Docker Deploy

What it does

When your agent uses it

• Reviewing a Dockerfile
• Docker-compose setup
• Container image build for a project
• Debugging a container that wont build

Example prompts

• “t build, start, or stay healthy. Triggers: user says”
• “Dockerfile”
• “container”
• “/docker-deploy”

Requirements

• Python 3
• Node.js
• Docker

Workflow steps

9 steps, taken from the first numbered list in SKILL.md.

1. 1Multi-stage builds: build with the toolchain and dev dependencies, ship a
2. 2Pin the base image to a specific version tag (optionally a digest); never
3. 3Order layers for caching: copy dependency manifests and the lockfile,
4. 4Install from the lockfile (npm ci, pnpm install --frozen-lockfile,
5. 5Run as a non-root user, and make only the paths the app writes to writable.
6. 6No secrets in the image — no ARG/ENV for credentials, no copied .env.
7. 7Use the exec form for ENTRYPOINT/CMD so signals reach the process, and
8. 8Keep a .dockerignore that excludes .git, dependency folders, build output,
9. 9Add a HEALTHCHECK for long-running services, pointing at a cheap readiness

What it can do on your machine

Read from SKILL.md and the folder at commit 57f6018. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • docker
  • git
  • npm
  • pnpm
  • pip
  • go

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use docker, git, npm, pnpm and pip, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • POSTGRES_PASSWORD

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Docker Deploy loads about 1.3k tokens when it runs. Until then it costs about 93 tokens; SKILL.md has 467 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~93

When it runs · the whole SKILL.md, loaded when a task matches

~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:32

  `ARG`/`ENV` for credentials, no copied `.env`.

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:71

  mount=type=secret,id=npmrc,target=/root/.npmrc pnpm install --frozen-lockfile

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:75

  ocker build --secret id=npmrc,src=$HOME/.npmrc -t app:$(git rev-parse --short HEAD) .

• NoteMentions a .env fileSKILL.md:85

  env_file: .env

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from WrongStack/WrongStack at commit 57f6018, republished under its MIT licence (© WrongStack). 467 words, ~1,289 tokens.

name

docker-deploy

description

Use this skill when writing or reviewing a Dockerfile, docker-compose setup, or container image build for a project, or when debugging a container that won't build, start, or stay healthy. Triggers: user says "docker", "Dockerfile", "container", "image", "docker compose", "containerize", "multi-stage", "distroless", "registry", "healthcheck", "image size".

version

2.0.0

required-capabilities

filesystem.read, filesystem.write, execution.shell

# syntax=docker/dockerfile:1
FROM node:22-bookworm-slim AS build
WORKDIR /app
RUN corepack enable
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile
COPY . .
RUN pnpm build && pnpm prune --prod

FROM node:22-bookworm-slim AS runtime
ENV NODE_ENV=production
WORKDIR /app
COPY --from=build --chown=node:node /app/node_modules ./node_modules
COPY --from=build --chown=node:node /app/dist ./dist
COPY --from=build --chown=node:node /app/package.json ./
USER node
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
CMD ["node", "dist/server.js"]

RUN --mount=type=secret,id=npmrc,target=/root/.npmrc pnpm install --frozen-lockfile

docker build --secret id=npmrc,src=$HOME/.npmrc -t app:$(git rev-parse --short HEAD) .

services:
  app:
    build: .
    ports: ["3000:3000"]
    env_file: .env
    depends_on:
      db:
        condition: service_healthy
  db:
    image: postgres:17
    environment:
      POSTGRES_PASSWORD: dev-only
    volumes: [db-data:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      retries: 10
volumes:
  db-data:

© WrongStack, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in packages/core/skills/docker-deploy of WrongStack/WrongStack.

• SKILL.md
• SKILL.save.md

Open the folder on GitHubat commit 57f6018