Claude Cursor Skill

container-standards

Container build and runtime standards: multi-stage builds into a minimal runtime (Alpine/Distroless/Scratch), manifest-before-source layer ordering for cache hits, non-root user, vulnerability scan failing on HIGH/CRITICAL, no secrets in the image, tini/dumb-init as PID 1, HEALTH

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download goldziher-ai-rulez-internal_builtins_universal_docker_skills_container-standards-ca967ad.zip · 0 KB

goldziher/ai-rulez 162 16 forks MIT Updated 5h ago

Part of goldziher/ai-rulez — 151 skills

Install

skills CLI

npx skills add https://github.com/Goldziher/ai-rulez/tree/main/internal/builtins/universal/docker/skills/container-standards

Claude Code claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install goldziher-ai-rulez@llmmart

Git git clone https://github.com/Goldziher/ai-rulez.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole goldziher/ai-rulez collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Multi-stage builds: full toolchain builder → minimal runtime (Alpine/Distroless/Scratch).
Layer caching: copy dependency manifests first, then source — maximize cache hits.
Security: non-root user, vulnerability scanning (fail on HIGH/CRITICAL), no secrets in the image.
Signal handling: use an init process (tini/dumb-init) as PID 1, and define a HEALTHCHECK.
Tagging: semantic version + commit SHA, never reuse a tag.

Files (ai-rulez)

SKILL.md 953 B

---
name: container-standards
description: "Container build and runtime standards: multi-stage builds into a minimal runtime (Alpine/Distroless/Scratch), manifest-before-source layer ordering for cache hits, non-root user, vulnerability scan failing on HIGH/CRITICAL, no secrets in the image, tini/dumb-init as PID 1, HEALTHCHECK, and semver+SHA tags that are never reused. Load when writing or reviewing a Dockerfile, docker-compose file, container build pipeline, or image tagging scheme."
---

- **Multi-stage builds**: full toolchain builder → minimal runtime (Alpine/Distroless/Scratch).
- **Layer caching**: copy dependency manifests first, then source — maximize cache hits.
- **Security**: non-root user, vulnerability scanning (fail on HIGH/CRITICAL), no secrets in the image.
- **Signal handling**: use an init process (tini/dumb-init) as PID 1, and define a `HEALTHCHECK`.
- **Tagging**: semantic version + commit SHA, never reuse a tag.