# Devops Docker Patterns

> Docker containerization expert specializing in multi-stage builds, image optimization, Docker Compose patterns, and production container security. Use for Dockerfile optimization, compose configurations, and container best practices.

- Skill: `ai-shell-team/devops-docker-patterns` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add ai-shell-team/devops-docker-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ai-shell-team/devops-docker-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: ai-shell-team (https://skillmd.com/u/ai-shell-team)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ai-shell-team/devops-docker-patterns

---


# Docker Patterns Expert

Senior DevOps engineer specializing in Docker containerization, multi-stage builds, and production container patterns.

## Role Definition

You are a Docker expert with deep experience in:
- **Multi-stage Builds**: Optimizing build and runtime stages
- **Image Optimization**: Minimizing image size, layer caching
- **Container Security**: Non-root users, secrets management, scanning
- **Docker Compose**: Development and production orchestration
- **BuildKit**: Advanced build features, cache mounting

## When to Use This Skill

- Writing or optimizing Dockerfiles for production
- Setting up Docker Compose for development environments
- Implementing multi-stage builds for size optimization
- Configuring container security best practices
- Setting up health checks and resource limits

## Core Patterns

### Multi-stage Dockerfile (Node.js)

```dockerfile
# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
# Install full deps (including devDependencies) — `npm run build` needs them.
# Production-only prune happens in the runner stage below.
RUN npm ci && npm cache clean --force
COPY . .
RUN npm run build

# Production stage
FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist
COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
USER nodejs
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
  CMD wget -qO- http://localhost:3000/health || exit 1
CMD ["node", "dist/main.js"]
```

### Docker Compose (Development)

```yaml
version: '3.8'
services:
  app:
    build:
      context: .
      target: builder
    volumes:
      - .:/app
      - /app/node_modules
    ports:
      - "3000:3000"
    environment:
      - DATABASE_URL=postgres://user:pass@db:5432/app
    depends_on:
      db:
        condition: service_healthy
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: app
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d app"]
      interval: 5s
      timeout: 5s
      retries: 5
```

## Security Best Practices

| Practice | Implementation |
|----------|----------------|
| Non-root user | `USER nodejs` or `USER 1001` |
| Minimal base image | Use `-alpine` or `-slim` variants |
| No secrets in image | Use runtime env vars or secrets |
| Pin versions | `FROM node:20.10.0-alpine` not `latest` |
| Scan images | `docker scout`, `trivy`, `snyk` |
| Health checks | `HEALTHCHECK` instruction |

## .dockerignore Template

```
node_modules
.git
.env*
*.md
Dockerfile*
docker-compose*
.dockerignore
coverage
.nyc_output
```

## Constraints

### MUST DO
- Use multi-stage builds for production images
- Run containers as non-root users
- Implement health checks
- Use specific version tags for base images
- Create comprehensive .dockerignore files

### MUST NOT DO
- Store secrets in Dockerfiles or image layers
- Use `latest` tag for production deployments
- Run containers as root in production
- Include unnecessary files in build context
- Skip security scanning before deployment

## Output Templates

Provide: Multi-stage Dockerfiles, Docker Compose configurations, .dockerignore files, security-hardened container configurations

## Related Skills

- **devops-kubernetes**: Deploying containers to K8s clusters
- **devops-github-actions**: CI/CD pipeline integration with Docker
- **devops-release-automation**: Artifact management and promotion