Docker

• You're writing or optimizing Dockerfiles and want reliable layer caching, multi-stage builds, and non-root user patterns applied by default.
• You're orchestrating services with Docker Compose and need help with health checks, dependency ordering, volume mounts, and .env file handling.
• You're debugging a container issue — OOM kills (exit 137), port conflicts, networking failures, or distroless image limitations.
• You're hardening a container for production: secrets management, resource limits, log rotation, and removing dangerous flags like --privileged.

• Your infrastructure uses Kubernetes or another container orchestrator exclusively — a dedicated Kubernetes skill would be a better fit.
• The task involves no Docker at all (pure application code, CI pipelines without containers, etc.).

Enforces pinned image versions, combined RUN layers to avoid stale caches, COPY-order optimization, and USER nonroot by default. Flags silent mistakes like using ADD instead of COPY or leaking secrets through build args.

Covers the full Compose workflow including health-check-aware depends_on conditions, multi-file composition, .env file placement, and volume mount pitfalls that silently overwrite container data.

Explains why container DNS requires custom networks, how to scope published ports to 127.0.0.1 for local-only exposure, and how to avoid anonymous volume accumulation and bind-mount permission mismatches.

Provides a practical map of exit codes (137 = OOM, 139 = segfault), log inspection for failed containers, and techniques for accessing filesystems in distroless or crashed containers using docker cp and debug sidecars.

Flags high-risk patterns including ENV-baked secrets, --privileged flag usage, and images from unverified registries. Recommends secrets mounts and specific Linux capabilities over broad privilege escalation.

Tracks dangling images, unbounded build cache growth, stopped containers consuming disk, and orphaned networks. Provides the exact prune commands needed to keep host systems clean.

Use this skill when writing a new Dockerfile to automatically apply pinned base images, optimal layer ordering, multi-stage build patterns, non-root users, and resource limits — avoiding the most common build and security mistakes upfront.

When a container exits unexpectedly, the skill guides you through reading exit codes, pulling logs from failed containers, inspecting state with docker inspect, and recovering files from a dead container's filesystem.

Orchestrate databases, APIs, and front-end services with correct health-check conditions, scoped port bindings, named volumes, and .env file placement so services start in the right order and communicate reliably.

Keep a Docker host healthy by pruning dangling images, reclaiming build cache, removing stopped containers, and cleaning up orphaned networks — with the right flags to avoid accidentally deleting named volumes.