docker-developmentlisted
Install: claude install-skill netresearch/docker-development-skill
# Docker Development
Patterns for building, testing, and deploying Docker containers.
## Core Principles
1. **Minimal** -- Alpine/distroless, multi-stage
2. **Secure** -- Non-root USER, no layer secrets, pin versions
3. **Testable** -- CI-verifiable: entrypoint bypass, DNS mocking
4. **Cache-efficient** -- deps first, clean in same layer
## Quick Reference
### Multi-Stage Build (Node.js)
```dockerfile
FROM node:24-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
FROM node:24-alpine
RUN addgroup -g 1001 app && adduser -u 1001 -G app -D app
USER app
COPY --from=builder /app .
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
CMD wget -qO- http://localhost:3000/health || exit 1
CMD ["node", "server.js"]
```
### Multi-Stage Build (Go -- scratch/distroless)
```dockerfile
FROM golang:1.26-alpine AS builder
WORKDIR /app
COPY go.* ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /app/server .
FROM gcr.io/distroless/static:nonroot
COPY --from=builder /app/server /server
CMD ["/server"]
```
### Layer Optimization
```dockerfile
RUN apt-get update && \
apt-get install -y --no-install-recommends curl && \
rm -rf /var/lib/apt/lists/*
```
### Build Cache: Copy Dependency Files First
```dockerfile
COPY package*.json ./
RUN npm ci
COPY . .
```
Manifests before source keeps install layers cached on source-only changes.
### BuildKit Secrets
```dockerfile
RUN --mount=type=secret,id=ssh_key,dst