refactor-docker_skill

Overview

This skill refactors Dockerfiles and docker-compose configurations to make containers secure, lean, and production-ready following 2025 best practices. It removes anti-patterns, implements multi-stage builds, enforces non-root execution, and replaces hardcoded secrets with proper secrets management. The goal is smaller, reproducible images with robust health checks and clear network segmentation.

How this skill works

I analyze existing Dockerfiles, docker-compose.yml files, and .dockerignore to find security, performance, and maintainability issues. I then produce a refactored set of artifacts: pinned base images or digested FROM lines, multi-stage builds, reduced layers, non-root users with static UIDs, HEALTHCHECK entries, .dockerignore recommendations, and docker-compose changes for secrets, networks, and resource limits. I also provide concrete change notes and example commands to build and verify the refactored images.

When to use it

• Preparing development images for production deployment or CI pipelines
• Hardening containers that run as root or include hardcoded credentials
• Reducing image size and improving build cache efficiency
• Converting single-stage builds into multi-stage, reproducible builds
• Introducing health checks, resource limits, and network segmentation

Best practices

• Pin images to specific tags or digests; never use latest in production
• Use multi-stage builds to separate build-time dependencies from runtime
• Create and use a non-root user with static UID/GID (e.g., 10000:10001)
• Add a comprehensive .dockerignore to shrink build context and speed builds
• Replace hardcoded env secrets with Docker secrets or mounted files
• Add HEALTHCHECKs, labels, and tiny init (tini) for correct signal handling

Example use cases

• Refactor a legacy Dockerfile that installs build tools in the final image into a multi-stage build with a tiny runtime image
• Convert a docker-compose that exposes DB ports publicly into segmented frontend/backend networks and internal DB network
• Replace hardcoded environment secrets with Docker secrets and env_file patterns
• Optimize layer ordering and caching for Python or Node projects to speed CI builds
• Shrink a bloated image by switching to slim/distroless base and removing unnecessary packages