| license | Apache-2.0 |
| name | docker-multi-stage-optimizer |
| description | Multi-stage Docker build optimizer for minimal, secure production images. Activate on: Dockerfile optimization, multi-stage build, distroless image, container size reduction, Docker security scanning, BuildKit features. NOT for: container orchestration (use kubernetes-manifest-generator), CI/CD pipelines (use github-actions-pipeline-builder), runtime container config (use environment-config-manager). |
| allowed-tools | Read,Write,Edit,Bash(docker:*,kubectl:*,terraform:*,npm:*,npx:*) |
| category | DevOps & Infrastructure |
| tags | ["docker","containers","security","optimization"] |
| pairs-with | [{"skill":"docker-containerization","reason":"General container patterns that this skill optimizes"},{"skill":"ci-cache-optimizer","reason":"Docker layer caching is a key CI speed lever"}] |
Docker Multi-Stage Optimizer
Expert in crafting minimal, secure Docker images using multi-stage builds, distroless bases, and BuildKit optimizations.
Activation Triggers
Activate on: "Dockerfile optimization", "multi-stage build", "distroless image", "container size", "Docker security scan", "BuildKit", "image layers", "slim image", "Docker best practices"
NOT for: Container orchestration → kubernetes-manifest-generator | CI/CD pipelines → github-actions-pipeline-builder | Runtime config → environment-config-manager
Quick Start
- Audit the existing Dockerfile — identify redundant layers, large base images, leaked secrets
- Design multi-stage pipeline — separate build, test, and runtime stages
- Select minimal base — distroless, alpine, or scratch depending on runtime needs
- Enable BuildKit — use cache mounts, secret mounts, and parallel builds
- Scan and validate — run Trivy/Grype, verify no dev dependencies in final image
Core Capabilities
| Domain | Technologies |
|---|
| Multi-Stage Builds | Builder pattern, named stages, COPY --from, cross-compilation |
| Base Images | gcr.io/distroless, alpine 3.21, chainguard, scratch |
| BuildKit | Cache mounts, secret mounts, SSH mounts, heredocs, parallel stages |
| Security | Trivy, Grype, Syft SBOM, non-root USER, read-only filesystem |
| Size Optimization | Layer squashing, .dockerignore, multi-arch builds, UPX compression |
Architecture Patterns
Multi-Stage Build Pipeline
# Stage 1: Dependencies (cached aggressively)
FROM node:22-alpine AS deps
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
pnpm install --frozen-lockfile
# Stage 2: Build
FROM deps AS build
COPY . .
RUN pnpm build
# Stage 3: Production (minimal)
FROM gcr.io/distroless/nodejs22-debian12 AS production
COPY --from=build /app/dist /app
COPY --from=deps /app/node_modules /app/node_modules
USER nonroot
EXPOSE 3000
CMD ["app/server.js"]
BuildKit Cache Mount Pattern
