Verified SOP & TutorialAudited Score 98/100

The Complete Production SOP: How to Deploy and Run Docker Compose Production Profiles & Healthchecks in Autonomous AI Agents

Production SOP to install and execute the docker-compose-production-spec skill in Claude Code, Codex, and Cursor. Configure healthchecks and profiles cleanly.

Target Runtimes:codexclaude-codecursorwindsurf
5 min read • Updated for 2026

Technical Overview & Architectural Context

Without deterministic procedural boundaries, autonomous coding agents (Codex, Claude Code, Cursor, Windsurf) frequently generate fragile Docker Compose configurations. Common LLM hallucinations in DevOps include relying on deprecated Compose v1 keys, using simple boolean 'depends_on' arrays that lead to database race conditions before listening ports are bound, and omitting memory/CPU limits which risk host OOM kills. Furthermore, agents often overlook the distinction between compose profiles and baseline environments, causing test and debug services to leak into production orchestrations. The docker-compose-production-spec skill injects rigid, deterministic operational procedures into agent workflows. It enforces Compose Specification v2 conventions, mandatory 'condition: service_healthy' gating for upstream dependencies, container resource limits (deploy.resources.limits), explicit isolated bridge networking, and deterministic healthcheck probes using native tools such as pg_isready or curl. By confining the agent to clear workspace-scoped file mutations and programmatic validation with 'docker compose config', it eliminates deployment race conditions and sandbox permission violations.

Prerequisites & Environment Requirements

Docker Engine 24.0+ and Docker Compose v2.20+ installed on host
Claude Code CLI, OpenAI Codex CLI, Cursor IDE, or Windsurf installed
Git 2.40+ with initialized workspace repository
Non-root user group configured for Docker daemon socket access

Verified Search Intents & Long-Tail Queries Solved

SEO Audit Score: 98/100

This operational tutorial is engineered to provide deterministic solutions for these developer search queries:

#install docker-compose-production-spec in cursor ide#claude code docker compose healthcheck rules#codex docker-compose production spec setup tutorial#docker compose depends_on condition service_healthy error#docker compose profiles and resource limits agent SOP#docker-compose-production-spec sandbox permissions and security score#write docker-compose healthcheck prompt examples and triggers

Step-by-Step Execution Playbook

1

Local Environment Setup & SKILL.md Mounting

Create the local skill manifest directory and inject verified procedural rules into the agent runtime directory.

Agent runtimes such as Claude Code, Cursor, and Windsurf index skill directives by scanning dedicated workspace and system skill directories. We install the docker-compose-production-spec manifest into '~/.agents/skills/docker-compose-production-spec/SKILL.md' or within the project-level '.claude/skills' directory so triggers match instantly when asking to write compose healthchecks or configure resource limits.

Terminal Command
mkdir -p ~/.agents/skills/docker-compose-production-spec && curl -fsSL https://askills.dev/api/skills/docker-compose-production-spec/raw -o ~/.agents/skills/docker-compose-production-spec/SKILL.md
~/.agents/skills/docker-compose-production-spec/SKILL.md
---
name: "docker-compose-production-spec"
description: "Orchestrate multi-container application stacks with production compose specifications."
metadata:
  author: "Docker"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "write docker-compose healthcheck"
  - "set docker compose resource limits"
  - "docker compose profiles"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Docker Compose Production Profiles & Healthchecks SOP
1. Define healthcheck on database services (e.g. pg_isready -U postgres) with interval 10s, timeout 5s, retries 5.
2. Enforce condition: service_healthy in depends_on blocks for deterministic startup ordering.
3. Assign deploy.resources.limits (e.g. cpus: '2.0', memory: 2048M) on all persistent workloads.
4. Segregate development utilities into explicit profiles (e.g., profiles: ['debug', 'tools']).
5. Validate compose syntax using `docker compose config`.
Production Pro-Tip

Keep the skill markdown focused on constraints and deterministic YAML contracts. Omitting lengthy narrative prose preserves over 1,500 LLM context window tokens per session.

Sandbox Gotcha

Ensure directory permissions match your current user UID/GID. If the agent runs inside a sandboxed subshell without write access to ~/.agents, mount the skill directly in ./.cursor/rules or ./.claude/rules.

2

Environment Secrets & Dependency Validation

Define environment templates and bridge network configurations without leaking secrets into conversation history.

Production compose specifications must never hardcode secrets. This step establishes an '.env.example' contract and configures externalized secret variables, preventing agents from injecting test credentials or ephemeral host parameters directly into the version-controlled 'docker-compose.yml'.

Terminal Command
touch .env.example && printf 'POSTGRES_USER=postgres\nPOSTGRES_PASSWORD=change_me_in_vault\nPOSTGRES_DB=app_prod\nNODE_ENV=production\n' >> .env.example
.env.example
POSTGRES_USER=postgres
POSTGRES_PASSWORD=replace_with_strong_password
POSTGRES_DB=production_db
APP_PORT=8080
REDIS_HOST=cache
COMPOSE_PROFILES=production
Production Pro-Tip

Instruct the agent to reference ${VAR:?error_message} expansion syntax in docker-compose.yml so execution halts if an essential environment variable is omitted at runtime.

Sandbox Gotcha

Verify that '.env' and '*.env.local' are listed in your repository '.gitignore'. Autonomous agents with fs_write access will create .env if unprompted.

3

Intent Matching & Trigger Invocation

Invoke the skill using precise trigger phrases to generate production-hardened compose configurations.

Provide a prompt containing the designated frontmatter triggers: 'write docker-compose healthcheck' and 'set docker compose resource limits'. The agent matches the trigger against its installed SKILL.md registry and applies the procedural rules for dependency ordering and limits.

docker-compose.yml
services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2048M
    networks:
      - internal_net

  api:
    image: ghcr.io/org/api:v1.0.0
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
    ports:
      - "127.0.0.1:8080:8080"
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1024M
    networks:
      - internal_net

networks:
  internal_net:
    driver: bridge

volumes:
  pgdata:
    driver: local
Production Pro-Tip

Always pair 'write docker-compose healthcheck' with 'set docker compose resource limits' in your initial prompt to generate full production-grade service stanzas in one pass.

4

Verification, Linting & Output Quality Gate

Execute automated self-healing checks and validate Compose specification schema compliance.

Before accepting changes from the agent, run the Docker Compose validation engine. This step ensures that all healthcheck intervals, YAML indentations, deploy resource schemas, and profile flags strictly adhere to Compose v2 specification standards.

Terminal Command
docker compose config --quiet && echo 'Docker Compose production configuration valid.'
Production Pro-Tip

Run 'docker compose --profile debug config' to check configuration resolution across non-default execution profiles without spinning up real containers.

Real-World Scenario: Configure Zero-Downtime PostgreSQL and Node.js Microservice with Diagnostic Profiles

Tested Trigger Prompt (Feed directly into Codex, Claude, or Cursor):

“Refactor our docker-compose.yml: write docker-compose healthcheck for postgres, set docker compose resource limits on all services, and add a pgadmin service assigned to a docker compose profiles debug block.”

Deterministic Agent Verification Pipeline:
Scans the current workspace for existing docker-compose.yml and database connection configuration.
Applies the SKILL.md SOP to add a comprehensive pg_isready healthcheck with interval 10s, timeout 5s, retries 5, and start_period 10s.
Updates the upstream Node.js service depends_on block from standard array syntax to a mapping containing 'condition: service_healthy'.
Applies deploy.resources.limits to both postgres (2.0 CPU, 2048MB RAM) and the Node.js API (1.0 CPU, 1024MB RAM).
Defines a pgadmin service containing 'profiles: ["debug"]' and configures isolated bridge networking.
Executes 'docker compose config' to verify configuration validity.

Runtime Troubleshooting & Failure Modes

Error: service "api" depends on undefined service "db": invalid compose project

Root Cause: The agent renamed or missed the target database service identifier when reformatting the 'depends_on' block from a plain sequence list into an explicit condition object.

Resolution Command / Fix:
Ensure service keys match exactly: 'depends_on:\n  db:\n    condition: service_healthy' where 'db' is identical to the top-level service key under 'services:'.
Error: container for service "api" failed to start: dependency failed to start: container for "db" is unhealthy

Root Cause: The healthcheck command executed inside the container without necessary variables or before the database initialization scripts finished, exceeding the retries counter.

Resolution Command / Fix:
Add 'start_period: 20s' to the db healthcheck block and ensure the check command specifies the username: 'test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]'.

Frequently Asked Questions (Docker Compose Production Profiles & Healthchecks SOP)

Q:Can I use Docker Compose Production Profiles & Healthchecks across Codex, Claude Code, and Cursor simultaneously?

Yes. The SKILL.md format is runtime-agnostic. Runtimes supporting the agent skill convention (including Codex Desktop, Claude Code CLI, Cursor, and Windsurf) parse the YAML frontmatter triggers and append the procedural guidance to context dynamically.

Q:How does Docker Compose Production Profiles & Healthchecks prevent context window overflow during long agent sessions?

The skill provides terse, rule-based procedural guidance and sample schemas rather than massive documentation dumps. This constraints the agent prompt overhead to less than 250 tokens per conversation turn while ensuring strict adherence to Compose v2 specs.

Q:Does this skill require escalated root or container permissions?

No. The skill is audited with a security score of 98/100. It requires only standard workspace file read and write permissions (fs_write: workspace) to update configuration files. Shell execution and network access are disabled within the skill contract itself.

Ready to equip your autonomous agent with Docker Compose Production Profiles & Healthchecks?

Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.

Get 1-Click Install Spec