Docker Optimize

What I do

• Analyze existing Dockerfile for inefficiencies and security issues
• Produce an optimized version with multi-stage builds
• Maximize layer caching for faster builds
• Select minimal base images to reduce attack surface
• Apply security hardening best practices

When to use me

Use this skill when you need to:

• Optimize a Dockerfile for smaller image size or faster builds
• Harden a container image for production deployment
• Convert a single-stage Dockerfile to multi-stage
• Debug slow Docker builds or bloated images
• Review a Dockerfile for security best practices

Process

1. Analyze: Read the existing Dockerfile and .dockerignore

• Identify the application type and runtime requirements
• Note current base image and its size
• Check for anti-patterns (see checklist below)

1. Optimize base image: Select the smallest viable base

• alpine variants for minimal footprint
• distroless for production (no shell, no package manager)
• slim variants as a middle ground
• Pin exact image digest or version tag, never use latest

1. Implement multi-stage build: Separate build and runtime

```dockerfile # Build stage FROM node:20-alpine AS build WORKDIR /app COPY package*.json ./ RUN npm ci --production=false COPY . . RUN npm run build

# Production stage FROM node:20-alpine AS production WORKDIR /app COPY --from=build /app/dist ./dist COPY --from=build /app/nodemodules ./nodemodules USER node EXPOSE 3000 CMD ["node", "dist/index.js"] ```

1. Maximize layer caching: Order instructions by change frequency

• Copy dependency manifests first, install, then copy source
• Group rarely-changing instructions early in the Dockerfile
• Use .dockerignore to exclude unnecessary files

1. Security hardening: Apply container security best practices

• Run as non-root user
• Drop all capabilities, add only what is needed
• Set HEALTHCHECK instruction
• Avoid storing secrets in image layers
• Use COPY instead of ADD unless tar extraction is needed

1. Validate: Verify the optimized image

• Compare image size before and after
• Confirm the application starts correctly
• Run a vulnerability scan on the final image

Anti-Pattern Checklist

• [ ] Using latest tag for base image
• [ ] Running as root user
• [ ] Installing unnecessary packages (build tools in production image)
• [ ] Copying entire context before installing dependencies
• [ ] Using ADD when COPY suffices
• [ ] Not using .dockerignore
• [ ] Storing secrets in ENV or ARG instructions
• [ ] Multiple RUN commands that should be combined
• [ ] Not cleaning up package manager caches in the same layer

Optimization Targets

| Metric | Goal | |--------|------| | Image size | Reduce by 50%+ from naive build | | Build time (cached) | Under 30 seconds for source-only changes | | Security | No critical/high CVEs in base image | | Layers | Minimize total layer count |

Language-Specific Patterns

Java

FROM eclipse-temurin:21-jdk-alpine AS build
WORKDIR /app
COPY pom.xml .
RUN mvn dependency:go-offline
COPY src ./src
RUN mvn package -DskipTests

FROM eclipse-temurin:21-jre-alpine
COPY --from=build /app/target/*.jar app.jar
USER 1001
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]

Go

FROM golang:1.22-alpine AS build
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /server .

FROM gcr.io/distroless/static
COPY --from=build /server /server
USER nonroot
EXPOSE 8080
ENTRYPOINT ["/server"]

Rules

• Always pin base image versions explicitly
• Never store secrets or credentials in the image
• Always run the final container as a non-root user
• Combine RUN commands to reduce layers and clean up in the same layer
• Include a .dockerignore that excludes .git, node_modules, and build artifacts

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: weisser-dev
• Source: weisser-dev/awesome-opencode
• License: MIT
• Homepage: https://www.npmjs.com/package/@weisser-dev/awesome-opencode

Install and usage instructions live in the source repository linked above.