Generate Optimized Dockerfiles

This skill provides expertise in Docker containerization and Dockerfile creation, with deep knowledge of container optimization, security best practices, and multi-stage builds, producing efficient, secure, and maintainable Dockerfiles for various application stacks and deployment scenarios. Core Dockerfile principles cover layer optimization (minimizing layer count by combining related RUN commands, ordering instructions from least to most frequently changed for cache efficiency, using .dockerignore to exclude unneeded files from build context, using multi-stage builds to shrink final image size) and security best practices (running containers as non-root users where possible, using specific image tags instead of latest, scanning base images for vulnerabilities, minimizing attack surface with minimal base images).

Multi-stage build patterns are demonstrated for Node.js (a builder stage running npm ci --only=production and a build step, then a production stage creating a non-root nextjs user and copying only the built output), Python (a builder stage installing dependencies to a user directory, then a production stage running as a non-root app user with uvicorn), Java Spring Boot (a Gradle builder stage producing a boot jar, then a JRE-slim runtime stage running as a non-root user), and Go (a builder stage compiling a statically linked CGO-disabled binary, deployed to a distroless static image running as nonroot:nonroot).

Base image selection strategy covers Alpine variants for smaller size, distroless images for maximum security, and scratch for static binaries. Optimization techniques cover dependency-layer caching (copying dependency manifests before source code so dependency installation layers are cached), build arguments and environment variables (ARG/ENV for version and environment configuration, with LABEL metadata), and health checks (a HEALTHCHECK instruction with interval/timeout/retries against an HTTP health endpoint).

Security hardening covers creating non-root users (via useradd/groupadd or Alpine's addgroup/adduser, then COPY --chown and USER) and minimal package installation (apt-get install --no-install-recommends followed by cleaning the apt cache). Advanced techniques cover BuildKit cache mounts (RUN --mount=type=cache to persist package manager caches like npm/pnpm across builds) and secret mounts (RUN --mount=type=secret to use credentials during build without baking them into image layers). Debugging and development support a development-stage override installing extra tooling (vim, curl) and running a dev command instead of production entrypoint.

Use this skill when writing or optimizing a Dockerfile - implementing multi-stage builds, choosing a minimal/distroless base image, hardening with a non-root user, or adding BuildKit cache/secret mounts. It is well suited to applications being containerized for production deployment where image size, security, and build cache efficiency matter. It is not meant for quick throwaway local containers with no production deployment or security requirements.

Input: the application's language/framework stack and its production deployment requirements.

Output: a multi-stage Dockerfile with a hardened, minimal production image. Example multi-stage Node.js production stage:

FROM node:18-alpine AS production
RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
WORKDIR /app
COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist
USER nextjs
EXPOSE 3000
CMD ["node", "dist/server.js"]

Works with Docker and BuildKit, Alpine and distroless base images, and standard language toolchains (Node.js, Python, Java/Gradle, Go).

DevOps and backend engineers writing production Dockerfiles, and teams that need optimized, security-hardened multi-stage builds rather than single-stage images with unnecessary size and root-user risk.