Generate Production-Ready Docker Compose Files

This skill is expert in Docker Compose and container orchestration, specializing in production-ready, scalable, maintainable multi-container applications, with knowledge of service dependencies, networking, volume management, environment configuration, and deployment strategies. Its core principles are service isolation (single responsibility, independent scalability), environment parity between dev/test/production, externalized configuration via environment variables and config files, network segmentation with proper isolation, deliberate data persistence strategy, and built-in health monitoring. It covers resource management (CPU/memory limits and reservations with restart policies), health checks with configurable interval/timeout/retries/start_period, multi-network architecture (separate frontend, internal backend, and internal database networks with services joined only to the networks they need), service discovery via environment variables and depends_on with service_healthy conditions, volume persistence patterns (named volumes plus bind-mounted directories), multi-environment configuration via base and override compose files, and secrets management using file-based or external secrets rather than plain environment variables.

Use this skill when composing a production multi-container application that needs real network segmentation, health-gated startup ordering, and secrets management - not a quick single-container docker run replacement. It provides a complete production pattern: a Traefik reverse proxy routing by Host rule, a frontend depending on the API, an API with health-gated database dependency and Traefik routing labels, and a Postgres database with a pg_isready health check, all wired across frontend/backend networks. It covers performance guidance (multi-stage builds, volume-mount caching, resource limits, Alpine-based images), security hardening (non-root users, secrets instead of env vars for sensitive data, network segmentation, regular base-image updates), and a separate dev-mode override with live code mounting, node_modules volume exclusion, and a debug port exposed. It is not a guide for single-container deployments or for orchestration beyond Compose's scope - its own scaling guidance is to consider Docker Swarm mode or Kubernetes for larger deployments once Compose's model no longer fits.

version: '3.8'

services:
  reverse-proxy:
    image: traefik:v2.9
    command:
      - --api.insecure=true
      - --providers.docker=true
      - --entrypoints.web.address=:80
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - frontend

  api:
    build: ./api
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://postgres:${DB_PASSWORD}@db:5432/app
    labels:
      - "traefik.http.routers.api.rule=Host(`api.localhost`)"
    depends_on:
      db:
        condition: service_healthy
    networks:
      - frontend
      - backend

  db:
    image: postgres:15-alpine
    environment:
      - POSTGRES_PASSWORD=${DB_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

Given an application's services, the skill produces complete docker-compose.yml files like the one above - reverse proxy, frontend, API, and database wired with health checks and network segmentation - plus resource-limited service definitions, base/production/dev override file sets, secrets blocks with file or external sources, and volume definitions covering named persistent volumes and bind-mounted directories.

DevOps and backend engineers composing multi-container applications for production who need real network isolation, health-gated startup, and secrets management rather than a flat single-network Compose file. It suits teams that maintain separate dev/prod override files, care about image size and caching (multi-stage builds, Alpine images), and plan to scale beyond Compose eventually - the skill explicitly frames itself as the right tool up to a point, after which Swarm or Kubernetes takes over.