# Docker K8S Optimizer

> Optimize Dockerfiles with multi-stage builds, layer caching, and security hardening; create Kubernetes manifests with resource limits, probes, HPA, PDB, network policies, and Helm charts Use when this capability is needed.

- Skill: `tomevault-io/docker-k8s-optimizer` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/docker-k8s-optimizer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/docker-k8s-optimizer/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/docker-k8s-optimizer

---


# Purpose

Build production-grade container images and Kubernetes configurations optimized for security, performance, and reliability.

## When to Use

Use this skill when the task involves:

- Writing or optimizing Dockerfiles
- Creating Kubernetes Deployments, Services, or ConfigMaps
- Setting up health checks, resource limits, or autoscaling
- Configuring Ingress with Istio, Emissary, or nginx
- Building Helm charts for deployable applications
- Troubleshooting container or pod issues

## Constraints

- Dockerfiles must use **multi-stage builds** to minimize image size
- Always run as **non-root user** in production images
- Pin image versions with **SHA digests** for reproducibility
- Kubernetes manifests must define **resource requests AND limits**
- Include **liveness, readiness, and startup probes**
- Use **semantic versioning** for container image tags
- Apply **Pod Disruption Budgets** for high-availability workloads

## Execution Steps

1. **Analyze application** — Identify runtime requirements, dependencies, ports
2. **Design Dockerfile** — Multi-stage build with optimized layer ordering
3. **Add security hardening** — Non-root user, minimal base image, no secrets in image
4. **Create K8s manifests** — Deployment, Service, ConfigMap, Secrets references
5. **Configure reliability** — Probes, resource limits, PDBs, HPA
6. **Set up networking** — Ingress, network policies, service mesh integration
7. **Verify locally** — Test with docker build and kubectl dry-run

## Examples

### Input

> Create an optimized Dockerfile for a Next.js application

### Output

```dockerfile
# Stage 1: Dependencies
FROM node:20-alpine AS deps
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN corepack enable pnpm && pnpm install --frozen-lockfile

# Stage 2: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
ENV NEXT_TELEMETRY_DISABLED=1
RUN corepack enable pnpm && pnpm build

# Stage 3: Production
FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1

# Security: non-root user
RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nextjs

COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static

USER nextjs
EXPOSE 3000
ENV PORT=3000
CMD ["node", "server.js"]
```

### Kubernetes Deployment

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nextjs-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nextjs-app
  template:
    spec:
      containers:
        - name: app
          image: myregistry/nextjs-app:v1.0.0@sha256:abc123...
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /api/health
              port: 3000
            initialDelaySeconds: 10
          readinessProbe:
            httpGet:
              path: /api/health
              port: 3000
            initialDelaySeconds: 5
```

## Related Skills

- `terraform-aws-builder` — Provision EKS clusters
- `telemetry-opentelemetry-integrator` — Add observability to containers

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/phatpham9) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->