slim` not `python:latest`
- Scan images for vulnerabilities with `docker scout` or `trivy`
- Use `COPY` instead of `ADD` unless you need tar extraction

## Health Checks

- Always define `HEALTHCHECK` in production Dockerfiles
- Use lightweight endpoints (`/healthz`) that check actual dependencies
- Set appropriate intervals, timeouts, and retries
- Health checks should complete quickly (< 5s)

## Compose Best Practices

- Use named volumes for persistent data
- Define explicit networks for service isolation
- Use `depends_on` with health check conditions
- Use `.env` files for environment configuration
- Define resource limits (`mem_limit`, `cpus`) for production
- Use `profiles` to group services by environment (dev, test, prod)

Versions

Database snapshot: 13.11.2026 · package version aae7d8ac8dc8 (SHA-256 digest of the entire package)

Downloads in the last 30 days: 0 · ranking

Report a problem with this skill: harmful content, incorrect descriptions or an author’s removal request.

Similar skills

• 90docker
  Use when writing or reviewing Dockerfiles, docker-compose files, or .dockerignore for any backend service. Covers multi-stage builds, container security hardening, compose orchestration, advanced build patterns, and a Docker review checklist for all 4 stacks: NestJS/Node 24,…
• 100docker-expert
  Use when working with Dockerfile, docker-compose.yml, .dockerignore, or multi-stage builds. Build, debug, secure, and optimize Docker 27+ images and Docker Compose services.
• 100docker-conventions
  Best practices and conventions for Docker, Dockerfiles, docker-compose, and containerization. Covers multi-stage builds, base image selection, layer optimization, .dockerignore, non-root users, CMD vs ENTRYPOINT, health checks, environment configuration, image security scanning,…
• 100docker-packaging
  This skill should be used when the user says \"create Dockerfile\", \"dockerize project\", \"Docker packaging\", \"container setup\", \"multi-stage build\", \"Docker Compose\", \"containerize application\", \"create docker-compose.yml\", \"create .dockerignore\", \"optimize…
• 100docker-expert
  Expert Docker: Dockerfiles, multi-stage builds, image size/cache optimization, Compose, and container best practices. Trigger keywords: Docker, Dockerfile, container, image, multi-stage, layer cache, docker-compose, .dockerignore, entrypoint, distroless, non-root, healthcheck,…
• 100docker
  Docker operations, Dockerfile best practices, Compose, image optimization, and registry workflows. Use when user says 'review my Dockerfile', 'optimize my image', 'reduce image size', 'container won't start', 'set up compose', 'multi-stage build', or when working in Dockerfile,…