docker-authorlisted

# Docker Author Write Dockerfiles and Compose files that pass a `docker-doctor` scan on the first try. Every default below maps to a rule the scanner enforces — this skill front-loads them so the generated file starts at a high health score instead of being fixed afterward. **The loop:** author → `npx @docker-doctor/cli@latest . --verbose` → fix anything flagged → aim for `Excellent 🏆` (score ≥ 90). Don't hand back a Dockerfile you haven't scanned. ## Production defaults (each maps to a docker-doctor rule) Apply these when authoring. If you deviate, say why. | Default | Rule it satisfies | | --- | --- | | **Multi-stage build** — a `build`/`deps` stage separate from the slim runtime stage | `use-multi-stage`, `avoid-dev-dependencies` | | **Pin the base image** to a concrete tag (never `latest`, never bare) — prefer digest for reproducibility | `pin-image-version` | | **Slim/alpine/distroless runtime base** (e.g. `node:22-alpine`, `python:3.12-slim`) | `prefer-slim-base` | | **Run as non-root** — create a user and `USER node` / `USER 1000` before `CMD` | `no-root-user`, `useradd-no-log-init` | | **No secrets in `ENV`/`ARG`** — pass at runtime or use `RUN --mount=type=secret` | `no-secrets-in-env` | | **`COPY` not `ADD`** (except local tar auto-extract); never `ADD` a remote URL | `prefer-copy-over-add`, `no-add-remote` | | **Cache-friendly layer order** — copy manifests + install deps _before_ copying source | `order-layers` | | **One `RUN` per logical step**, `&&`-chaine