The Complete Production SOP: Deploying Docker-Craft for Deterministic Container Hardening Across Codex, Claude Code, and Cursor
Deploy docker-craft in Codex, Claude Code, & Cursor. Master multi-stage Dockerfile minification, Alpine hardening, and deterministic Compose workflows.
Technical Overview & Architectural Context
Autonomous coding agents frequently generate vulnerable, bloated container assets. Left unbounded, agents default to obsolete practices: adopting mutable `:latest` tags, running processes under root privileges (UID 0), compounding build layer counts through redundant `RUN` operations, and ignoring multi-stage targets. In production microservice architectures, these mistakes result in supply-chain CVE vulnerabilities, build-cache invalidation thrashing, and massive artifacts scaling past multi-gigabyte boundaries. The `docker-craft` skill establishes strict, deterministic procedural operating boundaries for autonomous LLM runtimes. It enforces immutable SHA-pinned or semantic version tags, separates build-time tooling from scratch or Alpine-hardened execution runtimes, configures unprivileged user contexts (`USER nonroot` or explicit numeric UIDs), and codifies ordered cache-layer hierarchy. By constraining the agent's generation pipeline with verified security checkpoints, `docker-craft` guarantees reproducible, cloud-native images that satisfy PCI-DSS and SOC 2 container compliance gates automatically.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Mount the deterministic docker-craft manifest into local agent skill paths for hot-reloaded runtime discovery.
Autonomous runtimes like Claude Code, Cursor, Codex, and Windsurf index operational rules via declarative markdown files in standard project and global skill directories. By executing this command, you create the canonical registry path and mount the hardened SOP ruleset. The agent's AST parses the YAML frontmatter triggers (`write dockerfile`, `optimize container`, `container hardening`), ensuring deterministic execution whenever container lifecycle queries occur.
mkdir -p ~/.agents/skills/docker-craft && curl -fsSL https://askills.dev/api/skills/docker-craft/raw -o ~/.agents/skills/docker-craft/SKILL.md---
name: "docker-craft"
description: "Author and optimize secure, lightweight Dockerfiles and multi-service docker-compose setups."
version: "1.2.0"
triggers:
- "write dockerfile"
- "optimize container"
- "create docker-compose"
- "container hardening"
rules:
base_images:
prohibit_tags: ["latest", "edge", "nightly"]
enforce: "pinned-semantic-or-sha"
security:
root_prohibited: true
default_uid: 10001
read_only_rootfs: prefer
optimization:
multi_stage: mandatory
combine_run_instructions: true
---Place the SKILL.md inside your workspace's `.cursor/rules/` or `.claude/skills/` directory as a symbolic link to ~/.agents/skills/docker-craft/SKILL.md to maintain project-scoped version control without wasting prompt context.
Ensure directory permissions match current non-root user execution (`chmod 755 ~/.agents/skills/docker-craft`); restrictive umasks can block agent workers running inside localized container sandboxes.
Sandbox Verification & Tool Dependency Validation
Verify BuildKit runtime capabilities and declare deterministic linter constraints.
Before delegating container generation to the agent, verify that the local execution environment supports contemporary container assembly patterns, specifically BuildKit syntax (heredocs, cache mounts, secret mounts). Furthermore, ensure Docker CLI accessibility from the agent's target shell context without exposing daemon root sockets inadvertently.
docker buildx version && hadolint --version || (echo 'Missing build tools' && exit 1)# Agent Container Runtime Flags
DOCKER_BUILDKIT=1
COMPOSE_DOCKER_CLI_BUILD=1
HADOLINT_FAILURE_THRESHOLD=warning
BUILDKIT_PROGRESS=plainInstruct the agent to utilize `--mount=type=cache,target=/root/.cache` in multi-stage builds to avoid redownloading npm packages or go modules across iterative testing rounds.
Never mount `/var/run/docker.sock` directly into agent workspaces without read-only restrictions or a sandboxed DinD (Docker-in-Docker) proxy; arbitrary socket mounts grant complete host root privilege escalation.
Intent Matching & Trigger Invocation
Trigger deterministic multi-stage generation using frontmatter-aligned natural language requests.
Modern agent runtimes route tasks based on lexical and embedding matches against the `triggers` array defined in SKILL.md. By using clear operational directives like 'optimize container' or 'write dockerfile', you prevent ambiguous LLM reasoning and invoke docker-craft's strict constraints: immutable tagging, non-root user creation, and layer ordering.
# Example agent prompt execution via Claude Code CLI
claude "optimize container: transform our legacy Node.js monolith into a multi-stage Alpine Dockerfile with unprivileged user execution"Structure prompts with explicit functional boundaries: 'optimize container for [language/runtime] with target size < 100MB and non-root UID 10001'.
Avoid vague phrases like 'fix the build', which might cause agents to fall back on generic system knowledge rather than activating the docker-craft SOP manifest.
Verification, Linting & Output Quality Gate
Execute automated Hadolint and Docker dry-run quality gates to assert artifact compliance.
The skill enforces an automated feedback loop. Once the agent writes the `Dockerfile` or `docker-compose.yml`, it must execute Hadolint in parsing mode followed by a BuildKit validation pass. If static analysis fails (e.g., DL3006 for untagged images or DL3002 for root switching), the agent enters its self-correction loop to patch the AST before presenting the deliverable.
hadolint Dockerfile && docker buildx build --dry-run .#!/usr/bin/env bash
set -euo pipefail
echo "Checking Hadolint compliance..."
hadolint --ignore DL3018 Dockerfile
echo "Validating Docker Compose structure..."
if [ -f docker-compose.yml ]; then
docker compose config --quiet
fi
echo "All docker-craft quality gates passed successfully."Review `git diff Dockerfile` prior to running full images; verify that layer caching puts static manifests (`package.json`, `go.mod`) ahead of dynamic app source files (`./src`).
Alpine package managers require `--no-cache` flag (`apk add --no-cache ...`). Failing to include this triggers Hadolint rule DL3018, which rejects the agent's output gate.
Real-World Scenario: Hardening a Vulnerable Python FastAPI Microservice into Production Alpine Container
“write dockerfile and optimize container for this Python 3.11 FastAPI service. Pin base image to a secure digest or minor patch, enforce non-root user UID 10001, configure multi-stage wheel builds with BuildKit caching, and drop all unused build tools in final Alpine runtime.”
Runtime Troubleshooting & Failure Modes
Root Cause: The agent switched to USER root near the bottom of the Dockerfile to configure permissions or install an extra package, violating docker-craft's security rules.
# Replace late-stage root switching by running chown during the file copy stage in builder:
COPY --chown=10001:10001 --from=builder /install /usr/local
USER 10001Root Cause: The agent specified a non-existent or misformed image registry URL or private tag without valid BuildKit auth context in the workspace sandbox.
docker logout && docker login && export DOCKER_BUILDKIT=1
# Use verified upstream official library images: e.g., python:3.11.8-alpine3.19Frequently Asked Questions (Docker & Container Optimizer SOP)
Q:Can I use Docker & Container Optimizer across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification supported across all modern agent runtimes. By placing the manifest in your central `~/.agents/skills/docker-craft` or linking it to `.cursor/rules` / `.claude/skills`, all runtimes parse identical frontmatter constraints.
Q:How does Docker & Container Optimizer prevent context window overflow during long agent sessions?
Docker-craft enforces declarative boundaries through concise rule matrices and automated terminal quality gates (Hadolint/BuildKit) rather than feeding large container manuals or verbose explanations into the LLM system prompt, preserving up to 80% of workspace context tokens.
Q:Does this skill require escalated root or container permissions?
No. The skill is audited with a security score of 99/100 and operates safely within workspace-scoped sandboxes. It does not require host root escalation or direct Docker daemon write privileges to author, parse, and validate container specifications.
Ready to equip your autonomous agent with Docker & Container Optimizer?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.