Docker Author

Write Dockerfiles and Compose files that pass a docker-doctor scan on the first try. Every default below maps to a rule the scanner enforces — this skill front-loads them so the generated file starts at a high health score instead of being fixed afterward.

The loop: author → npx @docker-doctor/cli@latest . --verbose → fix anything flagged → aim for Excellent 🏆 (score ≥ 90). Don't hand back a Dockerfile you haven't scanned.

Production defaults (each maps to a docker-doctor rule)

Apply these when authoring. If you deviate, say why.

Beyond the rules: enable BuildKit and use RUN --mount=type=cache for package managers (faster rebuilds without bloating layers) and RUN --mount=type=secret for build-time credentials (keeps them out of the image).

Canonical multi-stage template (Node — adapt per stack)

# syntax=docker/dockerfile:1
FROM node:22-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci

FROM node:22-alpine AS build
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build

FROM node:22-alpine AS runtime
WORKDIR /app
ENV NODE_ENV=production
LABEL org.opencontainers.image.source="https://github.com/acme/app"
COPY --from=build /app/dist ./dist
COPY --from=deps /app/node_modules ./node_modules
USER node
HEALTHCHECK --interval=30s --timeout=3s CMD wget -q --spider http://localhost:3000/health || exit 1
CMD ["node", "dist/server.js"]

Compose defaults (each maps to a Compose rule)

Verify before handing off

npx @docker-doctor/cli@latest . --verbose

Fix every ERROR, then WARN. If a flagged rule genuinely doesn't apply, don't silently ignore it — either explain the trade-off or configure it (see the docker-doctor skill's references/explain.md). Inside this repo, run bun packages/docker-doctor/src/cli.ts . instead of npx.