# Docker

> Docker containerization best practices and patterns

- Skill: `neuralblitz/docker-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add neuralblitz/docker-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/neuralblitz/docker-4/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: NeuralBlitz (https://skillmd.com/u/neuralblitz)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/neuralblitz/docker-4

---

## What I do
- Write efficient Dockerfiles using multi-stage builds
- Optimize image size with minimal base images
- Properly structure docker-compose configurations
- Implement health checks
- Use .dockerignore effectively
- Follow security best practices for containers
- Manage environment variables and secrets properly

## When to use me
When creating Dockerfiles, docker-compose files, or container-related configurations.

## Multi-stage Dockerfile
```dockerfile
# Builder stage
FROM python:3.11-slim-bookworm AS builder

WORKDIR /build

RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

# Runtime stage
FROM python:3.11-slim-bookworm AS runtime

WORKDIR /home/runner/workspace

COPY --from=builder /install /usr/local

COPY src/ ./src/

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

RUN addgroup --gid 1000 appgroup && \
    adduser --uid 1000 --gid 1000 --shell /bin/bash appuser

USER appuser

EXPOSE 5000

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:5000/health')" || exit 1

CMD ["python", "src/main.py"]
```

## Docker Compose
```yaml
version: '3.8'

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "5000:5000"
    environment:
      - DATABASE_URL=postgres://user:pass@db:5432/app
      - REDIS_URL=redis://cache:6379
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_started
    volumes:
      - ./src:/home/runner/workspace/src
      - app_data:/home/runner/workspace/data
    networks:
      - app_network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:5000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3

  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: app
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d app"]
      interval: 10s
      timeout: 5s
      retries: 5

  cache:
    image: redis:7-alpine
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data

volumes:
  postgres_data:
  redis_data:
  app_data:

networks:
  app_network:
    driver: bridge
```

## Security Best Practices
- Don't run as root
- Use specific tags, not :latest
- Scan images for vulnerabilities
- Don't include secrets in build context
- Use read-only filesystems where possible
- Limit capabilities

## Commands
```bash
# Build and run
docker build -t myapp:latest .
docker run -p 5000:5000 myapp:latest

# View logs and debug
docker compose logs -f
docker exec -it container_name bash

# Clean up
docker system prune -a
docker volume prune
```