dockerfile-best-practices
Dockerfile Best Practices
Overview
Use this skill to create images that build reliably, run securely, and minimize size/startup overhead.
Scope Boundaries
- Use this skill when the task matches the trigger condition described in
description. - Do not use this skill when the primary task falls outside this skill's domain.
Shared References
- Layer and cache strategy guidance:
references/dockerfile-layer-cache-guidance.md
Templates And Assets
- Dockerfile baseline:
assets/Dockerfile.template
- Image hardening checklist:
assets/image-hardening-checklist.md
Inputs To Gather
- Runtime requirements and base image constraints.
- Dependency installation and caching strategy.
- Security/compliance requirements for runtime image.
- Build reproducibility and provenance requirements.
Deliverables
- Hardened Dockerfile with rationale for key choices.
- Build-cache strategy and layer ordering notes.
- Runtime hardening checklist (user, filesystem, capabilities).
- Image verification steps (size, vulnerabilities, startup behavior).
Quick Example
- Multi-stage build: compile in builder, copy only runtime artifacts.
- Pin dependency versions and base image digest when policy requires.
- Use non-root user in final stage.
- Keep only required runtime packages in final image.
Quality Standard
- Build is deterministic enough for release confidence.
- Final image includes minimal required artifacts only.
- Runtime privileges and writable paths are minimized.
- Secrets are not baked into image layers.
Workflow
- Select base image aligned to runtime and policy.
- Design multi-stage build and layer ordering for cache efficiency.
- Apply runtime hardening in final stage using
assets/image-hardening-checklist.md. - Validate build reproducibility and image behavior.
- Verify security and size/performance constraints.
Failure Conditions
- Stop when image requires unnecessary root privileges.
- Stop when build embeds secrets or unstable dependency sources.
- Escalate when vulnerability posture exceeds accepted threshold.
More from kentoshimizu/sw-agent-skills
graph-algorithms
Graph algorithm workflow for modeling entities/relations and selecting traversal, path, ordering, or flow strategies. Use when correctness or performance depends on graph representation and algorithm choice; do not use for schema-only modeling or deployment topology planning.
14bash-style-guide
Style, review, and refactoring standards for Bash shell scripting. Trigger when `.sh` files, files with `#!/usr/bin/env bash` or `#!/bin/bash`, or CI workflow blocks with `shell: bash` are created, modified, or reviewed and Bash-specific quality controls (quoting safety, error handling, portability, readability) must be enforced. Do not use for generic POSIX `sh`, PowerShell, or language-specific application style rules. In multi-language pull requests, run together with other applicable `*-style-guide` skills.
11architecture-clean-architecture
Clean Architecture workflow for enforcing dependency direction, stable domain boundaries, and use-case-centered application design. Use when teams must separate business rules from frameworks and delivery mechanisms; do not use for isolated module cleanup without boundary implications.
11powershell-style-guide
Style, review, and refactoring standards for PowerShell scripting. Trigger when `.ps1`, `.psm1`, `.psd1` files, or CI workflow blocks with `shell: pwsh` or `shell: powershell` are created, modified, or reviewed and PowerShell-specific quality controls (error handling, parameter validation, readability, operational safety) must be enforced. Do not use for Bash, generic POSIX `sh`, or language-specific application style rules. In multi-language pull requests, run together with other applicable `*-style-guide` skills.
10github-codeowners-management
Govern CODEOWNERS rules so review routing reflects real ownership and risk boundaries on GitHub. Use when repository ownership mapping or mandatory reviewer rules must be defined, updated, or audited; do not use for non-GitHub runtime architecture or data-layer design.
9security-authentication
Security workflow for authentication architecture, credential lifecycle, and session/token assurance. Use when login, identity proofing, MFA, or session security decisions are required; do not use for authorization policy design or non-security quality tuning.
9