# Dockerfile Optimizer

> Dockerfile Optimizer

- Skill: `shravan-amberkar/dockerfile-optimizer` (Agent Skill)
- Install (CLI): `npx skillmds@latest add shravan-amberkar/dockerfile-optimizer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/shravan-amberkar/dockerfile-optimizer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Shravan-Amberkar (https://skillmd.com/u/shravan-amberkar)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/shravan-amberkar/dockerfile-optimizer

---


# Dockerfile Optimizer

Produce production Docker images that are small, reproducible, cache-efficient, and secure.

## When to use
- "Write/optimize a Dockerfile" or "containerize this service"
- "My image is huge / builds slowly"
- Reviewing an existing Dockerfile

## Principles (apply these)

1. **Multi-stage build.** Compile/install in a builder stage; copy only artifacts into a slim final stage.
2. **Minimal final base.** Go → `gcr.io/distroless/static` or `scratch`; Python → `python:*-slim`;
   Node → `node:*-slim` or distroless. Never ship the full SDK image.
3. **Non-root.** Create and `USER` a non-root user in the final stage. Distroless `:nonroot` works for Go.
4. **Cache-friendly layer order.** Copy dependency manifests (`go.mod/go.sum`, `requirements.txt`,
   `package.json/lock`) and download deps *before* copying source, so code changes don't bust the dep cache.
5. **`.dockerignore`.** Exclude `.git`, build output, `node_modules`, env files, test data — keeps the
   build context (and secret-leak risk) small.
6. **Pin versions.** Pin base image tags (and digests for prod); never `latest`.
7. **No secrets in layers.** Use build args/secrets mounts, not `COPY .env`. Secrets in any layer
   persist in history even if later removed.
8. **Healthcheck + metadata.** Add a `HEALTHCHECK` and OCI labels where useful.
9. **Reproducibility.** For Go set `CGO_ENABLED=0`; strip with `-ldflags="-s -w"`.

## Reference — Go multi-stage
```dockerfile
FROM golang:1.22-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /app ./cmd/service

FROM gcr.io/distroless/static:nonroot
COPY --from=build /app /app
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/app"]
```

## Output
When reviewing, list issues by impact (security → size → build speed), then provide the rewritten
Dockerfile and a matching `.dockerignore`. State the expected before/after image size if known.