The Complete Production SOP: How to Deploy and Run Docker Compose Production Profiles & Healthchecks in Autonomous AI Agents
Production SOP to install and execute the docker-compose-production-spec skill in Claude Code, Codex, and Cursor. Configure healthchecks and profiles cleanly.
Technical Overview & Architectural Context
Without deterministic procedural boundaries, autonomous coding agents (Codex, Claude Code, Cursor, Windsurf) frequently generate fragile Docker Compose configurations. Common LLM hallucinations in DevOps include relying on deprecated Compose v1 keys, using simple boolean 'depends_on' arrays that lead to database race conditions before listening ports are bound, and omitting memory/CPU limits which risk host OOM kills. Furthermore, agents often overlook the distinction between compose profiles and baseline environments, causing test and debug services to leak into production orchestrations. The docker-compose-production-spec skill injects rigid, deterministic operational procedures into agent workflows. It enforces Compose Specification v2 conventions, mandatory 'condition: service_healthy' gating for upstream dependencies, container resource limits (deploy.resources.limits), explicit isolated bridge networking, and deterministic healthcheck probes using native tools such as pg_isready or curl. By confining the agent to clear workspace-scoped file mutations and programmatic validation with 'docker compose config', it eliminates deployment race conditions and sandbox permission violations.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules into the agent runtime directory.
Agent runtimes such as Claude Code, Cursor, and Windsurf index skill directives by scanning dedicated workspace and system skill directories. We install the docker-compose-production-spec manifest into '~/.agents/skills/docker-compose-production-spec/SKILL.md' or within the project-level '.claude/skills' directory so triggers match instantly when asking to write compose healthchecks or configure resource limits.
mkdir -p ~/.agents/skills/docker-compose-production-spec && curl -fsSL https://askills.dev/api/skills/docker-compose-production-spec/raw -o ~/.agents/skills/docker-compose-production-spec/SKILL.md---
name: "docker-compose-production-spec"
description: "Orchestrate multi-container application stacks with production compose specifications."
metadata:
author: "Docker"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "write docker-compose healthcheck"
- "set docker compose resource limits"
- "docker compose profiles"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---
# Docker Compose Production Profiles & Healthchecks SOP
1. Define healthcheck on database services (e.g. pg_isready -U postgres) with interval 10s, timeout 5s, retries 5.
2. Enforce condition: service_healthy in depends_on blocks for deterministic startup ordering.
3. Assign deploy.resources.limits (e.g. cpus: '2.0', memory: 2048M) on all persistent workloads.
4. Segregate development utilities into explicit profiles (e.g., profiles: ['debug', 'tools']).
5. Validate compose syntax using `docker compose config`.Keep the skill markdown focused on constraints and deterministic YAML contracts. Omitting lengthy narrative prose preserves over 1,500 LLM context window tokens per session.
Ensure directory permissions match your current user UID/GID. If the agent runs inside a sandboxed subshell without write access to ~/.agents, mount the skill directly in ./.cursor/rules or ./.claude/rules.
Environment Secrets & Dependency Validation
Define environment templates and bridge network configurations without leaking secrets into conversation history.
Production compose specifications must never hardcode secrets. This step establishes an '.env.example' contract and configures externalized secret variables, preventing agents from injecting test credentials or ephemeral host parameters directly into the version-controlled 'docker-compose.yml'.
touch .env.example && printf 'POSTGRES_USER=postgres\nPOSTGRES_PASSWORD=change_me_in_vault\nPOSTGRES_DB=app_prod\nNODE_ENV=production\n' >> .env.examplePOSTGRES_USER=postgres
POSTGRES_PASSWORD=replace_with_strong_password
POSTGRES_DB=production_db
APP_PORT=8080
REDIS_HOST=cache
COMPOSE_PROFILES=productionInstruct the agent to reference ${VAR:?error_message} expansion syntax in docker-compose.yml so execution halts if an essential environment variable is omitted at runtime.
Verify that '.env' and '*.env.local' are listed in your repository '.gitignore'. Autonomous agents with fs_write access will create .env if unprompted.
Intent Matching & Trigger Invocation
Invoke the skill using precise trigger phrases to generate production-hardened compose configurations.
Provide a prompt containing the designated frontmatter triggers: 'write docker-compose healthcheck' and 'set docker compose resource limits'. The agent matches the trigger against its installed SKILL.md registry and applies the procedural rules for dependency ordering and limits.
services:
db:
image: postgres:16-alpine
restart: unless-stopped
environment:
POSTGRES_USER: ${POSTGRES_USER}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
POSTGRES_DB: ${POSTGRES_DB}
volumes:
- pgdata:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
deploy:
resources:
limits:
cpus: '2.0'
memory: 2048M
networks:
- internal_net
api:
image: ghcr.io/org/api:v1.0.0
restart: unless-stopped
depends_on:
db:
condition: service_healthy
environment:
DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
ports:
- "127.0.0.1:8080:8080"
deploy:
resources:
limits:
cpus: '1.0'
memory: 1024M
networks:
- internal_net
networks:
internal_net:
driver: bridge
volumes:
pgdata:
driver: localAlways pair 'write docker-compose healthcheck' with 'set docker compose resource limits' in your initial prompt to generate full production-grade service stanzas in one pass.
Verification, Linting & Output Quality Gate
Execute automated self-healing checks and validate Compose specification schema compliance.
Before accepting changes from the agent, run the Docker Compose validation engine. This step ensures that all healthcheck intervals, YAML indentations, deploy resource schemas, and profile flags strictly adhere to Compose v2 specification standards.
docker compose config --quiet && echo 'Docker Compose production configuration valid.'Run 'docker compose --profile debug config' to check configuration resolution across non-default execution profiles without spinning up real containers.
Real-World Scenario: Configure Zero-Downtime PostgreSQL and Node.js Microservice with Diagnostic Profiles
“Refactor our docker-compose.yml: write docker-compose healthcheck for postgres, set docker compose resource limits on all services, and add a pgadmin service assigned to a docker compose profiles debug block.”
Runtime Troubleshooting & Failure Modes
Root Cause: The agent renamed or missed the target database service identifier when reformatting the 'depends_on' block from a plain sequence list into an explicit condition object.
Ensure service keys match exactly: 'depends_on:\n db:\n condition: service_healthy' where 'db' is identical to the top-level service key under 'services:'.Root Cause: The healthcheck command executed inside the container without necessary variables or before the database initialization scripts finished, exceeding the retries counter.
Add 'start_period: 20s' to the db healthcheck block and ensure the check command specifies the username: 'test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]'.Frequently Asked Questions (Docker Compose Production Profiles & Healthchecks SOP)
Q:Can I use Docker Compose Production Profiles & Healthchecks across Codex, Claude Code, and Cursor simultaneously?
Yes. The SKILL.md format is runtime-agnostic. Runtimes supporting the agent skill convention (including Codex Desktop, Claude Code CLI, Cursor, and Windsurf) parse the YAML frontmatter triggers and append the procedural guidance to context dynamically.
Q:How does Docker Compose Production Profiles & Healthchecks prevent context window overflow during long agent sessions?
The skill provides terse, rule-based procedural guidance and sample schemas rather than massive documentation dumps. This constraints the agent prompt overhead to less than 250 tokens per conversation turn while ensuring strict adherence to Compose v2 specs.
Q:Does this skill require escalated root or container permissions?
No. The skill is audited with a security score of 98/100. It requires only standard workspace file read and write permissions (fs_write: workspace) to update configuration files. Shell execution and network access are disabled within the skill contract itself.
Ready to equip your autonomous agent with Docker Compose Production Profiles & Healthchecks?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.