docker-multi-stage-optimizer

license	Apache-2.0
name	docker-multi-stage-optimizer
description	Multi-stage Docker build optimizer for minimal, secure production images. Activate on: Dockerfile optimization, multi-stage build, distroless image, container size reduction, Docker security scanning, BuildKit features. NOT for: container orchestration (use kubernetes-manifest-generator), CI/CD pipelines (use github-actions-pipeline-builder), runtime container config (use environment-config-manager).
allowed-tools	Read,Write,Edit,Bash(docker:*,kubectl:*,terraform:*,npm:*,npx:*)
category	DevOps & Infrastructure
tags	["docker","containers","security","optimization"]
pairs-with	[{"skill":"docker-containerization","reason":"General container patterns that this skill optimizes"},{"skill":"ci-cache-optimizer","reason":"Docker layer caching is a key CI speed lever"}]

Docker Multi-Stage Optimizer

Expert in crafting minimal, secure Docker images using multi-stage builds, distroless bases, and BuildKit optimizations.

Activation Triggers

Activate on: "Dockerfile optimization", "multi-stage build", "distroless image", "container size", "Docker security scan", "BuildKit", "image layers", "slim image", "Docker best practices"

NOT for: Container orchestration → kubernetes-manifest-generator | CI/CD pipelines → github-actions-pipeline-builder | Runtime config → environment-config-manager

Quick Start

1. Audit the existing Dockerfile — identify redundant layers, large base images, leaked secrets
2. Design multi-stage pipeline — separate build, test, and runtime stages
3. Select minimal base — distroless, alpine, or scratch depending on runtime needs
4. Enable BuildKit — use cache mounts, secret mounts, and parallel builds
5. Scan and validate — run Trivy/Grype, verify no dev dependencies in final image

Core Capabilities

Domain	Technologies
Multi-Stage Builds	Builder pattern, named stages, COPY --from, cross-compilation
Base Images	gcr.io/distroless, alpine 3.21, chainguard, scratch
BuildKit	Cache mounts, secret mounts, SSH mounts, heredocs, parallel stages
Security	Trivy, Grype, Syft SBOM, non-root USER, read-only filesystem
Size Optimization	Layer squashing, .dockerignore, multi-arch builds, UPX compression

Architecture Patterns

Multi-Stage Build Pipeline

# Stage 1: Dependencies (cached aggressively)
FROM node:22-alpine AS deps
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
    pnpm install --frozen-lockfile

# Stage 2: Build
FROM deps AS build
COPY . .
RUN pnpm build

# Stage 3: Production (minimal)
FROM gcr.io/distroless/nodejs22-debian12 AS production
COPY --from=build /app/dist /app
COPY --from=deps /app/node_modules /app/node_modules
USER nonroot
EXPOSE 3000
CMD ["app/server.js"]

BuildKit Cache Mount Pattern