Agent skill · affaan-m
docker-patterns
Docker and Docker Compose patterns for local development, hardened CLI installer harnesses, container security, networking, volumes, and multi-service orchestration. Use when creating or reviewing Dockerfiles and Compose services, testing installers across Linux distributions, or planning accurate native macOS and Windows validation.
What it needs
About 9k tokens when loaded.
What this skill does
Docker Patterns Docker and Docker Compose best practices for containerized development. Docker Compose for Local Development Standard Web App Stack Development vs Production Dockerfile Override Files Networking Service Discovery Services in the same Compose network resolve by service name: Custom Networks Exposing Only What's Needed Volume Strategies Common Patterns Container Security Dockerfile Hardening Compose Security Secret Management Hardened CLI Installer Harnesses Use containers to test installer behavior against disposable project copies without allowing the test to mutate the source checkout. Respect the Platform Boundary Run real containers for Linux distributions such as Debian and Ubuntu. macOS cannot run as a Docker container because Docker shares a Linux kernel. Run the same shell-free test entry point natively on macOS. Windows containers require a Windows Docker engine. Run platform-independent logic on a native Windows CI runner and reserve Windows containers for a Windows host. Keep a native Ubuntu/macOS/Windows CI matrix for host-specific paths, command shims, quoting, and filesystem behavior. Do not claim that a Linux container validates macOS or Windows behavior. Enforce the Isolation Contract Pin base images by immutable digest and pin installed CLI versions. Run as a non-root numeric UID/GID when distro account names differ. Mount the repository and source project read-only. Copy the source project into a writable tmpfs workspace before any mutation. Mount /workspace with noexec, UID/GID 1000, and mode=0700 so only the container user can inspect project data. Keep npm and npx's executable cache at NPMCONFIGCACHE=/tmp/npm-cache on the executable /tmp mount. Its default size is 2 GiB and can be adjusted with ECCTMPFSSIZE; ECCWORKSPACESIZE separately controls the private workspace mount. Set readonly: true, no-new-privileges:true, capdrop: [ALL], and a finite pidslimit. Keep the default real-CLI services on networkmode: none. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/docker-patterns--b5b699