The image goes to production: minimal, non-root and signed — no negotiation.
Multi-stage Dockerfile pinned by digest, non-root, no secrets in layers, with an SBOM, a blocking scan and a cosign signature. The container starts with no privileges at all.
$ schematize install dockerNon-negotiable floors
Never switched off "to go faster". Full list in the skill.
Base pinned by digest
FROM image:tag@sha256, never a moving tag or latest; Renovate or Dependabot renews the digest, in a PR with a scan.
Non-root with a numeric UID
USER 10001:10001 in the final stage; without USER the container runs as root.
Secrets out of ARG, ENV and layers
Build secrets only through RUN --mount=type=secret; runtime secrets arrive at start. COPY .env and private keys are forbidden.
Minimal multi-stage image
The toolchain stays in the build stage; the final image carries the binary or runtime and nothing else, with a .dockerignore excluding .env and .git.
Provenance on the way out
SBOM and provenance on push, a scan that blocks on HIGH/CRITICAL and a cosign signature by digest, verified at admission.
Immutable tag and deploy by digest
The tag is the git sha, deploys reference the digest, latest does not exist in a deploy registry and rollback is a redeploy of the previous digest.
Unprivileged container
read_only, cap_drop ALL, no-new-privileges and resource limits; never --privileged, a mounted docker.sock or net=host.
Commands
Installed in .claude/commands/. Run /docker-help anytime.
/docker-buildGenerates or adjusts the stack Dockerfile from the examples and proves it passes the gate./docker-ccContext compact: writes context + checklist to the archive and runs /compact./docker-claudeCreates or merges the always-on Docker CLAUDE.md at the repo root (won't overwrite other skills' blocks)./docker-composeAudits or generates the dev/hml compose: profiles, healthcheck, closed database and .env out of git./docker-handoffWrites the context handoff without compacting — session end or task switch./docker-hardenHardens image and runtime: minimal base, non-root, read-only, cap_drop and limits./docker-helpLists every command./docker-loadForce-loads the whole normative body: Dockerfile, supply chain, runtime, compose and languages./docker-reviewReviews Dockerfile and compose against the floor: runs both gates (plus hadolint if present) and reads what the machine cannot./docker-scanA blocking scan plus SBOM, provenance, signing and verification (trivy, grype or scout, cosign).For AI agents
Install with no human in the loop. Metadata in llms.txt.
- Run: git clone https://github.com/schematizeme/skill-docker.git && ./skill-docker/install.sh
- Or download: https://github.com/schematizeme/skill-docker/releases/latest/download/skill-docker.zip and unzip into .claude/skills/
- Copy assets/CLAUDE.md to the repo root (always-on rule).
- Confirm with /docker-help.
Обсуждение
Загрузка…