菜单
Docker best practices: image security, build efficiency, runtime hardening, Compose, local tooling (Colima, OrbStack). Use when writing or reviewing Dockerfiles and Compose files.
AWS best practices: IAM, secrets, networking, security, compute, IaC, ops. Use when building, reviewing, or modifying AWS resources.
GCP best practices: IAM, secrets, networking, security, compute, IaC, ops. Use when building, reviewing, or modifying GCP resources.
Idiomatic Go 1.25 practices: errors, interfaces, concurrency, generics, testing, security, tooling. Use when writing or reviewing Go code.
Modern Java practices: design, errors, concurrency, security, testing, tooling. Targets Java 21 LTS baseline; Java 25 LTS features called out explicitly. Use when writing or reviewing Java code.
Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions, and define verifiable success criteria.
Kubernetes best practices: security, workloads, networking, config, operations, GitOps. Use when writing or reviewing K8s manifests and configurations.
| name | docker |
| description | Docker best practices: image security, build efficiency, runtime hardening, Compose, local tooling (Colima, OrbStack). Use when writing or reviewing Dockerfiles and Compose files. |
nonroot, node user in Node images, nobody in Alpine. Otherwise add non-root user and switch: USER appuserdistroless, alpine, or official slim variantsFROM node:latest or image: myapp:latest in Compose--platform linux/amd64,linux/arm64 for cross-platform targetsDOCKER_BUILDKIT=1. Use --mount=type=cache for dependency caches, --mount=type=secret for build-time secretsCOPY specific files. Avoid COPY . . when targeted copy sufficesCOPY package.json before COPY src/.dockerignore: exclude .git, node_modules, test files, secrets, .envWORKDIR. No implicit root working dirENTRYPOINT for executable, CMD for default argsENV, ARG, or RUN — persist in layer history. Use --mount=type=secretHEALTHCHECK on all long-running services--read-only--cap-drop ALL --cap-add NET_BIND_SERVICE--privileged in production--memory, --cpus--log-opt max-size=10m --log-opt max-file=3. Unbounded logs fill diskscompose.yml for local dev only. Production: Kubernetes, ECS, or equivalentdepends_on + condition: service_healthyenv_file for local config. Never commit .env with real secretsrestart: unless-stopped for crash-resilient servicesprofiles: for optional services (e.g. debug tools, mock servers). Keep default startup leandocker system prune -f regularly. Dangling images and stopped containers accumulate fastdocker image prune -a to remove unused images. Run in CI after buildsdive before pushing large imagescolima start --cpu 4 --memory 8 --disk 60. Default VM is undersizeddocker context use colimacolima stop when not in use. Idle VM still consumes resources~/.lima/<profile> for multiple VM profiles (e.g. arm64, rosetta)