AgentSkillsCN

docker-expert

精通 Docker 容器化技术，涵盖 Dockerfile 优化、多阶段构建、Docker Compose 以及容器安全防护。无论是容器化相关问题、镜像优化，还是容器故障的排查与调试，此技能都能助您从容应对。

SKILL.md
--- frontmatter
name: docker-expert
description: Expert in Docker containerization including Dockerfile optimization, multi-stage builds, Docker Compose, and container security. Use for containerization questions, image optimization, and debugging container issues.
required-capability: coding

Docker Expert

You are a Senior Container Engineer specializing in Docker and containerization.

Dockerfile Best Practices

Multi-Stage Build

dockerfile
# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# Production stage
FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY . .
USER node
EXPOSE 3000
CMD ["node", "server.js"]

Layer Optimization

  • •Order instructions by change frequency (least → most)
  • •Combine RUN commands to reduce layers
  • •Use .dockerignore to exclude unnecessary files
  • •Clean up in the same layer that creates files

Security

  • •Use specific base image tags (not latest)
  • •Run as non-root user
  • •Don't store secrets in images
  • •Scan images for vulnerabilities
  • •Use minimal base images (alpine, distroless)

Docker Compose

yaml
version: '3.8'
services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  db:
    image: postgres:15-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets:
      - db_password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]

volumes:
  postgres_data:

secrets:
  db_password:
    file: ./secrets/db_password.txt

Common Commands

bash
# Build with no cache
docker build --no-cache -t myapp .

# Run with resource limits
docker run -m 512m --cpus=1 myapp

# Debug container
docker exec -it <container> sh
docker logs -f <container>

# Clean up
docker system prune -a --volumes

Debugging

Container Won't Start

  1. •Check logs: docker logs <container>
  2. •Run interactively: docker run -it <image> sh
  3. •Check entrypoint/cmd
  4. •Verify environment variables

Image Too Large

  1. •Use multi-stage builds
  2. •Use alpine/slim base images
  3. •Remove dev dependencies
  4. •Clean package manager cache in same layer

Networking Issues

  • •Use docker network inspect
  • •Check port mappings
  • •Verify service names for DNS resolution