# Docker

> ALWAYS activate when the user's query involves Docker in any way — even if it also matches other skills. If the words docker, Dockerfile, docker-compose, compose.yml, container, or image appear in the query, this skill MUST be used. Covers: writing or editing Dockerfiles and compose files, adding services (postgres, redis, etc.) to compose, volume mounts and data persistence, docker build failure…

- **Type:** Skill
- **Install:** `agentstack add skill-avibebuilder-claude-prime-docker`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [avibebuilder](https://agentstack.voostack.com/s/avibebuilder)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [avibebuilder](https://github.com/avibebuilder)
- **Source:** https://github.com/avibebuilder/claude-prime/tree/main/.claude/starter-skills/docker
- **Website:** https://claudeprime.avibebuilder.com

## Install

```sh
agentstack add skill-avibebuilder-claude-prime-docker
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Docker

Project-specific containerization patterns for Dockerfile and Docker Compose.

## Architecture Decisions

### Image Building
1. **Minimal base images** — Use slim/alpine variants; pin to digest for reproducibility.
2. **Multi-stage builds** — Separate build dependencies from runtime.
3. **Layer optimization** — Combine RUN commands; place frequently changed files last.
4. **COPY over ADD** — ADD only for tar extraction or remote URLs.

### Security
5. **Non-root users** — Always use UID >10000; never run as root in production.
6. **No secrets in images** — Use Docker secrets or runtime env injection.
7. **.dockerignore required** — Exclude .git, .env, node_modules, build artifacts.

### Runtime
8. **One process per container** — Single responsibility principle.
9. **Healthchecks required** — Define HEALTHCHECK in Dockerfile or Compose.
10. **Resource limits** — Always set mem_limit and cpus in production.

### Compose
11. **Network segmentation** — Dedicated networks per service group.
12. **Named volumes** — Never use anonymous volumes in production.
13. **depends_on with healthchecks** — Use `condition: service_healthy`.
14. **Environment separation** — Use override files for dev/staging/prod.

## Gotchas

- `COPY . .` before `RUN npm install` busts the cache on EVERY code change. Copy `package*.json` first, install, THEN copy source.
- Alpine uses musl libc, not glibc. Python packages with C extensions (numpy, pandas, cryptography) may fail to install or need `apk add` build dependencies. Consider `-slim` variants if you hit this.
- `ENTRYPOINT ["python", "app.py"]` (exec form) handles signals correctly. `ENTRYPOINT python app.py` (shell form) wraps in `/bin/sh -c` and PID 1 won't receive SIGTERM — containers take 10s to stop.
- Docker layer cache is invalidated from the FIRST changed layer downward. A changed `COPY` near the top rebuilds everything below it.
- `depends_on` without `condition: service_healthy` only waits for container START, not readiness. Your app will crash connecting to a database that's still initializing.
- `host.docker.internal` works on Docker Desktop (Mac/Windows) but NOT on Linux. Use `--network host` or explicit container networking on Linux.
- Build args (`ARG`) are NOT available after `FROM` in multi-stage builds unless re-declared. Each stage starts fresh.
- `docker compose up` reuses existing containers. After changing `Dockerfile`, you need `docker compose up --build` or `docker compose build` first.
- Volume mounts override the container's filesystem — if your `node_modules` are built inside the container but you mount `.:/app`, the host's (possibly empty) `node_modules` shadows them. Use a named volume for `node_modules`.
- `EXPOSE` is documentation only — it does NOT publish the port. You still need `-p 8080:8080` or `ports:` in compose.
- Docker's default bridge network does NOT provide DNS resolution between containers. Use a custom network or compose's default network.

## References

| When you need... | Read |
|------------------|------|
| Dockerfile patterns, CMD vs ENTRYPOINT | [dockerfile.md](./references/dockerfile.md) |
| Compose services, networks, volumes | [compose.md](./references/compose.md) |
| Security hardening | [security.md](./references/security.md) |
| Production deployment | [production.md](./references/production.md) |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [avibebuilder](https://github.com/avibebuilder)
- **Source:** [avibebuilder/claude-prime](https://github.com/avibebuilder/claude-prime)
- **License:** MIT
- **Homepage:** https://claudeprime.avibebuilder.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-avibebuilder-claude-prime-docker
- Seller: https://agentstack.voostack.com/s/avibebuilder
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.