dockerfile-standardlisted

# dockerfile-standard Secure, cache-efficient Dockerfiles adapted to the project in front of you. Not a template dump. ## Scope Not here: Compose topology (`compose-standard`), Go layout and golangci (`go-project-standard`), Make target names (`makefile-standard`), when CI builds an image (`ci-standard`, though the Dockerfile content is still yours). K8s, registries, and runtime secret distribution are out of scope. ## Workflow ### 1. Inspect the repository Inventory before writing: languages, entrypoints, manifests and lockfiles, CGO and native deps, CA and timezone needs, writable paths, ports, health and shutdown behavior, existing Dockerfiles and ignores, Compose, CI, Make, architectures, registry and tags. Say where you are uncertain. ### 2. Apply profile and standard Read [`references/rules.yaml`](references/rules.yaml), the source of truth for rule IDs. Then: - Full rules: [`references/dockerfile-standard.md`](references/dockerfile-standard.md) - [Security](references/security.md), [caching](references/caching.md), [reproducibility](references/reproducibility.md) - Language profiles: [Go](references/profiles/go.md), [Node](references/profiles/node.md) Greenfield: adapt a template from [`assets/`](assets/) and replace every `Adapt…` marker. Never ship an unfinished placeholder. Migrate: [`references/migration-guide.md`](references/migration-guide.md), incrementally, measuring size and behavior before and after. ### 3. YAGNI Nothing here is unconditional, a