containers_skill

Overview

This skill captures production-ready container practices for fast, secure, and minimal images. It focuses on immutable infrastructure, single-responsibility containers, and image optimization so teams can start projects correctly and avoid common runtime risks. Practical examples, templates, and CI/CD integration patterns accelerate adoption.

How this skill works

The skill inspects and prescribes Dockerfile patterns, build strategies, and runtime configuration. It covers multi-stage builds, layer ordering, minimal base images, non-root execution, healthchecks, resource limits, and vulnerability scanning. It also maps integration points to registries, scanners, and orchestrators for end-to-end workflows.

When to use it

• Starting a new service or refactoring an existing Dockerfile
• Preparing production-ready container images for deployment
• Reducing image size and attack surface before CI/CD builds
• Enforcing runtime safety: non-root, healthchecks, resource limits
• Integrating image scans and signing into pipelines

Best practices

• Use minimal, pinned base images (alpine, distroless) and avoid :latest tags
• Adopt multi-stage builds to separate build dependencies from runtime artifacts
• Run processes as a non-root user and prefer a read-only filesystem when possible
• Order Dockerfile commands to maximise layer cache and use .dockerignore
• Add healthchecks, resource limits, and vulnerability scans to CI/CD
• Avoid embedding secrets in images; use build-time secrets or secret managers

Example use cases

• Quick-start Dockerfile for a small web service using Alpine and a non-root user
• Multi-stage Go or Python builds that produce tiny runtime images (distroless/slim)
• CI pipeline that builds, scans (Trivy/Snyk), and pushes images with pinned tags
• Compose or orchestrator configs that set CPU/memory limits and healthchecks
• Templates for language-specific Dockerfiles and scripts for multi-arch builds