Aller au contenu principal

Skill: ops-docker

Inline

Docker and Docker Compose containerization. Trigger when the user wants to dockerize an application or create containers.

Configuration​

PropertyValue
Contextinline
Pre-approved toolsNone declared: the project's permission settings apply
Triggermanual only — run /ops-docker

Detailed description​

Docker Containerization (pointer)

Docker Inc. publishes its own agent skills at docker/skills (Apache-2.0, pin v0.3.1). Four of them cover what this skill used to teach — multi-stage builds, non-root users, .dockerignore, HEALTHCHECK, BuildKit secrets and cache mounts, Compose healthchecks and depends_on: service_healthy:

SkillUse it when
docker-project-foundationsDockerizing a project, local dev with containers
docker-build-strategiesWriting, slimming or hardening a Dockerfile
docker-compose-patternsWiring services, adding a database, Compose debugging
docker-destructive-guardrailsBefore any docker command that deletes or resets state
# pinned release (Docker's README documents the tree/<tag> form)
npx skills add https://github.com/docker/skills/tree/v0.3.1 --skill docker-project-foundations --yes
npx skills add https://github.com/docker/skills/tree/v0.3.1 --skill docker-build-strategies --yes
npx skills add https://github.com/docker/skills/tree/v0.3.1 --skill docker-compose-patterns --yes
npx skills add https://github.com/docker/skills/tree/v0.3.1 --skill docker-destructive-guardrails --yes

The repo's other seven skills (Docker Agent, Docker Sandboxes) are product-specific; install them only if you use those products. The three skills that ship a scripts/verify-*.sh only build the image and validate the Compose file.

Recipe entry: docs/recipes/recommended-vendor-skills.md §"Docker".

Foundation discipline the vendor skills leave out​

  • Scan the image before it ships: none of the four mentions vulnerability scanning. Gate the push on trivy image <image> (or Docker Scout, Grype) failing on HIGH/CRITICAL — the ops-ci skill wires it; qa-security owns the policy.
  • Lint the Dockerfile in CI: hadolint Dockerfile as a blocking step, also absent from the vendor skills.
  • Never bake secrets: no COPY .env, no credentials in ENV or build args — BuildKit --mount=type=secret at build time, orchestrator-injected env at run time (.claude/rules/security.md).

See also​

  • /ops:ops-deploy — deployment checklist consumes the built image
  • /ops:ops-database — Compose patterns for DB services
  • qa-security — image scanning gate before push
  • ops-ci — Hadolint + image scan as CI steps

Manual invocation only​

This skill carries disable-model-invocation: true, so Claude cannot load it — not when keywords match, and not from inside the same-named command either. Start it yourself with /ops-docker.

Context inline​

Inline means the skill runs in the conversation (the default, no context key):

  • Sees the full history
  • Its work is visible as it happens
  • Right for almost every skill

See also​