configure-dockerfile

Dockerfile standards: Alpine/slim base, non-root user, multi-stage builds. Use when creating a Dockerfile, hardening security, or auditing image size.

仓库: laurigates/claude-plugins
最近来源活动: 2026年6月18日 06:18
检测到的 SKILL.md 语言: 英语
星标: 49
分支: 7

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

返回搜索返回安装

created	"2025-12-16T00:00:00.000Z"
modified	"2026-06-18T00:00:00.000Z"
reviewed	"2026-06-01T00:00:00.000Z"
description	Dockerfile standards: Alpine/slim base, non-root user, multi-stage builds. Use when creating a Dockerfile, hardening security, or auditing image size.
allowed-tools	Glob, Grep, Read, Write, Edit, AskUserQuestion, TodoWrite, WebSearch, WebFetch
args	[--check-only] [--fix] [--type <frontend\|python\|go\|rust>]
argument-hint	[--check-only] [--fix] [--type <frontend\|python\|go\|rust>]
name	configure-dockerfile

/configure:dockerfile

Check and configure Dockerfile against project standards with emphasis on minimal images, non-root users, and multi-stage builds.

When to Use This Skill

Use this skill when...	Use another approach when...
Checking Dockerfile compliance with standards	Just viewing Dockerfile (use Read tool)
Creating Dockerfile from template	Dockerfile already follows all standards
Validating image size, security, multi-stage builds	Need container runtime config (use `/configure:container`)
Setting up minimal Alpine/slim-based images	Project uses specialized base images (custom requirements)
Ensuring non-root user configuration	Debugging container issues (check logs, inspect runtime)

Context

Dockerfiles: !find . -maxdepth 1 \( -name 'Dockerfile' -o -name 'Dockerfile.*' -o -name '*.Dockerfile' \)
Dockerignore: !find . -maxdepth 1 -name \'.dockerignore\'
Project type: !find . -maxdepth 1 \( -name 'package.json' -o -name 'pyproject.toml' -o -name 'Cargo.toml' -o -name 'go.mod' \) -print -quit
Base images: !find . -maxdepth 1 \( -name 'Dockerfile' -o -name 'Dockerfile.*' -o -name '*.Dockerfile' \) -exec grep -hm5 '^FROM' {} +

Parameters

Parse from command arguments:

--check-only: Report compliance status without modifications
--fix: Apply fixes automatically without prompting
--type <type>: Override project type detection (frontend, python, go, rust)

Execution

Execute this Dockerfile compliance check:

Step 1: Detect project type and Dockerfiles

Find Dockerfile(s) in project root
Detect project type from context (package.json, pyproject.toml, go.mod, Cargo.toml)
Parse Dockerfile to analyze current configuration
Apply --type override if provided

Step 2: Verify latest base image versions

Before flagging outdated base images, use WebSearch or WebFetch to verify latest versions:

Node.js Alpine: Check Docker Hub for latest LTS Alpine tags

Check	Standard	Severity
Build base	`node:24-alpine` (LTS)	WARN if other
Runtime base	`nginx:1.30-alpine`	WARN if other
Multi-stage	Required	FAIL if missing
HEALTHCHECK	Required	FAIL if missing
Non-root user	Required	FAIL if missing
Build caching	`--mount=type=cache` recommended	INFO
OCI Labels	Required for GHCR integration	WARN if missing

Check	Standard	Severity
Base image	`python:3.14-slim`	WARN if other
Multi-stage	Required for production	FAIL if missing
HEALTHCHECK	Required	FAIL if missing
Non-root user	Required	FAIL if missing
OCI Labels	Required for GHCR integration	WARN if missing

Label	Purpose	Severity
`org.opencontainers.image.source`	Links to repository	WARN if missing
`org.opencontainers.image.description`	Package description	WARN if missing
`org.opencontainers.image.licenses`	SPDX license identifier	WARN if missing
`org.opencontainers.image.version`	Semantic version (via ARG)	INFO if missing
`org.opencontainers.image.revision`	Git commit SHA (via ARG)	INFO if missing

Dockerfile Compliance Report
================================
Project Type: <type> (detected)
Dockerfile: ./Dockerfile (found)

Configuration Checks:
  Build base      <image>           [PASS|WARN]
  Runtime base    <image>           [PASS|WARN]
  Multi-stage     <N> stages        [PASS|FAIL]
  HEALTHCHECK     <present|missing> [PASS|FAIL]
  Non-root user   <present|missing> [PASS|FAIL]
  Build caching   <enabled|missing> [PASS|INFO]

OCI Labels Checks:
  image.source       <present|missing> [PASS|WARN]
  image.description  <present|missing> [PASS|WARN]
  image.licenses     <present|missing> [PASS|WARN]

Recommendations:
  <list specific fixes needed>

components:
  dockerfile: "2025.1"

FROM node:24-alpine AS build

ARG SENTRY_AUTH_TOKEN
ARG VITE_SENTRY_DSN

WORKDIR /app

COPY package*.json ./
RUN --mount=type=cache,target=/root/.npm npm ci

COPY . .
RUN --mount=type=cache,target=/root/.npm \
    --mount=type=cache,target=/app/node_modules/.vite \
    npm run build

FROM nginx:1.30-alpine

# OCI labels for GHCR integration
LABEL org.opencontainers.image.source="https://github.com/OWNER/REPO" \
      org.opencontainers.image.description="Production frontend application" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.vendor="Your Organization"

# Dynamic labels via build args
ARG VERSION=dev
ARG BUILD_DATE
ARG VCS_REF
LABEL org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.revision="${VCS_REF}"

COPY --from=build /app/dist /usr/share/nginx/html
COPY nginx/default.conf.template /etc/nginx/templates/

EXPOSE 80

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost/health || exit 1

FROM python:3.14-slim AS builder

WORKDIR /app
COPY pyproject.toml uv.lock ./
RUN pip install uv && uv sync --frozen --no-dev

FROM python:3.14-slim

# OCI labels for GHCR integration
LABEL org.opencontainers.image.source="https://github.com/OWNER/REPO" \
      org.opencontainers.image.description="Production Python API server" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.vendor="Your Organization"

ARG VERSION=dev
ARG BUILD_DATE
ARG VCS_REF
LABEL org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.revision="${VCS_REF}"

RUN useradd --create-home appuser
USER appuser
WORKDIR /app

COPY --from=builder /app/.venv /app/.venv
COPY --chown=appuser:appuser . .

ENV PATH="/app/.venv/bin:$PATH"
EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD curl -f http://localhost:8000/health || exit 1

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

Context	Command
Check Dockerfile exists	`find . -maxdepth 1 \( -name 'Dockerfile' -o -name 'Dockerfile.*' \) 2>/dev/null`
Validate multi-stage build	`grep -c '^FROM' Dockerfile 2>/dev/null`
Check for non-root user	`grep -E '^USER [^root]' Dockerfile 2>/dev/null`
Check base image	`grep '^FROM' Dockerfile \| head -1`
Quick compliance check	`/configure:dockerfile --check-only`
Auto-fix issues	`/configure:dockerfile --fix`