About this skill

Problems It Solves

Container failures are rarely a single bad command. They usually come from non-reproducible images, invalid build caches, root execution, missing resource limits, logs filling disks, DNS or port exposure mistakes, premature Compose dependencies, anonymous volume growth, and secrets baked into image history through ENV, COPY, or build args. Engineers often need a consistent checklist across commands, Dockerfiles, Compose files, networking, and volumes.

How It Works

The skill organizes Docker work into actionable rules and traps:
- Image builds: pin base image versions such as python:3.11.5-slim; combine RUN package steps; make multi-stage build stages explicit; copy dependency manifests before installing dependencies and source code.
- Runtime and debugging: set memory and resource limits; configure log rotation; interpret exit codes 137 and 139; inspect state with docker inspect, docker logs, and docker cp.
- Networking and volumes: use custom networks for container DNS; bind local-only services to 127.0.0.1; prefer named volumes; match bind-mount permissions between host and container users.
- Security and cleanup: avoid secrets in ENV, COPY, or build args; prefer secrets mounts or runtime environment variables; avoid --privileged unless necessary; clean images, builder cache, containers, and networks regularly.

Scope and Caveats

It fits Dockerfile, Docker Compose, image publishing, container debugging, and host-level container operations. It does not replace Kubernetes orchestration, cloud IAM, GitOps, or application architecture design. For distroless or shell-less images, use docker cp or a debug sidecar.

Screenshots

Use Cases

When building a Python service image, pin base versions, combine package installs, and optimize build cache.
When debugging containers killed by OOM or segfault, read exit codes, logs, and resource limits.
When starting multi-service stacks with Compose, fix depends_on, env file location, and named volume mounts.
Before publishing images, verify non-root users, log rotation, port bindings, and secrets left in image history.

Best For

Backend engineers packaging Python microservices: reproducible, non-root image builds.
Ops engineers maintaining internal tooling: debugging OOM, disk-filling logs, and port conflicts.
Full-stack engineers wiring multi-service local stacks: fixing Compose dependencies, volume mounts, and env files.
Infrastructure engineers reviewing container security: preventing secrets in image layers and pruning unused resources.