Docker Development

Smaller images. Faster builds. Secure containers. No guesswork.

Opinionated Docker workflow that turns bloated Dockerfiles into production-grade containers. Covers optimization, multi-stage builds, compose orchestration, and security hardening.

Not a Docker tutorial — a set of concrete decisions about how to build containers that don't waste time, space, or attack surface.

Slash Commands

When This Skill Activates

Recognize these patterns from the user:

• - "Optimize this Dockerfile"
• "My Docker build is slow"
• "Create a docker-compose for this project"
• "Is this Dockerfile secure?"
• "Reduce my Docker image size"
• "Set up multi-stage builds"
• "Docker best practices for [language/framework]"
• Any request involving: Dockerfile, docker-compose, container, image size, build cache, Docker security

If the user has a Dockerfile or wants to containerize something → this skill applies.

Workflow

/docker:optimize — Dockerfile Optimization

1. 1. Analyze current state

1. 2. Apply optimization checklist

CODEBLOCK0

1. 3. Generate optimized Dockerfile

1. 4. Validate

/docker:compose — Docker Compose Configuration

1. 1. Identify services

1. 2. Apply compose best practices

CODEBLOCK2

1. 3. Generate compose file

/docker:security — Container Security Audit

1. 1. Dockerfile audit

| Check | Severity | Fix |
|-------|----------|-----|
| Running as root | Critical | Add USER nonroot after creating user |
| Using :latest tag | High | Pin to specific version |
| Secrets in ENV/ARG | Critical | Use BuildKit secrets: --mount=type=secret |
| COPY with broad glob | Medium | Use specific paths, add .dockerignore |
| Unnecessary EXPOSE | Low | Only expose ports the app uses |
| No HEALTHCHECK | Medium | Add HEALTHCHECK with appropriate interval |
| Privileged instructions | High | Avoid --privileged, drop capabilities |
| Package manager cache retained | Low | Clean in same RUN layer |

1. 2. Runtime security checks

| Check | Severity | Fix |
|-------|----------|-----|
| Container running as root | Critical | Set user in Dockerfile or compose |
| Writable root filesystem | Medium | Use read_only: true in compose |
| All capabilities retained | High | Drop all, add only needed: cap_drop: [ALL] |
| No resource limits | Medium | Set mem_limit and cpus |
| Host network mode | High | Use bridge or custom network |
| Sensitive mounts | Critical | Never mount /etc, /var/run/docker.sock in prod |
| No log driver configured | Low | Set logging: with size limits |

1. 3. Generate security report

   SECURITY AUDIT — [Dockerfile/Image name]
   Date: [timestamp]

   CRITICAL: [count]
   HIGH:     [count]
   MEDIUM:   [count]
   LOW:      [count]

   [Detailed findings with fix recommendations]
   

Tooling

scripts/dockerfile_analyzer.py

CLI utility for static analysis of Dockerfiles.

Features:

• - Layer count and optimization suggestions
• Base image analysis with size estimates
• Anti-pattern detection (15+ rules)
• Security issue flagging
• Multi-stage build detection and validation
• JSON and text output

Usage:
CODEBLOCK4

scripts/compose_validator.py

CLI utility for validating docker-compose files.

Features:

• - Service dependency validation
• Healthcheck presence detection
• Network configuration analysis
• Volume mount validation
• Environment variable audit
• Port conflict detection
• Best practice scoring

Usage:

# Validate a compose file
python3 scripts/compose_validator.py docker-compose.yml

# JSON output
python3 scripts/compose_validator.py docker-compose.yml --output json

# Strict mode (fail on warnings)
python3 scripts/compose_validator.py docker-compose.yml --strict

Multi-Stage Build Patterns

Pattern 1: Compiled Language (Go, Rust, C++)

CODEBLOCK6

Pattern 2: Node.js / TypeScript

CODEBLOCK7

Pattern 3: Python

CODEBLOCK8

Base Image Decision Tree

CODEBLOCK9

Proactive Triggers

Flag these without being asked:

• - Dockerfile uses :latest → Suggest pinning to a specific version tag.
• No .dockerignore → Create one. At minimum: .git, node_modules, __pycache__, .env.
• COPY . . before dependency install → Cache bust. Reorder to install deps first.
• Running as root → Add USER instruction. No exceptions for production.
• Secrets in ENV or ARG → Use BuildKit secret mounts. Never bake secrets into layers.
• Image over 1GB → Multi-stage build required. No reason for a production image this large.
• No healthcheck → Add one. Orchestrators (Compose, K8s) need it for proper lifecycle management.
• apt-get without cleanup in same layer → rm -rf /var/lib/apt/lists/* in the same RUN.

Installation

One-liner (any tool)

Multi-tool install

OpenClaw

clawhub install cs-docker-development

Related Skills

• - senior-devops — Broader DevOps scope (CI/CD, IaC, monitoring). Complementary — use docker-development for container-specific work, senior-devops for pipeline and infrastructure.
• senior-security — Application security. Complementary — docker-development covers container security, senior-security covers application-level threats.
• autoresearch-agent — Can optimize Docker build times or image sizes as measurable experiments.
• ci-cd-pipeline-builder — Pipeline construction. Complementary — docker-development builds the containers, ci-cd-pipeline-builder deploys them.