// Docker and container best practices. Multi-stage builds, security, optimization. Use when creating Dockerfiles.
| name | dockerfile-best-practices |
| description | Docker and container best practices. Multi-stage builds, security, optimization. Use when creating Dockerfiles. |
| compatibility | opencode |
Secure, optimized Dockerfiles for production containers.
# Build stage
FROM golang:1.23-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /binary ./cmd/app
# Runtime stage
FROM alpine:3.20
RUN adduser -D -u 1000 appuser
WORKDIR /app
COPY --from=builder /binary /app/app
USER appuser
ENTRYPOINT ["/app/app"]
# Never run as root
USER appuser
# Read-only filesystem (where possible)
# HEALTHCHECK for monitoring
HEALTHCHECK --interval=30s --timeout=3s \
CMD wget -q --spider http://localhost:8080/healthz || exit 1
# Order: least frequently changed → most frequently changed
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN go build
# This way, go.mod changes trigger cache rebuild, not code changes
# Build
docker build -t app:latest .
# Scan for vulnerabilities
hadolint Dockerfile
trivy image app:latest
# Build with buildkit
DOCKER_BUILDKIT=1 docker build -t app:latest .
C++ development best practices. Modern C++20/23, RAII, zero-overhead abstractions, safety. Use when writing C++ code.
Go development best practices. Idiomatic Go, error handling, concurrency patterns, testing. Use when writing Go code.
Observability best practices. Logging, metrics, tracing, alerting. Essential for production services. Use for any backend service.
React Native development. Cross-platform code, native modules, performance. Use when building mobile apps.
Test-Driven Development workflow. Write failing test first, implement code to pass, then refactor. Essential for all languages: Go, TypeScript, C++, Python. Use before any implementation task.
Use when the user wants to commit, push, and open a pull request for the current changes. Stages relevant files, writes a descriptive commit message, pushes the branch, opens a PR against main, and posts an /oc review comment so opencode automatically reviews and approves if ready.